hcidump does not show all traffic

hcidump does not show all traffic

[Freek de Kruijf]

I am trying to monitor the traffic between my linux system and an external 
bluetooth system using the command "hcidump -i hci0 -w filename". I only catch 
some traffic from the host to the external device, but nothing from the device 
to the host. I analyze the file using wireshark.

-- 
fr.gr.

Freek de Kruijf

Re: hcidump does not show all traffic

[Marcel Holtmann]

Hi Freek,

> I am trying to monitor the traffic between my linux system and an external 
> bluetooth system using the command "hcidump -i hci0 -w filename". I only catch 
> some traffic from the host to the external device, but nothing from the device 
> to the host. I analyze the file using wireshark.

you need a newer Wireshark version. I remember it had some issues with correctly decoding the base packet types. Double check with btmon or hcidump that all traffic is actually in the file.

Regards

Marcel

Re: hcidump does not show all traffic

[Freek de Kruijf]

Op vrijdag 28 augustus 2015 12:05:29 schreef Marcel Holtmann:
> Hi Freek,
> 
> > I am trying to monitor the traffic between my linux system and an external
> > bluetooth system using the command "hcidump -i hci0 -w filename". I only
> > catch some traffic from the host to the external device, but nothing from
> > the device to the host. I analyze the file using wireshark.
> 
> you need a newer Wireshark version. I remember it had some issues with
> correctly decoding the base packet types. Double check with btmon or
> hcidump that all traffic is actually in the file.

I finally found the cause. The bluetooth communication was between an 
application of a normal user and the device. I used hcidump from the same 
user. Now that I use hcidump as root I get all the traffic. Silly mistake.

I would propose to put some text in the man page of hcidump about using the 
command only as root. Maybe it should be installed in sbin instead of bin.

-- 
fr.gr.

Freek de Kruijf

Re: hcidump does not show all traffic

[Marcel Holtmann]

Hi Freek,

>>> I am trying to monitor the traffic between my linux system and an external
>>> bluetooth system using the command "hcidump -i hci0 -w filename". I only
>>> catch some traffic from the host to the external device, but nothing from
>>> the device to the host. I analyze the file using wireshark.
>> 
>> you need a newer Wireshark version. I remember it had some issues with
>> correctly decoding the base packet types. Double check with btmon or
>> hcidump that all traffic is actually in the file.
> 
> I finally found the cause. The bluetooth communication was between an 
> application of a normal user and the device. I used hcidump from the same 
> user. Now that I use hcidump as root I get all the traffic. Silly mistake.
> 
> I would propose to put some text in the man page of hcidump about using the 
> command only as root. Maybe it should be installed in sbin instead of bin.

just start using btmon instead of hcidump.

Regards

Marcel