Unable to capture BLE packets using nrf52840 dongle in Wireshark

[Thomas]

Hi,

My problem is that I can't sniff any advertising packet using Wireshark.

I have well followed the detailed procedure https://infocenter.nordicsemi.com/index.jsp?topic=%2Fug_sniffer_ble%2FUG%2Fsniffer_ble%2Fintro.html

The setup:

• Linux Ubuntu

$ uname -a
Linux 4.15.0-143-generic #147-Ubuntu SMP Wed Apr 14 16:10:11 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

• nRF52840 dongle (PCA10059) using sniffer_nrf52840dongle_nrf52840_7cc811f.hex

$ python -m serial.tools.list_ports -v
/dev/ttyACM0        
    desc: nRF Sniffer for Bluetooth LE
    hwid: USB VID:PID=1915:522A SER=E4F7133D6E699013 LOCATION=1-4:1.0

• Python 3.6
• Wireshark 2.6.10
  • nRF Sniffer profile installed
  • Capture tool installed

$ python3.6 nrf_sniffer_ble.py --extcap-interfaces
extcap {version=3.1.0}{display=nRF Sniffer for Bluetooth LE}{help=https://www.nordicsemi.com/Software-and-Tools/Development-Tools/nRF-Sniffer-for-Bluetooth-LE}
interface {value=/dev/ttyACM0}{display=nRF Sniffer for Bluetooth LE}
control {number=0}{type=selector}{display=Device}{tooltip=Device list}
control {number=1}{type=string}{display=Passkey / OOB key}{tooltip=6 digit temporary key or 16 byte Out-of-band (OOB) key in hexadecimal starting with '0x', big endian format. If the entered key is shorter than 16 bytes, it will be zero-padded in front'}{validation=\b^(([0-9]{6})|(0x[0-9a-fA-F]{1,32}))$\b}
control {number=2}{type=string}{display=Adv Hop}{default=37,38,39}{tooltip=Advertising channel hop sequence. Change the order in which the siffer switches advertising channels. Valid channels are 37, 38 and 39 separated by comma.}{validation=^\s*((37|38|39)\s*,\s*){0,2}(37|38|39){1}\s*$}{required=true}
control {number=3}{type=button}{role=help}{display=Help}{tooltip=Access user guide (launches browser)}
control {number=4}{type=button}{role=restore}{display=Defaults}{tooltip=Resets the user interface and clears the log file}
control {number=5}{type=button}{role=logger}{display=Log}{tooltip=Log per interface}
value {control=0}{value= }{display=All advertising devices}{default=true}

I am able to start the wireshark capture using "nRF Sniffer for Bluetooth LE:/dev/ttyACM0" but I am unable to visualize any packet in wireshark, screen is blank.

Any insight on this issue?

Thanks in advance,

Thomas

[JONATHAN LL]

Hi,

This might be the issue:
Ubuntu dont have seriell accessible by default, permissions - Could not open port /dev/ttyACM0 Error after every restart - Ask Ubuntu.

Regards,
Jonathan

[Thomas]

Hello Johathan,

Thanks for your reply.

Unfortunately it did not solve the problem. What I have done is add my $USER to dialout group:

$ groups $USER
thomas : **** dialout sudo **** **** wireshark
$ ls -l /dev/ttyACM0
crw-rw-rw- 1 root dialout 166, 0 juin   2 17:22 /dev/ttyACM0

This way, my $USER running wireshark has access to dialout group which correspond with /dev/ttyACM0.

I notice when that the nRF52840 LED on the dongle starts blinking when wireshark is launched, is it a normal behaviour?

Also on the wireshark interface it says at the bottom left: "nRF Sniffer for Bluetooth LE:/dev/ttyACM0: <live capture in progress>" and in the bottom "No Packets".

Regards,

Thomas

[Thomas]

I have also tried to run the python script in command line (both as root and simple user):

$ python nrf_sniffer_ble.py --capture  --extcap-interface /dev/ttyACM0 --fifo /tmp/wireshark_extcap_-dev-ttyACM0_20210602174315_hpRj0k --extcap-control-out /tmp/wireshark_control_ext_to_ws_-dev-ttyACM0_20210602174315_XPBNJb --extcap-control-in /tmp/wireshark_control_ws_to_ext_-dev-ttyACM0_20210602174315_JUy3mL

I could not see any log output and the file generated in /tmp empty.

[JONATHAN LL]

Can you provide a screenshot of Wireshark app.  and a basic question to get it out of the way, are you sending any BLE packets ?

Regards,
Jonathan

[Thomas]

I have solved the problem by upgrading wireshark to the latest version.

Now it is working with nrf_sniffer_for_bluetooth_le_3.1.0_7cc811f and wireshark 3.4.2.

Thanks for your time, you can close the topic.

Regards,

Thomas