coap 802.15.4 packet not parsable by Wireshark

[Hongfeng]

Here's my setup:

1. RPI4+nRF52840 dongle as OT border router

2. nRF5340DK running CoAP client example application

3. Wireshark running on Mac OS, with nRF52840 dongle as sniffer

Problem:

From the 5340DK's console, I can use "ot udp send" to send out a packet, and the packet can be parsed properly by Wireshark. However when I push button 1, I can see the 802.15.4 packet being sent out, but Wireshark complains about "No extended address - can't decrypt", and it won't parse the 6lowpan and upper layers. 

Is this a Wireshark setup issue or do I need to modify some code in CoAP client example? Thanks!

[run_ar]

Hi,

Can you please provide the PCAP file and the network key? Thanks

[Hongfeng]

After Wireshark starts up, if I push the button on the board, the CoAP message won't be decoded. However after I send out a ping command from the console, following CoAP messages would decode fine. Here's my capture, networkkey is the default "00112233445566778899aabbccddeeff"

coap.pcapng

[run_ar]

Hi,

A colleague of mine mentioned:

I got the same error when sniffing the coap_client. However, when I added decryption keys following Configuring Wireshark for Thread, I was able to decrypt the messages.

Could you try to configure wireshark according to the description in the link above?

[Hongfeng]

It appears the instructions in the link you provided is slightly different than I followed earlier, mainly the 6LoWPAN context 1 setting is different. Not sure it's updated or I was using a different document. Anyway, after plugin the dongle, restart Wireshark, it can parse the CoAP packet, except the first round trip packets. However if I click "restart capture" on Wireshark, it won't be able to parse the CoAP packets. So I just need to restart Wireshark each time.

I guess it's good enough for me right now. Thanks for the help.