nRF Sniffer Interface not showing up in Wireshark on macOS (11.5.1)

RE: nRF Sniffer Interface not showing up in Wireshark on macOS (11.5.1)

Ola Oni — Tue, 25 Oct 2022 17:57:14 GMT

Hi Vidar,

All is well now. I ended up building wireshark from source but that ended not been the solution either. I also already had my user as part of the wireshark group.

The problem was that I copied the Nordic sniffer extcap folder contents to wireshark "Global Extcap Path" instead of "Personal Extcap Path".

My thinking was that, if it resides in the global path then any user can access it but for some reason it does not seem to be happy with this.

Other issues that was observed when using the global path was that when wireshark is started with sudo you can only start the sniffer once and to restart it, one has to close wireshark and relaunch as it says complains it can't save files.

Anyway all is working now. Thanks for your speedy response and just also can confirm that Nordic sniffer plugins works with wireshark 4.0.0

Regards

Ola

RE: nRF Sniffer Interface not showing up in Wireshark on macOS (11.5.1)

Vidar Berg — Tue, 25 Oct 2022 16:14:53 GMT

Hi Ola,

We made some changes to the python scripts after this issue was reported to make handling of multiple python installations more robust, so I suspect you may encountering a different problem, even though the symptom is similar.

To troubleshoot this further, please try the following:

1. Add wireshark to your user group:

sudo usermod -a -G wireshark $USER

2. Check Wireshark logs in /tmp/logs for errors.

RE: nRF Sniffer Interface not showing up in Wireshark on macOS (11.5.1)

Ola Oni — Tue, 25 Oct 2022 14:43:26 GMT

Hi All,

I am a new comer to Bluetooth and recently bought nRf52840 dongle to be used as a sniffer. I seems to be experiencing the same exact problem as described by Mohammad. The only difference is that I am on an Ubuntu Cinnamon 22.04 64-bit machine.

If I use sudo wireshark then I can see and use the sniffer okay but not as a normal user. My user is already in the "wireshark" and "dialout" group.

I can see other interfaces but just not nrfNordic one.

As part of the installation I installed python3 so the above did solution does not work for me.

Many thanks in advance.

Ola

RE: nRF Sniffer Interface not showing up in Wireshark on macOS (11.5.1)

Vidar Berg — Tue, 31 Aug 2021 12:12:19 GMT

Thanks for confirming! I'm glad to hear that it worked.

[quote userid="8648" url="~/f/nordic-q-a/78703/nrf-sniffer-interface-not-showing-up-in-wireshark-on-macos-11-5-1/327400#327400"]I suggest this be added to the user guide, as I suspect many people will face the same issue[/quote]

Yes, I agree with you. I believe I have a pretty good understanding of the problem now and I will request an update of the user guide.

RE: nRF Sniffer Interface not showing up in Wireshark on macOS (11.5.1)

Mohammad Afaneh — Tue, 31 Aug 2021 11:37:20 GMT

Thank you! That fixed it. serial was already installed for python 2.7 but not for python3. I suggest this be added to the user guide, as I suspect many people will face the same issue.

RE: nRF Sniffer Interface not showing up in Wireshark on macOS (11.5.1)

Vidar Berg — Tue, 31 Aug 2021 10:37:14 GMT

Mohammad Afaneh, I don't recall having to change permissions on my mac to get the sniffer to work. I have however had some problems related to having multiple python installations on my system that basically resulted in a different python instance being invoked from command line compared the one invoked by Wireshark.

Could you please try the following:

1. Open Wireshark from the terminal, but not as root, and see if it has the same effect as running Wireshark in admin mode. Apparently the PATH variable is different depending on how you launch a GUI application in macos. E.g. binaries in /usr/local/bin does not seem to get found.

2. Try to install PySerial for other Python installations. E.g. /usr/bin/python3 -m pip install --user pyserial && /usr/bin/python -m pip install --user pyserial

RE: nRF Sniffer Interface not showing up in Wireshark on macOS (11.5.1)

Øyvind — Mon, 30 Aug 2021 18:03:24 GMT

Hello,

Not Python environment permission, but the sniffer port itself via the group "dialout".

E.g. adding the following permissions:

# Add yourself to the group dialout, Log out and in again.
sudo usermod -aG dialout $USER

Might need add Wireshark as well.

Let me know how that works. Not sure about the Mac OS permission, might be best to search the web to verify 100%

Kind regards,
Øyvind

RE: nRF Sniffer Interface not showing up in Wireshark on macOS (11.5.1)

Mohammad Afaneh — Sat, 28 Aug 2021 17:56:45 GMT

I don't see a folder named "/logs" under /tmp. How do I check the permissions of the Python environment?

RE: nRF Sniffer Interface not showing up in Wireshark on macOS (11.5.1)

Øyvind — Thu, 26 Aug 2021 07:57:35 GMT

Have you checked the permissions of your Python environment? Could it be possible that you have either a different python environment for admin/user mode, or that the user does not have permission to open the sniffer port?

Could you please check in your /tmp/logs/log.txt log file?

RE: nRF Sniffer Interface not showing up in Wireshark on macOS (11.5.1)

Øyvind — Thu, 26 Aug 2021 07:02:29 GMT

Sorry for the late response. Have not been able to get anyone to test this due to large amount of cases after the summer period.

[quote user="mafaneh"]Please let me know once you or someone else is able to test it and report any updates.[/quote]

Yes, sir, I will. I'll forward this to the BLE Sniffer team, and register an internal ticket to follow up.

[quote user="mafaneh"]I can continue using it in admin mode for now, but there’s an inherent risk running Wireshark in admin mode, and something that should probably be avoided. [/quote]

I see what you mean, and unfortunately have no answer to that at the moment.

Kind regards,
Øyvind

RE: nRF Sniffer Interface not showing up in Wireshark on macOS (11.5.1)

Mohammad Afaneh — Fri, 20 Aug 2021 14:05:18 GMT

Thanks. Please let me know once you or someone else is able to test it and report any updates.

I can continue using it in admin mode for now, but there’s an inherent risk running Wireshark in admin mode, and something that should probably be avoided.

RE: nRF Sniffer Interface not showing up in Wireshark on macOS (11.5.1)

Øyvind — Fri, 20 Aug 2021 13:30:21 GMT

Hello,

Sorry, I have not found a good answer to you, other than running Wireshark as administrator when you need to. As I don't have a Mac available at my home office, I will need to ask a colleague to replicate or at least try.

Kind regards,
Øyvind

RE: nRF Sniffer Interface not showing up in Wireshark on macOS (11.5.1)

Mohammad Afaneh — Wed, 18 Aug 2021 20:02:29 GMT

Actually, I can't get to that step because I have to select it from the Interfaces list first (in which it does not show up). I also followed the steps in the troubleshooting section right above the one you pasted (which refers to the issue I'm having) with no luck.

I can simply switch between running Wireshark as an admin and as a user and the interface disappears when I run as user.

RE: nRF Sniffer Interface not showing up in Wireshark on macOS (11.5.1)

Øyvind — Wed, 18 Aug 2021 12:37:00 GMT

Ok, I see.

Did you try with the following from the guide:

RE: nRF Sniffer Interface not showing up in Wireshark on macOS (11.5.1)

Mohammad Afaneh — Wed, 18 Aug 2021 12:18:03 GMT

I have not used the sniffer in a while so I did not have any of the packages installed before I followed the new updated guide.

RE: nRF Sniffer Interface not showing up in Wireshark on macOS (11.5.1)

Øyvind — Wed, 18 Aug 2021 11:56:42 GMT

Did this work with the previous version, v3.x.0?

RE: nRF Sniffer Interface not showing up in Wireshark on macOS (11.5.1)

Øyvind — Wed, 18 Aug 2021 11:10:23 GMT

Hello,

I will need to forward this to our developer team. I hope to have an answer by tomorrow.

Kind regards,
Øyvind