0

I'm using WireShark on Ubuntu 20.04.1 LTS. I listen to bluetooth0 interface while transferring a file from my laptop to my smartphone over Bluetooth(using Blueman). Without any transfer, I get packets for protocols: HCI_EVT and HCI_CMD to obtain Tx Power Level, RSSI, and Link Quality which makes sense.

When I transfer a file, I get additionally, L2CAP packets.

My goal is to filter only packets with fragmentation/packet/any loss/re-transmission error. I'm not perfectly familiar with the Bluetooth protocol, I have tried several filters from here: https://www.wireshark.org/docs/dfref/b/btl2cap.html

Any knowledge regarding the possibility to filter packets with fragmentation/packet/any loss/re-transmission error would really help.

1

I found a solution, and wrote a python script for it. The filter was btl2cap.retransmittimeout and the code(which uses pyshark):

import pyshark

class SniffPacket(object):
    def sniff(self):
        capture = pyshark.LiveCapture(interface='bluetooth0', display_filter='btl2cap.retransmittimeout')
        try:
            capture.sniff(timeout=20)
        except:
            pass
        return capture

if __name__ == '__main__':
    print(f'Initiate sniffer...')
    capture = SniffPacket().sniff()
    print('Sniffer complete, parse data...')
    ct = 0
    try:
        while True:
            res = str(capture.next_packet())
            ct += 1
    except:
        pass
    print('Retransmitted packets: ' + str(ct))

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.