custom wireshark dissector

[bloobird0]

Hello,

I think the question may be more related on how Wireshark works but I plan to do the following:

* use the v2 sniffer firmware and the Nordic Wireshark plugin

* catch the decoded data and decode the applicative level protocole on top of the Nordic dissector.

Do you know if this feasible? I mean, is it possible to catch the Nordic decoded data and add another dissector on top of that?

Thanks in advance for any feedback on this topic.

[Håkon Alseth]

Hi,

 

Do you know if this feasible? I mean, is it possible to catch the Nordic decoded data and add another dissector on top of that?

Yes, this is possible to create a bluetooth profile or service dissector, but I am not sure you'll get a lot of information on creating wireshark dissectors on this forum. I'd recommend asking/checking out the wireshark wiki and forums, as well as generic guides for creating a dissector (like the one I found here)

 

Best regards,

Håkon

[bloobird0]

thanks,

yes, I understand. You may give me information about the Nordic Dissector. Is the BLE GATT/GAP decoding done by wireshark integrated dissector on top of the nordic dissector or is it done by the Nordic dissector itself?

Is the Nordic dissector open source?

[Håkon Alseth]

The nordic part of the dissector is open source: https://github.com/wireshark/wireshark/blob/master/epan/dissectors/packet-nordic_ble.c

However, this only handles time stamping, version checking of the nrf-sniffer, and other added metadata that is piped into wireshark. The actual dissection of bluetooth LE is performed by the generic btle dissector: https://github.com/wireshark/wireshark/blob/master/epan/dissectors/packet-btle.c

 

Best regards,

Håkon

[bloobird0]

thanks for your helpful support.