nRF Sniffer for 802.15.4 doesn't appear on Wireshark interface

[Md Mazedul Islam Khan]

I am struggling to see nRF Sniffer for 802.15.4 as an interface in the Wireshark interface list under the startup welcome screen. I am using nRF62840-Dongle and flashed it by utilizing the nrf802154_sniffer_dongle.hex available under the GitHub nRF-Sniffer-for-802.15.4 repository. I didn't find a specific binary for nRF62840-Dongle device there.

• Since I flashed the nRF62840-Dongle device using a mismatched binary nrf802154_sniffer_dongle.hex, is it the main cause of the issue? If so, where do I get the correct binary for the nRF62840-Dongle device?

I have Python 3 installation with Homebrew including Pip 3. I have listed the relevant installation path in the following:

• which python: python not found
• which pip: /usr/local/bin/pip
• which python3: /usr/local/bin/python3
• which pip3: /usr/local/bin/pip3

I installed pyserial using pip3 install pyserial. I copied the nrf802154_sniffer.py file under the ~/.config/wireshark/extcap location which is a Personal Extcap path.

When running the python3 nrf802154_sniffer.py --extcap-interfaces command, it outputs the following valid confirmation:

extcap {version=0.7.2}{help=https://github.com/NordicSemiconductor/nRF-Sniffer-for-802.15.4}{display=nRF Sniffer for 802.15.4}
interface {value=/dev/cu.usbmodemF1BD057D01BB1}{display=nRF Sniffer for 802.15.4}
control {number=6}{type=button}{role=logger}{display=Log}{tooltip=Show capture log}

So, what am I missing? Why nRF Sniffer for 802.15.4 interface isn't appearing on the Wireshark Custom Interface list?

[Jørgen Holmefjord]

Hi,

I assume you meant nRF52840-Dongle? The firmware named "nrf802154_sniffer_dongle.hex" is the correct file to use with this dongle. We do not have other dongles that support IEEE 802.15.4. The output from the "--extcap-interfaces" command also indicates that the sniffer firmware is found and working correctly.

I do not have too much experience with MacOS, but I assume this is caused by the missing "python" application. Can you try to change the first line of the script from "python" to "python3", or to create a symbolic link from python3 to python?

Best regards,
Jørgen

[Jørgen Holmefjord]

Did you try both suggestions?

Have you tried restarting Wireshark and reboot the computer?

Which Python 3 version are you using?

[Sigurd Hellesvik]

Hi,

I will continue helping in this case.

To test if it is an issue with the computer or not:

Do you have access to another computer where you can try to install the sniffer?
For example borrow one from a friend?

It is not intended as a permanent solution, just to collect more debugging information.

Regards,
Sigurd Hellesvik

[JANC]

I am using python 3.5,still wireshark doesnt show up extcap directory and hence doesnt show nrf dongle for extcap interfaces

Please guide what could be the issue

The dongle is enumerated as ttyACM0

[Sigurd Hellesvik]

JANC said:

I am using python 3.5,still wireshark doesnt show up extcap directory and hence doesnt show nrf dongle for extcap interfaces

QuoteWhat do you mean "Doesnt show up"? Can you elaborate and add a screenshot?

[JANC]

In the about wireshark/tshark in Linux machine it should show extcap and path for the nRF python file right?

Also, my main issue is i have connected nrf dongle to capture 15.4 packets. The dongle is enumerated as ttyACM0. I gave permission as well to the port. Pyserial is available. Please guide me what am i missing that wireshark doesnt show nrf as one of the interfaces and hence unable to capture. If i forcefully give tshark -i /dev/ttyACM0 - it crashes the wireshark.

I am using FC25, 4.8.6 kernel version.

Should there be any file here? I saw in some other write up where they say port related file should exist here

No Nordic dongle in the interfaces list

Listed in /dev/

Please guide me, for linux based systems what are the things to be ensured that Nordic dongle is shown as interface. In windows its pretty simple after copying extcap directory..

Thanks for the guidance

[Sigurd Hellesvik]

JANC said:

Should there be any file here? I saw in some other write up where they say port related file should exist here

/root/.config/wireshark/ is the configuration directory for roots wireshark. In this case, you must always run it with "sudo wireshark".

For a normal user, use $HOME/.config/wireshark/ instead.

I recommend following our guide at Installing nRF Sniffer for 802.15.4.

[JANC]

Also, i have installed wireshark using rpm and dont build using source. Is it mandatory to build using source for linux machine?

I hope nRF dongle works with tshark right?

I will re-look at the link do if any steps missing

Why wireshark -D is not listing nrf dongle... i can see in /dev/serial/by-id/USB-Nordic dongle

Also, in the above link Installing nRF Sniffer for 802.15.4. which i didnt follow or didnt find is

• Install the nRF Sniffer capture plugin.

Could you guide me plug in w.r.t linux machine what should be done? I didn find any shell script similar to bat file in windows?

[Sigurd Hellesvik]

JANC said:

Also, i have installed wireshark using rpm and dont build using source. Is it mandatory to build using source for linux machine?

No, I recommend using a package manager for installing wireshark.

JANC said:

Could you guide me plug in w.r.t linux machine what should be done? I didn find any shell script similar to bat file in windows?

From https://infocenter.nordicsemi.com/index.jsp?topic=%2Fug_sniffer_802154%2FUG%2Fsniffer_802154%2Fintro_802154.html :

[JANC]

I see, What is package manager. Can you share the link for the same? That will help me.

Also regarding nrf802.15.4_sniffer.py --extcap-interfaces - does display the characters as show in your pic. The only thing missing is i am using rpm wireshark version 2.1.1.

Does nrf dongle support for wireshark 2.1.1?

[root@pc12rve3 nrf802154_sniffer]# python3 nrf802154_sniffer.py --extcap-interfaces
extcap {version=0.7.2}{help=github.com/.../nRF-Sniffer-for-802.15.4}{display=nRF Sniffer for 802.15.4}
interface {value=/dev/ttyACM0}{display=nRF Sniffer for 802.15.4}
control {number=6}{type=button}{role=logger}{display=Log}{tooltip=Show capture log}
[root@pc12rve3 nrf802154_sniffer]#

But i dont see the device in wireshark -D interfaces

[root@pc12rve3 nrf802154_sniffer]# sudo tshark -i /dev/ttyACM0
Running as user "root" and group "root". This could be dangerous.
Capturing on '/dev/ttyACM0'
tshark: The capture session could not be initiated on interface '/dev/ttyACM0' (/dev/ttyACM0: SIOCETHTOOL(ETHTOOL_GET_TS_INFO) ioctl failed: No such device).
Please check to make sure you have sufficient permissions, and that you have the proper interface or pipe specified.
0 packets captured

[Sigurd Hellesvik]

JANC said:

I see, What is package manager. Can you share the link for the same? That will help me.

https://itsfoss.com/package-manager/

JANC said:

But i dont see the device in wireshark -D interfaces

Do you see anything in the Wireshark GUI?

JANC said:

[root@pc12rve3 nrf802154_sniffer]# sudo tshark -i /dev/ttyACM0
Running as user "root" and group "root". This could be dangerous.

Try to run this as a user and not as root.

Which firmware do you run on the dongle?

[JANC]

Hi,

Yes I am using RPM package manager and installed the wireshark.

GUI also doesn't show up the interfaces. But the usb is enumerated as /dev/ttyACM0.

Dongle firmware is loaded in the dongle nrf802154_sniffer_dongle.hex was loaded. The same dongle captures packets in windows platform.

The issue is only with Linux plactform.

Does nrf dongle work on FC25 kernel version 4.8.6, wireshark version 2.0.1?

I am blocked because of this, could you let me know what else should be checked?

When i run the python file, 

[root@pc12rve3 nrf802154_sniffer]# python3 nrf802154_sniffer.py --extcap-interfaces
extcap {version=0.7.2}{help=github.com/.../nRF-Sniffer-for-802.15.4}{display=nRF Sniffer for 802.15.4}
interface {value=/dev/ttyACM0}{display=nRF Sniffer for 802.15.4}
control {number=6}{type=button}{role=logger}{display=Log}{tooltip=Show capture log}
[root@pc12rve3 nrf802154_sniffer]#

The output is as expected, then why the interfaces is not listed.