• State Resolved
  • Locked Locked
  • Replies 8 replies
  • Answers 1 answer
  • Subscribers 54 subscribers
  • Views 1081 views
  • Users 0 members are here
Support feedback
Options
Options
Similar topics

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

SmartRF Packet Sniffer 2 (1.70) + LAUNCHXL-CC1352R1

alemv
Intellectual 410 points
Other Parts Discussed in Thread: LAUNCHXL-CC1352R1, CC2540, BLE-STACK, CC2650

I try to use Smart RF Sniffer 2 Agent 1.70 with the LAUNCHXL-CC1352R1 board to sniff the BLE connection. Unfortunately, the sniffer receives only the ADV_IND packets, then the CONNECT_REQ packet and that’s it, please see the attached screenshot and pcapng file.I tried the sniffer with another CC1352P1 module - the result is the same.

Smart RF Sniffer + CC2540 can sniff all the packets, please see the attached psd file.

What could be the problem? What am I doing wrong?

4478.logs.zip

  • 0
    TI__Guru* 76491 points

    Hi,

    1. Can you double check that you are using Wireshark version2.6.x?

    2. Can you go though the steps in the BLE-Stack user's guide and check that everything is k?

  • 0 in reply to Marie H
    Intellectual 410 points

    I have completed all the steps from the SmartRF Packet Sniffer 2 v1.7.0 User Guide. I flashed the firmware on LAUNCHXL-CC1352R1 with the revision of the E / 2.1 chip, installed Wireshark 2.6.13, copied the TI dissector plugins to the Wireshark plugins folder.


    I have tried all advertising channels (37, 38, 39) in the Selected Channels field, checked the "Connect to Initiator Address" checkbox and unchecked it, tried different initiator addresses (0x000000000000 and my devices). Nothing helped. All I got is the ADV_IND messages and one CONNECT_REQ message and that’s it. As soon as the connection is terminated ADV_IND packets appear again.

  • 0 in reply to alemv
    TI__Guru 56590 points

    Which SDK and which examples are you using?

    Can you try to invert the endianess on the initiator address?

  • 0 in reply to Eirik V
    Intellectual 410 points

    1. BLE Server - CC2650 SensorTag
    firmware from ble_examples2.2:
    spp_ble_server_cc2650lp_stack.hex + spp_ble_server_cc2650lp_app.hex

    BLE Client
    BTool + CC1352P1 custom board
    firmware from simplelink_cc13x2_26x2_sdk_3_10_00_53:
    ble5_host_test_cc13x2p1lp_app_FlashROM_Release.hex

    BLE sniffer
    Smart RF Sniffer 2 Agent 1.70 + LAUNCHXL-CC1352R1
    firmware:
    C:/Program Files (x86)/Texas Instruments/SmartRF Tools/SmartRF Packet Sniffer 2/sniffer_fw/bin/cc1352r1lp/sniffer_fw.hex

    2. I tried all the options:
    e9204a03ee04
    04ee034a20e9
    000000000000

    I even changed the CC1352P1 and CC1352R1 boards with roles - the result is the same.

  • 0
    TI__Expert 4470 points

    Hi,

    I had a look at the *.psd and *.pcapng files and it looks like the CONNECT_REQ packet has ChSel bit = 1, which means that the Advertiser supports channel selection algorithm 2. This is a BLE 5 feature. The SmartRF Packet Sniffer 2 does not support any BLE 5 features yet, and it does not try to follow any connection where the CONNECT_REQ has this bit set to 1. The old CC2540 sniffer does not support BLE 5 either, but it probably does not filter out the connection based on this bit as the SmartRF Packet Sniffer 2 does. The reason why this scenarion works with CC2540 might be because even though the initiator support CSA 2, CSA 1 is being used in the connection because the other node does not support CSA 2.

    It looks like the filtering criteria is a bit too strict in the SmartRF Packet Sniffer 2. I will note this and look at it for the next version. In case you want to modify the source code yourself, and build sniffer FW without this restriction in the meantime I can point you to the relevant place in the source code.

    Thanks,

    Bjørn

  • 0 in reply to Bjørn
    Intellectual 410 points

    Thanks for the detailed consultation. I will be very grateful if you point me to the relevant place in the source code.

  • 0 in reply to alemv
    TI__Expert 4470 points

    Hi,

    The name of the function is LLBle_filterDataConnection located in the file ll_ble.c. That function checks the ChSel bit, and filters the connection based on that.

    There are project files for IAR and CCS included in the installation, and there are descriptions in the User Guide (in the Firmware section) on how to rebuild the firmware.

    Regards,

    Bjørn

  • 0 in reply to Bjørn
    Intellectual 410 points

    Thank You. It works.