This blog is to provide the procedure how to install the nRF Sniffer and run on the Window 10. Nordic provides the free to use Bluetooth LE sniffer and it can run with Nordic Development Board.
nRF Sniffer for Bluetooth LE
The nRF Sniffer for Bluetooth® LE is a useful tool for learning about and debugging Bluetooth Low Energy applications. It provides a near real-time display of Bluetooth packets that are sent between a selected Bluetooth Low Energy device and the device it is communicating with, even when the link is encrypted.
When developing a Bluetooth Low Energy product, knowing what happens over-the-air between devices can help you identify and fix issues quickly.
On startup, the Sniffer lists all nearby Bluetooth Low Energy devices that are advertising, providing the Bluetooth address and address type, complete or shortened name, and RSSI.
Supported devices
- nRF52 Development Kit (PCA10040)
- nRF52840 Development Kit (PCA10056)
- nRF52840 Dongle (PCA10059)
- nRF51 Development Kit (PCA10028)
- nRF51 Dongle (PCA10031)
Supported operating systems
- Windows 7 or later
- 64-bit OS X/macOS 10.6 or later
- Linux (check the Wireshark prerequisites for version compatibility)
Data Length Extension (DLE)
Data Length Update procedure and 2Mbit PHY (PCA10040 only, requires Wireshark version 2.4.6 or
newer) since version 2.0.0-beta-3 or later.
Release note of the nRF Sniffer (3.1.0)
This release adds support for the nRF52840 Dongle.
Removed features:
– Removed support for PCA10000 board.
– Removed support for PCA10001 board.
New features:
– Added support for nrf52840dongle_nrf52840 (PCA10059) board.
Changes:
– Renamed PCA10028 board to nrf51dk_nrf51422.
– Renamed PCA10031 board to nrf51dongle_nrf51422.
– Renamed PCA10040 board to nrf52dk_nrf52832.
– Renamed PCA10056 board to nrf52840dk_nrf52840.
Bug fixes:
– Fix unable to decrypt when re-encrypting a connection using LE secure connection LTK if one of the devices is
privacy-enabled and has cycled its resolvable private address.
In this blog, I will use the nRF52840 Dongle as the sniffer and run on the Windows 10 (64 bit).
https://infocenter.nordicsemi.com/topic/ug_sniffer_ble/UG/sniffer_ble/intro.html
https://infocenter.nordicsemi.com/pdf/nRF_Sniffer_BLE_UG_v3.2.pdf
Installing nRF Sniffer
Before you start setting up the nRF Sniffer, make sure that you have the following prerequisites installed on your computer:
- Wireshark v2.4.6 or later (v3.0.7 or later recommended on Windows). Wireshark is a free software tool that captures wireless traffic and reproduces it in a readable format.
- Python v3.6 or later
Installing the Wireshark
Select the windows installer for 64 bit version of wireshark
https://www.wireshark.org/download.html
After clicking the installer,
Download the nRF Sniffer package
You can get the zip package from the Nordic Web page.
After unzip the package folder, it has multiple sub-folder as below.
Program the Sniffer Hex on the nRF52840 Dongle
Open the nRF Connect Desktop and then select the Programmer
Select the target board and add the hex file
Click Write
After finish to program the sniffer hex,
Install the require Python module
Install the Python requirements:
a) Open a command window in the Sniffer_Software/extcap/ folder.
b) Type pip3 install -r requirements.txt to install the requirements.
c) Close the command window
Copy the Sniffer capture tool into Wireshark’s folder for external capture plugins:
Copy the contents of the Sniffer_Software/extcap/ folder into this folder
Make sure that the nRF Sniffer files can be run correctly:
Adding a Wireshark profile for nRF Sniffer
You can add a profile in Wireshark for displaying the data recorded by the nRF Sniffer for Bluetooth LE in a convenient way.
To add the nRF Sniffer profile in Wireshark, complete the following steps:
Go to Help > About Wireshark (on Windows or Linux) or Wireshark > About Wireshark (on macOS).
Copy the profile folder Sniffer_Software/Profile_nRF_Sniffer_Bluetooth_LE into the profiles subfolder of this folder.
In Wireshark, select Edit > Configuration Profiles.
Select Profile_nRF_Sniffer_Bluetooth_LE and click OK.
Running nRF Sniffer
To start sniffing, place the board or dongle that runs the nRF Sniffer for Bluetooth LE firmware between the two devices that are communicating. Then open Wireshark and start recording packets.
Connect the development board or dongle to your computer and turn it on. Then place it between the Central and Peripheral device that you want to sniff.
When you open Wireshark, the Wireshark capture screen is displayed. It includes the Wireshark interface for managing packets that are captured, the nRF Sniffer toolbar, and the hardware interfaces connected to the nRF Sniffer.
If the nRF Sniffer toolbar is not visible, select View > Interface Toolbars > nRF Sniffer for
Bluetooth LE.
In this case, I use the buttonless DFU firmware and put the device name inside the scan response.
All the details of the Sniffer options can be found inside the USER GUIDE of BLE Sniffer document.
Nordic has the Video on the BLE Sniffer (old version) that is running on the nRF51 DK board.
Thanks for your interests on my blog. Since 2019, I have created this blog and shared the idea how to do some funny stuffs. I am very pleasure that I get quite a lot of positive feedback. I really hope that this blog helps your own embedded solution development. May I get support from you to keep it in order to maintain the wordpress host service? Your appreciation would be very helpful.
https://jimmywongiot.com/2021/05/26/asking-for-support/
JimmyIoT 
Thank you!
LikeLike
perfectly documented
LikeLike
Thank you for sharing.
Can be used to debug ESB or Gazell protocol?
LikeLike
it is difference protocol. It can’t be used for ESB and Gazell sniffer.
LikeLike
I can’t capture any ATT packet, only “LE LL” packets are captured.
Do you have any ideas?
Thank you.
LikeLike
You need to capture from adv and connection ;otherwise the sniffer cant follow the hopping sequence.
LikeLike
I ran in the same problem: I see only LE LL packets, not ATT packets. What am i doing wrong?
LikeLike
Do you capture from beginning? Also , is it just work security level or other ?
LikeLike
first, are you using the passkey, just work or other methods for the connection. The sniffer should capture from the starting point.
if you use the passkey or other such as LE secure connection, it may need to use the pre-defined debug key for testing.
LikeLike
Hi, I’m using nRF52840 Dongle and follow all the step above: flashing hex, correct COM port shows up in python serial scanner and windows devices as “nRF Sniffer for BLE”, but wireshark (also extcap-interfaces command) not detecting the device. I digging up on the doc folder and run example file, playing around with baudrate, it also still not detected. Did I miss something? Is there anyways like “AT-OK command so I can check whether the device is responding?
LikeLike
Hi, I’m using nRF52840 Dongle and follow all the step above: flashing hex, correct COM port shows up in python serial scanner and windows devices as “nRF Sniffer for BLE”, but wireshark (also extcap-interfaces command) not detecting the device. I digging up on the doc folder and run example file, playing around with baudrate, it also still not detected. Did I miss something? Is there anyways like “AT-OK command so I can check whether the device is responding?
LikeLike
Hi,
you can run the nrf_sniffer_ble.bat –extcap-interfaces on the command line to check the log file.
LikeLike
Thanks for your article. I tried to do the same here and everything works, but… I can’t see any packages. The green indication LED is flickering on the board, but Wireshark just doesn’t show anything. The profile and the extcap is installed correctly.
What did you mean with “In this case, I use the buttonless DFU firmware and put the device name inside the scan response.”?
LikeLike
Thanks for this article. I tried to do the same, but it doesn’t work here – neither on Linux nor on macOS. The nRF52840 is flashed correctly and the green LED is flickering, but Wireshark does not show any packets – the profile is correctly installed – as is the extcap plugin.
Any idea what else could be missing? What did you mean by “In this case, I use the buttonless DFU firmware and put the device name inside the scan response.”?
LikeLike
You can try to use the pyserial to ping the dongle for double check first.
can you use the nRF Connect (programmer) to flash this hex on it?
LikeLike
I think I had this issue, running wireshark as admin solved it
LikeLike
Hello, i followed all the instructions here, but im not seeing anything apart from : ADV_NONCONN_IND from the dongle itself, i dont see any other traffic on bluetooth at all – what can be wrong?
LikeLike
Which python version do you use? you can run the pyserial with the sniffer dongle to check instead of wireshark directly.
LikeLike
Works! Thanks!
LikeLike
Hi, great tutorial.
Could you tell me please, what is this IDE that you used to open the code in the last screenshot?
LikeLike
it is wireshark.
LikeLike
Hi,
Im having trouble whats the best way to identify the devices it is capturing? I see the source MAC address but it does not match the Bluetooth MAC thats stated on my device.
LikeLike
thanks boss
LikeLike