<?xml version="1.0" encoding="UTF-8" ?>
<?xml-stylesheet type="text/xsl" href="https://devzone.nordicsemi.com/cfs-file/__key/system/syndication/rss.xsl" media="screen"?><rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:slash="http://purl.org/rss/1.0/modules/slash/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>sniffer does not decrypt packets after pairing</title><link>https://devzone.nordicsemi.com/f/nordic-q-a/65527/sniffer-does-not-decrypt-packets-after-pairing</link><description>I have burned the new fw 3.0. I am running the wireshark perform pairing and I can&amp;#39;t see the packet content after encryption is started. 
 on previous fw 2.0 I could see only packets which are max 27 bytes (DLE packets was not decrypted correctly) 
 all</description><dc:language>en-US</dc:language><generator>Telligent Community 13</generator><lastBuildDate>Thu, 03 Sep 2020 11:49:48 GMT</lastBuildDate><atom:link rel="self" type="application/rss+xml" href="https://devzone.nordicsemi.com/f/nordic-q-a/65527/sniffer-does-not-decrypt-packets-after-pairing" /><item><title>RE: sniffer does not decrypt packets after pairing</title><link>https://devzone.nordicsemi.com/thread/267818?ContentTypeID=1</link><pubDate>Thu, 03 Sep 2020 11:49:48 GMT</pubDate><guid isPermaLink="false">137ad170-7792-4731-bb38-c0d22fbe4515:c1556ab7-da0e-4cbf-8087-9d691ad0c34a</guid><dc:creator>Karl Ylvisaker</dc:creator><description>&lt;p&gt;Hello,&lt;/p&gt;
[quote user=""]I can&amp;#39;t see the packet content after encryption is started.[/quote][quote user=""]DLE packets was not decrypted correctly[/quote]
&lt;p&gt;By this, do you mean that you do in fact see the packets - but not their contents? The message &amp;quot;packet was not decrypted correctly(bad MIC)&amp;quot; is most commonly caused by the sniffer not having the private keys for the connection, so it can not decrypt the packages it intercepts.&lt;br /&gt;To ensure that the sniffer gets the keys, it will need to be sniffing for the particular device at the time of pairing / bonding.&lt;br /&gt;I.e you will need to select your device from the device menu ( shown in the included picture ) before going into the secure connection. This will let the sniffer acquire the keys, and follow into the connection.&lt;br /&gt;In the case that your devices are already bonded ( the keys are stored on the devices ) then you will need to delete the bonds before pairing / bonding again, to ensure that the sniffer is present during the key exchange.&lt;br /&gt;Please try this and let me know if this lets you see the packets&amp;#39; content.&lt;br /&gt;&lt;br /&gt;Additionally, out of curiosity, could you tell me which device you are pairing your nRF52840 with? Is it a iOS / Android smartphone, or nRF Connect application for desktop?&lt;br /&gt;&lt;br /&gt;Best regards,&lt;br /&gt;Karl&lt;/p&gt;&lt;div style="clear:both;"&gt;&lt;/div&gt;</description></item></channel></rss>