Wireshark hangs totally when trying to start capture

[Dave Hitchman]

Followed instructions on https://infocenter.nordicsemi.com/index.jsp?topic=%2Fug_sniffer_ble%2FUG%2Fsniffer_ble%2Fmin_requirements.html

Running on Linux:

LSB Version: core-11.1.0ubuntu2-noarch:printing-11.1.0ubuntu2-noarch:security-11.1.0ubuntu2-noarch
Distributor ID: Ubuntu
Description: Ubuntu 20.04.5 LTS
Release: 20.04
Codename: focal

Processor:

Architecture: x86_64
CPU op-mode(s): 32-bit, 64-bit
Byte Order: Little Endian
Address sizes: 48 bits physical, 48 bits virtual
CPU(s): 8
On-line CPU(s) list: 0-7
Thread(s) per core: 1
Core(s) per socket: 8
Socket(s): 1
NUMA node(s): 1
Vendor ID: AuthenticAMD
CPU family: 23
Model: 96
Model name: AMD Ryzen 7 4700U with Radeon Graphics

nRF52840 dongle

wireshark:

Version 3.6.7 (Git v3.6.7 packaged as 3.6.7-1~ubuntu20.04.0+wiresharkdevstable)

Python 3.9.5 (default, Nov 23 2021, 15:27:38)

Wireshark starts ok, shows nothing on any of the capture lines and then hangs totally if I ask it to start capture, nothing is responsive so have to force quit - even tried waiting while I made a cup of tea just in case, nothing, nada. 

Any idea?

[Håkon Alseth]

Hi,

 

Could you ensure that your user has the correct permissions?

Here's the groups that your user should be a part of:

 RE: nrf52840 dongle sniffer + wireshark 

 

You'll also need the udev rules in place:

https://github.com/NordicSemiconductor/nrf-udev

 

Kind regards,

Håkon

[Dave Hitchman]

.config/wireshark/extcap$ ./nrf_sniffer_ble.sh --extcap-interfaces
extcap {version=4.1.1}{display=nRF Sniffer for Bluetooth LE}{help=www.nordicsemi.com/.../nRF-Sniffer-for-Bluetooth-LE}
interface {value=/dev/ttyACM0-None}{display=nRF Sniffer for Bluetooth LE}
control {number=0}{type=selector}{display=Device}{tooltip=Device list}
control {number=1}{type=selector}{display=Key}{tooltip=}
control {number=2}{type=string}{display=Value}{tooltip=6 digit passkey or 16 or 32 bytes encryption key in hexadecimal starting with '0x', big endian format.If the entered key is shorter than 16 or 32 bytes, it will be zero-padded in front'}{validation=\b^(([0-9]{6})|(0x[0-9a-fA-F]{1,64})|([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2}) (public|random))$\b}
control {number=3}{type=string}{display=Adv Hop}{default=37,38,39}{tooltip=Advertising channel hop sequence. Change the order in which the sniffer switches advertising channels. Valid channels are 37, 38 and 39 separated by comma.}{validation=^\s*((37|38|39)\s*,\s*){0,2}(37|38|39){1}\s*$}{required=true}
control {number=7}{type=button}{display=Clear}{tooltop=Clear or remove device from Device list}
control {number=4}{type=button}{role=help}{display=Help}{tooltip=Access user guide (launches browser)}
control {number=5}{type=button}{role=restore}{display=Defaults}{tooltip=Resets the user interface and clears the log file}
control {number=6}{type=button}{role=logger}{display=Log}{tooltip=Log per interface}
value {control=0}{value= }{display=All advertising devices}{default=true}
value {control=0}{value=[00,00,00,00,00,00,0]}{display=Follow IRK}
value {control=1}{value=0}{display=Legacy Passkey}{default=true}
value {control=1}{value=1}{display=Legacy OOB data}
value {control=1}{value=2}{display=Legacy LTK}
value {control=1}{value=3}{display=SC LTK}
value {control=1}{value=4}{display=SC Private Key}
value {control=1}{value=5}{display=IRK}
value {control=1}{value=6}{display=Add LE address}
value {control=1}{value=7}{display=Follow LE address}

[Dave Hitchman]

Even odder, sudo wireshark (and doing a bit more installing the same stufff in different folders) and it works. Why sudo?

[Håkon Alseth]

Hi,

 

It is because your user does not have the correct permissions.

Please see my comment:

Håkon Alseth said:

Could you ensure that your user has the correct permissions?

Here's the groups that your user should be a part of:

 RE: nrf52840 dongle sniffer + wireshark 

 

You'll also need the udev rules in place:

https://github.com/NordicSemiconductor/nrf-udev

 

Kind regards,

Håkon

[Dave Hitchman]

Super, will try, perhaps the instructions need this info (or I missed it)

thanks