nRF52840 DK sniffer only displays ADV_IND

[aladin.taleb]

Hey! I'm trying to sniff the data moving between a Bluetooth LE button and a Central.

Installation of the Bluetooth LE Sniffer went pretty smoothly but Wireshark only shows `ADV_IND` packets.

• nRF52840 DK
• macOS Intel on Catalina
• I have to use a USB-C hub to go from the DK to the MacBook Pro
• Wireshark Version 3.6.1 (v3.6.1-0-ga0a473c7c1ba)
• JLink version 7.60d
• nRF Bluetooth sniffer v4.1.0

What can I do to see all the packets going between the the button and the central?

only_adv.pcapng

[Karl Ylvisaker]

Hello,

Thank you for your patience with this.

aladin.taleb said:

I am not sure I understand how that works. When I input an address in the "Value", the field gets all red and I cannot click on the arrow (see screenshot)

You will need to include the " (random)" or " (private)" at the end of address before it is a valid address.

aladin.taleb said:

To be honest, I don't know. It seems that anything can connect to this button.

Could you use the "forget device" on your central side, and then redo the trace for the scenario in which the central establishes connection to the device, to see if there is any difference then?

Best regards,
Karl

[aladin.taleb]

Karl Ylvisaker said:

You will need to include the " (random)" or " (private)" at the end of address before it is a valid address.

Okay, I had to add " public" to make the Value field not turn red but it didn't really help. 

Karl Ylvisaker said:

Could you use the "forget device" on your central side, and then redo the trace for the scenario in which the central establishes connection to the device, to see if there is any difference then?

So the central side is a node.js script running on my mac. After digging into the library (@abandonware/noble) it seems that bonding/pairing is not supported so I don't see how "forgetting the device" would help.

I've also tried to sniff a connection between my iPhone and the button but same thing: only `ADV_IND` are output on Wireshark.

Any other ideas?

[Karl Ylvisaker]

aladin.taleb said:

Okay, I had to add " public" to make the Value field not turn red but it didn't really help. 

Strange that this also made no difference.

aladin.taleb said:

So the central side is a node.js script running on my mac. After digging into the library (@abandonware/noble) it seems that bonding/pairing is not supported so I don't see how "forgetting the device" would help.

I've also tried to sniff a connection between my iPhone and the button but same thing: only `ADV_IND` are output on Wireshark.

I see - it is still strange that the sniffer log ends so abruptly, and that it does not perform as expected prior to the abrupt stop.
Since the devices are able to connect this means that there is something wrong with the wireshark / sniffer.
I will discuss this with some colleagues who work on Mac's, to see if they ever have experienced anything like this with wireshark, and if they are able to reproduce the behavior you describe.

In the mean time, could you do a completely fresh install of the sniffer v4.1 - including reflashing of the sniffer device?
Could you also try to switch which USB port you are using on the DK, to see if this makes any difference after the re-installation?
I.e if you were using the programming port during regular operation, try to switch to the nRF USB port (after having successfully flashed the sniffer firmware), or visa versa.

Best regards,
Karl

[aladin.taleb]

It seems that using the nRF USB port instead of "the other one" has made it work as expected!

After reading through the doc - I now realise that there was a note about this... However, as a non-bluetooth expert, I just followed the hardware setup picture.

The nRF USB connector is on the size of the DK - hence the mistake!

Thanks for your support.