nRF Sniffer for Bluetooth LE v4.1.0

Inspecting captured data

All Bluetooth® Low Energy packets detected by the Sniffer for Bluetooth LE are passed to Wireshark, where they are wrapped in a header containing useful meta-information not present in the Bluetooth Low Energy packet itself. Wireshark dissects the packets and separates the actual packet from the meta-information.

When you browse captured packets, select a packet in the packet list to show the breakdown of that packet in the packet details pane. The bytes of the packet are shown in the packet bytes pane. Click a value in the details to highlight it among the bytes, or click on the bytes to highlight it in the details.
Figure 1. Wireshark interface
Screenshot showing the different parts of the Wireshark interface

To view the display filter for any field, click a value in the packet details pane. The display filter is shown in the bottom left corner.

Figure 2. Wireshark display filter
Wireshark display filter

Use display filters to display a chosen packet subset. Most filters are based on the values of the packets, such as length or access address. The filter expressions use Boolean operators (&& || == != !). To construct a filter, click Expression in the filtering bar. See the following table for some examples.

Table 1. Display filtering
Display filter Description
btle.length != 0 Filter that displays only packets where the length field of the Bluetooth Low Energy packet is not zero, meaning it hides empty data packets.
btle.advertising_address Filter that displays only packets that have an advertising address (advertising packets).
btle Protocol filter that displays all Bluetooth Low Energy packets.
btatt, btsmp, btl2cap Protocol filters for ATT, SMP, and L2CAP packets, respectively.
nordic_ble.channel < 37 Filter that displays only packets received on the data channels.

The following tips can help when inspecting your data:

See the documentation on the Wireshark website for more information.