nRF52840 DK sniffer fails to display Data messages after Connect_Ind, only advertisements

RE: nRF52840 DK sniffer fails to display Data messages after Connect_Ind, only advertisements

Aeneas — Fri, 09 Dec 2022 09:27:08 GMT

Right-click on the Source field in a particular line in the nrf/Wireshark display

yields something line "eth.src == xx:xx:xx:xx:xx:xx " .

When nrf BLE is active, nrf/Wireshark should generate:

"btle.advertising_address == xx:xx:xx:xx:xx:xx " .

This is especially useful in the Advertising Only realm, inclduing groups of addresses

using the built-in right-click filter boolean operations.

The point of the Filter All, is to filter out all currently air-detected addresses,

so that when the user presses Go on his debugger, that new advertiser random address

will be the only one who appears on the display.

Filtering all advertisers through 0x8e89bed6 would also filter this new advertiser.

There was an update for Wireshark yesterday, but I did not see a list of

updated features.

btle.length != 0 does seem to work for Empty PDU -- well done.

RE: nRF52840 DK sniffer fails to display Data messages after Connect_Ind, only advertisements

Hung Bui — Fri, 09 Dec 2022 08:42:59 GMT

Hi Aeneas,

Could you please explain a little bit more on the eth.src thing ? I'm not very familiar with that.

Please note that you can use right click filter and filter out empty packet, address etc as explained here.

And for advertising packet, all packets from any boardcaster have the same physical address of 0x8e89bed6 address and the broadcaster address is only provided in the payload. You need to filter it the same way as you filter the payload data.

RE: nRF52840 DK sniffer fails to display Data messages after Connect_Ind, only advertisements

Aeneas — Thu, 08 Dec 2022 17:50:41 GMT

The Wireshark right-click filter menu generates excellent boolean compound

statements when several addresses are filtered in or out, so it is a

powerful feature which is hampered by this eth.src text replace oversight.

So, to which part of the nrf project have you moved ?

Maybe I will add some more recs by the time you are back on Wireshark..

RE: nRF52840 DK sniffer fails to display Data messages after Connect_Ind, only advertisements

Hung Bui — Thu, 08 Dec 2022 12:00:45 GMT

Hi Aeneas,
Unfortunately I don't have a timeline for it.

RE: nRF52840 DK sniffer fails to display Data messages after Connect_Ind, only advertisements

Aeneas — Wed, 07 Dec 2022 17:05:50 GMT

I was already well familiar with the limitations of your nrf Sniffer tool,

which explain why your tool is much less expensive, but still very useful.

They have nothing to do with my recommendations, which pertain

to the usability of the product the way it is.

When do you plan an update to the nrf.wireshark software ?

RE: nRF52840 DK sniffer fails to display Data messages after Connect_Ind, only advertisements

Hung Bui — Wed, 07 Dec 2022 10:20:18 GMT

Hi Aeneas,

Thanks for the feedback.

The challenge here is that there are 40 channels for BLE and the radio on the nRF52 can only listen on one channel at a time. It's impossible for the sniffer to follow multiple connections (and advertising packet) with just one radio.

This is the reason why if you don't select a single device the sniffer can only scan advertising packets (which use only 3 channels in a predictable way). Only after a device is selected the sniffer can detect a connection for the specified device and can follow the connection. Only one connection at a time.
Some of the more expensive sniffer can sniff on all channels so you can just simply filter the device(s) you want to listen on the right-click menu but we are talking about professional sniffers at the cost of dozen of thousand USD.

RE: nRF52840 DK sniffer fails to display Data messages after Connect_Ind, only advertisements

Aeneas — Mon, 05 Dec 2022 16:44:05 GMT

That portion of my statement deals with the fact that the nrf Sniffer Plugin

documentation does not state clearly that unless you select one of the

air-detected devices

listed with dBm under Device, you will not see any Data traffic at all --

only Advertising traffic.

This runs counter to the historic background of Wireshark, which relies

on the right-click Filter menu, to select addresses to monitor/follow.

That right-click Filter menu still works for Advertising Only traffic,

as long as translation is made to btle.advertising_address in a tedious text replacement

process from the eth.src default (i.e. for Ethernet).

RE: nRF52840 DK sniffer fails to display Data messages after Connect_Ind, only advertisements

Hung Bui — Mon, 05 Dec 2022 15:46:53 GMT

Hi Aeneas,
I assume you have managed to select your device in the device list and now can follow the connection ?
The process of selecting the device in device list is actually in the documentation of the sniffer. You can see here and here.
You can filter empty packet using !(btle.data_header.length == 0) . You can see some other common use filters here.

[quote user="Aeneas"]

Normally, in developing ble firmware, after a firmware build, one runs the sniffer anew,

sets up them sniffer's configuration,

then presses Go on the firmware debugger, to start executing the firmware.

That sequence would not see the under-development device as

an active air-detected device, yet, in that Device list.

So it would be hard even to 'intuit' that functionality.

[/quote]

I don't really get what you meant above. Could you elaborate ?
The sniffer can only capture active on-air device. The list may not be updated if you are only following one single device. If you want to update the list (if your device changes the address) you need to select follow all advertising devices or restart the sniffer.
Usually to make it easy to track a device, I would fix the address of the device as a static random address and then I don't need to change the sniffer to follow new address.

RE: nRF52840 DK sniffer fails to display Data messages after Connect_Ind, only advertisements

Aeneas — Fri, 02 Dec 2022 13:36:56 GMT

I just figured that out last night.

So that is what the purpose of that list of various detected devices under Device.

Is this nordic-wireshark interface documented anywhere, or is this the chaos of active

development by hard working engineers ?

Normally, in developing ble firmware, after a firmware build, one runs the sniffer anew,

sets up them sniffer's configuration,

then presses Go on the firmware debugger, to start executing the firmware.

That sequence would not see the under-development device as

an active air-detected device, yet, in that Device list.

So it would be hard even to 'intuit' that functionality.

Separately, is there any way to filter out the Empty PDUs from the list of packets ?

And when will your engineers modify the Wireshark plug-in

to make btle.advertising_address official,

in the /list right-click menu/apply as filter/ option ?

Currently eth.src is the default.

Also useful would be a Filter All option, for already detected sources,

just before pressing Go on a device generating random addresses for itself,

Thanks.

RE: nRF52840 DK sniffer fails to display Data messages after Connect_Ind, only advertisements

ovrebekk — Fri, 02 Dec 2022 13:00:25 GMT

Have you selected the device in the Wireshark interface?

The nRF Sniffer can only sniff one connection at a time, and you need to select which device you want to track before the device connects.

Best regards
Torbjørn