BLE Sniffer with nRF52840

Using a special firmware image provided by Nordic Semiconductor and the open source network analysis tool Wireshark, an Adafruit nRF52840 board can be used as a low cost Bluetooth Low Energy sniffer.

NOTE: This can only be used to sniff Bluetooth Low Energy devices. It will not work with classic Bluetooth devices. Since nRF-Sniffer is a passive solution that is simply scanning packets over the air, there is the possibility of missing packets using this tool (or any other passive sniffing solution)

The bootloader version must be at least 0.6.0 . If your board has older version, please try to update it first https://learn.adafruit.com/introducing-the-adafruit-nrf52840-feather/update-bootloader

Once things are all setup, usage is fairly easy. However, there are numerous separate items that need to be installed and configured. So the initial setup can be a bit cumbersome.

This guide will go through each step, but it can also help to have a general understanding of the overall setup.

Here's a simplified diagram:

Here's a summary of all the parts needed:

The actual BLE sniffing hardware, this guide use an Adafruit nRF52840 board running sniffer uf2 firmware.
nRF52840 native USB shows up as virtual serial (cdc)
The BLE sniffing plugin uses Python.
To talk to the virtual com port from Python, the pyserial module needs to be installed.
Wireshark is the main software front end used to facilitate BLE sniffing and decoding.
To talk to the BLE sniffer from Wireshark, the Nordic Semiconductor nRF Sniffer for BLE plugin is used.

These parts come from different sources - at least 5 different vendors are shown in the diagram above. So this will be quite the journey.

BLE Sniffer Hardware

You'll need one of Adafruit's nRF52840 boards, for example:

nRF52840 USB Key with TinyUF2 Bootloader - Bluetooth Low Energy

This USB dongle/key type thing is a little unusual - it isn't a BLE adapter that you plug into a computer to add wireless capability. (If you do want something like that,...

$15.95

In Stock

Add to Cart

Adafruit Feather nRF52840 Express

The Adafruit Feather nRF52840 Express is the new Feather family member with Bluetooth Low Energy and native USB support featuring the nRF52840! It's...

$24.95

In Stock

Add to Cart

In order to use your nRF52840 board as sniffer hardware, you need to flash the sniffer firmware on your board first. Click the link below to download the Sniffer UF2 firmware file.

sniffer_nrf52840dongle_4.1.0.uf2

Double-click the Reset button on your board, and you will see the NeoPixel RGB LED turn green (identified by the arrow in the image). If it turns red, check the USB cable, try another USB port, etc.

Note: on nRF52840 USB Key with TinyUF2 (PID 5199) you need to hold its button while plugging into your PC.

You will see a new BOOT disk drive appear e.g FTHR840BOOT.

Drag the sniffer_nrf52840dongle_4.1.0.uf2 file to FTHR840BOOT.

The LED will flash. Then, the FTHR840BOOT drive will disappear and a new device with a virtual com port appear

Bus 001 Device 018: ID 1915:522a Nordic Semiconductor ASA

That's it, you have successfully converted your board into a BE sniffing device and it's ready to use.

An LED can be wried to nRF52840 pin P1.09 as activity indicator. Unfortunately, the sniffer is provided as hex only from Nordic, therefore we couldn't re-compile it to match on-board LED for our boards.

Sniffer firmware will erase softdevice (BLE stack) on your board. If you want to switch your board back to normal developing flow with Arduino or CircuitPython, click on the link below to download Softdevice UF2 file then drag and drop into BOOT drive as above.

s140_nrf52_6.1.1_softdevice.uf2