nRF52840 random disconnection

[Dani]

Good morning,

We have a new equipment based on the nRF52840 and s140.

                Just now, a new problem has appeared and it is very strange, as it seems to be a ‘random’ error:

 

                We have already assembled tens of equipment, and most of them are perfectly working with any smartphone (using both your ‘nRF Connect’ application or our own application).

                But, we have a few smartphones that show a strange behavior: they are able to perfectly connect to some of our nRF52840-based equipment, and in a few ones, they are able to connect but they get disconnected after a few seconds. Same equipment is connecting to other smartphones without problems (without disconnecting).

                This is (step by step) what it is happening a few times:

• Equipment (nRF52840) is advertising.
• Smartphone stablish connection with equipment using pin number
• First time, the connection is perfectly working.
• If smartphone is disconnected and connected back again with same equipment (Already bonded), then connection is stablished but smartphone disconnects after 30”, approximately. Same behavior is happening with both nRF connect application and our own application. Looking at log in nRF application we see: ‘Connection terminated by peer (status 19)’or ‘GATT_CONN_TIMEOUT’

 

Why is it happening?

Which is the reason?

How can we solve this?

 

 Could you help us? (For your information, we have set MIN_CONN_INTERVAL to 7.5m and MAX_CONN_INTERVAL to 100ms)

Thank you

[Hung Bui]

Hi Daniel, 

I got the update from Brian Kim about your email discussion. I agree with Brian that the sniffer trace would play a very important role here to solve the issue. I have some comments: 

- Regarding the sniffer trace, I could see the communication because the link was encrypted. What you need to do is to either do Legacy pairing and use the sniffer to follow the initial bonding. Or use LESC but in debug mode. 

- Another option you can try is to turn off bonding and encryption requirement to see if the issue is related to bonding or not. If the issue remain, please capture a sniffer trace. 

- The disconnection happened at second 26th into the connection so it may not related to the 30seconds GAP/GATT timeout.

- Please try to do a chip erase on the defected board and test again.

- Please try to test using one of our example in the SDK, ble_app_proximity for example. 

[Dani]

Hi again,

I have programmed one equipment turning bonding off, and then it is imposssible to connect (please, look at the attached screenshot with nRF Connect).

In order to set it off, I set my variable 'BONDING_WITH_NO_CODE' to 1, and I have implement this in 'peer_manager_init' function:

static void peer_manager_init(void)
{
    ble_gap_sec_params_t sec_param;
    ret_code_t           err_code;

    err_code = pm_init();
    APP_ERROR_CHECK(err_code);

    memset(&sec_param, 0, sizeof(ble_gap_sec_params_t));

    // Security parameters to be used for all security procedures.
		if(BONDING_WITH_NO_CODE)
		{
			sec_param.bond         = 0;    
			sec_param.oob          = 0;
			sec_param.mitm         = 0; 
			sec_param.io_caps      = BLE_GAP_IO_CAPS_NONE;
			sec_param.kdist_own.enc  = 0;
			sec_param.kdist_own.id   = 0;
			sec_param.kdist_peer.enc = 0;
			sec_param.kdist_peer.id  = 0;
		}
		else
		{
			sec_param.bond           = SEC_PARAM_BOND;
			sec_param.oob            = SEC_PARAM_OOB;
			sec_param.mitm           = SEC_PARAM_MITM; //Static Key
			sec_param.io_caps        = SEC_PARAM_IO_CAPABILITIES;    
			sec_param.kdist_own.enc  = 1;
			sec_param.kdist_own.id   = 1;
			sec_param.kdist_peer.enc = 1;
			sec_param.kdist_peer.id  = 1;
		}
		
        
    sec_param.lesc           = SEC_PARAM_LESC;
    sec_param.keypress       = SEC_PARAM_KEYPRESS;    
    sec_param.min_key_size   = SEC_PARAM_MIN_KEY_SIZE;
    sec_param.max_key_size   = SEC_PARAM_MAX_KEY_SIZE;
    

    err_code = pm_sec_params_set(&sec_param);
    APP_ERROR_CHECK(err_code);

    err_code = pm_register(pm_evt_handler);
    APP_ERROR_CHECK(err_code);
}

Furthermore, in this case, in all services, I proceed in the following way:

if(BONDING_WITH_NO_CODE)
{
	BLE_GAP_CONN_SEC_MODE_SET_OPEN(&attr_md.read_perm);
	BLE_GAP_CONN_SEC_MODE_SET_OPEN(&attr_md.write_perm);			
}		
else
{
	BLE_GAP_CONN_SEC_MODE_SET_ENC_WITH_MITM(&attr_md.read_perm);
	BLE_GAP_CONN_SEC_MODE_SET_ENC_WITH_MITM(&attr_md.write_perm);
}

Hope to go ahead with the solution.

Best regards,

Dani.

[Dani]

Hi Hung,

Should I see the LTK info through the log of the nRF Connect tool?

I'm not seeing it.

Dani

[Hung Bui]

Hi Dani, 

No nRF Connect wouldn't display the LTK (it's not available to the app on the phone). You can only get it by using the log as I suggested in the last reply. 

[Dani]

Hi Hung,

I dind't know how to get this log with my equipment: no way, I have debugged it and I succeded to read the LTK code. Then I have introduced it into the Wireshark tool and I register connection and auto-disconnection after around 30".

Please, find attached a screenshot of Wireshark tool and the trace.

Dani.Android_pairing_with_disconnection_bonded_LTK_23_05_22.pcapng

[Hung Bui]

Hi Dani,

 I don't think it's managed to decrypt the connection. You can see here that the sniffer didn't managed to decrypt the connection: 

You would need to input the LTK when select SC LTK, not Passkey/OOB key as showed in your screenshot. 
Please refer to this screenshot: 

[Dani]

Hi Hung,

Sorry for not knowing this but, how can I select the SCLTK key in Wireshark tool? I do not know how to do it. Please, find attached a screenshot of main screen I can see when initializing this tool...

Dani.

[Hung Bui]

Hi Dani, 
I think you are using an older version of the nRF Sniffer. Could you check if you have version 4.1 of the sniffer  ? It must have a drop down menu next to Keys , instead of what in your screenshot. 

[Dani]

Hi Hung,

Indeed, this was the problem. I have already updated it, and now interface is as expected.

Now I have done the following procedure, as you have described:

- Smartphone has been paired with my device

- I have disconnected the device from smartphone

- I have connected the device again. And being connected, in Wireshark, I have introduced the SC-LTK value: from that moment, only 'Empty PDU' messages appear, up to the moment the device disconnects (after around 30")

Please, find trace here attached

Dani.3755.Android_pairing_with_disconnection_bonded_LTK_23_05_22.pcapng

[Hung Bui]

Hi Dani, 

No it still couldn't decrypt the connection correctly. 
Please see here: 

When the sniffer says "encrypted packet decrypted incorrectly" that mean the key was missing or the key was wrong. 
Please make sure you reverse the order of the bytes as I showed in my screenshot. And make sure you click the arrow button . And all of this must be done before the re-connection taking place. 

Please look for the way to print the log out, you can either use UART or RTT logging if you don't have UART(doesn't require extra pin, just the debugger).

[Dani]

Hi Hung,

I think now I got it: but I have seen that when I click the arrow button, I do not see incoming information in the log window: please, look at the screenshot here attached, where a time gap without info is noticed. And the information is received after this gap is related to advertising, as device has disconnected.

Please, find also attached this trace

DaniAndroid_Disconnection_24_05_22.pcapng

[Hung Bui]

Hi again Daniel, 

It still can't decode the connection. Note that the empty packet is not encrypted. 

Please click the arrow button before starting the connection, basically the sniffer need to have the keys before the LL_START_ENC_REQ (0x05) packet. And the key need to be correct key (reversed byte order).