# Sniffle

> NCC Group's sniffer for Bluetooth 5 and 4.x Low Energy, made of firmware for TI CC1352/CC26x2 radio boards and Python host tools. It captures advertising and connection traffic on the 1M, 2M and coded PHYs, follows connections through channel-map, connection-parameter and PHY changes, captures BT5 extended advertising, and filters by MAC address, IRK, RSSI or advertisement content; for a filtered target it hops all three primary advertising channels, which the README says makes connection detection nearly three times more reliable than single-channel sniffers. Captures are saved as Ubertooth-compatible PCAP, a Wireshark extcap plugin starts captures from the Wireshark GUI, and command-line decoders print advertising data, including Apple and Microsoft manufacturer-specific fields.

- Type: Tool
- Targets: Protocol
- Category: Protocol analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-19
- Added to the catalog: 2026-10-30
- Original resource: <https://github.com/nccgroup/Sniffle>
- Primary source: <https://github.com/nccgroup/Sniffle/blob/3a53f5ab21df7599ad0c46475d322603c1a54bb7/README.md>
- Catalog page: <https://awesomerea.org/resources/sniffle/>
- Record JSON: <https://awesomerea.org/resources/sniffle/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/sniffle/index.md)

## Requirements & limits

- Release at review: v1.11.0, published 2025-07-12 with prebuilt firmware hex files for each supported board; the reviewed master commit adds two relay-script fixes. The README asks users of prebuilt firmware to run the Python code from the matching release tag rather than master. The release notes describe SDR-based sniffing as an incomplete work in progress.
- Needs one of the listed TI Launchpad boards (CC26x2R, CC2652RB, CC1352R, CC1352P, CC2652R7, CC1352P7, CC2651P3 or CC1354P10), a SONOFF CC2652P USB Dongle Plus or a CatSniffer V3. Firmware is flashed with TI UniFlash/DSLite, the cc2538-bsl bootloader utility for the SONOFF dongle or Electronic Cats' uploader; the README warns that flashing the wrong SONOFF build variant can brick the dongle. Building firmware needs the ARM GNU toolchain and TI SimpleLink Low Power F2 SDK 8.30.01.01, which the README patches for recent GCC. Host tools need Python 3.9+ with PySerial.
- Encrypted connections are not decrypted: Sniffle follows their timing and detects parameter updates without the key, and reliable connection following needs a MAC or IRK filter on the peripheral. Later firmware can also transmit for active scanning, advertising, initiating connections and link-layer relaying.
- GPL-3.0; source headers name NCC Group plc as the copyright holder, jointly with Jay Logue for the Wireshark extcap plugin.

## Primary sources

1. <https://github.com/nccgroup/Sniffle/blob/3a53f5ab21df7599ad0c46475d322603c1a54bb7/README.md>
2. <https://github.com/nccgroup/Sniffle/blob/3a53f5ab21df7599ad0c46475d322603c1a54bb7/README.md#L22-L45>
3. <https://github.com/nccgroup/Sniffle/blob/3a53f5ab21df7599ad0c46475d322603c1a54bb7/README.md#L494-L537>
4. <https://github.com/nccgroup/Sniffle/blob/3a53f5ab21df7599ad0c46475d322603c1a54bb7/fw/makefile>
5. <https://github.com/nccgroup/Sniffle/blob/3a53f5ab21df7599ad0c46475d322603c1a54bb7/python_cli/sniffle/pcap.py>
6. <https://github.com/nccgroup/Sniffle/blob/3a53f5ab21df7599ad0c46475d322603c1a54bb7/python_cli/pcap_decoder.py>
7. <https://github.com/nccgroup/Sniffle/blob/3a53f5ab21df7599ad0c46475d322603c1a54bb7/LICENSE>
8. <https://github.com/nccgroup/Sniffle/releases/tag/v1.11.0>

## More in Protocols

- [Packetry](https://awesomerea.org/resources/packetry/index.md) · Tool
- [Caring Caribou](https://awesomerea.org/resources/caringcaribou/index.md) · Tool
- [protodump](https://awesomerea.org/resources/protodump/index.md) · Tool
- [CAN Commander](https://awesomerea.org/resources/can-commander/index.md) · Tool
- [Automated CAN Payload Reverse Engineering](https://awesomerea.org/resources/can-reverse-engineering/index.md) · Tool
- [Deluder](https://awesomerea.org/resources/deluder/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.