Can't sniff for CoAP packets with tcpdump command despite running coap server and coap clients

[jtaySWE]

I run tcpdump -i wpan0 -w - > wpan0.pcapng to capture packets on openwrt router running border router and coap server. However the command I use is not capturing any coap packets, as i can't see them when i open wireshark. Has anyone else had this problem before?

[jwhui]

The behavior you are observing is due to the OpenThread core stack intercepting CoAP (UDP) messages before they can be passed to the host network interface.

Technical Explanation

In OpenThread, the IPv6 layer (Ip6::DetermineAction) is responsible for deciding whether an incoming packet should be processed locally or forwarded to the host. If a unicast packet is destined for an IPv6 address that OpenThread considers "local" (such as the Mesh-Local EID, an RLOC, or an OMR address added to the interface), the core stack sets the receive flag to true and the forwardHost flag to false.

Once the packet is handed to the internal UDP stack:

1. Internal Receivers: OpenThread checks if any internal otUdpReceiver is registered to handle the packet.
2. Internal Sockets: OpenThread searches for a bound otUdpSocket (e.g., the CLI CoAP service on port 5683 or internal TMF services).

If no internal socket or receiver matches the destination port, the packet is dropped within the OpenThread core. Because the IPv6 layer already decided not to forward the packet to the host, it never reaches the host's network stack, even if the host has an application listening on that same port.

[jtaySWE]

What's the setting that i have to check over to ensure I can intercept coap packets for wireshark?

[jwhui]

Thread's CoAP messages are not delivered to the host network stack.

An alternative is to use a separate IEEE 802.15.4 sniffer to capture the IEEE 802.15.4 frames into a pcap file and decode those within wireshark.