Bluetooth Low Energy Fundamentals

Feedback
Feedback

If you are having issues with the exercises, please create a ticket on DevZone: devzone.nordicsemi.com
Click or drag files to this area to upload. You can upload up to 2 files.
RegisterLog in

Sniffing Bluetooth LE packets

A Bluetooth sniffer is a tool used to intercept the Bluetooth LE packets as they are transmitted, ie. “sniff” the packets, and view them in real-time. This not only provides an overview of what happens over the air but also offers you a better understanding of the protocol. It gives you very detailed information about each and every packet exchanged between two Bluetooth LE devices in near real-time, even when the connection is encrypted.

It’s also an excellent tool to capture and provide the sniffer trace to our Technical Support team so that they can quickly inspect your data without having to reproduce the whole setup on their side. This can significantly speed up the investigation and troubleshooting process.

nRF Sniffer for Bluetooth LE

Nordic provides a simple-to-use and easy-to-set-up Bluetooth LE Sniffer called the nRF Sniffer for Bluetooth LE. nRF Sniffer works by running in Bluetooth LE hardware placed in radio range of the Bluetooth LE communication you would like to debug. Therefore, it requires an extra nRF52 development kit or dongle to use as the hardware for the sniffer.

Bluetooth LE sniffer

nRF Sniffer was initially built in the spare time of our engineers when they were developing Bluetooth LE applications. The aim was to have an alternative to the rather expensive professional Bluetooth LE sniffer equipment to test and verify our own Bluetooth LE stack. And it quickly proved to be an imperative tool, not only for us but also for our customers. Anyone with a spare nRF52 development kit can use it as a sniffer for debugging.

How does nRF Sniffer work?

The sniffer works by using the radio hardware on the Nordic SoC running Nordic proprietary firmware that utilizes said radio to observe and analyze Bluetooth LE packets between other devices. The firmware does not use the Bluetooth stack we have been using in this course, but a stack that was written in bare metal (i.e without an operating system). This gives the sniffer more flexibility and control over how we can utilize the radio to capture Bluetooth LE packets.

Since the Nordic chips only have one antenna, the sniffer can only observe a single RF channel at a time. As we have covered, Bluetooth LE advertising transmits advertisement packets on three channels, channel 37, 38 and 39. This is solved by utilizing the advertising pattern. So the majority of the time, the sniffer will scan in the first channel in the pattern, say channel 37. When it captures a packet in channel 37, it will automatically switch to scanning channel 38 until it has captured another packet, and then switch to channel 39.

What about connection-oriented communication where up to 37 channels can be used ? Luckily, the channel hopping when in connection can be easily tracked by looking at the connection request and the channel map update. nRF Sniffer will automatically detect that and follow the channel hopping of the connection.

Because of the limitations on the SoC (with only one radio and one antenna) it is not possible to follow more than one connection at a time. For example, if you are following the connection from an advertising device, you will not be able to capture advertising packets from other devices.

Make sure to Log in or Register to save your progress

Back
Next
Register an account
Already have an account? Log in
(All fields are required unless specified optional)

  • 8 or more characters
  • Upper and lower case letters
  • At least one number or special character

Forgot your password?
Enter the email associated with your account, and we will send you a link to reset your password.