Wireshark plugin to decipher BLE Attribute protocol messages

[Arun]

I am using Bluefruit BLE sniffer based on nRF51822 chip. Now Wireshark seems to decode most of the messages but not those where the actual information is being transmitted. I could see BLE service and characteristics discovery procedure where UDID's are mapped to the handle IDs. For subsequent message communication the handle IDs are used i.e. for writing, reading and notification of characteristics from the server to the client.

The wireshark is not able to decode these messages. For example Heart rate changes at server are notified to client using Attribute protocol Handle Value Notification message. Wireshark could decode the opcode of this message but other fields it shows as Handle and Value. It would have been nice to know the logical value of the Handle i.e. Heart Rate Measurement and sub-fields corresponding to Value i.e. Flags, Heart Rate value and so on as captured on the following link.

developer.bluetooth.org/.../CharacteristicViewer.aspx

Is there any wireshark plugin available which can help to decode the messages at a deeper level?

[RK]

No there currently isn't - nor is there one which chains together prepared writes and commits and shows the net of what's set.

But it's all open source if you want to add them ...

[Michal Labedzki]

The wireshark is not able to decode these messages.

Now it is. You can wait for stable Wireshark 2.0 or try use development Wireshark just now.

code.wireshark.org/.../gitweb

Please note that current "master" branch of Wireshark (aka Wireshark 2.1) already contains bunch of fixes/improvements on GATT decoding level.

Code is quite new so you can expect some bugs like incorrect decoding of some attributes.