nRF52840 Dongle
A cheap Nordic nRF52840 USB stick (PCA10059) that, once flashed with the right firmware, becomes a BLE or 802.15.4 sniffer feeding live packets into Wireshark, or a fully scriptable 2.4 GHz radio you program yourself.
The nRF52840 Dongle (Nordic's PCA10059) is a USB stick built around the nRF52840 multiprotocol SoC. It costs about the price of a cable, needs no external debugger because it carries a USB DFU bootloader, and depending on the firmware you flash it becomes a BLE sniffer, an 802.15.4 sniffer, or a radio you program yourself. It is the standard cheap answer to "how do I actually see what this Wiki: ble device is saying".
What it is
The nRF52840 is an ARM Cortex-M4F with a 2.4 GHz radio that supports Bluetooth Low Energy (including BLE 5 features such as extended advertising and coded PHY), IEEE 802.15.4 (the PHY under Wiki: zigbee and Thread), and Nordic's own proprietary ESB mode. The dongle exposes that radio, a USB port, a user button and an RGB LED, and nothing else. There is no on-board debugger: you hold the side button while inserting it to enter the bootloader, then flash over USB with nrfutil.
What people use it for
- nRF Sniffer for Bluetooth LE. Nordic's firmware plus a Wireshark extcap plugin. The dongle appears as a capture interface in Wireshark, you pick a device from the advertising list, and you get its packets live, decoded by Wireshark's BLE dissectors.
- nRF Sniffer for 802.15.4. The same idea for Zigbee and Thread. Give Wireshark the network key and the payloads decrypt in the dissector.
- Sniffle (an open-source BLE sniffer firmware) which handles connection following, extended advertising and channel selection algorithm 2 more robustly than the vendor sniffer, and is scriptable from Python.
- Your own firmware, written against Zephyr or the nRF Connect SDK, when you need the dongle to act as a peripheral, a central, or a deliberately misbehaving one for testing.
# Enter bootloader (hold the side button while plugging in), then flash.
nrfutil pkg generate --hw-version 52 --sd-req 0x00 \
--application sniffer.hex --application-version 1 sniffer.zip
nrfutil dfu usb-serial -pkg sniffer.zip -p /dev/ttyACM0
# With the sniffer firmware and the extcap plugin installed:
wireshark # then pick "nRF Sniffer for Bluetooth LE" as the interface
Limits worth knowing before you buy one
- A sniffer follows one connection at a time. It listens on the advertising channels, and when the central connects it follows that link's hop sequence. Miss the
CONNECT_INDand you cannot follow the connection; you have to force a reconnect (kill the app, walk out of range, power-cycle the device) and capture the start. - Encryption. If the link is encrypted, the sniffer can decrypt it only when it captured the pairing. That works for BLE Legacy pairing, including Just Works. It does not work for LE Secure Connections, whose ECDH key exchange is not passively recoverable, no matter what the sniffer captured.
- It is not a Bluetooth adapter. Out of the box with sniffer firmware,
bluetoothctlandhcitooldo not see it. If you want an HCI adapter, that is a different firmware (or just use a supported USB Bluetooth dongle). - Antenna and range. The on-board PCB antenna is fine at desk range. Do not draw conclusions about a device's reachability from a dongle in the back of a laptop.
- DFU confusion. The Dongle (PCA10059) and the nRF52840 DK (PCA10056, a full development board with an on-board J-Link) take firmware differently. Instructions for one will not work on the other, and this trips up almost everyone once.
Pitfalls
- Flashing a firmware built for the DK onto the Dongle bricks nothing, but it will not run, and the LED pattern will make you think the hardware is dead. Re-enter the bootloader and flash the right build.
- The Wireshark extcap plugin must match the sniffer firmware version. Mismatches show up as an interface that appears but captures nothing.
- Sniffing 2.4 GHz in a crowded room is genuinely lossy. Missing packets are normal; a gap in a capture is not proof the device did not send.