1

Using Ubertooth, a bluetooth sniffer, I created a pcap file in Unbuntu that captured some data.

When I opened that file in WireShark 2.4.1 in Windows 10 it showed more information in the SMP data section.

The top photo is the original scan in Unbuntu and the last pic is when I opened that file in windows. Why am I seeing more information in the Windows Wireshark?

In Unbuntu I get nothing about the Secure Connection Bit being present.

Is it a setting or preference?

Thanks in advance.

WireShark 2.2.6 in Unbuntu

Windows 10 WireShark 2.4.1

Improve this question

1 Answer 1

Reset to default
2

Wireshark uses pieces of code it calls dissectors to analyze packets and provide the information given in the packet details. These get added to and updated regularly by the community and developers of Wireshark.

You didn't give the version of Wireshark running on your Ubuntu install, but my Ubuntu apt-cache shows the newest version of Wireshark available is currently 2.2.6, although I am using 16.04LTS as opposed to 17.04.

If you will check the release notes between version 2.2.6 (or whatever your installed version is) and 2.4.1, you will find a number of Bluetooth related dissectors that have been added and/or updated. Specifically in 2.4.1 "BT LE" is updated and based on your screenshots appears to be one of the dissectors in use.

The end result is that the newer release of Wireshark is better able to analyse the captured data for you to view.

Improve this answer
2
  • thanks for the clear explanation. I am using 2.2.6 on Unbuntu, I assume apt-get install wireshark -update will get me any new dissectors?
    – Niko_Jako
    Commented Sep 8, 2017 at 1:46
  • Since the newest version of Wireshark in the Ubuntu repositories that I am aware of is v2.2.6, I doubt it. You would likely have to look outside the standard Ubuntu repositories to one that may have it or more likely compile it from source yourself.
    – YLearn
    Commented Sep 8, 2017 at 3:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.