nRF Sniffer not capturing packets after connection

RE: nRF Sniffer not capturing packets after connection

Szwed — Thu, 01 Feb 2024 14:22:32 GMT

Hi, I'd like to report, that this problem still exists.

I've tested it and I have the same problem.

If I use nRF52840 Dongle as a sniffer and nRF52832-DK as "nRF Connect for Desktop" device. With this combination I can see ADV_IND, SCAN_REQ, SCAN_RSP and CONNECT_IND packets, but nothing more. In wireshark's combo box "Device" I can see options: all advertising devices, follow IRK, but that's all. If I try to connect using "nRF Connect for Desktop" tool, advertising ADV_IND stops and CONNECT_IND packet is shown. If I disconnect, then advertising resumes.

What is funny: If I switch the devices, so DK kit is a sniffer and a dongle is used to connect, then I can see all connection packets (GAP, GATT, empty PDU...). Wireshark's combo box contains more options as just 2 I've listed above.

All software and firmware is up to date, freshly installed today. Running on Win 10.

RE: nRF Sniffer not capturing packets after connection

Menon — Thu, 02 Mar 2023 10:19:29 GMT

Hello,

Yes, ChmodBPF need to be installed for capturing packets by Wireshark in macOS. I am wondering why this only happened after establishing the connection.

Anyhow Glad to hear that it resolved your issue.

Kind Regards,

Abhijith

RE: nRF Sniffer not capturing packets after connection

denis — Thu, 02 Mar 2023 01:59:58 GMT

It started working. Not totally sure why. But I did install ChmodBPF. From what it said, I assumed that was only needed to capture packets in the OS. But maybe that is needed for the BLE sniffer also?

RE: nRF Sniffer not capturing packets after connection

denis — Wed, 01 Mar 2023 23:17:54 GMT

Correct, I can see advertising packets after filtering. But when I connect I just see a single CONNECT_IND in wire shark and that's it.

I believe I followed everything in the nRF sniffers documentation.

This is the /tmp/logs/log.txt output:

01-Mar-2023 17:04:43 (-0600) INFO: Software version: 4.1.1

01-Mar-2023 17:04:43 (-0600) INFO: sniffer started

01-Mar-2023 17:04:43 (-0600) INFO: starting scan

01-Mar-2023 17:04:43 (-0600) INFO: Scan flags: 0b11

01-Mar-2023 17:04:43 (-0600) INFO: Sent TK to sniffer: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]

01-Mar-2023 17:04:43 (-0600) INFO: scanning started

01-Mar-2023 17:04:43 (-0600) INFO: defaults written

01-Mar-2023 17:04:43 (-0600) INFO: control loop

01-Mar-2023 17:04:43 (-0600) INFO: Firmware version 4.1.1

01-Mar-2023 17:04:43 (-0600) INFO: Firmware timestamp 35287739 reference: Mar 01 2023 17:04:43.619431 CST

01-Mar-2023 17:09:55 (-0600) INFO: Clearing

01-Mar-2023 17:11:32 (-0600) INFO: follow_device: [b'225', b' 187', b' 34', b' 69', b' 21', b' 200', b' 1']

01-Mar-2023 17:11:32 (-0600) INFO: Sniffing device 14 - """"

01-Mar-2023 17:11:32 (-0600) INFO: Follow flags: 0b0

01-Mar-2023 17:11:33 (-0600) INFO: Following e1:bb:22:45:15:c8 random

RE: nRF Sniffer not capturing packets after connection

Menon — Wed, 01 Mar 2023 13:57:46 GMT

Hello,

AFAIK, there is nothing more to be done for capturing the packets. So you are able to see the advertising packets after device filtering (by choosing your device in Wireshark) but not able to see the packets after connection is established?

Did you follow everything mentioned in nRF sniffers section? Could you share sniffer_log for getting more idea on this?

Kind Regards,

Abhijith