Wireshark · Wireshark-dev: [Wireshark-dev] A Mini-Challenge/A Feature Request: Support for Dissecting Bluetooth HCI Frames over

[Tyson Key <tyson.key@xxxxxxxxx>]

Hi, 
I have just captured* a session of using a connecting and initialising a USB Bluetooth adapter, before performing pairing/authentication, and receiving a file over OBEX from a mobile phone. It appears that the Bluetooth (HCI H1? HCI H4?) frames are carried over either URB_BULK or URB_INTERRUPT "channels", depending upon the size or type of the payload, although I'm unsure exactly of what protocols/frame types are in each payload from looking at the raw trace file, at present (although the actual OBEX traffic is split across several USB frames). 

Would it be feasible/easily possible to add support for dissecting Bluetooth traffic at this level? I was initially going to post this over on the Bugzilla instance, although I felt it was better suited to the mailing list.

* The capture file is now on the SampleCaptures page of the Wireshark Wiki as "Bluetooth_HCI_and_OBEX_Transaction_over_USB.ntar.gz", if anyone wants a look 

Thanks in advance,
Tyson.
-- 
Fight Internet Censorship! http://www.eff.org
               ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://i9.house404.co.uk/ | Twitter/FriendFeed/Skype: vmlemon | +447549728105