Sniffing BLE with multiple NRF52840-DONGLEs?

Question

Nordic provides hardware, firmware and software to sniff BLE in conjuction with Wireshark:

• https://www.nordicsemi.com/Products/Development-hardware/nRF52840-Dongle
• https://infocenter.nordicsemi.com/index.jsp?topic=/ug_nrf52840_dongle/UG/nrf52840_Dongle/getting_started.html
• https://www.nordicsemi.com/Products/Development-tools/nrf-sniffer-for-bluetooth-le
• https://infocenter.nordicsemi.com/topic/ug_sniffer_ble/UG/sniffer_ble/intro.html
• https://infocenter.nordicsemi.com/topic/ug_sniffer_ble/UG/sniffer_ble/capturing_multiple.html

It supports using multiple hardware interfaces. I thought I'd read some time ago that this would be advantageous for sniffing BLE due to channel hopping or something similar, and I have the number three (interfaces) stuck in my head - but I can't seem to find any info on this, so:

• what are the advantages of multiple interfaces for sniffing BLE in this context?
• does the documentation recommend a number of interfaces, if so, where?

Answer 1

BLE has 40 operating channels, 37 of them for data exchange, and 3 for advertising. When advertising, the BLE peripheral broadcasts a very short (few mSec) packet on each of the 3 channels in sequence. The BLE central device can only receive one channel at a time, so it scans the 3 frequencies in sequence. It has to spend a fair amount of time listening on each channel in order to pick up the short advertising pulse, and depending on the advertising and scanning timing parameters, it could take several seconds to pick up the peripheral's pulse.

If you set up 3 BLE devices, each programmed to continuously receive one of the 3 advertising channels, the system would pick up the advertising immediately, avoiding the typical lag when scanning. It's not a practical design for a battery-powered device, but if you really need to pick up every advertisement immediately, that would do it.

There's only a small advantage to using 3 devices. If you set up just one device, listening on just one of the advertising channels, it would pick up the advertisement within a few mSec of the more elaborate 3-device setup.

Answer 2

I'll give you another answer, because the accepted one seems to miss the point.

When using a bluetooth sniffer, you often do it to capture the traffic between 2 devices. The communication between these 2 devices will be initiated on one of the 3 advertisement channel. If you miss the initiation, nRF52 dongle won't capture anything.

So the point of using several capture devices is to cover all 3 channels (or you could buy a much more expensive BT capture device that capture the whole 40 channels simultaneously, all the time). If you don't, when trying to capture the traffic, you'll get the frustration of often not catching some exchanges. If it's your product you're debugging, you will try, and try, and try again.

Unlike a more expensive one, you'll still be able to follow only 1 or maybe up to 3 established links. One that capture the whole sprectrum might be able to follow hundreds of connections...

If we're talking about your device (your BT peripheral), you can also change its configuration to have it advertise on only one channel. I used to do that, didn't pose problems (but was tricky to do on the platform I used, that is, nRF52 SDK). You can then focus on that channel.

Note, so far, I've ever only used ONE nRF52 dongle at a time, but I've used other sniffers in 3, much nicer experience. I'm just about to plug 3 nRF52 dongle, which is why I researched the topic and found your post. I'm yet to see if something allows you to efficiently spread the 3 devices across the 3 channels.