Running the nRF Sniffer for Bluetooth LE

To start sniffing, place the Development Kit (DK) or dongle that runs the nRF Sniffer for Bluetooth® LE firmware between the two devices that are communicating. Then open Wireshark and start recording packets.

Connect the DK or dongle to your computer and turn it on. Then place it between the Central and Peripheral device that you want to sniff.

Note: If you are using a DK with the nRF Universal Serial Bus (USB) connector available, it is recommended to use the nRF USB connector instead of the virtual COM port of the onboard interface MCU. This is because the virtual COM port cannot match the higher Bluetooth LE throughput of the nRF USB connector.

Figure 1. Hardware setup

Figure showing the hardware setup with a development kit placed between a Central and a Peripheral device

When you open Wireshark, the Wireshark capture screen is displayed. It includes the Wireshark interface for managing packets that are captured, the nRF Sniffer toolbar, and the hardware interfaces connected to the nRF Sniffer.

Note: If the nRF Sniffer toolbar is not visible, select View > Interface Toolbars > nRF Sniffer for Bluetooth LE.

To start sniffing, double-click on the hardware interface (nRF Sniffer for Bluetooth LE COM17 in the following figure).

Figure 2. Wireshark capture screen

Screenshot of the Wireshark capture screen

The following options are available from the capture screen in Wireshark:

RSSI filter: You can apply a Received Signal Strength Indication (RSSI) filter on the packets that are being received. Only packets that match the filter are displayed.
You must set the capture filter in the capture screen by using the keyword rssi. For example, the filter rssi >= -70 only captures packets that have an RSSI greater than or equal to -70 dBm.

Figure 3. RSSI filter

Interface options: Click the gear icon next to the interface to configure additional options for the nRF Sniffer for Bluetooth LE.
Figure 4. Interface options

The following options are available:

Only advertising packets: Sniff only the advertising packets of the given device. When a new connection is established, the nRF Sniffer ignores it.
Only legacy advertising packets: Sniff only the legacy advertising packets of the given device. The nRF Sniffer does not look for the advertiser's device address in extended advertising packets in the auxiliary advertising packets.
Find scan response data: Follow scan requests and scan responses when sniffing all advertising devices. This option is useful for finding the advertiser's name in the scan response data. You need an active scanner to generate the scan requests to follow.
Find auxiliary pointer data: Follow the auxiliary pointer for additional data when sniffing all advertising devices. This option is useful for finding the advertiser's address and name in the auxiliary advertising data.
Scan and follow devices on LE Coded PHY: Sniff on the LE Coded PHY when sniffing all advertising devices and a specific device. The nRF Sniffer follows the connection on any PHY it uses. To sniff on both LE 1M PHY and LE Coded PHY at the same time, use multiple sniffers.