Adafruit Bluefruit LE Sniffer (BLE 4.0) nRF51822 & Wireshark

[yenhui]

I am using the Adafruit Bluefruit LE Sniffer (nRF51822), and I have gone through all of the steps in the step by step instructions at this Adafruit page:

https://learn.adafruit.com/introducing- ... nd-python3

I am at the part titled "Final Check and Test Capture". I have plugged my Sniffer into a USB port on my Windows 11 laptop computer, and I have opened Wireshark, but I do not see the "nRF Sniffer for Bluetooth LE:/dev/ttyUSB0-3.2" as shown in the Wireshark image at the above link. I do see the following items:

Local Area Connection* 10
Local Area Connection* 9
Local Area Connection* 8
Bluetooth Network Connection
Wi-Fi
Local Area Connection* 2
Local Area Connection* 1
Adapter for loopback traffic capture
Ethernet

Only 2 of the above items (Wi-Fi and Adapter for loopback traffic capture) are displaying activity (squiggly lines to the left of those 2).

I went to C:\Program Files\Wireshark\extcap in my Windows 11 laptop computer to make sure that the files from the extcap folder originally downloaded from the nrf_sniffer_for_bluetooth_le_4.1.0.zip at the Nordic page:

https://www.nordicsemi.com/Products/Dev ... n#infotabs

had been copied to the extcap folder in the Wireshark location (C:\Program Files\Wireshark\extcap), and they were. I tried plugging the Sniffer into another USB port on my computer, but I still do not see the nRF Sniffer for Bluetooth LE:/dev/ttyUSB0-3.2 in the Wireshark "Capture" list. I still see the same items that I listed above. Any advice would be greatly appreciated. Thanks

[barley]

Hey, I'm also having this issue on windows 10. I feel confident that the extcap folder's plugin is working since I connected in a nordic nRF52840-Dongle and it was detected by wireshark. Is there any way to confirm the V2 firmware is ok?

[yenhui]

Your issue sounds somewhat different than mine since my Adafruit Bluefruit LE Sniffer (BLE 4.0) nRF51822 is not being detected by Wireshark. And I also operated a Bluetooth device around my sniffer while the sniffer was plugged into my laptop (which was using Wireshark at the same time), and Wireshark did not detect that Bluetooth device either.

[freddyboomboom]

/dev/ttyUSB0-3.2 is the path to the device in Linux.

It is probably "Adapter for loopback traffic capture", but not having the device I couldn't really tell you for sure.

[yenhui]

I apologize for my ignorance, but in response to the message from freddyboomboom, is your advice directed to me (yenhui) or to barley? If it is directed to me (yenhui), could you please elaborate more on what you mean? I do not really understand what you are saying. Again, I apologize for my ignorance, but I am rather new to this technology.

[freddyboomboom]

No worries. Clarifying questions are fine.

Yenhui, you say you are running Windows 11, yet you are expecting to see a device called "nRF Sniffer for Bluetooth LE:/dev/ttyUSB0-3.2" like shown in a few of the screenshots in the Learn Guide.

The portion of that that tells me it's a screenshot from Linux (or maybe Mac OS) is the "/dev/ttyUSB0-3.2" part. Linux (and some of the other Unix-like operating systems) refers to devices by file names in the /dev/ directory. The "tty" devices are "teletype" or devices that use some sort of serial (RS-232, RS-488, etc) connection like the original "teletype" machines that were used in the original Unix systems to connect to the computers. In modern Unix-like operating systems, they are still called "tty".

Windows (7/8/10/11/etc) does not refer to devices in the same fashion, and depending on what the driver tells Windows it could call it any number of things. For example, the driver's "inf" file could call it one thing for Windows 7 and a different thing for Windows 10.

If the driver's inf file doesn't have a section for Windows 11, it may load the Windows 10 section, or may not load at all. If it doesn't load the proper driver, Windows may decide to load a generic driver that it thinks will work, or may not load a driver at all.

You should go into Device Manager to check what Windows is calling it. Then you can select it in Wireshark.

[yenhui]

A friend (who is much more proficient with this technology than I) was able to fix my problem. Unknown to me, it turns out that I had 2 versions of Python installed on my Windows 11 laptop computer. Once he uninstalled the older version of Python, Wireshark then registered the presence of my sniffer, and it seems to work now as expected. Hopefully this may help someone else who encounters a similar problem.