While developers use it to debug GATT server errors (Why isn't my characteristic notifying?), the nRF Sniffer has found a second life in and reverse engineering .
Emily was intrigued and asked Ryan to show her how to use the NRF Sniffer. Ryan started by downloading the Nordic Sniffer software from the Nordic Semiconductor website. He navigated to the "Software" section of the website, searched for "nRF Sniffer", and downloaded the latest version of the software. nrf sniffer for bluetooth le download nordic
Nordic provides a workaround: If you control the pairing process (i.e., you are the developer), you can extract the Long Term Key (LTK) from your central device (like a smartphone) and feed it into the sniffer. Once injected, Wireshark decrypts the packets in real-time, revealing the actual payloads (e.g., Write Request: Handle 0x0031, Value: 0x45 ). While developers use it to debug GATT server
| Tool | Price | Decryption | Ease of Use | Live Capture | | :--- | :--- | :--- | :--- | :--- | | | $10 - $40 | Manual (LTK injection) | Medium (CLI + Wireshark) | Yes | | Teledyne Frontline | $15,000+ | Automatic (Passkey entry) | High (GUI) | Yes | | Adafruit Bluefruit LE Sniffer | $40 | None (Promiscuous only) | High (Wireshark plugin) | Yes | | Ubertooth One | $120 | Manual (Legacy only) | Low (Complex CLI) | Yes | He navigated to the "Software" section of the
Unlike cheaper Texas Instruments CC2540 USB dongles (which often miss packets due to buffer overflows), the nRF52840 has enough horsepower to capture, timestamp, and forward full BLE packets over USB without dropping data—even in noisy environments.
The nRF Sniffer is a debug tool that allows developers to listen to the Bluetooth LE radio traffic exchanged between devices in real-time. It creates a "wiretap" for the air, capturing every packet transmitted within range.