Running nRF Sniffer

This guide walks you through the steps to start capturing Bluetooth® LE packets using the nRF Sniffer with Wireshark.

Before you begin, make sure you completed the following tasks:

• Installed Wireshark and the nRF Util plugin.
• Prepared your hardware for nRF Sniffer.

Complete the following steps:

1. Open Wireshark.
   The Wireshark capture screen is displayed with the following components:

   • Capture packets - The main Wireshark interface for starting the packets capture.
   • nRF Sniffer toolbar - Provides controls specific to the nRF Sniffer for Bluetooth LE.
   • Hardware interfaces - Lists available capture tools, including nRF Sniffer ("nRF Sniffer for Bluetooth LE COM17" in the following image).

   

   Note

   If the nRF Sniffer toolbar is not visible, try the following options:

   • Select View > Interface Toolbars > nRF Sniffer for Bluetooth LE.
   • Check if you have correctly connected the hardware and that your sniffing device is powered on.

2. Optionally, configure the RSSI filter.
   You can apply a Received Signal Strength Indication (RSSI) filter on the packets that are being received. Only packets that match the filter are displayed.

   You must set the capture filter in the capture screen by using the keyword rssi. For example, the filter rssi >= -70 only captures packets that have an RSSI greater than or equal to -70 dBm.

   

3. Optionally, click the gear icon next to the interface to configure interface options.

   

   The following options are available:

   • Only advertising packets - Sniff only the advertising packets of the given device. When a new connection is established, the nRF Sniffer ignores it.
   • Only legacy advertising packets - Sniff only the legacy advertising packets of the given device. The nRF Sniffer does not look for the advertiser's device address in extended advertising packets in the auxiliary advertising packets.
   • Find scan response data - Follow scan requests and scan responses when sniffing all advertising devices. This option is useful for finding the advertiser's name in the scan response data. You need an active scanner to generate the scan requests to follow.
   • Find auxiliary pointer data - Follow the auxiliary pointer for additional data when sniffing all advertising devices. This option is useful for finding the advertiser's address and name in the auxiliary advertising data.
   • Scan and follow devices on LE Coded PHY - Sniff on the LE Coded PHY when sniffing all advertising devices and a specific device. The nRF Sniffer follows the connection on any PHY it uses. To sniff on both LE 1M PHY and LE Coded PHY at the same time, use multiple sniffers.

4. Start sniffing by double-clicking on the hardware interface name.
   The capture screen opens and begins displaying captured Bluetooth LE packets in real-time.