Version3.4.1
Revision2
Size0.9 MB
LicenseGPL-3.0-or-later
Confinementstrict
Basecore24

Bluetooth protocol analyzer, like Wireshark, but for the Bluetooth airwaves around you

ScreenshotScreenshotScreenshotScreenshot

Shark Tooth is a Bluetooth protocol analyzer for Linux: the Bluetooth
counterpart to a wired packet sniffer. It uses the system BlueZ stack to:

* Discover nearby Bluetooth / Bluetooth LE devices and watch their
 advertisement broadcasts in real time (name, address, RSSI, service
 UUIDs, manufacturer data, service data).


* Monitor the local adapter's state and decode every observation into
 readable, drill-down fields — the way Wireshark decodes a wired capture.


* Record a session and export it to a .pcap capture (opens in Wireshark
 as HCI LE Advertising Reports) or .jsonl for your own tooling.


It is built for debugging your own Bluetooth devices and for authorized
security research. It observes broadcast advertising data and your own
adapter's state through the standard BlueZ APIs; it does not and cannot
decrypt or covertly intercept third parties' paired, encrypted links.

Confinement note: this snap requests only the Bluetooth interface it
genuinely needs (bluez) plus the desktop runtime from the gnome extension.
It deliberately avoids network, home, removable-media and similar plugs —
captures are written to the snap's own data directory unless you connect
extra interfaces yourself. If capture says no adapter was found, run once:
sudo snap connect shark-tooth-team:bluez

Update History

3.4.1 (2)
25 Oct 2026, 17:45 UTC

Published25 Oct 2026, 17:26 UTC

Last updated25 Oct 2026, 17:39 UTC

First seen25 Oct 2026, 17:45 UTC