Controlling that BLE is encrypted - using Wireshark and nRF 52 DK

[Hussain]

Hi,

I am using nRF 52 DK as a sniffer and monitoring the BLE traffic on Wireshark. The goal of this is to ensure that the communication is encrypted.

I can see that in the package there is a flag called "encrypted" - see picture below. 

Is there some documentation that refers to how the program determines if it is encrypted?

Alternatively, can anyone explain how I can figure it out for myself?

 

[Hussain]

Hi,

Is there a reference to some document regarding these explanation? which can be used as a reference.

[Kenneth]

Sorry no, but the fields are directly related to the BLE spec (which describe the actual implementation of link layer roles, crc, mic and encryption).

Best regards,
Kenneth

[Hussain]

Hi ,

I want to ask you that is there a way to know about LTK in sniffing and we can see in wireshark.

[Kenneth]

If you are sniffing the bonding procedure when using "just works" pairing you should be able to get the LTK in one of the decrypted packets. In other bonding procedures (e.g MITM and passkey) you will not be able to sniff the LTK when using nRF Sniffer no.

Best regards,
Kenneth

[Hussain]

Do you have any video or tutorial for this thing. As I want to see the LTK for just works pairing via nrf52 dk sniffer

[Kenneth]

Not aware of any video in specific no, but just start Wireshark with the initial connection and bonding should do. You may need to do an erase all of the flash first to ensure that previous bonding information is gone.

Best regards,
Kenneth