Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Wireshark seeing malformed packets #83

Open
jsmif opened this issue May 5, 2023 · 0 comments
Open

Wireshark seeing malformed packets #83

jsmif opened this issue May 5, 2023 · 0 comments

Comments

@jsmif
Copy link

jsmif commented May 5, 2023

On Ubuntu 20.04, when I run the following:

btlejack -c any -w /tmp/ble -o ble_test.pcap
BtleJack version 2.1

[i] No output format supplied, pcap format will be used
[i] Waiting for wireshark ...
[i] Detected sniffers:
 > Sniffer #0: version 2.1
LL Data: 45 22 aa 82 1d 47 e1 6c aa 94 a1 0e 6c 94 95 84 9a af b3 35 fa 03 14 00 18 00 00 00 48 00 00 00 c0 d7 0f 0e
[i] Got CONNECT_REQ packet from 6c:e1:47:1d:82:aa to 94:6c:0e:a1:94:aa
 |-- Access Address: 0xaf9a8495
 |-- CRC Init value: 0xfa35b3
 |-- Hop interval: 24
 |-- Hop increment: 14
 |-- Channel Map: 0fd7c00000
 |-- Timeout: 720 ms

LL Data: 03 06 0c 0b 0f 00 11 02
LL Data: 03 06 0c 0b 0f 00 11 02
LL Data: 03 06 0c 0b 0f 00 11 02
LL Data: 03 06 0c 0b 0f 00 11 02
LL Data: 03 06 0c 0b 0f 00 11 02
LL Data: 03 06 0c 0b 0f 00 11 02
LL Data: 03 06 0c 0b 0f 00 11 02
LL Data: 03 06 0c 0b 0f 00 11 02

Wireshark/tshark sees the following:

tshark -i /tmp/ble
Capturing on '/tmp/ble'
    1   0.000000 af:9a:84:95:94:aa → Renasis_fa:35:aa LE LL 33 ADV_DIRECT_IND
    2   0.019143              →              LE LL 7 UnknownDirection [Malformed Packet]
    3   0.049076              →              LE LL 7 UnknownDirection [Malformed Packet]
    4   0.079197              →              LE LL 7 UnknownDirection [Malformed Packet]
    5   0.109192              →              LE LL 7 UnknownDirection [Malformed Packet]
    6   0.139112              →              LE LL 7 UnknownDirection [Malformed Packet]
    7   0.169077              →              LE LL 7 UnknownDirection [Malformed Packet]
    8   0.199098              →              LE LL 7 UnknownDirection [Malformed Packet]

I thought perhaps it was because of the older version of Wireshark I'm running (to use someone else's custom BLE dissector), but I copied the ble_test.pcap to a system with the latest version of Wireshark, and it also saw the packets as malformed.

I'm also wondering why btlejack says it's seeing a CONNECT_REQ but wireshark thinks it's an ADV_DIRECT_IND?

Am I doing something wrong on my end?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant