For the "simple user" with NRFsniffer1.0.1 here is a basic help on how to use wireshark 2.3.0 or more (note it will be simplified if Nordic does an update of it's nRFsniffer):
open the sniffer
open wireshark
go to capture->options->manage interfaces...->pipes
add \.\pipe\wireshark_nordic_ble in the field
press OK and start the capture on this interface (for me I have to press several times for it to work)
For the first time only you open Wireshark:
go to edit->preferences->protocols->DLT_USER
edit the encapsulation table and add "user10 (DLT=157)" with "nordic_ble" in payload protocol field.
@Cdealti implemented pipes in his fork https://github.com/cdealti/Adafruit_BLESniffer_Python/ but overwrote the logging so I figured you wouldn't take it as a PR. I kept his cleaner reporting (which I can remove if its a dealbreaker) and brought in his pipe work as an argument. I could see disabling file logging if you enable pipe, but I left it for now.
Looks like this now with verbosity off
Jacobs-MacBook-Air:Adafruit_BLESniffer_Python jacobrosenthal$ python sniffer.py /dev/tty.usbmodem1411 -p
Capturing data to logs/capture.pcap
Connecting to sniffer on /dev/tty.usbmodem1411
Scanning for BLE devices (5s) ...
Found 8 BLE devices:
[1] "" (00:22:D0:2A:E4:A3, RSSI = -64)
[2] "" (33:B2:5F:DA:48:D6, RSSI = -103)
[3] "" (B0:03:4B:F1:75:F3, RSSI = -50)
[4] "" (D0:03:4B:45:EC:F1, RSSI = -103)
[5] "" (D0:03:4B:31:75:F2, RSSI = -103)
[6] "" (0B:F2:C4:87:78:2C, RSSI = -103)
[7] "" (F8:B2:3F:43:6E:F3, RSSI = -100)
[8] "oura_0_E32000D86085" (E3:20:00:D8:60:85, RSSI = -84)
Select a device to sniff, or '0' to scan again
> 1
Attempting to follow device 00:22:D0:2A:E4:A3
Pipe ready, run: wireshark -Y btle -k -i /Users/jacobrosenthal/Downloads/Adafruit_BLESniffer_Python/logs/ble.pipe
connected: False, packets: 2695, missed: 0
Wireshark supports pipes natively now as of 2.3 https://devzone.nordicsemi.com/question/79845/nrf-sniffer-support-for-wireshark-v203/
@Cdealti implemented pipes in his fork https://github.com/cdealti/Adafruit_BLESniffer_Python/ but overwrote the logging so I figured you wouldn't take it as a PR. I kept his cleaner reporting (which I can remove if its a dealbreaker) and brought in his pipe work as an argument. I could see disabling file logging if you enable pipe, but I left it for now.
Looks like this now with verbosity off