Sniffing Read and Write with Wireshark on Mac

[DrRKC]

Hello, 

Setup : M1 Macbook Pro 2021, WireShark Version 4.0.3, nRF52840 BlueTooth Sniffer : sniffer_nrf52840dongle_nrf52840_4.1.1.hex

I have a nRF52840 hooked up and successfully receiving data via WireShark on my M1 Macbook Pro. I'm writing a BlueTooth battery monitor for a new electric motorbike. We need to get basic battery information from the battery BMS (like the information returned from the Smart BMS app). I thought this would be a simple case of sniffing the right packets and then updating our Bluetooth code. Unfortunately, I can not get the Read and Write information from WireShark. I get a CONNECT_IND message and then nothing else. I actually sometimes don't see the CONNECT_IND message - I have to connect several times for it to appear. 

Can the nRF52840 do this kind of sniffing - I read somewhere that the other messages might be on another channel and it can't change channel (that doesn't seem right to me). 

Any help is greatly appreciated. I attach a screenshot of WireShark at the point where it got the CONNECT_IND message (this took several attemtps), you can see SmartBMS running on the Mac too. Then I request the battery data - the second screenshot - and you can see the SmartBMS has the data but I'm still stuck on the CONNECT_IND message - I get no further comms until I discount (and the broadcast restarts). 

The filter is the ID for the battery and the ID for my machine: 

btle.advertising_address == 96:69:08:02:04:fd || btle.initiator_address == f0:2f:4b:06:61:f0

Removing this and sifting through the resulting stream of messages shows the same result. 

I'm connecting to a standard LIFEP04 battery bank to run my tests. I also attach the WireShark output file. 

Thank you

Regards

Raj

Connect_Ind demonstration.pcapng.gz

[Kenneth]

Hello,

You need to select the device you want to sniff in specific if you want to follow it:

Kenneth

[DrRKC]

Hi Kenneth, 

Thank you for the reply.

I have tried that - with both ends of the connection (i.e. selecting 96:69:08:02:04:fd public, and when I did not get the right messages selecting f0:2f:4b:06:61:f0 public). I still never receive an ATT protocol message for the read or write (or any messages for that matter after connection).

I've also manually set Follow LE to the public (and random) addresses. Nothing!

I suspect your advice is in the right direction - i.e. there is something very small that I haven't set that is the problem.

Once again. Thanks for your reply.

Regards

Raj