So let’s take a look at what that means and what can be done about it. For the Wireshark enhancement to be considered, do you have to have sniffer traces from me, or is there another option for this enhancement to be considered? It will take a while for me to get a working setup and perform some encrypted OTA sniffs.Every once in a while there is some news about Wireshark being vulnerable to being attacked/exploited/pwned, meaning that there is a way to craft frames/packets in a pcap/pcapng file to make Wireshark crash and (if done right) execute malicious code. Like I said, giving wireshark the link key or have one device in SSP debug mode, enabling wireshark to decrypt all of the useful profile data.Īt the present time, I want an ubertooth but don't have one. This would be a really powerful enhancement, if wireshark could decrypt pcap files generated from open source sniffers like ubertooth. Out of interest, do you know of any sniffers/plug-ins that have decrypting capabilities? One's that are affordable and not from Frontline/Ellysis? If you have dump files from a host stack (libpcap, hcidump etc), as that is already decrypted, Wireshark can abstract the relevant protocol data.įor me, the greatest use of sniffer traces are from over the air or promiscuous sniffing. Thanks for your reply, this has clarified things greatly. If you have a logs from air sniffer - if sniffer does not decrypt it, then Wireshark does not help you (right now) and you will see 'some bytes'. Summary: If you have Bluetooth USB dongle and capturing from local host interfaces (or USB), then encryption is not a problem (decrypted by controller or host)

As I remember Ubertooth do not decrypt payload right now. However, in most cases Bluetooth sniffer also decrypting payload so maybe there is nothing to do.

Wireshark use libpcap or androiddump to capturing from Bluetooth interfaces what are in real implemented on host side (after processing by controller ), so payload is decrypted in all cases (and often saved in BTSNOOP format).īut if you have logs from Bluetooth sniffer (from the air), then answer is: there is no decrypting on Wireshark side (but if you need that feature you can fill the bug/enhancement on Wireshark Bugzilla, upload two or more capture files and information needed to decryption, then it will be implemented).

Wireshark pcap problem