You're not doing anything wrong—it's just that the btsnoop_hci.log file contains low-level Bluetooth HCI traffic (like commands, events, and data packets) and does not include high-level Android log messages such as W/bt_btm: btm_sec_disconnected, which are only available in logcat. Wireshark can decode and display the raw HCI packets, but it won’t show Android-specific logs or debugging information from the Bluetooth stack. To fully troubleshoot the issue, you should analyze both the HCI log in Wireshark for protocol-level behavior and use logcat to see system-level events and disconnection reasons.