AwesomeREA.org

Tool

Sniffle

NCC Group's sniffer for Bluetooth 5 and 4.x Low Energy, made of firmware for TI CC1352/CC26x2 radio boards and Python host tools. It captures advertising and connection traffic on the 1M, 2M and coded PHYs, follows connections through channel-map, connection-parameter and PHY changes, captures BT5 extended advertising, and filters by MAC address, IRK, RSSI or advertisement content; for a filtered target it hops all three primary advertising channels, which the README says makes connection detection nearly three times more reliable than single-channel sniffers. Captures are saved as Ubertooth-compatible PCAP, a Wireshark extcap plugin starts captures from the Wireshark GUI, and command-line decoders print advertising data, including Apple and Microsoft manufacturer-specific fields.

Requirements & limits

  • Release at review: v1.11.0, published 2025-07-12 with prebuilt firmware hex files for each supported board; the reviewed master commit adds two relay-script fixes. The README asks users of prebuilt firmware to run the Python code from the matching release tag rather than master. The release notes describe SDR-based sniffing as an incomplete work in progress.
  • Needs one of the listed TI Launchpad boards (CC26x2R, CC2652RB, CC1352R, CC1352P, CC2652R7, CC1352P7, CC2651P3 or CC1354P10), a SONOFF CC2652P USB Dongle Plus or a CatSniffer V3. Firmware is flashed with TI UniFlash/DSLite, the cc2538-bsl bootloader utility for the SONOFF dongle or Electronic Cats' uploader; the README warns that flashing the wrong SONOFF build variant can brick the dongle. Building firmware needs the ARM GNU toolchain and TI SimpleLink Low Power F2 SDK 8.30.01.01, which the README patches for recent GCC. Host tools need Python 3.9+ with PySerial.
  • Encrypted connections are not decrypted: Sniffle follows their timing and detects parameter updates without the key, and reliable connection following needs a MAC or IRK filter on the peripheral. Later firmware can also transmit for active scanning, advertising, initiating connections and link-layer relaying; this entry covers passive capture and decoding only.
  • GPL-3.0; source headers name NCC Group plc as the copyright holder, jointly with Jay Logue for the Wireshark extcap plugin. No hardware was flashed and no traffic was captured.

About this entry

Type
Tool
Category
Protocol analysis tools
Relationship
Foundation tool
Targets
Protocol

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · nccgroup/Sniffle · Revision 3a53f5a
  2. README.md#L22-L45 GitHub · nccgroup/Sniffle · Revision 3a53f5a
  3. README.md#L494-L537 GitHub · nccgroup/Sniffle · Revision 3a53f5a
  4. fw/makefile GitHub · nccgroup/Sniffle · Revision 3a53f5a
  5. python_cli/sniffle/pcap.py GitHub · nccgroup/Sniffle · Revision 3a53f5a
  6. python_cli/pcap_decoder.py GitHub · nccgroup/Sniffle · Revision 3a53f5a
  7. LICENSE GitHub · nccgroup/Sniffle · Revision 3a53f5a
  8. https://github.com/nccgroup/Sniffle/releases/tag/v1.11.0

More in Protocols

All 28 entries in Protocols