Missing packages while sniffing with nRF52DK using SnifferAPI script on Raspberry PI4

RE: Missing packages while sniffing with nRF52DK using SnifferAPI script on Raspberry PI4

Marte Myrvold — Wed, 24 May 2023 07:02:52 GMT

Hi,

Are you doing anything differently when it captures packages after disconnect compared to when it does not?

When you are sniffing a connection in Wireshark and one of the devices disconnect, the sniffer will go back to following. In the Sniffer API there is a property for whether the device you are sniffing is in a connection or not, inConnection. You can use this to check the connection status of the device, and to go back to following if it is no longer connected.

Best regards,
Marte

RE: Missing packages while sniffing with nRF52DK using SnifferAPI script on Raspberry PI4

dzs — Fri, 12 May 2023 11:34:14 GMT

Hi,

Sorry, I am not sure if I expressed myself clearly in the previous answer. When I said disconnect, I meant to disconnect two communicating devices one from another, not disconnecting from the network.

However, I am not handling disconnecting two devices since sometimes it captures packages after disconnecting, but usually, it doesn't. So, I thought it's already been handled. Also, I tried it in Wireshark, and it worked okay.

Regards.

RE: Missing packages while sniffing with nRF52DK using SnifferAPI script on Raspberry PI4

Marte Myrvold — Fri, 12 May 2023 07:33:05 GMT

Hi,

What do you do when devices disconnect? Do you handle it in some way such that the sniffer can go back to capturing advertising packets?

Best regards,
Marte

RE: Missing packages while sniffing with nRF52DK using SnifferAPI script on Raspberry PI4

dzs — Thu, 11 May 2023 13:06:20 GMT

Hi,

Thank you for the answer. Now I am able to capture more packages, as well as connection and data packages, but it only works for the first connection between the nrf dongle and the device. It doesn't capture any package after disconnecting devices for the first time.

I have modified the nrf_sniffer_ble.py script based on the example_linux.py and handle_control_command function.

Do you have any idea what is happening there?

Regards.

RE: Missing packages while sniffing with nRF52DK using SnifferAPI script on Raspberry PI4

Marte Myrvold — Wed, 10 May 2023 13:32:28 GMT

Hi,

The nrf_sniffer_ble.py script is a Wireshark extcap wrapper. The script itself cannot follow a device. Instead, it expects a command from the Wireshark drop down menu, as you can see in handle_control_command():

def handle_control_command(sniffer, arg, typ, payload):
    """Handle command from control channel"""
    global last_used_key_type

    if arg == CTRL_ARG_DEVICE:
        if payload == b' ':
            scan_for_devices(sniffer)
        else:
            values = payload
            values = values.replace(b'[', b'')
            values = values.replace(b']', b'')
            device_address = values.split(b',')

            logging.info('follow_device: {}'.format(device_address))
            for i in range(6):
                device_address[i] = int(device_address[i])

            device_address[6] = 1 if device_address[6] == b' 1' else 0

            device = Devices.Device(address=device_address, name='""', RSSI=0)

            follow_device(sniffer, device)
            
...

If you want to use a script instead of Wireshark, then you need to write your own script and add following of a device there. I suggest taking a look at the 'Sniffer Api Guide.pdf' in the doc directory and the example scripts in the same directory.

Best regards,
Marte