NRFSniffer python tools: How to capture the connection phase

[v.planat]

Hi

We are using NRF_51422 dongle in our university for Labs development with students

We were able to setup & install the NRF_sniffer. It is working with the command line  python nrf_sniffer.py and we were able to capture traces with the command

   python nrf_sniffer_ble.py --extcap-interface COM6-None --capture --fifo myOutput_connect.pcap

Unfortunately, we cannot for the moment capture CONNECT req messages.

In your doc you mention that (https://infocenter.nordicsemi.com/index.jsp?topic=%2Fug_sniffer_ble%2FUG%2Fsniffer_ble%2Fsniffer_usage.html) the 2nd mode of opertation allows

1. Follow one particular device and try to catch all packets sent to or from this particular device. This mode catches all:
   • Advertisements and Scan Responses sent from the device
   • Scan Requests and Connect Requests sent to the device
   • Packets in the connection sent between the two devices in the connection

But I cannot find any example of command line that allows this capture

In your doc here https://infocenter.nordicsemi.com/index.jsp?topic=%2Fug_sniffer_ble%2FUG%2Fsniffer_ble%2Fsniffer_usage.html you refer to wireshark for selecting the peripheral but in our case (cmd.exe not allowed on the PC) the automatic capture from wireshark is not possible. We have to capture manually & then open file from wireshark

We tried the following command

python nrf_sniffer_ble.py --extcap-interface COM6-None --capture --fifo myOutput_connect.pcap --device fd:e0:99:56:27:c2

But not CON_REQ message ..

Which procedure should we follow ?

Thanks a lot for your help

Regards

[Hung Bui]

Hi Planat, 

I don't think --device has been implemented in the nrf_sniffer_ble.py to actually follow the device. 

The device to follow is handled in control_loop() -> handle_control_command->follow_device() 

I don't have much experience with the nrf_sniffer_ble.py file, but I would suggest to have a look at the Sniffer API Guide.pdf doc and follow the documentation there to write your own python (instead of nrf_sniffer_ble.py)  to run the sniffer, an example.py is provided in the doc folder.  
You job is to modify that and then output to a file. 

[v.planat]

Hi,

Thanks very much for your answer.

I'm very surprised that the capture is not possible on the connection ..?? Are you really sure that I have to develop this  code, meaning that this sniffer_ble.py is only capable of sniffing ADV_IND ?? I'm not a deep expert in python but the code seems much extended and seems to cover this space also..

Are you aware of any other example of command line that are refering to this code ?

I'm a bit reluctant trying to recode something that may already work 

I really thank you for your support

Regards

Vincent

[Hung Bui]

Hi Vincent, 

The sniffer_ble.py expects a command from Wireshark drop down menu (the handle_control_command()) to start tracking the device. It's not something you can input in the commandline arguments when calling python. 

It's API from Wireshark that communicate to the python application directly. So I afraid the easiest way is still to modify nrf_sniffer_ble.py to add the command in, or you can write your own python code for that.