Bluetooth capture setup

Bluetooth support in Wireshark is currently limited.

Currently, there's no support for capturing Bluetooth traffic in Wireshark. However Wireshark can read capture files containing Bluetooth frames from the hcidump utility. The hcidump utility is available for both the Linux Bluetooth stack as well as for FreeBSD.

Wireshark doesn't include code that directly captures packets; it relies on libpcap/WinPcap to do so, so, to capture Bluetooth traffic, you'd first have to change libpcap/WinPcap.

This means you'd first need to ask tcpdump-workers@tcpdump.org for a link-layer type value for Bluetooth. You should indicate what the link-layer header will be - would it be some standard header (such as the one-byte H4 HCI type, with the payload being an HCI packet), or would it include platform-dependent information?

You would then have to add to libpcap support for capturing Bluetooth packets on whatever OS you're trying to do this - are you doing this on Linux, one of the BSDs, Windows, or some other OS?

Once that's done, the code in Wireshark's Wiretap library would need to add support for the new link-layer type value - and a new Wiretap encapsulation type would have to be added.

Somebody is looking at adding support to NetBSD for capturing H4 HCI packets; that could result in a new link-layer type value for Bluetooth HCI H4, and support for it in libpcap. It might also be useful to add to libpcap support for capturing with the BlueZ and FreeBSD stacks, and perhaps with the Affix stack as well.

See Also


CategoryHowTo

CaptureSetup/Bluetooth (last edited 2008-04-12 17:51:47 by localhost)