Hi, I'm quite a beginner to Wireshark and got problem using it, I searched the wiki page but seems no promising results. Hopefully I can get some help here. I am trying to analyze the network traffic between LG smart watch and Android phone, which all go through bluetooth channel. Now I have got the network traffic log file and I can view it by running > wireshark "LogFileName" Problem is how can I retrieve infomation by removing the bluetooth header and get the original network layer packet, because I can parse the IP layer packet but bluetooth packet is not what I want and what I understand. asked 21 Sep '15, 13:02  xl45 showing 5 of 6 show 1 more comments |
2 Answers:
it depends on the content you are interested in. If I look at the payload of large RFCOMM frames, I can see payload that's seems to be related to smart watch communication. So, first you probably need to develop a better understanding of what your are actually looking for, then you can either extract that information manually via the Wireshark GUI (RFCOMM frames), or by using tshark. If you are looking for TCP/IP commuincation between the devices, I don't think there is any in that capture file. Regards answered 22 Sep '15, 10:59  Kurt Knochner ♦ edited 22 Sep '15, 11:00 |
The RFCOMM service has UUID128: 5e8945b0-9525-11e3-a5e2-0800200c9a66 and name: WearableBt, so I hope it is Android Wear (I hear you can use androiddump in latest Wireshark to live-capturing). As I remember Wear require closed-sources application from Google on Android to make it works (this one: https://play.google.com/store/apps/details?id=com.google.android.wearable.app&hl=en ), so there is no any documentation about protocol used by Google to communicate with Wear (implies no easy support for that in Wireshark). If anyone found some documentation about it, please share with me. For now... Only Google know how to read Wear payload (over RFCOMM). I think I can see some structures, but it is (not!) reverse engineering. answered 24 Sep '15, 14:00  Michał Łabędzki |
Can you share the Wireshark "log" file? Otherwise it's hard to tell what's wrong with that capture file.
Sure, the log file can be accessed here: https://drive.google.com/file/d/0BxINm19KyB6raTZVZ2lpb2dzZnM/view?usp=sharing
@Kurt Knochner
actually bluetooth just remove the ethernet header and add its own header with the remaining payload unchanged. but still i have no idea how to do the extraction.
no one knows?
I don't see any IP traffic "encapsulated in Bluetooth" in that capture file.
Why do you think this is an IP communication?
thanks for answering, well actually i may misunderstand this by thinking that bluetooth just remove ethernet header upon the regular TCP/IP packet and add its own header. but still i have no idea what to do if i want to retrieve data from the packet. @Kurt Knochner