0

I'm using WireShark on Ubuntu 20.04.1 LTS. I listen to bluetooth0 interface while transferring a file from my laptop to my smartphone over Bluetooth(using Blueman). Without any transfer, I get packets for protocols: HCI_EVT and HCI_CMD to obtain Tx Power Level, RSSI, and Link Quality which makes sense.

When I transfer a file, I get additionally, L2CAP packets.

My goal is to filter only packets with fragmentation/packet/any loss/re-transmission error. I'm not perfectly familiar with the Bluetooth protocol, I have tried several filters from here: https://www.wireshark.org/docs/dfref/b/btl2cap.html

Any knowledge regarding the possibility to filter packets with fragmentation/packet/any loss/re-transmission error would really help.

1
  • Did any answer help you? if so, you should accept the answer so that the question does not keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Dec 23, 2021 at 16:23

1 Answer 1

1

I found a solution, and wrote a python script for it. The filter was btl2cap.retransmittimeout and the code(which uses pyshark):

import pyshark

class SniffPacket(object):
    def sniff(self):
        capture = pyshark.LiveCapture(interface='bluetooth0', display_filter='btl2cap.retransmittimeout')
        try:
            capture.sniff(timeout=20)
        except:
            pass
        return capture

if __name__ == '__main__':
    print(f'Initiate sniffer...')
    capture = SniffPacket().sniff()
    print('Sniffer complete, parse data...')
    ct = 0
    try:
        while True:
            res = str(capture.next_packet())
            ct += 1
    except:
        pass
    print('Retransmitted packets: ' + str(ct))

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.