2006-06-12 10:25:07

by ronnie sahlberg

[permalink] [raw]
Subject: [Bluez-devel] Ethereal/Wireshark support for bluetooth, developer needs sample captures

Hi again list.

I have modified and checked in most of the protocols from the affix
patch to ethereal into the new wireshark svn repository.
http://www.wireshark.com

(wireshark is the new name for ethereal. no drama. simple trademark issue)

This is support to read hcidump files natively in wireshark and to
decode the actual packets.


Right now what is still remaining and what I would like example
captures to test with would be
BNEP: bnep is currently not implemented and I would need some hcidump
captures with this kind of traffic. Once i have example captures of
bnep it would be easy to do the required modifications and check in
support for it.

RFCOMM: rfcomm is implemented but what is not implemented is the
de-escaping of ppp and dissection of ppp ontop rfcomm.



Would someone here have any captures they can share with me so i can
finish off implementing bnep and rfcomm support in wireshark?
I would need any capture with bnep traffic as well as a capture with
RFCOMM where ppp is transported atop RFCOMM.


best regards
ronnie s


(you guys should actually talk some with the tcpdump.org people and
add support four your bluetooth interface to pcap, so that one could
capture natively from pcap applications such as wireshark, tcpdump
etc.)


_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel


2006-06-17 10:50:15

by Marcel Holtmann

[permalink] [raw]
Subject: Re: [Bluez-devel] Ethereal/Wireshark support for bluetooth, developer needs sample captures

Hi Ronnie,

> I have modified and checked in most of the protocols from the affix
> patch to ethereal into the new wireshark svn repository.
> http://www.wireshark.com

great. Keep on the good work.

> This is support to read hcidump files natively in wireshark and to
> decode the actual packets.

We also need to add support for the BTSnoop format that is also
supported by hcidump and actually preferred over the native hcidump
format.

> Right now what is still remaining and what I would like example
> captures to test with would be
> BNEP: bnep is currently not implemented and I would need some hcidump
> captures with this kind of traffic. Once i have example captures of
> bnep it would be easy to do the required modifications and check in
> support for it.

I have a couple of BNEP capable access points. So if you still need them
then I can take care of that next week when I am back home.

> RFCOMM: rfcomm is implemented but what is not implemented is the
> de-escaping of ppp and dissection of ppp ontop rfcomm.

Be careful, because you can have also OBEX and a lot of other protocols
on top of RFCOMM. It is not always PPP and only the SDP database knows
what to expect.

> Would someone here have any captures they can share with me so i can
> finish off implementing bnep and rfcomm support in wireshark?
> I would need any capture with bnep traffic as well as a capture with
> RFCOMM where ppp is transported atop RFCOMM.

Please support Ronnie in sending him sample dumps. Last time I checked I
saw that a lot of Bluetooth 1.2 and 2.0 HCI commands and events are also
not supported. If you see missing HCI decodings please forward him this
dump.

> (you guys should actually talk some with the tcpdump.org people and
> add support four your bluetooth interface to pcap, so that one could
> capture natively from pcap applications such as wireshark, tcpdump
> etc.)

Anybody who wants to look into this?

Regards

Marcel




_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel