Controlling that BLE is encrypted - using Wireshark and nRF 52 DK

[Hussain]

Hi,

I am using nRF 52 DK as a sniffer and monitoring the BLE traffic on Wireshark. The goal of this is to ensure that the communication is encrypted.

I can see that in the package there is a flag called "encrypted" - see picture below. 

Is there some documentation that refers to how the program determines if it is encrypted?

Alternatively, can anyone explain how I can figure it out for myself?

 

[Kenneth]

Hi,

The sniffer will do the decryption in hardware (to meet the timing requirements). So Wireshark will only have access to the decrypted data. So you will need to refer to the flags if the link is encrypted or not:

crc - was the CRC received by the sniffer OK.

direction - Only relevant during connection. True -> Master to Slave, False -> Slave to Master

encrypted - has the packet been encrypted.

mic - the message integriy check OK. Only relevant in encrypted state.

Best regards,
Kenneth