filtering issue using wireshark and nRF52840 sniffer

[Thomas_Thomas]

Hello,

I'm using nRF52840 dongle as BLE sniffer and the plugin for wireshark.

capture example

if I want to filter one source : right clic, apply as a filter, selected, then this filter is created :

eth.src == 44:5c:e9:ab:a7:03

44:5c:e9:ab:a7:03 is the mac address of the Samsung device

why it is eth for ethernet where as I'm capturing BLE packets?

and then if I put bluetooth.src == 44:5c:e9:ab:a7:03, there is no packets displayed?

[Thomas_Thomas]

Hello,

I found the right filter for advertisement

btle.advertising_address == mac address, it is working fine

But I can't find the right filter for the other exchanges, pairing, data, here it is only for advertising.

Do you have a list of filter commands please? I'm looking for all exchanges based on one MAC, and it looks different from the standard one used with other devices with wireshark

[Hung Bui]

Hi Thomas, 
I would suggest you to go through Lesson 6 in our Bluetooth Academy here: https://academy.nordicsemi.com/lessons/lesson-6-bluetooth-le-sniffer/

It lesson 6 I explained how to use the sniffer to follow a connection. At exercise 2 Step 6 you can find how you can apply a filter. 

[Thomas_Thomas]

Hi Hung,

Thank you very much it is working, for my understanding, why it doesn't work with the filter?

Regards,

Thomas.

[Hung Bui]

Hi Thomas, 
I'm not so sure which filter you are asking about. 
But to be able for the sniffer to follow a connection, you would need to select the advertiser. It can only follow one advertiser/connection at a time, so you need to select the advertiser in advance.