Controlling that BLE is encrypted - using Wireshark and nRF 52 DK

RE: Controlling that BLE is encrypted - using Wireshark and nRF 52 DK

Kenneth — Wed, 11 Nov 2020 14:25:53 GMT

Not aware of any video in specific no, but just start Wireshark with the initial connection and bonding should do. You may need to do an erase all of the flash first to ensure that previous bonding information is gone.

Best regards,
Kenneth

RE: Controlling that BLE is encrypted - using Wireshark and nRF 52 DK

Hussain — Wed, 11 Nov 2020 12:19:36 GMT

Do you have any video or tutorial for this thing. As I want to see the LTK for just works pairing via nrf52 dk sniffer

RE: Controlling that BLE is encrypted - using Wireshark and nRF 52 DK

Kenneth — Mon, 02 Nov 2020 10:36:40 GMT

If you are sniffing the bonding procedure when using "just works" pairing you should be able to get the LTK in one of the decrypted packets. In other bonding procedures (e.g MITM and passkey) you will not be able to sniff the LTK when using nRF Sniffer no.

Best regards,
Kenneth

RE: Controlling that BLE is encrypted - using Wireshark and nRF 52 DK

Hussain — Mon, 02 Nov 2020 09:31:52 GMT

Hi ,

I want to ask you that is there a way to know about LTK in sniffing and we can see in wireshark.

RE: Controlling that BLE is encrypted - using Wireshark and nRF 52 DK

Kenneth — Thu, 15 Oct 2020 09:53:32 GMT

Sorry no, but the fields are directly related to the BLE spec (which describe the actual implementation of link layer roles, crc, mic and encryption).

Best regards,
Kenneth

RE: Controlling that BLE is encrypted - using Wireshark and nRF 52 DK

Hussain — Thu, 15 Oct 2020 07:49:15 GMT

Hi,

Is there a reference to some document regarding these explanation? which can be used as a reference.

RE: Controlling that BLE is encrypted - using Wireshark and nRF 52 DK

Kenneth — Wed, 14 Oct 2020 11:57:23 GMT

Hi,

The sniffer will do the decryption in hardware (to meet the timing requirements). So Wireshark will only have access to the decrypted data. So you will need to refer to the flags if the link is encrypted or not:

crc - was the CRC received by the sniffer OK.

direction - Only relevant during connection. True -> Master to Slave, False -> Slave to Master

encrypted - has the packet been encrypted.

mic - the message integriy check OK. Only relevant in encrypted state.

Best regards,
Kenneth