Capturing and inspecting decrypted traffic

Asset Tracker Template
tags
Asset Tracker Template

The Cellular Monitor app handles the trace database selection and Wireshark hand-off for you:

  1. Connect the device over USB and open Cellular Monitor.
  2. Set Modem trace database to Autoselect, or to the modem firmware version programmed on the device.
  3. Select Open in Wireshark.
  4. Click Start and let the device connect to nRF Cloud.
  5. In Wireshark, expand a DTLS packet and look for the Decrypted TLS layer in the packet details pane. The decoded CoAP request or response and its CBOR payload are shown underneath.

You can also capture with nRF Util as described in UART Tracing and open the resulting .pcapng afterwards.

If the Decrypted TLS layer is missing, check the following:

  • The build actually used the developer security tag. Verify with rg NRF_CLOUD_COAP_SEC_TAG build/app/zephyr/.config.
  • The trace database matches the modem firmware on the device.
  • The trace covers the DTLS handshake. The keys are exported with the handshake, so a trace started mid-session cannot be decrypted. Reset the device with the capture running, either physically or by running kernel reboot in the shell.