nRF52840 Does Not Appear as a Wireshark Interface
Recent work has been heading towards Bluetooth software enhancement on the ESP32. The basic design of the system follows the classic server (central) and peripheral model. The ESP device is acting as a server with connections from peripheral devices such as sensors or event Bluetooth client applications such as LightBlue.
It would be really useful if as part of the debugging process we have some visibility of the Bluetooth traffic in the air. This will allow the diagnosis of software issues. There are two ways we can tackle this problem:
- Write our own client on a second ESP32
- Use commercially available software
The first of these will be cheaper initially but will require extra time to develop the software. The second option has a small initial outlay but allows us to build on the experience and expertise of others.
It is this second option that we will examine here.
BLE Sniffer
Nordic offer a range of development platforms for WiFi and Bluetooth. One of these platforms, the nrf52480, has the option for your own software development as well as some custom firmware allowing sniffing of BLE traffic.
Setting up the System
There are some really good instructions over on the Nordic web site discussing Setting up nRF Sniffer for Bluetooth LE. The nrf52480 dongle is installed as an interface for Wireshark. Wireshark then provides the user interface and the ability to decode the Bluetooth packets.
All was fine until section 3 of the guide where we find the following instructions:
3. Enable the nRF Sniffer capture tool in Wireshark. 3.1 Refresh the interfaces in Wireshark by selecting Capture > Refresh Interfaces or pressing F5. 3.2 Select View > Interface Toolbars > nRF Sniffer for Bluetooth LE to enable the nRF Sniffer interface.
The instruction at 3.2 no longer seems to be relevant as Wireshark displays the Interfaces panel when it starts. Time to search for the nRF Sniffer for Bluetooth LE in the list of installed interfaces.
No luck.
Troubleshooting
One of the prerequisite steps (section 1 of the document linked above) is to install the Python requirements with the command:
python3 -m pip install -r requirements.txt
This completed as expected and the command installed the required packages. So let’s run the shell script to check the hardware:
./nrf_sniffer_ble.sh --extcap-interfaces
The output from this script included a full
pyserial not found, please run: "/opt/homebrew/opt/python@3.13/bin/python3.13 -m pip install -r requirements.txt" and retry
Double checking with the python3 -m pip install -r requirements.txt command results in the following output:
Requirement already satisfied: pyserial>=3.5 in /Users/user-name/.pyenv/versions/3.12.0/lib/python3.12/site-packages
Looking at the output it appears that there is a conflict with the Python environments. The script is trying to use the homebrew version of Python but the command line is using a Python virtual environment.
Examining the script we find that the is special consideration for MacOS:
unamestr=`uname`
if [ "$unamestr" = 'Darwin' ]; then
hb_x86_py3="/usr/local/bin/python3"
hb_apple_silicon_py3="/opt/homebrew/bin/python3"
.
.
.
The remainder of the if statement makes some checks on the various versions of Python that could be installed on the system. In this case the script selects /opt/homebrew/opt/python@3.13/bin/python3.13. However, which python shows /Users/username/.pyenv/shims/python as the Python interpreter being used.
So this looks to be the problem, the script is using the incorrect version of Python. Editing the script and adding the line py3=python3 towards the end of the script and re-running the ./nrf_sniffer_ble.sh –extcap-interfaces command results in the following in the output:
extcap {version=4.1.1}{display=nRF Sniffer for Bluetooth LE}{help=https://www.nordicsemi.com/Software-and-Tools/Development-Tools/nRF-Sniffer-for-Bluetooth-LE}
control {number=0}{type=selector}{display=Device}{tooltip=Device list}
control {number=1}{type=selector}{display=Key}{tooltip=}
control {number=2}{type=string}{display=Value}{tooltip=6 digit passkey or 16 or 32 bytes encryption key in hexadecimal starting with '0x', big endian format.If the entered key is shorter than 16 or 32 bytes, it will be zero-padded in front'}{validation=\b^(([0-9]{6})|(0x[0-9a-fA-F]{1,64})|([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2}) (public|random))$\b}
.
.
.
This is looking more positive. Back to Wireshark and this time the interface is shown in the list of interfaces available.
Conclusion
This problem took a little tracing and appears to have occurred due to two issues:
- VIRTUAL_ENV was not set by the Python virtual environment being used
- Several different version of Python installed on the host system
The Python versions had been installed as pre-requisites for other packages installed by homebrew and as such could result in more issues if uninstalled.
Editing the Nordic script, while not ideal, was probably the most pragmatic solution to this issue.
