How to dissect BLE in UDP payload?
Dear community,
TLDR: I have raw BLE data as a payload of UDP datagrams and would like Wireshark to dissect them properly, without developing new dissector EDIT: Tried to fix the pictures not showing up.
Theme of my master's project is wireless sniffer for BLE and IEEE 802.15.4. I am basically trying to replicate Texas Instruments' Packet Sniffer 2. Using even the same hardware (CC2652RB). Captured BLE (Bluetooth Low Energy) frames are being sent as a payload of UDP messages to a PC running Wireshark, which should be able to dissect them.
TI Solution behaves like this:
If the picture does not show, hit this link
As you can see, in UDP payload, there are another auxiliary protocol headers (TI Radio Packet Info and TI BLE Packet Info) before the actual BLE Link Layer. Dissectors for these headers were installed during the installation of TI Packet Sniffer itself. However I do believe, that dissector for BLE LL is a part of default Wireshark installation.
My solution looks like this:
if the picture does not show, hit this link
Now here is my problem: Wireshark seems to "ignore" the BLE LL frames in UDP payload. And I would like to ask how to "make Wireshark" recognize them? Or how can I help Wireshark recognizing them? My advisor says, I should look into Wireshark Remote Capture field, however I am not sure if it is the right way, as I wasn't been able to find anything useful regarding this issue so far.
Thank You for any feedback!
Can you put the screenshots on a public fileshare (dropbox, onedrive, google) and update the question with links to them.
I tried my normal trick of replacing the image references with
<img src="..." />but for reasons unknown to me that doesn't work with these images even though they show up in a browser@grahamb & @Chuckc thanks for Your hints, I tried to edit the original post.
Are you open to Lua code that would call the existing dissector?
Can you share a capture file?
Yes, I think it might be within the rules of the project. Sample capture file is here (expires on Feb 16)