Sniffing BT Mesh - SRC, DST, SEQ etc. not available anymore

[Michal L.]

Hello,

I am preparing sniffing workspace for BT Mesh, where I have 3 devices in the Mesh network (provided by nRF Mesh app) and I need to read SRC, DST, SEQ and simmilar values from the packets. I am using Wireshark and after setting Network key, Application key and Device key I was able to read mentioned values, see screenshot: https://ibb.co/tHQdZwx

But when I removed node which is inspected in the screenshot from the network and added again, SRC, DST, SEQ values are not available even after I set up new Device key in protocol settings.

Is there something I am missing? Some button I have to press to apply new protocol settings?

[Hung Bui]

Hi Michal, 
Could you give some more info about how you removed the node ? If you blacklist the node, there should be a new network key that you need to update. 

The SRC, DST, SEQ is obfuscated when transmitting. The obfuscating uses a privacy key that derived from the network key, in combination with the IV Index. 

Could you take a screenshot when you setup the new device back ? 

[Michal L.]

Hi Hung,

I removed node using nRF Mesh app, by selecting Network - my node - Reset node (at the bottom of screen). And then provisioned it again.

Screenshots of settings are attached.

I tried to kill the Wireshark and disconnect sniffer and then opened Wireshark and connected sniffer again and it started to work although I didn't change anything. It looks like the change of the settings is not properly 'confirmed' during runtime of Wireshark or something like that.

[Hung Bui]

I'm not sure what could be wrong here. but if you restart wireshark and it can catch the SRC, DST, SEQ again then I think it's a good solution.