Inspecting captured data

All Bluetooth® Low Energy packets detected by the Sniffer for Bluetooth LE are passed to Wireshark, where they are wrapped in a header containing useful meta-information not present in the Bluetooth Low Energy packet itself. Wireshark dissects the packets and separates the actual packet from the meta-information.

When you browse captured packets, select a packet in the packet list to show the breakdown of that packet in the packet details pane. The bytes of the packet are shown in the packet bytes pane. Click a value in the details to highlight it among the bytes, or click on the bytes to highlight it in the details.

To view the display filter for any field, click a value in the packet details pane. The display filter is shown in the bottom left corner.

Use display filters to display a chosen packet subset. Most filters are based on the values of the packets, such as length or access address. The filter expressions use Boolean operators (&&, ||, ==, !=, !). To construct a filter, click Expression in the filtering bar. See the following table for some examples.

Display filtering	Display filter Description
btle.length != 0	Filter that displays only packets where the length field of the Bluetooth Low Energy packet is not zero, meaning it hides empty data packets.
btle.advertising_address	Filter that displays only packets that have an advertising address (advertising packets).
btle	Protocol filter that displays all Bluetooth Low Energy packets.
btatt, btsmp, btl2cap	Protocol filters for ATT, SMP, and L2CAP packets, respectively.
nordic_ble.channel < 37	Filter that displays only packets received on the data channels.

The following tips can help when inspecting your data:

• Turn any field in the packet details pane into a column. To do so:

  1. Right-click the value in the packet details.
  2. Click Apply as Column.

  

• Apply a value as a filter to, for example, see only operations affecting a particular handle. To filter packets that have a specific value for some field:

  1. Right-click the value in the packet details.
  2. Click Apply as Filter.
  3. Click Selected.

• Save a set of captured packets to be able to look at them later. To do so:

  1. Click the Stop button to stop capturing packets.
  2. Click File > Save As to save all packets, or click File > Export Specified Packets to save a selection of packets.

• Clear the packet list and restart a capture by clicking the Restart button.

See the documentation on the Wireshark website for more information.