Btle Sniffer Tutorial for Beginners

A btle sniffer is a tool used to scan and analyze Bluetooth Low Energy (BLE) signals.

BLE signals are transmitted by devices such as fitness trackers, smart home appliances, and medical devices.

To use a btle sniffer, you'll need a device that can capture and decode BLE packets, such as a Raspberry Pi or a dedicated BLE sniffer device.

First, make sure your device is properly configured to capture BLE packets, as described in the "Configuring Your Device" section.

You might enjoy: Why Is Bluetooth Not Finding Devices Android

To set up your environment for a BLE sniffer solution, you'll need a few essential components. You can use any Nordic Semiconductor nRF52 series development kit as an alternative to the nRF52840 USB Dongle, but the nRF51 series development kit or USB dongle is not recommended due to compatibility issues with the latest Bluetooth features.

First, you'll need to download the nRF Sniffer software package, the nRF Connect for Desktop application, and the SEGGER J-Link Software package. These packages can be found on Nordic's dedicated Infocenter page or in the nRF Sniffer User Guide.

On a similar theme: Bluetooth File Transfer Software for Android

Next, you'll need to flash the nRF52840 USB Dongle with the BLE sniffer firmware hex file via the Programmer app within the nRF Connect for desktop application. This step is crucial for setting up the sniffer.

To analyze the data, you'll need to download and install Wireshark, as well as copy the nRF Sniffer software to the appropriate Wireshark folder. You can also copy the nRF Sniffer Wireshark Profile to the appropriate Wireshark folder, but this is optional.

Here's a summary of the requirements:

The solution works on all major operating systems: Windows, macOS, and Linux. Make sure to check Wireshark prerequisites for version compatibility.

Using a sniffer can be a game-changer when it comes to troubleshooting bugs and optimizing performance in Bluetooth Low Energy products.

You can use a sniffer to capture and analyze Bluetooth Low Energy advertising packets, which is a great place to start since all BLE devices start in the advertising state.

Take a look at this: Bluetooth Low Energy Beacon

By becoming proficient at BLE sniffing techniques, you can troubleshoot bugs more efficiently and optimize performance by adjusting the settings of your Bluetooth Low Energy product accordingly.

To start sniffing BLE data, you'll need a tool like Wireshark, and you can click the green button to start capturing packets.

Wireshark shows a lot of data from nearby BLE devices, which can be overwhelming, but you can use display filters to clean this up later in the tutorial.

The btle_rx usage provides detailed settings for capturing packets, including channel number, Rx gain, LNA gain, access address, and verbose mode.

You should tune the gain carefully to ensure the best performance under your circumstances, as high gain can cause severe distortion.

The frequency override setting allows you to work on frequencies other than BTLE, making it a more general-purpose tool.

You can store packets to a pcap file and use a mask to take specific bits into account when detecting packets.

The tutorial will focus on capturing and analyzing Bluetooth Low Energy advertising packets using the combination of the nRF52840 USB Dongle, nRF Sniffer software tool, and Wireshark.

To identify a BLE device, you can use its Bluetooth Address, Manufacturer Specific Data Company ID, or Device Name.

The Bluetooth Address is usually fixed for non-smartphone devices, making it a reliable parameter.

A BLE dongle can work as an observer, like a sniffer, and receive Advertisement packets from devices.

You can view these packets using the CySmart API, which is provided by Cypress for their BLE dongle.

The CySmart USB Dongle can be used to sniff packets of an unencrypted BLE connection between a peripheral and a central with an established connection.

Here are the ways to identify a BLE device:

Becoming proficient at BLE sniffing techniques can help you troubleshoot bugs more efficiently and optimize performance by adjusting the settings of your Bluetooth Low Energy product accordingly.

It's worth noting that reading and interpreting raw packet data gives you greater insight into how BLE works.

Capturing and analyzing Bluetooth Low Energy advertising packets is a great place to start, as all BLE devices start in the advertising state.

Using the right tools, like the nRF52840 USB Dongle, nRF Sniffer software tool, and Wireshark, can make a big difference in your BLE sniffing journey.

Reading theory, specifications, and even developing applications can take much longer than learning how to read and interpret raw packet data.

Adding columns to your capture can make finding devices a breeze. One way to do this is by adding columns displaying relevant fields in the packets.

To add a column, look for a BLE device with the desired field in its advertising packet, right-click on the specific field, and click "Apply as Column". This will display the field as a new column in the packet capture view.

Some useful columns to add are the Manufacturer-Specific Data Company ID, which can be found in the Bluetooth LE Link Layer, and the Tx Address Type, also located in the Bluetooth LE Link Layer.

Here are some other columns you might find useful:

Adding display columns to your Wireshark capture can make a huge difference in finding and identifying BLE devices.

One way to do this is by adding columns displaying the relevant fields in the packets. You can right-click on a specific field in a BLE device's advertising packet and click "Apply as Column".

This will add the Device Name field as a column, making it easier to locate and identify devices with a Device Name.

Other useful columns to add include Manufacturer-Specific Data Company ID, which is located in the Bluetooth LE Link Layer, and Tx Address Type, also found in the Bluetooth LE Link Layer.

You can also add Packet Time – start to end, which is a useful column located in the nRF Sniffer for Bluetooth LE.

Here are some specific columns you can add to make your packet capture view more informative:

Applying Wireshark Display Filters is a powerful way to focus on the data that matters. You can use these filters to exclude non-relevant BLE devices and concentrate on the ones you're interested in.

The format of a Wireshark Display Filter is [protocol layer].[filter] [operand] [value]. For example, nordic_ble.rssi >= value can be used to filter out devices with an RSSI below a certain threshold.

Worth a look: What Is Nearby Devices Permission in Android

You can apply a Display Filter by finding a packet broadcast by the device you're interested in, selecting the field of interest, right-clicking it, and then clicking "Apply as Filter –> Selected."

Wireshark Display Filters can be added to the filter field, where you'll need to know the exact format and filter syntax. The good news is that Wireshark will auto-complete and suggest filters based on the letters you type.

You can add multiple Display Filters and apply them, but it's often easier to do so via the Filters entry field. This is because the right-click/UI method will override any applied Display Filters.

Here are a few examples of useful Display Filters that apply specifically to BLE advertising packets:

Wireshark Display Filters are not to be confused with Wireshark Capture Filters, which are set before beginning a capture and cannot be modified during the capture.

Hardware and software requirements for a BLE sniffer are crucial for capturing and analyzing Bluetooth Low Energy packets. You can use a BLE dongle as a sniffer, and TI and Nordic both have this capability.

To set up a BLE sniffer, you'll need to download and install the nRF Sniffer software package, which includes the nRF Connect for Desktop application and the SEGGER J-Link Software package. Additionally, you'll need to flash the nRF52840 USB Dongle with the BLE sniffer firmware hex file via the Programmer app within the nRF Connect for desktop application.

Here are the necessary software packages to download:

If you're using a Cypress BLE dongle, you can use the CySmart API to view the Advertisement packets received by the dongle, and Cypress provides libraries to build your own app to obtain the data sniffed by the dongle.

To enable the nRF Sniffer Interface toolbar in Wireshark, navigate to the following menu: Once you have it enabled, you will see it at the top of the window right below the generic Wireshark toolbar.

The toolbar provides a few useful options, including selecting the interface, which can be helpful when you have multiple nRF52840 USB dongles attached. This is especially useful if you're working with multiple devices at once.

Readers also liked: Connect Multiple Bluetooth Speakers Android

To select a specific device, you can use the Bluetooth address or an IRK (which a bonded BLE device uses to resolve a previously bonded BLE device's random Bluetooth address).

You can also use the nRF Sniffer Interface toolbar to select a key (type and value), which applies during a connection and allows you to decrypt encrypted data being exchanged between two paired or bonded BLE devices. This is primarily related to pairing and bonding.

The default mode for the nRF Sniffer is scanning all three primary advertising channels (37, 38, and 39), but you can modify that within the nRF Sniffer Interface Toolbar.

To set up your BLE sniffer, you'll need a specific board. The Adafruit nRF52840 board is a popular choice, and you can use it as sniffer hardware with the right firmware.

First, you need to flash the sniffer firmware on your board. You can download the Sniffer UF2 firmware file by clicking a link.

Once you've downloaded the file, double-click the Reset button on your board to start the process. If the NeoPixel RGB LED turns green, you're on the right track. If it turns red, check your USB cable and try a different port.

Note that if you're using an nRF52840 USB Key with TinyUF2, you'll need to hold the button while plugging it into your PC.

After flashing the firmware, you'll see a new BOOT disk drive appear. Drag the sniffer_nrf52840dongle_4.1.0.uf2 file to this drive.

A BLE dongle can work as an observer, allowing you to view Advertisement packets received by the dongle using the CySmart API.

You can use a BLE dongle as a sniffer to capture data from nearby devices, but it's essential to note that it communicates unidirectional, meaning it doesn't establish connections.

Cypress provides libraries to build your own app to obtain the data sniffed by the dongle, which are available with the CY8CKIT-042-BLE Package on their website.

The CySmart USB Dongle can be used to sniff packets of an unencrypted BLE connection, allowing you to access the packets that flow between a peripheral and a central with an established connection.

TI and Nordic also offer BLE dongle sniffers, but it's unclear if Cypress has a similar product available.

The technical details of our BTLE sniffer board are worth noting.

Datasheets, drivers, and EagleCAD files are available for download from the tutorial page.

The board may come with a different regulator than AP2112K due to parts shortages, but it can still provide at least 150mA.

We've updated the board to use CP2102N instead of CP2104 as the CP2014 has been discontinued and replaced with CP2102n.

This USB-to-Serial chip is the same functionality and driver.

The board has gone through several updates, including the change from CP2104 to CP2102n and the removal of the SWD connector.

Here's a brief summary of the updates:

The firmware has also been improved, with Firmware V2 providing better Wireshark-streaming sniffer software.

The btle sniffer is a powerful tool with some amazing features. One of the standout features is that the PHY and upper layer are implemented in software, specifically in the C language, giving it full software defined radio flexibility.

This flexibility allows for a lot of customization and adaptability. The BLE standard 1Mbps GFSK PHY is also supported.

The sniffer is capable of parsing and tracking channel hopping patterns automatically, not limited to broadcasting channels or fixed channels. This makes it a valuable tool for analyzing and understanding complex Bluetooth Low Energy (BLE) networks.

Here are some key features of the btle sniffer: