nRF Sniffer for 802.15.4 doesn't appear on Wireshark interface

[Md Mazedul Islam Khan]

I am struggling to see nRF Sniffer for 802.15.4 as an interface in the Wireshark interface list under the startup welcome screen. I am using nRF62840-Dongle and flashed it by utilizing the nrf802154_sniffer_dongle.hex available under the GitHub nRF-Sniffer-for-802.15.4 repository. I didn't find a specific binary for nRF62840-Dongle device there.

• Since I flashed the nRF62840-Dongle device using a mismatched binary nrf802154_sniffer_dongle.hex, is it the main cause of the issue? If so, where do I get the correct binary for the nRF62840-Dongle device?

I have Python 3 installation with Homebrew including Pip 3. I have listed the relevant installation path in the following:

• which python: python not found
• which pip: /usr/local/bin/pip
• which python3: /usr/local/bin/python3
• which pip3: /usr/local/bin/pip3

I installed pyserial using pip3 install pyserial. I copied the nrf802154_sniffer.py file under the ~/.config/wireshark/extcap location which is a Personal Extcap path.

When running the python3 nrf802154_sniffer.py --extcap-interfaces command, it outputs the following valid confirmation:

extcap {version=0.7.2}{help=https://github.com/NordicSemiconductor/nRF-Sniffer-for-802.15.4}{display=nRF Sniffer for 802.15.4}
interface {value=/dev/cu.usbmodemF1BD057D01BB1}{display=nRF Sniffer for 802.15.4}
control {number=6}{type=button}{role=logger}{display=Log}{tooltip=Show capture log}

So, what am I missing? Why nRF Sniffer for 802.15.4 interface isn't appearing on the Wireshark Custom Interface list?

[Jørgen Holmefjord]

Hi,

I assume you meant nRF52840-Dongle? The firmware named "nrf802154_sniffer_dongle.hex" is the correct file to use with this dongle. We do not have other dongles that support IEEE 802.15.4. The output from the "--extcap-interfaces" command also indicates that the sniffer firmware is found and working correctly.

I do not have too much experience with MacOS, but I assume this is caused by the missing "python" application. Can you try to change the first line of the script from "python" to "python3", or to create a symbolic link from python3 to python?

Best regards,
Jørgen

[Jørgen Holmefjord]

Did you try both suggestions?

Have you tried restarting Wireshark and reboot the computer?

Which Python 3 version are you using?

[JANC]

I see, What is package manager. Can you share the link for the same? That will help me.

Also regarding nrf802.15.4_sniffer.py --extcap-interfaces - does display the characters as show in your pic. The only thing missing is i am using rpm wireshark version 2.1.1.

Does nrf dongle support for wireshark 2.1.1?

[root@pc12rve3 nrf802154_sniffer]# python3 nrf802154_sniffer.py --extcap-interfaces
extcap {version=0.7.2}{help=github.com/.../nRF-Sniffer-for-802.15.4}{display=nRF Sniffer for 802.15.4}
interface {value=/dev/ttyACM0}{display=nRF Sniffer for 802.15.4}
control {number=6}{type=button}{role=logger}{display=Log}{tooltip=Show capture log}
[root@pc12rve3 nrf802154_sniffer]#

But i dont see the device in wireshark -D interfaces

[root@pc12rve3 nrf802154_sniffer]# sudo tshark -i /dev/ttyACM0
Running as user "root" and group "root". This could be dangerous.
Capturing on '/dev/ttyACM0'
tshark: The capture session could not be initiated on interface '/dev/ttyACM0' (/dev/ttyACM0: SIOCETHTOOL(ETHTOOL_GET_TS_INFO) ioctl failed: No such device).
Please check to make sure you have sufficient permissions, and that you have the proper interface or pipe specified.
0 packets captured

[Sigurd Hellesvik]

JANC said:

I see, What is package manager. Can you share the link for the same? That will help me.

https://itsfoss.com/package-manager/

JANC said:

But i dont see the device in wireshark -D interfaces

Do you see anything in the Wireshark GUI?

JANC said:

[root@pc12rve3 nrf802154_sniffer]# sudo tshark -i /dev/ttyACM0
Running as user "root" and group "root". This could be dangerous.

Try to run this as a user and not as root.

Which firmware do you run on the dongle?

[JANC]

Hi,

Yes I am using RPM package manager and installed the wireshark.

GUI also doesn't show up the interfaces. But the usb is enumerated as /dev/ttyACM0.

Dongle firmware is loaded in the dongle nrf802154_sniffer_dongle.hex was loaded. The same dongle captures packets in windows platform.

The issue is only with Linux plactform.

Does nrf dongle work on FC25 kernel version 4.8.6, wireshark version 2.0.1?

I am blocked because of this, could you let me know what else should be checked?

When i run the python file, 

[root@pc12rve3 nrf802154_sniffer]# python3 nrf802154_sniffer.py --extcap-interfaces
extcap {version=0.7.2}{help=github.com/.../nRF-Sniffer-for-802.15.4}{display=nRF Sniffer for 802.15.4}
interface {value=/dev/ttyACM0}{display=nRF Sniffer for 802.15.4}
control {number=6}{type=button}{role=logger}{display=Log}{tooltip=Show capture log}
[root@pc12rve3 nrf802154_sniffer]#

The output is as expected, then why the interfaces is not listed.

[JANC]

I tried using it as user as well, i dont see the nrf sniffer as an interface.

[Sigurd Hellesvik]

JANC said:

Does nrf dongle work on FC25 kernel version 4.8.6, wireshark version 2.0.1?

I have not heard about any system requirements for the dongle before, so I assume it should work for something like this as well.

JANC said:

Dongle firmware is loaded in the dongle nrf802154_sniffer_dongle.hex was loaded. The same dongle captures packets in windows platform.

The issue is only with Linux plactform.

Good to know, then we know that the dongle should work.

JANC said:

I tried using it as user as well, i dont see the nrf sniffer as an interface.

Try to add the user to the correct user groups for USB access. The group for this is often dialout, but it may vary with distros.
See for example https://askubuntu.com/questions/133235/how-do-i-allow-non-root-access-to-ttyusb0

Also, which output do you get from "

wireshark -D interfaces

"

?

[JANC]

fir wireshark -D interfaces

Nordic dongle doesnt get listed here

I created user instead of root and added to dialout, But no luck

[Sigurd Hellesvik]

JANC said:

I created user instead of root and added to dialout, But no luck

From Installing Wireshark on Ubuntu Linux:

Did you also rememver to log out and in again

Can you do "ls -l" from  the extcap folder?

[JANC]

Yes in fact i restarted the machine and used in root config

this is at usr login

What is expected in this location? Can you share some file or screen shot of what is expected here? So i will know

This is x86 based machine using FC25 OS.

On Another note, i tried same steps on ubuntu machine - just to check

I dont see any file in extcap directory here also and when i force open the tshark, i get below message

tshark: The capture session could not be initiated on interface '/dev/ttyACM0' (No such device exists).
Please check that you have the proper interface or pipe specified.
0 packets captured

Thanks

[Sigurd Hellesvik]

JANC said:

Yes in fact i restarted the machine and used in root config

I specified "ls -l" because I also need to see permissions on the files. The screenshots is not enough.

However, I see that root is the owner of the user files, so that may interfere.

JANC said:

What is expected in this location? Can you share some file or screen shot of what is expected here? So i will know

Disregard files other than "nrf802154_sniffer.py".

JANC said:

On Another note, i tried same steps on ubuntu machine - just to check

I dont see any file in extcap directory here also

You must manually move files into extcap directory.

If you get the same issue on Ubuntu, I guess you are missing some steps.
Please make sure to follow every step explained in the nRF Sniffer for 802.15.4 guide.

JANC said:

tshark: The capture session could not be initiated on interface '/dev/ttyACM0' (No such device exists).

Can you show me the output of these commands?

ls /dev/ttyACM*
groups

[JANC]

Yes i copied the python file manually in extcap directory and executed. No other files is added here.

wcduser@wcduser-Latitude-7480:/usr/share/wireshark/extcap$ ls -l /dev/ttyACM*
crw-rw-rw- 1 root dialout 166, 0 Sep 20 14:43 /dev/ttyACM0

wcduser adm dialout cdrom sudo dip plugdev lpadmin lxd 

This ubuntu machine.

As i am using the user login and not root, the wireshark exists in this path /usr/share/wireshark/extcap

Where is the extcap file expected to be available?