Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Set CRC and payload decrypted flags PCAP packet header #66

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

gsingh93
Copy link

After attempting to sniff some Bluetooth BR/EDR traffic, I saw that the correct plaintext data was present in the packet bytes in Wireshark, but Wireshark was not decoding the packet any more than the "BT BR/EDR RF" packet type, even though I should have seen LMP and L2CAP packets decoded as well. Digging into the code for the Wireshark BT BR/EDR packet dissector shows that the LLID of the packets is only decoded if there is a non-zero data length, the CRC is checked, and the CRC is valid: https://github.com/wireshark/wireshark/blob/master/epan/dissectors/packet-btbredr_rf.c#L1558-L1559

These bits should be set in the BT BR/EDR packet "Flags" field whenever libbtbb adds a new packet to the PCAP, but currently they're not being set.

This PR sets the BREDR_CRC_CHECKED, BREDR_CRC_VALID, and BREDR_PAYLOAD_DECRYPTED flags here so that the PCAP is properly decoded in Wireshark.

This solution probably can't be merged in its current state, as we're setting these flags without actually ensuring the data is encrypted or the CRC is valid. But hardcoding them was helpful for my use case, so I'm putting this PR up as an FYI of this issue and so others can use.

For a full solution, maybe ubertooth-rx and ubertooth-follow could have a command line flag that would set these flags when enabled?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant