Vendor BLE sniffer firmware (nRF52 DK / dongle) with a Wireshark plugin. Easy and well-documented, but follows a single connection and is less capable than Sniffle for adversarial work.
nRF52840-dongle firmware implementing the InjectaBLE strategy: eavesdrop a connection and inject link-layer frames to hijack a role or run a man-in-the-middle.