How to use Raytac’s MDBT50Q-CX-40 dongle as a BLE sniffer?

Introduction

Uncertainties in Bluetooth Application Development
Bluetooth’s growing popularity comes with challenges during development. Common issues include hardware instability, software incompatibilities, and environmental interference.
Accurate issue identification and resolution are keys to successful development.

Common Uncertainties
Unstable Connections: Disruptions from wireless signals or physical obstacles.
Pairing Failures: Devices unable to establish connections.
Data Errors: Packet loss or corruption during transmission.
Compatibility Problems: Protocol version mismatches affecting interoperability.

Efficient Bluetooth Issue Analysis
Challenges like transmission speed limitations, data loss, connection failures, or protocol violations can arise. As Bluetooth signals travel wirelessly, precise analysis requires specialized tools.
Nordic offers firmware integrated with Wireshark, flashable onto the Raytac MDBT50Q-CX-40 Dongle, enabling engineers to capture and analyze Bluetooth broadcast signals via USB.
This setup streamlines issue identification and resolution.
Below’s how to configure the Dongle for Wireshark reception.



Flashing Firmware into MDBT50Q-CX-40
Step 1: Download and extract the nRF Sniffer for Bluetooth LE from Nordic:
https://www.nordicsemi.com/Products/Development-tools/nRF-Sniffer-for-Bluetooth-LE
Step 2: Locate the file: sniffer_nrf52840dongle_nrf52840_4.1.1.hex
This is the firmware to flash into MDBT50Q-CX-40.


Step 3: Press and hold the button on MDBT50Q-CX-40 and plug it into a PC USB port.
Bootloader mode will be activated after the LED light is turned on.
Then flash the firmware using nRF Programmer.

Step 4: Open the nRF Programmer and follow the below steps:
Select the Device:


The device will appear as the name shown in below:


Add Firmware File:


Load sniffer_nrf52840dongle_nrf52840_4.1.1.hex into the Programmer:


Press “Write" to flash the firmware.
After flashing, press “Select Device" again.
If the Device name appears as nRF Sniffer for Bluetooth, the flashing is successful.


Set Up Wireshark Software Environment
Step 1: Download & install nRF-Util: https://www.nordicsemi.com/Products/Development-tools/nRF-Util
Step 2: Open MS-DOS and use the command nrfutil list to check if the ble-sniffer item is available.
If not, install it using nrfutil install ble-sniffer.


Step 3: Download and Install Wireshark: https://www.wireshark.org/download.html.
Step 4: Open Wireshark and navigate to: Help → About Wireshark → Folders.
Step 5: Locate the string under Personal Extcap Path for the extcap directory, which will be an empty folder.


Step 6: Copy the files from nrf_sniffer_for_bluetooth_le_4.1.1\extcap (downloaded earlier) into Wireshark\extcap directory.


Step 7: After reopening, you should see an interface with a configurable icon next to the dongle.


Step 8: Edit Configuration Profiles Import From Directory Navigate to the directory nrf_sniffer_for_bluetooth_le_4.1.1\Profile_nRF_Sniffer_Bluetooth_LE and click “Select Folder".


Step 9: The profile will be imported. Click OK to confirm.


After all the above is done, the setup shall be completed.



Capturing and analyzing Bluetooth packets
After launching the program, you can see the following devices and Dongle settings.
Double-click to start the packet capture process:


If you want to capture packets with PHY=125K, you can use the following settings:


Packet Analysis Method
In Wireshark, select the device from the “Device" menu to capture and analyze broadcast packets.


User Cases – What sniffer can offer
1. Disconnection when transmitting over 20 bytes between Tablet and Raytac’s AT-Command Module:
Through sniffer analysis, it was discovered that Raytac’s module requested a packet length of 251 bytes, but the tablet’s TX setting was limited to 27 bytes.


2. Broadcast Device Name containing invisible characters:
The device could connect using a mobile app but failed to connect using Central’s code.
From the sniffer interface shown below, the device name length is 11, but the Length field shows 13.
The actual data length (Type length + Device Name) = 1 + 11 = 12, indicating an issue with the program’s broadcast name length.


3. Incorrect parameter settings causing issues with throughput or packet reception:
Improper settings can lead to reduced throughput, incorrect data reception, or disconnections.
The diagram below shows a correct setup with high-volume data transmission. The Protocol Length is 251, and the data transmission intervals are consistent, achieving optimal throughput.


Summary
Mastering hardware and software setups and effectively using packet analysis tools can boost development efficiency and enable high-performance Bluetooth applications.

Resources:
https://www.nordicsemi.com/Products/Development-tools/nRF-Sniffer-for-Bluetooth-LE
https://docs.nordicsemi.com/bundle/nrfutil_ble_sniffer_pdf/resource/nRF_Sniffer_BLE_UG_v4.0.0.pdf
https://www.wireshark.org/download.html

User manual:
https://raytac.blog/2024/07/10/firmware-coding-dfu-onto-mdbt50q-rxuser-manual-of-mdbt50q-cx-nrf52840-usb-c-dongle/


Edited by Business Development Manager: Mr. Tony Yin
Technical guidance provided by R&D Manager: Mr. Stanley Huang


Raytac Corporation 勁達國際電子股份有限公司
A Bluetooth, Wi-Fi, and LoRa Module Maker based on
Nordic nRF54; nRF53: nRF52; nRF51; nRF7002
Semtech Specification: SX1262

Bluetooth Specification: BT6.0 ; BT5.4 ; BT5.3 ; BT5.2.
Wi-Fi Specification: Wi-Fi 6
LoRa Specification: LoRaWAN

All products are FCC/IC/CE/Telec/KC/RCM/SRRC/NCC/WPC Pre-Certified.
http://www.raytac.com
email: sales@raytac.com
Tel: +886-2-3234-0208



Overview of Raytac’s nRF54L15 module – AN54L15 series & Channel Sounding preview (Bluetooth 6.0)

Raytac nRF54L15 Module Series (If you want to know more or register for samples, please click me)
Table of Contents:

  1. nRF54L15 SoC feature brief
  2. Comparison among nRF54L15/ nRF5340/ nRF52840/ nRF52832 SoC modules
  3. Get started with nRF54L15 development (NCS 2.8.0)
  4. Channel Sounding preview

Next Level multi-protocol SOC -nRF54L Series

A. NEW generation nRF54L15 Soc Series

Key Features:
– ARM Cortex M33 + RISC-V co-processor 128Mhz in Nordic SoC
– Ultra compact Soc variant QFN/WLCSP, 22nm
– 2x the processing power, 3x the processing efficiency
– Industry-leading power consumption for battery-critical applications
– Global RTC wake-up from system-off
– Compatible with Raytac WIFI module -AN7002Q series
– High throughput 4MB proprietary radio mode
– Bluetooth Specification 6.0 / Support Channel sounding (Pending firmware)
– PSA(Platform Security Architecture) security level 3 qualified

Raytac’s nRF54L15 Modules
– AN54LQ-15 (Regular) & AN54LV-15(Compact)


B. Comparison among nRF54L15/ nRF5340/ nRF52840/ nRF52832 SoC modules

If you are familiar with Nordic nRF52, nRF53 module series, you will have better idea to tell the difference heading to NRF54L series by referring to the chart as below. (Click on the picture to zoom in)


C. Get started with nRF54L15 development (NCS 2.8.0)

nRF54L15 SoC Spec  << access link
Nordic nRF54L15 DK  << access link
Raytac AN54LQ-DB-15   << access link to be updated

Photo of Nordic nRF54L15 DK


Preparation of Hardware:
1. 1x Nordic NRF54L15 DK (PCA10156-0.9.1)
(Note: If you have PDK (PCA10156-0.8.1) on hand, it can be done in trial phase)
2. 1x Raytac AN54LQ-DB-15
3. 1x IDC Ribbon wire
4. 2x USB-C connector wires (for powering the kit up)

Note: Using Nordic nRF54L15DK / nRF54L15PDK as debugging tool and Raytac Demo board-AN54LQ-DB-15 as simulated carrier board(main board) to proceed the program of nRF54L15 for code compiling and development.

Tips: Please align the red edge of Ribbon at side of 1 in connector J1.


Step 1 —- Connected NRF54L15 DK and AN54LQ-DB-15 by IDC Ribbon wire
Step 2 —- Powering on both NRF54L15 DK and AN54LQ-DB-15 by USB-C connector


<<  Schematic of AN54LQ-DB-15(Updated on 21-Jan-2025)  >> (Click on the picture to zoom in)


Software Kits Resource & Preparation
Download nRF Connect For Desktop (Please Click Me)
Download nRF Command Line Tools (Please Click Me)


Preparation
1. Prepared with the latest version of nRF Connect for Desktop and Select version Windows 64-bit – 5.1.0
2. Prepared with the latest version of nRF Command Line Tools and Select version Windows x86 64-10.24.2
**Note: SEGGER J-LINK Upgrade message might pop up while you’re doing above download.

 If you’re initiating Segger Embedded Studio (SES) application, please check the guideline here(Click me) 

3. Locate all the necessary kits for programming in PC (Check Software/Application list)


Get started with building your program

Intro: The development tool of nRF Connect SDK(NCS) equipped with free VS (Visual Studio) Code IDE for firmware compile and programming.
Note: it is highly recommended to apply NCS 2.8.0 for advanced features of nRF54L15.

Step 1 —- Activate your “nRF Connect for Desktop”  >> “Toolchain Manager” >> “Open” >> “Install”


Step 2 —- You will find multiple options of NCS V x.x.x in the tool, we’re using NCS v2.8.0 as example to run sample code of nRF54L15.


Step 3 —- Make sure the NCS v2.8.0 is installed at same directory with compiling system. (the root of Open VS Code) (This is using C:\ncs  as example.)


In case to organize the files, do “Select directory’” and “Confirm”.


Step 4 —- After nRF Connect SDK v2.8.0 Download ready , go “Open VS Code”.


Step 5 —- Go “Open Existing Application” , and activate example code: Bluetooth > peripheral_uart


Step 6 —- Moving to program build & compiling by selecting dev kit: nrf54l15dk/nrf54l15/cpuapp


Step 7 —- You will get a .hex file after the above programming compiling process.


Step 8 —- Functions are available for during the code compiling process under “ACTIONS” in VS Code IDE
<< Build >>


<< Debug >>


<< Flash >>


Firmware Programming
It is feasible to do the firmware programming using nRFConnect SDK (NCS) tool.
Developer may use “Programmer” to do the firmware flashing with the candidate .hex file.

Step 1 —- Execute nRF Connect for Desktop >> Programmer >> Open


 “Select Device”


Select ”nRF54L15 DK


“Add File”


Step 2 —- Select the candidate .hex file

Select “Erase & Write”


It indicates the programming process is on the way↓


The firmware programming process is done after seeing “Completed” in system Log field.


Step 3 —- Use the mobile App to make sure the Bluetooth broadcasting is functioning after the firmware flashing process is successfully done to the module.


D. Channel Sounding Preview

What is Channel Sounding? —- Advance the “Find My” feature into next level accuracy
Have you ever concerned about the distance accuracy when you’re using RSSI to get the distance between devices and to evaluate the transmission distance with legacy Bluetooth module?
Nordic NRF54 solution has taken us into next level with Channel Sounding feature that achieves the “centimeter-level” distance accuracy. Early implement achieves 10-20cm in the record.

Credit: Bluetooth Alliance


How does Bluetooth Channel Sounding work?
Bluetooth Channel Sounding implemented with Phased-Based Ranging (PBR) & Round-trip time (RTT)(the concept idea of TOF time of flight) algorithm to achieve a higher precision of measuring distance between 2 devices.

Phased-Based Ranging (PBR):
Signal has been sent between initiator and reflector with multiple frequency to increase measuring accuracy.

Credit: Bluetooth Alliance


Round-trip time (RTT): It’s the concept of utilizing TOA (Time of arrival). Using TOD(Time of departure) & TOA to measure the timing during the packet transmission between devices.

Credit: Bluetooth Alliance


Potential applications:
Personal item finding
Secure access control
Smart lock system
Digital Key
Asset Tracking


Reference:
Bluetooth Channel Sounding
nRF54L15 DK hardware
nRF Connect SDK Documentation
Nordic Dev Zone forum
AN54LQ-15 Module series


Edited by Business Development Manager: Ms. Jocelyn Tsai
Technical guidance provided by R&D Manager: Mr. MW Lee & Mr. Stanley Huang




Raytac Corporation 勁達國際電子股份有限公司
A Bluetooth, Wi-Fi, and LoRa Module Maker based on
Nordic nRF54; nRF53: nRF52; nRF51; nRF7002
Semtech Specification: SX1262


Bluetooth Specification: BT6 ; BT5.4 ; BT5.3 ; BT5.2.
Wi-Fi Specification: Wi-Fi 6
LoRa Specification: LoRaWAN


All products are FCC/IC/CE/Telec/KC/RCM/SRRC/NCC/WPC Pre-Certified.
http://www.raytac.com
email: sales@raytac.com
Tel: +886-2-3234-0208