Ellisys Bluetooth Explorer 400
Revolutionary Ellisys Rainbow™ Technology

Download the datasheet »

All-Channel, Full-Spectrum, Concurrent Synchronous Capture of
Bluetooth 2.1 BR/EDR, Low Energy and HCI traffic

Bluetooth Days are too short to waste time

Traffic analysis is one of the key day-to-day activities of Bluetooth engineers looking to rapidly test and debug their implementations.  Unfortunately, Bluetooth over-the-air sniffing has always been some difficult task topic.  Legacy sniffing methods suffered from major drawbacks, making them unreliable and unusable in some circumstances, therefore making Bluetooth engineers' lives difficult. 

With its Bluetooth® Explorer™, Ellisys lifts protocol capture and analysis to new heights, radically overcoming drawbacks of those legacy approaches to Bluetooth sniffing.  The new Ellisys All-Channel sniffer robustly records any packet, at any time, from any neighboring piconet, with zero-configuration and without being intrusive. 

With the right tool, your Bluetooth Days will not seem too short anymore!

Why were Bluetooth systems previously so difficult to sniff?

Bluetooth wireless technology was originally designed to be robustly impervious to interference on the much-used ISM 2.4 GHz band, and was also designed to be non-easily sniffable for security reasons.  The two main RF characteristics unique to the Bluetooth specification are:

• Frequency Hopping: packets are transmitted on one chosen channel amongst 79, every 625us, following a pseudo-random sequence.
   
• Data Whitening: packets are scrambled in order to produce an equal distribution of 1s and 0s, avoiding reception of plain packets from neighboring piconets or sniffers.

A standard Bluetooth radio can receive or transmit on only one of the 79 channels at a given time.  Legacy Bluetooth sniffers used a standard single-channel radio.  Because of this inherent limitation, those sniffers had to connect to a piconet’s master device using a mandatorily configured 48-bit address, retrieve the master’s clock, and eventually follow the hopping sequence based on this information.  Main drawbacks of this approach were:

• Complex configuration was required – needs expert users and some prior information
• Was intrusive – the analyzer must interact with the master
• Was non-reliable – loss of sync because of clock drift when master is not active
• Was limited to a single piconet – interference issues are out of scope
• Was not able of recording some connection steps such as paging and inquiry packets 

Ellisys has created a revolutionary sniffer that overcomes all those drawbacks and adds innovative features, opening new horizons to Bluetooth debugging and interoperability testing. 

Revolutionary Ellisys Rainbow™ All-Channel Capture Technology

This multi-protocol, multi-band and multifaceted protocol analysis system is powered by the revolutionary Ellisys Rainbow™ all-channel capture engine.  With this breakthrough technology, Ellisys hardware is capable of capturing concurrently all 79 BR/EDR channels as well as all 40 Low-Energy channels, plus related HCI traffic for cross-analysis. 

Former single-channels capture

Ellisys Rainbow All-Channel Capture

               
The above illustrations show how legacy sniffers received packets by listening
to a single channel at a time, compared to the Ellisys Rainbow All-Channel capture
catching all Bluetooth packets by listening to a 80 MHz wideband
frequency range concurrently

With this method the Ellisys Bluetooth® Explorer does not need to follow the hopping sequence of a given piconet; it can receive any packet from any neighboring device!  Smart post-capture analysis groups packets into physical channels and determines devices states, displaying useful high-level information on master and slaves.  

Stop Hopping – It Just Works!

What about security?

Ellisys developed smart security algorithms to further ease engineers' lives.  The Ellisys software application will automatically determine PIN codes and Link Keys when pairing are detected.  Resulting link keys can be stored, such that any further traffic capture from the same devices will be decrypted automatically.

SSP (Simple Secure Pairing) is also supported.  SSP uses encryption methods similar to the methods used on the Internet, to secure sensitive information exchanges, such as banking transactions.  No algorithm can help automatically determine the keys for decrypting packets. The link key must thus be specified to the analysis software for decryption.  Ellisys eases this process by automating link key extraction from HCI traces. 

Next page »

More

» Product Overview
» Software Download
» Technical Specifications
» Purchase