Revision history [back]

Revision 4

updated 2018-08-24 17:24:55 +0000

How to capture filter on BLE address?

I'm using the AdaFruit BLE sniffer, along with a bunch of software so it can talk to Wireshark. I see BLE packets galore, but I'm interested only in the device I'm testing, not Bill's Android, or the TV, or the... I think everything has BT in it now.

So, I have been trying to filter for the MAC address to no avail. I've tried making filters that look like:

btle.access_address == 00:00:00:00:00:00 (i.e. "some MAC address")
btle.advertising_address == <some MAC address>

One of them does no apparent filtering, the other apparently causes the program distress in that it can't figure out the filter's meaning, I guess.

Can someone tell me what filter string to really use? (This has been a bane of mine in Wireshark from the very beginning, when I was using it on (gasp) wired Ethernet.

Thanks, John

Revision 3

23.8k

grahamb

updated 2018-08-23 14:34:59 +0000

How to capture filter on BLE address?

So, I have been trying to filter for the MAC address to no avail. I've tried making filters that look like:

btle.access_address btle.access\_address    == 00:00:00:00:00:00 (i.e. "some MAC address")
btle.advertising_address btle.advertising\_address == <some MAC address>

One of them does no apparent filtering, the other apparently causes the program distress in that it can't figure out the filter's meaning, I guess.

Can someone tell me what filter string to really use? (This has been a bane of mine in Wireshark from the very beginning, when I was using it on (gasp) wired Ethernet.

Thanks, John

Revision 2

23.8k

grahamb

updated 2018-08-23 14:34:32 +0000

How to capture filter on BLE address?

So, I have been trying to filter for the MAC address to no avail. I've tried making filters that look ~~like:~~

btle.access\_address like:
btle.access_address    == 00:00:00:00:00:00 (i.e. "some MAC address")
btle.advertising\_address btle.advertising_address == <some MAC address>

One of them does no apparent filtering, the other apparently causes the program distress in that it can't figure out the filter's meaning, I guess.

Can someone tell me what filter string to really use? (This has been a bane of mine in Wireshark from the very beginning, when I was using it on (gasp) wired Ethernet.

Thanks, John

Revision 1

johngriswold

asked 2018-08-23 14:23:36 +0000

How to capture filter on BLE address?

So, I have been trying to filter for the MAC address to no avail. I've tried making filters that look like: btle.access_address == 00:00:00:00:00:00 (i.e. "some MAC address") btle.advertising_address ==

One of them does no apparent filtering, the other apparently causes the program distress in that it can't figure out the filter's meaning, I guess.

Can someone tell me what filter string to really use? (This has been a bane of mine in Wireshark from the very beginning, when I was using it on (gasp) wired Ethernet.

Thanks, John