nRF sniffer does not show connection packets

[jby]

Hello,

I try to debug a BLE connection with the nRF Sniffer. As a test, I used one nRF52 DK (PCA10040)  as peripheral using nRF Connect and and Android phone as central device (running the nRF Android Connect app). They are able to connect to each other. I use another nRF52 DK (PCA10040) as the sniffer. I programmed the firmware as listed in the nRF sniffer installation manual.

To observe the BLE packets, I installed the nRF sniffer with Wireshark. No errors during the installation, everything went smooth.

In Wireshark, I can see the advertisement packages, but when I establish a connection between the nRF52 DK and Android phone, I don't see the packets anymore. I did select the specific peripheral device that I use for the connection, but still it is not showing the connection packets. In attachment, you can find the captured packets from Wireshark.

Here is the software I used:

- operating system: macOS Big Sur 11.6

- Wireshark 3.4.7

- nRF sniffer 4.0.0

- BLE sniffer nRF52 DK (PCA10040)

Do you know what could be the reason?

Thanks!

JBY

packet_log.pcapng

[Amanda Hsieh]

Hi, 

I did select the specific peripheral device that I use for the connection, but still it is not showing the connection packets.

Seems you already selected the advertising device in the device field before connecting to the Android phone as the central device. Is it right?

What is the application? Does it use any pairing procedure of a connection? Is the peripheral device still running while connecting? Does the device log have any errors? 

Are you able to test with the example as BLE Blinky Application? Does it also have the same issue? 

Regards,
Amanda

[jby]

Amanda Hsieh said:

Seems you already selected the advertising device in the device field before connecting to the Android phone as the central device. Is it right?

Yes, I select the advertising device in the drop down list before connecting.

Amanda Hsieh said:

What is the application? Does it use any pairing procedure of a connection? Is the peripheral device still running while connecting? Does the device log have any errors? 

The original test was just using nRF connect, where the peripheral sends advertisements without any custom service. I could see in nRF connect that the Android phone successfully connects with the nRF52 DK acting as peripheral.

Amanda Hsieh said:

Are you able to test with the example as BLE Blinky Application? Does it also have the same issue? 

I flashed the BLE blinky application on the nRF52 DK acting as peripheral. For the central device, I downloaded the nRF Blinky appilcation on the Android Play store. The application works successfully, it correctly toggles the LED on the nRF52. However, I still cannot capture the connection with the other nRF52 DK acting as BLE sniffer. I added the new packet log in attachment. Please find below log file of the BLE sniffer:

INFO: Log started at Thu Jan 6 11:03:16 2022

INFO: Extcap version 3.4

INFO: Opening serial port /dev/cu.usbmodem0006820402261

INFO: closing UART

INFO: Opening serial port /dev/cu.usbmodem0006820402261

INFO: args: ()

INFO: kwargs: {'callbacks': [('*', <bound method Notifier.passOnNotification of <Sniffer(Thread-3, initial)>>)]}

INFO: board ID (random): 161

INFO: Sniffer created

INFO: Software version: 4.0.0

INFO: sniffer started

INFO: starting scan

INFO: Scan flags: 0b11

INFO: Sent TK to sniffer: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]

INFO: scanning started

INFO: defaults written

INFO: control loop

INFO: gap in packets, between 784 and 957 packet before: [55, 0, 3, 16, 3, 2, 10, 1, 38, 47, 0, 0, 177, 18, 151, 0, 214, 190, 137, 142, 66, 36, 196, 218, 125, 92, 87, 13, 29, 255, 6, 0, 1, 9, 33, 10, 5, 218, 151, 96, 164, 176, 76, 65, 80, 84, 79, 80, 45, 68, 82, 65, 71, 79, 78, 70, 76, 89, 87, 173, 215] packet after: [53, 0, 3, 189, 3, 2, 10, 1, 37, 59, 0, 0, 246, 99, 180, 0, 214, 190, 137, 142, 2, 34, 39, 180, 148, 46, 4, 248, 27, 255, 117, 0, 66, 4, 1, 128, 174, 248, 4, 46, 148, 180, 39, 250, 4, 46, 148, 180, 38, 1, 0, 0, 0, 0, 0, 0, 183, 157, 49]

INFO: gap in packets, between 961 and 4158 packet before: [53, 0, 3, 193, 3, 2, 10, 1, 38, 56, 0, 0, 195, 156, 180, 0, 214, 190, 137, 142, 70, 34, 135, 199, 232, 87, 220, 88, 3, 3, 111, 253, 23, 22, 111, 253, 66, 246, 27, 5, 63, 239, 61, 1, 69, 165, 110, 168, 165, 222, 191, 240, 160, 141, 21, 136, 43, 29, 106] packet after: [0, 0, 3, 62, 16, 14]

INFO: Firmware timestamp 49306699 reference: Jan 06 2022 11:03:17.51584 CET

INFO: follow_device: [b'251', b' 192', b' 183', b' 169', b' 201', b' 216', b' 1']

INFO: Sniffing device 9 - """"

INFO: Follow flags: 0b0

INFO: Following fb:c0:b7:a9:c9:d8 random

BTW, I also tested the same setup (Wireshark 3.4.7 and nRF sniffer 4.0.0) on Windows 10 without any success.

packet_log_ble_blinky_application.pcapng

[Amanda Hsieh]

Sounds so strange. Are you able to test with another PC/Windows and nRF sniffer 4.1.0? 

-Amanda

[jby]

I tested it on the Windows 10 PC with nRF sniffer 4.1.0, but wireshark does still not show the connection packets. Can you think of anything that could be reason for this problem? Is there a way to debug what happens on the nRF52 sniffer itself? Maybe it does not capture the connection packets correctly?

[Amanda Hsieh]

Do you also try the versions of Wireshark?

I cannot reproduce the issue with nRF sniffer v4.1.0 on nRF52DK and Wireshark Version 3.6.0 (v3.6.0-0-g3a34e44d02c9) on Windows, and running BLE Blinky on nRF52840DK connecting to nRF Connect app. 

-Amanda

[jby]

I finally found the issue, it seems a wrong J-LINK firmware version was installed on the nRF52 DK used as sniffer. I flashed it with version V6.88a and now it works! With V7.60b and V7.22 it doesn't seem to work. Thanks for the help!

[Amanda Hsieh]

Good to know find the issue. Happy to help.