nRF Sniffer decryption is not working after entering passkey

[Acutetech]

I am a newbie with nRF Sniffer, which I have installed on one PCA10040 board. I am sniffing communications between a Samsung phone running nRF Connect and a second PCA10040 running the glucose sample app.

I believe I am following the instructions in the User Guide section 5.5: when the glucose app prints the 6-digit passkey I enter this into Wireshark and type enter, then I enter it into the phone. The phone and peripheral then bond and work, but Wireshark starts printing "Encrypted packet decrypted incorrectly (Bad MIC)" . When I click on Log I see this:

INFO: Setting Passkey: 691295

INFO: Sent key value to sniffer: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 10, 140, 95]

A screenshot is here:

/resized-image/__size/640x480/__key/support-attachments/beef5d1b77644c448dabff31668f3a47-e588f28969f94ee0a39b08c9e8afde0d/Screenshot-2018_2D00_11_2D00_19-10.57.32.png

Q1: Are my results expected? What should I do differently?

Q2: Assuming I am able to get beyond this problem, is it possible to sniff subsequent connections? The Central and Peripheral will be bonded and the peripheral will not print a passkey. Can nRF Sniffer decrypt the second session based on keys it has saved?

[Acutetech]

Hi David

I was thinking about this: it must be straight forward for me to replicate a working system here. Can you suggest a setup that you have tested and I can set up  as closely as possible. At present I have two PCA10040 boards plugged into two USB ports of the same Windows 10 laptop, and nRF Connect running on either an Android 8 phone or a choice of Windows 7 tablets. I can't think that there is much I can vary here, other than this: can you suggest which of the sample apps from SDK15.2 I should program into the peripheral?

Regards - Charles

[David Edwin]

lets test it first with the nRF Sniffer v2 on one of the PCA10040 boards and the ble_app_uart on the other PCA10040 board. The Win 10 laptop's ble should be used to connect the ble_app_uart and sniffed.

I can replicate the above config and we can take this forward. Will this work for you ?

[Acutetech]

Hi David - I have started on the process. So far I have installed ble_app_uart on one PCA10040 and I can communicate with it using nRF Connect on an Android tablet. (I note that the documentation here: https://infocenter.nordicsemi.com/index.jsp?topic=%2Fcom.nordic.infocenter.sdk5.v15.0.0%2Findex.html differs from what I see: the peripheral prints "UART started." rather than "UART Start!" and characters typed are treated as ASCII rather than hex value.

However when I click "bond" on nRF Connect I get "Bonding failed" in the log. The ble_app_uart source code includes "Pairing not supported".

I have also installed the Windows version of nRF Connect and have it running using an nRF52840 dongle (cool!). (and I see this version does use hex rather than ASCII!).

Jumping ahead: I  have connected Wireshark to a second PCA10040 running the latest nRF Sniffer you sent yesterday, and used it to sniff a session between the ble_app_uart and Windows nRF Connect.

What next?

[David Edwin]

Next we use an example that will allow us to encrypt the link ble_peripheral/experimental/ble_app_cli is a possible option, you can use the hex file that is already available in the examples.

Use the documentation for ble_app_cli to get the application started.

Once started you should be able to encrypt the link and follow it on the sniffer.

[Acutetech]

OK David - I put ble_app_cli in one PCA10040 and connect to it from nRF Connect running on Windows. I then bonded (clicked "Pair", checked only the "Perform Bonding" check box, selected "No keyboard/no display") Both nRF Connect and the peripheral report that they bonded, but nRF sniffer prints "decrypted incorrectly" again. Screenshot and sniffer log attached.ble_app_cli.pcapng

I don't see how I can delete the bonding information on both deveices so I can try again...