nRF52840 Dongle BLE Sniffing

[ISMET FAIK SAGLAR]

I have nRF52840 Dongle and I want to sniff packets between two BLE devices. When I search in the Nordic DevZone forum, there are inconsistent answer about BLE sniffing support for the nRF52840 Dongle. On the "nRF Sniffer for Bluetooth LE" tool page (https://www.nordicsemi.com/Products/Development-tools/nRF-Sniffer-for-Bluetooth-LE) the device is shown as supported. Whereas, on this page (https://devzone.nordicsemi.com/f/nordic-q-a/61805/nrf52840-dongle-as-sniffer) it is written as not supported. 

Would you please clarify the support and describe usage if supported.

Thank you.

Best Regards.

[Marte Myrvold]

Hi,

The nRF Sniffer for Bluetooth LE is supported on the nRF52840 Dongle. You can see supported DKs and Dongles under nRF Sniffer for Bluetooth LE > Minimum requirements.

Information about installation and how to use the sniffer can be found in the documentation here: nRF Sniffer for Bluetooth LE.

Best regards,

Marte

[ilker]

Thanks for this. I have successfully followed the instructions and now I am able to see BLE packets in Wireshark with the provided profile.

But all I see is advertising packets.

How can I see messages between bonded/paired devices ?

The documentation says:

1. Run the nRF Sniffer (if not already running).
2. Select your device from the device list.
3. Enter the LTK for the bond.

But I don't have the LTK.

I also followed the "Sniffing the pairing procedure of a connection" instructions but I could not get packetrs other than advertising.

My devices pair withput a key. I just turn both devices on (reset them to force bonding) and select the device B from device A menu.

Edit:

I finally managed to sniff packets other than advertising data. But that only happens in the same session.

To continue capturing in another session, I got the LTK from the first session but I was not able to use it.

The problem is that,

1.device B starts pairing to device A

2.Then I get 2 LTKs (one is from master, the other one is from slave)

3.In the next session, device A does not advertise because it is already bonded, so I can not select it from the device list.

4. If I select device B from the list , then I try both LTK to get packets, I can not get any data other than advertising data.

What am I doing wrong ?

[Marte Myrvold]

Hi,

If the device is not advertising you can add the device's LE address to the device list, as explained under Add LE Address in nRF Sniffer usage.

Best regards,

Marte

[ilker]

Thank you.

Now I am able to get packets from that specific device.

However, I see "Encrypted packet decrypted incorrectly (bad MIC)" info

In fact, from the previous pairing session I got the LTK.

I got 2 LTKs, one from master device (sent encryption information)

value: 24c2432367ca4ba062aa2be421b233e5

one from the slave device (rcvd encryption information)

value: c4383dae339da6bb0be21f61bd7cd0b6

I tried both values entering them on the value field like 0xc4383dae339da6bb0be21f61bd7cd0b6

selecting Legacy LTK

but it is still not decrypting.

Any ideas about where am I doing wrong ?

thanks.

[ilker]

what might be wrong ?

[Marte Myrvold]

Hi,

It is difficult to say without looking at the sniffer trace. Can you upload it here as a pcap file?

Best regarads,

Marte

[ilker]

ble_captures.7z

Hi,

I have captured 5 files. The first one named "pairing" includes the pairing session.

From that session following notes:

d4:9c:dd:9e:f7:5b - camera (BLE client)
94:a1:a2:25:5a:49 - remote (BLE server)

33cd8dab22a023202a7074ad2a7afc69 - rcvd encryption information (packet 7887)
b0ddb6dbfb16725a1091d08c2b547221 - sent encryption information (packet 7898)

And with these keys I tried to decrypt other sessions. Files are named tfor easy understanding.

I hope you can find my mistake.

Thanks