Wireshark manufacturer data

[RichieJH]

I'm starting to use Wireshark a little more and sometimes it is not displaying all of a device's manufacturer data. For example on some devices it is not displaying the manufacturer company identifier nor the custom payload. I see this data using the Master Control Panel Android App, but not in the Wireshark representation of the advertisement payload. It makes me think I'm missing a setting or something in Wireshark.

Any ideas?

IMG_2211.png IMG_2212.png

[Hung Bui]

@Richie: Could you update a screenshot and maybe the sniffer trace file ?

[RichieJH]

Here are screen shots of both the Wireshark and MCP representation of the data (above in original question). It appears that Wireshark is not showing all of it.

[jon]

Have you tried running the sniffer while the Android App is scanning? I suspect you will see a SCAN_REQUEST packet from the phone, and a SCAN_RESPONSE from the device with the missing info. Since wireshark is just passively listening, it cannot request this additional info by itself.

[Hung Bui]

@RichieJH: I agree with what Jon said, as you can find the data size in the screenshot with Master Control Panel app is much bigger than the max size of an advertising packet which is 31 bytes. Most likely you included the Manufacturer data in the scan response packet.

[RichieJH]

Indeed. So it looks like nRF Connect/MCP take both the advertisement and the scan response and cojoin them as one "advertisement".