Adafruit nRF52840 USB not detected as BLE sniffer in Wireshark

For CircuitPython issues, ask in the Adafruit CircuitPython forum.

Moderators: adafruit_support_bill, adafruit

Please be positive and constructive with your questions and comments.
Locked
User avatar
hc32ax
 
Posts: 3
Joined: Wed Mar 29, 2023 2:56 pm

Adafruit nRF52840 USB not detected as BLE sniffer in Wireshark

Post by hc32ax »

Hi,

I'm trying to get the Adafruit nRF52840 USB key (https://www.adafruit.com/product/5199) working in Wireshark in Windows 11, using the instructions at: https://learn.adafruit.com/ble-sniffer-with-nrf52840

However, the nRF Sniffer never appears in the Capture menu of Wireshark, even if I run Wireshark as administrator.

I confirmed that running the command "nrf_sniffer_ble.bat --extcap-interfaces" in the Wireshark extcap directory runs, but does not display the interface:
extcap {version=4.1.1}{display=nRF Sniffer for Bluetooth LE}{help=https://www.nordicsemi.com/Software-and ... uetooth-LE}
control {number=0}{type=selector}{display=Device}{tooltip=Device list}
control {number=1}{type=selector}{display=Key}{tooltip=}
control {number=2}{type=string}{display=Value}{tooltip=6 digit passkey or 16 or 32 bytes encryption key in hexadecimal starting with '0x', big endian format.If the entered key is shorter than 16 or 32 bytes, it will be zero-padded in front'}{validation=\b^(([0-9]{6})|(0x[0-9a-fA-F]{1,64})|([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2}) (public|random))$\b}
control {number=3}{type=string}{display=Adv Hop}{default=37,38,39}{tooltip=Advertising channel hop sequence. Change the order in which the sniffer switches advertising channels. Valid channels are 37, 38 and 39 separated by comma.}{validation=^\s*((37|38|39)\s*,\s*){0,2}(37|38|39){1}\s*$}{required=true}
control {number=7}{type=button}{display=Clear}{tooltop=Clear or remove device from Device list}
control {number=4}{type=button}{role=help}{display=Help}{tooltip=Access user guide (launches browser)}
control {number=5}{type=button}{role=restore}{display=Defaults}{tooltip=Resets the user interface and clears the log file}
control {number=6}{type=button}{role=logger}{display=Log}{tooltip=Log per interface}
value {control=0}{value= }{display=All advertising devices}{default=true}
value {control=0}{value=[00,00,00,00,00,00,0]}{display=Follow IRK}
value {control=1}{value=0}{display=Legacy Passkey}{default=true}
value {control=1}{value=1}{display=Legacy OOB data}
value {control=1}{value=2}{display=Legacy LTK}
value {control=1}{value=3}{display=SC LTK}
value {control=1}{value=4}{display=SC Private Key}
value {control=1}{value=5}{display=IRK}
value {control=1}{value=6}{display=Add LE address}
value {control=1}{value=7}{display=Follow LE address}

The Sniffer\Logs\log.txt file contains:
30-Mar-2023 09:55:48 (-0400) INFO: --------------------------------------------------------
30-Mar-2023 09:55:48 (-0400) INFO: Software version: 4.1.1
30-Mar-2023 09:55:48 (-0400) INFO: Started PID 16260
30-Mar-2023 09:55:48 (-0400) INFO: Namespace(capture=False, extcap_interfaces=True, extcap_interface=None, extcap_dlts=False, extcap_config=False, extcap_capture_filter=None, fifo=None, extcap_control_in=None, extcap_control_out=None, extcap_version=None, device='', baudrate=None, only_advertising=False, only_legacy_advertising=False, scan_follow_rsp=False, scan_follow_aux=False, coded=False)
30-Mar-2023 09:55:48 (-0400) INFO: Opening serial port COM3
30-Mar-2023 09:55:49 (-0400) INFO: closing UART
30-Mar-2023 09:55:49 (-0400) INFO: Opening serial port COM3
30-Mar-2023 09:55:49 (-0400) INFO: closing UART
30-Mar-2023 09:55:49 (-0400) INFO: Exiting PID 16260
And when I launch Wireshark, I get the same result in log.txt as above - so it does seem to be launching the extcap plugin ok.

Any suggestions?

User avatar
hc32ax
 
Posts: 3
Joined: Wed Mar 29, 2023 2:56 pm

Re: Adafruit nRF52840 USB not detected as BLE sniffer in Wireshark

Post by hc32ax »

Before my post above, I read a similar thread here: viewtopic.php?t=196157
-- which is in reference to the Adafruit Feather nRF52840, whereas I am using the nRF52840 USB key (link above).

Just to confirm: the Adafruit nRF52840 USB key comes ready-to-use, and does not need a FW update, correct?

And to answer some of the same questions in that other thread:
  • I did the Python3 & Wireshark setup as described.
  • I am running Win11 x64, and have tried this on two PC's with the same result.
  • The serial port (COM3) appears in Device Manager when I plug in the USB key.

User avatar
hc32ax
 
Posts: 3
Joined: Wed Mar 29, 2023 2:56 pm

Re: Adafruit nRF52840 USB not detected as BLE sniffer in Wireshark

Post by hc32ax »

I see I made a poor assumption:
Just to confirm: the Adafruit nRF52840 USB key comes ready-to-use, and does not need a FW update, correct?
Wrong! -- I had assumed the FW update (to sniffer_nrf52840dongle_4.1.0.uf2) was only needed for the Adafruit Feather nRF52840 Express, and not for the USB key.

I installed the FW update on my USB key. It works in Wireshark now!

Locked
Please be positive and constructive with your questions and comments.

Return to “Wireless: WiFi and Bluetooth”