Ask Your Question

Filtering BLE source hides all results

asked 2022-09-06 21:10:58 +0000


My nRF52840 finds many BLE devices nearby (humble brag, I know) on macOS 12.5.1 in Wireshark v3.6.7-0-g4a304d7ec222.


How can I filter the frames to show just one device? I assume there is specific syntax for nordic_ble.* in the filter bar, but what it is not obvious and GUI options fail. (See below.)

Problematic Attempts

(A) I right click a target frame's source cell and tap "Apply as Filter -> Selected". Results disappear and never flow back in, but the bookmark icon bar is now green and reads:

eth.src == c5:ac:16:b8:78:ce

(B) I repeat the above, but select "Prepare as Filter" instead. I edit "eth" t\oh "nordic_ble", but the filter turns red and nothing happens. Various auto-completes in the bar after "nordic_ble.*" also don't work, not does using variations of the device in the nRF toolbar ("dev/cu.usbmodem1401-3.6")

nordic_ble.* == c5:ac:16:b8:78:ce

(C) I right click a target frame's delta time cell, tap "Apply as Filter -> Selected". Results filter as expected, although it's not terribly useful. The filter bar shows:

nordic_ble.delta_time == 194

(D) View -> Interface Toolbars -> nRF Sniffer for BLE reveals a toolbar. Selecting the target in the Device dropdown does nothing.

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2022-09-06 22:21:52 +0000

Chuckc gravatar image

(This can be recreated using the sample capture attached to 18267: Assertion due to incorrect mask for btatt.battery_power_state.*)

It is a shortcoming of how dissectors/packet-btle.c treats the btle addresses as type AT_ETHER which get a filter string of eth.src or eth.dst in epan/address_types.c.

The btle address fields are listed in the Display Filter Reference: Bluetooth Low Energy Link Layer.

Look in the Packet Details and select a field to filter on (such as btle.scanning_address or btle.advertising_address).

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools


Asked: 2022-09-06 21:10:58 +0000

Seen: 51 times

Last updated: Sep 06