nRF52840 Dongle BLE Sniffing

[ISMET FAIK SAGLAR]

I have nRF52840 Dongle and I want to sniff packets between two BLE devices. When I search in the Nordic DevZone forum, there are inconsistent answer about BLE sniffing support for the nRF52840 Dongle. On the "nRF Sniffer for Bluetooth LE" tool page (https://www.nordicsemi.com/Products/Development-tools/nRF-Sniffer-for-Bluetooth-LE) the device is shown as supported. Whereas, on this page (https://devzone.nordicsemi.com/f/nordic-q-a/61805/nrf52840-dongle-as-sniffer) it is written as not supported. 

Would you please clarify the support and describe usage if supported.

Thank you.

Best Regards.

[Marte Myrvold]

Hi,

It is difficult to say without looking at the sniffer trace. Can you upload it here as a pcap file?

Best regarads,

Marte

[ilker]

ble_captures.7z

Hi,

I have captured 5 files. The first one named "pairing" includes the pairing session.

From that session following notes:

d4:9c:dd:9e:f7:5b - camera (BLE client)
94:a1:a2:25:5a:49 - remote (BLE server)

33cd8dab22a023202a7074ad2a7afc69 - rcvd encryption information (packet 7887)
b0ddb6dbfb16725a1091d08c2b547221 - sent encryption information (packet 7898)

And with these keys I tried to decrypt other sessions. Files are named tfor easy understanding.

I hope you can find my mistake.

Thanks

[ilker]

did you see my post below ? Is it helpful to understand the problem ?

[Marte Myrvold]

Hi,

You must reverse the byte order of the LTK. Wireshark is showing the LTK as little endian, but the LTK must be provided as big endian.

Additionally, it is the LTK from the received encryption information you should use (so 33cd8dab22a023202a7074ad2a7afc69 in your case), since it is the central that starts the encryption.

Best regards,

Marte

[ilker]

ok. thanks.

is this 16bit ? how shouls I reverse the byte order ?