Decrypting encrypted connection packets

By default, the sniff subcommand captures encrypted connection packets without decrypting them. To decrypt data event packets in a connection, provide the appropriate key with one of the following options.

Option	Key length	Required format	When to use
`--diffie-hellman-key`	32 bytes	64 hexadecimal digits	To be used when the connection uses LE Secure Connections pairing and you need to derive the Secure Connections Long Term Key (SC LTK) during pairing. Provide this before the pairing starts.
`--sc-ltk-key`	16 bytes	32 hexadecimal digits	To be used when the devices are already bonded using LE Secure Connections and you have the SC LTK.
`--legacy-ltk-key`	16 bytes	32 hexadecimal digits	To be used when the devices are already bonded using legacy pairing and you have the legacy LTK.

You must use one of these key options together with --follow, --follow-by-name, or --irk-key. Provide each key in big-endian hexadecimal format with a 0x prefix. The decoded value must be exactly the required length.

Note

These options behave like the input keys in the nRF Sniffer for Bluetooth LE plugin for Wireshark. See nRF Sniffer toolbar controls for more background on when each key is required.

In Wireshark, a key with an incorrect length is logged as an error but capture continues. From the command line, an incorrect key length causes sniff to exit with an error.

For example:

If your peripheral firmware logs the SC LTK at bonding time (for example, with CONFIG_BT_LOG_SNIFFER_INFO=y in the nRF Connect SDK or Zephyr), read the key from the device serial terminal after bonding completes. Then start sniffing with --follow and --sc-ltk-key:
```
nrfutil ble-sniffer sniff --port <serial_port> --follow <BD_address> --sc-ltk-key 0x<LTK_KEY>
```
To decrypt during pairing instead of using a pre-existing bond, provide --diffie-hellman-key before the devices start pairing:
```
nrfutil ble-sniffer sniff --port <serial_port> --follow <BD_address> --diffie-hellman-key 0x<DH_PRIVATE_KEY>
```

For a legacy bonded connection:

nrfutil ble-sniffer sniff --port <serial_port> --follow <BD_address> --legacy-ltk-key 0x<LEGACY_LTK>