Wireshark BLE Sniffer is not showing any packets during or after Peripheral connect

[Danjx]

I start the sniff and see packets from all advertising peripherals in the area.
I select my peripheral in the Device dropdown list.
Then I see a string of "ADV_IND" packets from my device only.
I have no Capture or Display filter active.
All well and good.

Then I enable my Central device and start the connect.
-> They connect without any trouble and start streaming data.
However all I see in Wireshark is a single "CONNECT_IND" packet. Nothing else.

--> I don't see any other packets!
Does anyone have any guesses as to what I'm doing wrong?
Driver/firmware/software versions perhaps?

Setup:

- Mac (Catalina)

- nRF51822 v2 (with Driver = Silicon Labs: CP210x Macintosh OS VCP Driver v6)
(note: dongle came preprogrammed from Adafruit, April 6, 2021)

- Wireshark v 3.4.4 (and Python v3.9.4)

- nRF_sniffer_for_bluetooth_le_3.1.0

Thank you in advance for any suggestions.

[Simonr]

Hi

Have you selected the device you'd like to follow into a connection? By default, the sniffer will only capture advertising packets. You can choose a device from the device list in Wireshark to be able to follow it into a connection. Please check the "Sniffing a connection between paired devices" page on our Infocenter for a step by step guide.

Best regards,

Simon

[Danjx]

Hi Simon,

Please read an entire post before replying.

In line 2 of my post I said, "I select my peripheral in the Device dropdown list." So the answer to your question is yes. Also indicated by the next line where I say, I then see the ADV_IND packets from my device only. So yes, I'm sure the peripheral device selection is active.

In anticipation of your next question please refer to line 7, "They connect without any trouble and start streaming data." So yes, I'm sure they are pairing and establishing comms. I can see the data updating in the Central.

And yes I'm sure the dongle is in range. I've got an RSSI of -50.

I appreciate your help, but I am really pressed for time on this. Can you think of anything I can try? (that I haven't already)

[Simonr]

I'm very sorry that I missed that line. Is it the nRF51822 you're using as a sniffer device, or an nRF52840 Dongle?

I'm sure you've already checked it out, but just in case, here is a link to the troubleshooting page. Please make sure that you're using the latest J-Link firmware. Please also try forcing J-Link to use flow control in the serial connection if you haven't already. 

Best regards,

Simon

[Danjx]

Hi Simon,

Again, the answer to your question is in my original post ....

"- nRF51822 v2 (with Driver = Silicon Labs: CP210x Macintosh OS VCP Driver v6)
(note: dongle came preprogrammed from Adafruit, April 6, 2021)"

So, why would I need the J-Link firmware if my dongle came preprogrammed?

Also thank you for the links, but they don't appear relevant to my problem. I can't find my problem even hinted at. What did you see that made you suggest these documents?

I got an email from Nordic that says you've been "assigned" to this case. But this does not appear to be your area of expertise. So is there someone there you could share with before your next reply? I'm really pressed for time.

[Simonr]

Hi

Indeed, that was noted in the setup, but it wasn't clear to me whether you used it as the Sniffer device or the peripheral/central in your setup. Thank you for clarifying that. The reason I'm asking is because the nRF51 for instance, does not support larger MTU sizes like what was introduced in Bluetooth 5.0, and if so would have issues following a connection where the MTU size wasn't supported (for instance).

Can you show me a sniffer trace with some details on this? 

The J-Link firmware should be updated because the communication from the DK goes over UART (the OB-Segger/JLink on the nRF51 DK). 

The links I provided were provided because you don't receive (some) packets in Wireshark, or appears unstable. We're also currently investigating the nRFSniffer on the Catalina OS, as we've had one other customer having issues with it as well, and I have updated our internal ticket with your report as well.

The best suggestion we have taking the "pressed for time" into consideration would be to test if you can see the same behavior on a Windows computer for instance, or if you have an nRF52 DK available, use that as a sniffing device.

Best regards,

Simon