Wireshark BLE Sniffer is not showing any packets during or after Peripheral connect

[Danjx]

I start the sniff and see packets from all advertising peripherals in the area.
I select my peripheral in the Device dropdown list.
Then I see a string of "ADV_IND" packets from my device only.
I have no Capture or Display filter active.
All well and good.

Then I enable my Central device and start the connect.
-> They connect without any trouble and start streaming data.
However all I see in Wireshark is a single "CONNECT_IND" packet. Nothing else.

--> I don't see any other packets!
Does anyone have any guesses as to what I'm doing wrong?
Driver/firmware/software versions perhaps?

Setup:

- Mac (Catalina)

- nRF51822 v2 (with Driver = Silicon Labs: CP210x Macintosh OS VCP Driver v6)
(note: dongle came preprogrammed from Adafruit, April 6, 2021)

- Wireshark v 3.4.4 (and Python v3.9.4)

- nRF_sniffer_for_bluetooth_le_3.1.0

Thank you in advance for any suggestions.

[Danjx]

Hi Simon,

Thank you for your reply. The screenshot you requested is below. Well, it will be after I figure out how to post it. But moving on ...

I have in fact updated with the latest J-Link Software Pack, but it's not clear how the UART drivers are installed/called in my setup because my "nRF51822 v2" came preprogrammed. Are you saying I should try to overwrite my preprogrammed nRF51822 v2 that I received 2 weeks ago? Or is there some other (of the 11 installed J-link apps in the Software Pack) that I should install/run?

[Danjx]

No Packets are received (displayed) after the CONNECT_IND.

[Simonr]

If you'd like, I can set this case to Private mode so you can share the sniffer trace in its entirety.

I did some reading up on the Adafruit sniffer you're using, and it seems it would not be a good idea to flash newer firmware onto it, as it requires firmware specifically not using the external 32.768 kHz LF clock (which is used by default).

What kind of connection are you doing between the two devices? Is there a pairing process for example or what?

I assume you only have this Adafruit device available to use as a Sniffer?

Best regards,

Simon

[Danjx]

No need to go private. Hopefully we can help others.

The pairing is just standard (no passcode) pairing. Then, Service and Characteristic discovery. Then, some GATT writes to the Peripheral. Then, the Peripheral streams data out (2-byte samples, one every 100 ms) using Notify.

And yes, the Adafruit supplied nRF51822 v2 is my only Sniffer candidate in hand at the moment. (Which by the way, was incredibly complex to setup on the Mac. Documentation, setup, and users guides are either lacking or flat-out wrong in many places. It took a lot of online research to get it working just to this point.) I'd try to setup in a Windows virtual machine, but the majority online opinion is that the USB timing with virtual machines is insufficient for this.

[Simonr]

Okay, according to the Adafruit BLE sniffer introduction, the Adafruit device is at a mismatch with version 3.1.0 of the Sniffer firmware you've installed on Wireshark, and they only provide support for v2.0.0 (Beta version actually) of the sniffer firmware. You can either download the Wireshark extcap.zip (BETA 1) from their user guide, or from the nRF Sniffer product page on our homepage.

Best regards,

Simon