Ask Your Question

Revision history [back]

Filtering BLE source hides all results

Context

My nRF52840 finds many BLE devices nearby (humble brag, I know) on macOS 12.5.1 in Wireshark v3.6.7-0-g4a304d7ec222.

Question

How can I filter the frames to show just one device? I assume there is specific syntax for nordic_ble.* in the filter bar, but what it is not obvious and GUI options fail. (See below.)

Problematic Attempts

(A) I right click a target frame's source cell and tap "Apply as Filter -> Selected". Results disappear and never flow back in, but the bookmark icon bar is now green and reads:

eth.src == c5:ac:16:b8:78:ce

(B) I repeat the above, but select "Prepare as Filter" instead. I edit "eth" t\oh "nordic_ble", but the filter turns red and nothing happens. Various auto-completes in the bar after "nordic_ble.*" also don't work, not does using variations of the device in the nRF toolbar ("dev/cu.usbmodem1401-3.6")

nordic_ble.* == c5:ac:16:b8:78:ce

(C) I right click a target frame's delta time cell, tap "Apply as Filter -> Selected". Results filter as expected, although it's not terribly useful. The filter bar shows:

nordic_ble.delta_time == 194

(D) View -> Interface Toolbars -> nRF Sniffer for BLE reveals a toolbar. Selecting the target in the Device dropdown does nothing.