Do nRF bluetooth sniffers work with pyshark?

[damianjwilliams]

I'm thinking of getting a nRF sniffer an (Adafruit Bluefruit LE Friend) and use it to read streaming advertising packets from a peripheral device. It seems like pyshark/tshark did not work with with the board (at least a few years ago) e.g. Stack Overflow and Nordic Semiconductor Q &A. Is that still the case?

[KimiNewt]

I'm not familiar with it, but the easiest way to find out is just to try running tshark on it. If it runs, pyshark should too.

[damianjwilliams]

Hi,

Here you go:

capture = pyshark.LiveCapture(interface="COM14-3.6",debug=True)
capture.sniff(timeout=20)
2022-06-09 10:00:11,334 - LiveCapture - DEBUG - Creating Dumpcap subprocess with parameters: C:/Program Files/Wireshark/dumpcap.exe -q -i COM14-3.6 -w -
2022-06-09 10:00:11,343 - LiveCapture - DEBUG - Dumpcap subprocess (pid 16228) created
2022-06-09 10:00:11,344 - LiveCapture - DEBUG - Creating TShark subprocess with parameters: C:/Program Files/Wireshark/tshark.exe -l -n -T pdml -i -
2022-06-09 10:00:11,344 - LiveCapture - DEBUG - Executable: C:/Program Files/Wireshark/tshark.exe
2022-06-09 10:00:11,350 - LiveCapture - DEBUG - TShark subprocess (pid 5936) created
2022-06-09 10:00:11,350 - LiveCapture - DEBUG - Starting to go through packets
Capturing on 'COM14-3.6'
dumpcap: The capture session could not be initiated on capture device "COM14-3.6" (No such device exists).
Please check that you have the proper interface or pipe specified.
2022-06-09 10:00:18,685 - LiveCapture - DEBUG - Cleanup Subprocess (pid 16228)
2022-06-09 10:00:18,685 - LiveCapture - DEBUG - Cleanup Subprocess (pid 5936)

Looks like dumpcap is not recognizing the sniffer but tshark is.

To confirm this, when I run dumpcap from the command line I get a list of interfaces missing the the sniffer

C:\Program Files\Wireshark>dumpcap -D

5. \Device\NPF_{DF97E23C-D9D3-4196-92C4-159FE9F14F6B} (Wi-Fi)
6. \Device\NPF_{9ED7B0A0-17BF-4DAF-B27E-501EF1492897} (Local Area Connection* 3)
7. \Device\NPF_{5563DB7F-6508-4E85-A846-1CBFC93B1F19} (Local Area Connection* 2)
8. \Device\NPF_Loopback (Adapter for loopback traffic capture)

but when I run tshark, the sniffer is present

C:\Program Files\Wireshark>tshark -D

5. \Device\NPF_{DF97E23C-D9D3-4196-92C4-159FE9F14F6B} (Wi-Fi)
6. \Device\NPF_{9ED7B0A0-17BF-4DAF-B27E-501EF1492897} (Local Area Connection* 3)
7. \Device\NPF_{5563DB7F-6508-4E85-A846-1CBFC93B1F19} (Local Area Connection* 2)
8. \Device\NPF_Loopback (Adapter for loopback traffic capture)
9. COM14-3.6 (nRF Sniffer for Bluetooth LE COM14)
10. \\.\USBPcap1 (USBPcap1)

Does dumpcap need to be run in addition to tshark?

Thanks,

Damian

[KimiNewt]

Yes, for live captures dumpcap needs to run as well. It's really bizarre that not all the same interfaces are available. I assume you can see all of them in wireshark?

[damianjwilliams]

Yup, I can see all of the interfaces on Wireshark

[alereds94]

Hi all,
I am trying to automate wireshark sniffing with Python. I experience the same issues reported in this topic. The only way I've found up to now is to launch tshark from a subprocess in Python, save the output to file with -w and then use a pyshark.FileCapture for later analysis.
Is there any way to implement a pyshark.LiveCapture directly with the "nRF Sniffer for Bluetooth LE" interface? Thanks in advance

[DaveDixon]

Ther are things you can see in wireshark/tshark you can't see in pyshark, because pyshark relies heavily on dumpcap, and, to quote the documentation:

"Unlike Wireshark and tshark, dumpcap cannot see non-physical interfaces like extcap interfaces. tshark has most of the same flags that dumpcap has because tshark calls dumpcap for much of its capture functionality." (from https://tshark.dev/capture/dumpcap/)

Thus, I can see my nRF Sniffer in tshark (tshark -D), and I can list it in python using pyshark.tshark.tshark.get_tshark_interfaces(), but capture.debug() says "dumpcap: There is no device named ..."

So, but putting the nRF Sniffer code in the extcap folder for wireshark, you're telling wireshark and tshark about it, but dumpcap can't see it because it's not physical.