nRF Sniffer Interface not showing up in Wireshark on macOS (11.5.1)

[Mohammad Afaneh]

I recently followed the instructions laid out in the "nRF Sniffer for Bluetooth LE" User Guide version 4.0.0 and having trouble seeing the nRF Sniffer interface in Wireshark (v 3.4.7).

The only way I could get it to show up is to run Wireshark as an administrator. I recall this being an issue a couple of years ago, has this not been fixed? or is there something special that needs to be done to enable Wireshark to see the nRF Sniffer when run in user mode? I can see all the other interfaces, but not the nRF Sniffer.

[Øyvind]

Hello, 

I will need to forward this to our developer team. I hope to have an answer by tomorrow.

Kind regards,
Øyvind

[Øyvind]

Did this work with the previous version, v3.x.0?

[Øyvind]

Sorry for the late response. Have not been able to get anyone to test this due to large amount of cases after the summer period. 

Mohammad Afaneh said:

Please let me know once you or someone else is able to test it and report any updates.

 Yes, sir, I will. I'll forward this to the BLE Sniffer team, and register an internal ticket to follow up. 

 

Mohammad Afaneh said:

I can continue using it in admin mode for now, but there’s an inherent risk running Wireshark in admin mode, and something that should probably be avoided. 

 I see what you mean, and unfortunately have no answer to that at the moment. 

Kind regards,
Øyvind

[Øyvind]

Have you checked the permissions of your Python environment? Could it be possible that you have either a different python environment for admin/user mode, or that the user does not have permission to open the sniffer port?

Could you please check in your /tmp/logs/log.txt log file?

[Mohammad Afaneh]

I don't see a folder named "/logs" under /tmp. How do I check the permissions of the Python environment? 

[Øyvind]

Hello, 

Not Python environment permission, but the sniffer port itself via the group "dialout".

E.g. adding the following permissions:

# Add yourself to the group dialout, Log out and in again.
sudo usermod -aG dialout $USER 

Might need add Wireshark as well. 

Let me know how that works.  Not sure about the Mac OS permission, might be best to search the web to verify 100%

Kind regards,
Øyvind

[Vidar Berg]

Mohammad Afaneh, I don't recall having to change permissions on my mac to get the sniffer to work. I have however had some problems related to having multiple python installations on my system that basically resulted in a different python instance being invoked from command line compared the one invoked by Wireshark.

Could you please try the following:

1. Open Wireshark from the terminal, but not as root, and see if it has the same effect as running Wireshark in admin mode. Apparently the PATH variable is different depending on how you launch a GUI application in macos. E.g. binaries in /usr/local/bin does not seem to get found.

2. Try to install PySerial for other Python installations. E.g. /usr/bin/python3 -m pip install --user pyserial &&  /usr/bin/python -m pip install --user pyserial 

[Mohammad Afaneh]

Thank you! That fixed it. serial was already installed for python 2.7 but not for python3. I suggest this be added to the user guide, as I suspect many people will face the same issue.

[Vidar Berg]

Thanks for confirming! I'm glad to hear that it worked.

Mohammad Afaneh said:

I suggest this be added to the user guide, as I suspect many people will face the same issue

Yes, I agree with you. I believe I have a pretty good understanding of the problem now and I will request an update of the user guide.

[Ola Oni]

Hi All,

I am a new comer to Bluetooth and recently bought nRf52840 dongle to be used as a sniffer. I seems to be experiencing the same exact problem as described by Mohammad. The only difference is that I am on an Ubuntu Cinnamon  22.04 64-bit machine.

If I use sudo wireshark then I can see and use the sniffer okay but not as a normal user. My user is already in the "wireshark" and "dialout" group.

I can see other interfaces but just not nrfNordic one.

As part of the installation I installed python3 so the above did solution does not work for me.

Many thanks in advance.

Ola

[Vidar Berg]

Hi Ola,

We made some changes to the python scripts after this issue was reported to make handling of multiple python installations more robust, so I suspect you may encountering a different problem, even though the symptom is similar.

To troubleshoot this further, please try the following:

1. Add wireshark to your user group:

    sudo usermod -a -G wireshark $USER

2. Check Wireshark logs in /tmp/logs for errors.

[Ola Oni]

Hi Vidar,

All is well now. I ended up building wireshark from source but that ended not been the solution either. I also already had my user as part of the wireshark group.

The problem was that I copied the Nordic sniffer extcap folder contents to wireshark "Global Extcap Path" instead of "Personal Extcap Path".

My thinking was that, if it resides in the global path then any user can access it but for some reason it does not seem to be happy with this.

Other issues that was observed when using the global path was that when wireshark is started with sudo you can only start the sniffer once and to restart it, one has to close wireshark and relaunch as it says complains it can't save files.

Anyway all is working now. Thanks for your speedy response and just also can confirm that Nordic sniffer plugins works with wireshark 4.0.0

Regards

Ola