62 lines
2.1 KiB
Plaintext
62 lines
2.1 KiB
Plaintext
|
BTLE Wireshark plugin
|
||
|
|
=====================
|
||
|
|
|
||
|
|
This plugin is no longer in use, it has been merged in to the Wireshark source
|
||
|
|
tree as of release 1.12.
|
||
|
|
|
||
|
|
|
||
|
|
This is the Bluetooth Low Energy plugin for Wireshark.
|
||
|
|
|
||
|
|
To build this on Debian/Ubuntu/BackTrack linux distributions:
|
||
|
|
sudo apt-get install wireshark-dev wireshark
|
||
|
|
cd libbtbb/wireshark/plugins/btle/
|
||
|
|
cmake .
|
||
|
|
make
|
||
|
|
make install
|
||
|
|
|
||
|
|
This will install to the .wireshark/ in your home directory. To override
|
||
|
|
this set the DESTDIR environment variable when running cmake.
|
||
|
|
|
||
|
|
PPI Support (Patch)
|
||
|
|
-------------------
|
||
|
|
|
||
|
|
Ubertooth records capture frequency, internal clock state, and certain
|
||
|
|
other metadata about packets in a PPI header. It is not possible to add
|
||
|
|
PPI support in an external plugin, so if you wish to access these fields
|
||
|
|
you must patch Wireshark.
|
||
|
|
|
||
|
|
The patch wireshark-1.8-btle-ppi.patch was built against the Ubuntu
|
||
|
|
12.10 Quantal Wireshark package. It can be added to the Ubuntu package
|
||
|
|
source or applied directly to vanilla Wireshark.
|
||
|
|
|
||
|
|
To build a .deb on Ubuntu, follow these instructions:
|
||
|
|
|
||
|
|
mkdir wireshark && cd wireshark
|
||
|
|
apt-get source wireshark
|
||
|
|
cp wireshark-1.8-btle-ppi.patch wireshark-1.8.2/debian/patches
|
||
|
|
echo wireshark-1.8-btle-ppi.patch >> wireshark-1.8.2/debian/patches/series
|
||
|
|
cd wireshark-1.8.2
|
||
|
|
dpkg-buildpackage -rfakeroot
|
||
|
|
|
||
|
|
The .deb will be created in the wireshark directory, and it can be
|
||
|
|
installed with dpkg -i.
|
||
|
|
|
||
|
|
Attribute Protocol Support
|
||
|
|
--------------------------
|
||
|
|
|
||
|
|
Wireshark trunk has native support for the Bluetooth Attribute protocol.
|
||
|
|
If you are using a distro package that does not support it, install the
|
||
|
|
plugin found in the btatt directory (above this directory).
|
||
|
|
|
||
|
|
If the protocol column of non-empty data packets says L2CAP, you should
|
||
|
|
install the plugin. If it says ATT, you do not need the plugin. If it
|
||
|
|
says something else, please email me!
|
||
|
|
|
||
|
|
Bluetooth Security Manager Protocol
|
||
|
|
-----------------------------------
|
||
|
|
|
||
|
|
All security-related exchanges (pairing and identity resolution) take
|
||
|
|
place over the Bluetooth Security Manager (SM) protocol, which runs on
|
||
|
|
L2CAP. If you would like to dissect these packets, build and install the
|
||
|
|
plugin found in the btsm directory above this directory.
|