nRF Sniffer for Bluetooth LE v4.1.x

Sniffing the pairing procedure of a connection

Use the nRF Sniffer for Bluetooth® to sniff an encrypted connection between paired devices by sniffing the pairing procedure.

Note: If the Development Kit (DK) or dongle running the nRF Sniffer firmware is reset, stored bond information is lost.
  1. Run the nRF Sniffer (if not already running).
  2. Select your device from the device list.
  3. Enter the credentials for pairing. The procedure depends on the type of encryption.
    • For connections that use legacy pairing with Just Works:
      1. Initiate pairing between the devices if it does not happen automatically.
      No further action is required.
    • For connections that use legacy pairing with a passkey:
      1. Initiate pairing between the devices if it does not happen automatically.
      2. Select Legacy Passkey as input key and type the 6-digit passkey that is displayed on either the Central or the Peripheral into the input field in Wireshark.
      3. Press Enter.
      4. Enter the passkey into the other device.
    • For connections that use legacy pairing with Out of Band (OOB):
      1. Before the devices initiate pairing, select Legacy OOB data as input key and type the OOB key in big-endian, hexadecimal format with a leading "0x" into the input field in Wireshark.
      2. Press Enter.
      3. Connect the Central to the Peripheral.
      4. Initiate pairing between the devices if it does not happen automatically.
    • For connections that use LE Secure Connections in debug mode:
      1. Enable Secure Connections debug mode on one or both of the devices.
      2. Initiate pairing between the devices if it does not happen automatically.
      In debug mode, the connection uses the debug keys specified in the Bluetooth Core Specification. The nRF Sniffer uses the same keys to decrypt the encrypted packets.
    • For connections that use LE Secure Connections with a private key:
      1. Before the devices initiate pairing, select SC Private Key as input key and type the 32-byte Diffie-Hellman private key of your device in big-endian, hexadecimal format with a leading "0x" into the input field in Wireshark.
      2. Initiate pairing between the devices if it does not happen automatically.