5.10 Inspecting Captured Data

The Bluetooth Low Energy Sniffer captures all Bluetooth Low Energy packets and sends them to Wireshark. These packets are, then, enclosed in a header that includes additional useful meta-information not originally included in the Bluetooth Low Energy packet. Wireshark, then, dissects these packets, separating the actual packet from the added meta-information. When reviewing captured packets, the user can select a specific packet from the list to view its breakdown in the packet details pane. The packet bytes pane displays the bytes of the packet. By clicking a value in the details, it gets highlighted among the bytes. Similarly, clicking on the bytes highlights it in detail.
Figure 5-4. Data Captured from Multiple Interface
To view the display filter for any field, click a value in the packet details pane. The following figure illustrates the display filter.
Figure 5-5. Display Filter
The user can utilize display filters to showcase a selected subset of packets. In general, these filters depend on packet values like length or access address. The filter expressions incorporate Boolean operators such as is present, &&, ||, ==, !=, !. To create a filter, select Analyze>Display Filter Expression.
  1. Inside the Display Filter Expression window, the user can select any field name to define its relation and value.
  2. Click OK, then a filter string will be built.
Figure 5-6. Wireshark Display Filter Expression
The following are the steps to convert any field into a column in the packet details pane:
  1. Select the value in the packet details.
  2. Right-click, then select the “Apply as Column” option.
Figure 5-7. Wireshark Apply Filter
The following are the steps to apply a filter for viewing operations affecting a specific handle:
  1. Right-click on the desired value within the packet details.
  2. Select “Apply as Filter”, then click Selected.
The following are the steps to save a set of captured packets for future reference:
  1. Click the Stop button to halt the packet capture.
  2. To save all packets, navigate to File>Save As.
  3. To save a selection of packets, navigate to File>Export Specified Packets.
To clear the packet list and start a new capture, click the Restart button.