User Manual
BPA100
Bluetooth Protocol Analyzer
071-0904-01
This document supports firmware version 2.1 and
above.
www.tektronix.com
Copyright © Tektronix, Inc. All rights reserved.
Tektronix products are covered by U.S. and foreign patents, issued and
pending. Information in this publication supercedes that in all previously
published material. Specifications and price change privileges reserved.
Tektronix, Inc., P.O. Box 500, Beaverton, OR 97077
TEKTRONIX and TEK are registered trademarks of Tektronix, Inc.
Bluetooth is a trademark of Telefonaktiebolaget L M Ericsson, Sweden
WARRANTY
Tektronix warrants that the products that it manufactures and sells will be free from defects
in materials and workmanship for a period of three (3) years from the date of shipment. If a
product proves defective during this warranty period, Tektronix, at its option, either will
repair the defective product without charge for parts and labor, or will provide a
replacement in exchange for the defective product.
In order to obtain service under this warranty, Customer must notify Tektronix of the
defect before the expiration of the warranty period and make suitable arrangements for the
performance of service. Customer shall be responsible for packaging and shipping the
defective product to the service center designated by Tektronix, with shipping charges
prepaid. Tektronix shall pay for the return of the product to Customer if the shipment is to
a location within the country in which the Tektronix service center is located. Customer
shall be responsible for paying all shipping charges, duties, taxes, and any other charges for
products returned to any other locations.
This warranty shall not apply to any defect, failure or damage caused by improper use or
improper or inadequate maintenance and care. Tektronix shall not be obligated to furnish
service under this warranty a) to repair damage resulting from attempts by personnel other
than Tektronix representatives to install, repair or service the product; b) to repair damage
resulting from improper use or connection to incompatible equipment; c) to repair any
damage or malfunction caused by the use of non-Tektronix supplies; or d) to service a
product that has been modified or integrated with other products when the effect of such
modification or integration increases the time or difficulty of servicing the product.
THIS WARRANTY IS GIVEN BY TEKTRONIX IN LIEU OF ANY OTHER
WARRANTIES, EXPRESS OR IMPLIED. TEKTRONIX AND ITS VENDORS
DISCLAIM ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR
FITNESS FOR A PARTICULAR PURPOSE. TEKTRONIX’ RESPONSIBILITY
TO REPAIR OR REPLACE DEFECTIVE PRODUCTS IS THE SOLE AND
EXCLUSIVE REMEDY PROVIDED TO THE CUSTOMER FOR BREACH OF
THIS WARRANTY. TEKTRONIX AND ITS VENDORS WILL NOT BE LIABLE
FOR ANY INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL
DAMAGES IRRESPECTIVE OF WHETHER TEKTRONIX OR THE VENDOR
HAS ADVANCE NOTICE OF THE POSSIBILITY OF SUCH DAMAGES.
WARRANTY
Tektronix warrants that the media on which this software product is furnished and the
encoding of the programs on the media will be free from defects in materials and
workmanship for a period of three (3) months from date of shipment. If a medium or
encoding proves defective during the warranty period, Tektronix will provide a
replacement in exchange for the defective medium. Except as to the media on which this
software product is furnished, this software product is provided “as is” without warranty of
any kind, either express or implied. T ektronix does not warrant that the functions contained
in this software product will meet Customer’s requirements or that the operation of the
programs will be uninterrupted or error-free.
In order to obtain service under this warranty, Customer must notify Tektronix of the
defect before the expiration of the warranty period. If Tektronix is unable to provide a
replacement that is free from defects in materials and workmanship within a reasonable
time thereafter, Customer may terminate the license for this software product and return
this software product and any associated materials for credit or refund.
THIS WARRANTY IS GIVEN BY TEKTRONIX IN LIEU OF ANY OTHER
WARRANTIES, EXPRESS OR IMPLIED. TEKTRONIX AND ITS VENDORS
DISCLAIM ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR
FITNESS FOR A PARTICULAR PURPOSE. TEKTRONIX’ RESPONSIBILITY
TO REPLACE DEFECTIVE MEDIA OR REFUND CUSTOMER’SPAYMENTIS
THE SOLE AND EXCLUSIVE REMEDY PROVIDED TO THE CUSTOMER
FOR BREACH OF THIS WARRANTY. TEKTRONIX AND ITS VENDORS WILL
NOT BE LIABLE FOR ANY INDIRECT, SPECIAL, INCIDENTAL, OR
CONSEQUENTIAL DAMAGES IRRESPECTIVE OF WHETHER TEKTRONIX
OR THE VENDOR HAS ADVANCE NOTICE OF THE POSSIBILITY OF SUCH
DAMAGES.
Table of Contents
General Safety Summary v............................
Preface vii............................................
Reference Documents vii................................
Contacting Tektronix viii.................................
Getting Started
Getting Started 1--1.....................................
Product Overview 1--1...................................
Key Features 1--1....................................
Software and Data Files Included 1--2....................
Bluetooth Specification 1--5............................
Bluetooth Protocol Analyzer Configurations 1--5...........
System Requirements 1--6................................
Unpacking 1--7.........................................
Replaceable Parts 1--8....................................
Installation 1--8.........................................
Installation Procedure for New Installs 1--9................
Installation Procedure for Upgrades 1--10..................
Uninstalling DemoCard Software 1--12....................
Uninstalling Earlier Versions of Bluetooth Software 1--12.....
Operating Basics
Operating Basics 2--1...................................
Data Collector Operation 2--1..............................
BPA100 Bluetooth Protocol Analyzer User Manua l
i
Table of Contents
Main Window 2--2....................................
Data Collector Toolbar Buttons 2--5......................
Low Level Trigger Toolbar Buttons 2--19..................
High Level Trigger 2--25...............................
Differences between High Level and Low Level
Example of a Generated Error 2--31.......................
Decryption 2--32......................................
Enable Decryption Procedure 2--34.......................
HCI Terminal 2--35....................................
Exiting the Data Collector 2--35..........................
Packet Analyzer Operation 2--36............................
Main Window 2--36....................................
Packet Analyzer Toolbar Buttons 2--39....................
Context Menu 2--43....................................
Exporting Data 2--49...................................
Exiting the Bluetooth Packet Analyzer 2--49................
Triggers 2--26......................................
Reference
Reference 3--1.........................................
Hardware Specifications 3--1...........................
Bluetooth Radio Specifications 3--1......................
Environmental Specifications 3--1.......................
Dimensions of the Bluetooth Air Probe 3--2................
HCI Terminal Sample Scripts 3--3.......................
Appendices
Appendix A: Regulatory Statements A--1...................
United States of America and Canada A--1....................
European Union (EU) and EFTA A--1.......................
Glossary
Index
ii
BPA100 Bluetooth Protocol Analyzer User Manua l
List of Figures
Figure 1--1: Bluetooth Protocol Analyzer components 1--7....
Figure 1--2: Bluetooth Protocol Analyzer About screen 1--10...
Figure 1--3: USB Update Flash screen 1--11..................
Figure 2--1: Main window of the Data Collector 2--3.........
Figure 2--2: Start new log session... dialog box 2--6...........
Figure 2--3: Select Master... and Select Slave... dialog boxes 2--9
Figure 2--4: Sync view in Independent Mode with values 2--11..
Figure 2--5: Out of Sync view in Independent Mode 2--11......
Table of Contents
Figure 2--6: Data Acquisition Filter Setup... dialog box 2--14....
Figure 2--7: Pre- Post Trigger Setup dial og box 2--15..........
Figure 2--8: Low Level Trigger--Setup window 2--16...........
Figure 2--9: Customize Pattern dialog box 2--20..............
Figure 2--10: Patterns in Hardware property sheet 2--24.......
Figure 2--11: High Level Trigger Setup... dialog box 2--25......
Figure 2--12: Error Packet Generation--Setup window 2--28....
Figure 2--13: Error Select dialog box 2--29...................
Figure 2--14: Standard packet format 2--30..................
Figure 2--15: Packet Analyzer display of error generated
by the Data Collector 2--31.............................
Figure 2--16: Decryption window 2--32......................
Figure 2--17: Decryption of Data diagram 2--33..............
Figure 2--18: Main window of the Bluetooth Packet
Analyzer 2--37.......................................
Figure 2--19: Filter Setup dialog box 2--40...................
Figure 2--20: View Setup dialog box 2 --41....................
Figure 2--21: Packet Hex View window displayed on
topofMainwindow 2--42..............................
BPA100 Bluetooth Protocol Analyzer User Manua l
iii
Table of Contents
Figure 2--22: List view context-sensitive menu 2--43...........
Figure 2--23: Bookmarks dialog box 2--44...................
Figure 3--1: Dimensions of the Bluetooth Air Probe 3--2......
iv
BPA100 Bluetooth Protocol Analyzer User Manua l
General Safety Summary
Review the following safety precautions to avoid injury and prevent
damage to this product or any products connected to it. To avoid
potential hazards, use this product only as specifi ed.
Only qualified personnel should perform service procedures.
To Avoid Fire or Personal Injury
Do Not Operate With Suspected Failures. If you suspect there is damage
to this product, have i t inspected by qualified service personnel.
Do Not Operate in Wet/Damp Conditions.
Do Not Operate in an Explosive Atmosphere.
Keep Product Surfaces Clean and Dry.
Safety Terms and Symbols
Terms in This Manual. These terms may appear in this manual:
WARNING. Warning statements identify conditions or practices that
could result in injury or loss of life.
CAUTION. Caution statements identify conditions or practices that
could result in damage to this product or other property.
Terms on the Product. These terms may appear on the product:
DANGER indicates an injury hazard immediately accessible as you
read the marking.
WARNING indicates an injury hazard not immediately accessible as
you read the ma rking.
CAUTION indicates a hazard to property including the product.
BPA100 Bluetooth Protocol Analyzer User Manua l
v
General Safety Summary
Symbols on the Product. These symbols may appe ar on the product:
CAUTION
Refer to Manual
Double
Insulated
Protective Ground
(Earth) Terminal
vi
BPA100 Bluetooth Protocol Analyzer User Manua l
Preface
This user manual provides you with the information you need to use
the Tektronix BPA100 Bluetooth Protocol Analyz er. The manual is
structured as follows:
H Getting Started provides a description of the Bluetooth Protocol
H Operating Basics provides instructions for using the Data
H Reference contains hardware specifications, Bluetooth radio
H Appendix A contains various regulatory stat ements.
H Glossary contains terms used in the manual.
Analyzer, lists the system requirements, and provides instructions
for installing and uninstalling the associated software.
Collector and the Bluetooth Packet Analyzer.
specifications, and sample HCI terminal scripts.
Reference Documents
The following third--party documents provide additional information:
H HCI Terminal Guide (Digianswer #00--11--03) provides
information about using a HCI terminal as an interface with
Bluetooth hardware.
H Bluetooth Revealed (Prentice Hall, Inc., ISBN 0-- 13--090294--2)
provides background on several are as including the basic
technology, the Bluetooth specification with information about
the protocol stack, Bluetooth profiles, and the future of the
technology.
H Bluetooth: Connect without Cables (Prentice Hall, Inc., ISBN
0--13--089840--6) provides less background about the technology
and more i n--depth information about the protocol stack and other
areas. This book provides many diagra ms.
BPA100 Bluetooth Protocol Analyzer User Manua l
vii
Preface
Contacting Tektronix
Phone 1-800-833-9200*
Address Tektronix, Inc.
14200 SW Karl Braun Drive
P.O. Box 500
Beaverton, OR 97077
USA
Web site www.tektronix.com
Sales
support
Service
support
Technical
support
* This phone number is toll free in North America. After office
hours, please leave a voice mail message.
Outside North America, contact a Tektronix sales office or
distributor; see the Tektronix web site for a list of offices.
1-800-833-9200, select option 1*
1-800-833-9200, select option 2*
Email: techsupport@tektronix.com
1-800-833-9200, select option 3*
1-503-627-2400
6:00 a.m. -- 5:00 p.m. Pacific time
viii
BPA100 Bluetooth Protocol Analyzer User Manua l
Getting Started
Getting Started
This section contains a description of the Tektronix BPA100
Bluetooth Protocol Analyzer, the system re quirements, a list of the
product components, and procedures for installing and uninstalling
the application software.
Product Overview
The Bluetooth Protocol Analyzer facilitates the development of
Bluetooth devices by providing a tool that can nonintrusively and
independently intercept the baseband traffic, log, decode, and
analyze the packet data transmitted and received over a Bluetooth
piconet. The Bluetooth Protocol Analyzer also can function as a
prototype debug tool that is capable of participating in a pi conet,
either as a master or a slave, to initiate various modes of operation,
introduce intentional errors, and act as a known reference device.
The Bluetooth Protocol Analyzer consists of a Blue tooth Air Probe
with USB connector, a custom USB cable, a CD-ROM containing
application software, and a user manual (see Figure 1-- 1 on
page 1--7).
Key Features
The following list notes the ke y features of the BPA100 Bluetooth
Protocol Analyzer:
H Provides decryption in Piconet Mode or Independent Mode.
(Version 2.1)
H Enables users to use the HCI terminal application (software
provided with Version 2.1) to control the BPA100 in Piconet
mode
H Synchronization enhancement provides new capabilities to set
drift value in PPM, which is useful when the link goe s to sniff,
hold, or park mode (Version 2.1)
BPA100 Bluetooth Protocol Analyzer User Manua l
1- 1
Getting Started
H Provides capture and display of paging sequence while in
Independent Mode and using slave inquiry sync mode (Version
2.1)
H Complies with Bluetooth 1.1 specification (Version 2.1)
H Provides reliable analysis using a fully--c ompliant product based
on proven Digianswer technology
H Operates in either Independent or Piconet (master/slave) mode,
which allows you the maximum test and debug flexibility
H Allows you to use advanced triggering and filtering to capture,
log, and display only those event s or transactions of interest,
making it easier to track down faults and optimize storage
H Allows you to use the Free Run Analyzer Display funct ion to
continuously monitor the latest session transactions with
real-time screen updates while logging directly to the hard disk
of the PC
H Provides maximum log history file siz e by direc tly logging to the
hard drive of the PC, allowing for long-term monitoring of
packet traffic to uncover intermittent problems over extended
time periods
H Captures and logs all baseband packets transmitted within a
Bluetooth piconet, including retransmitted packets, for full
session transaction audits
H Isolates, decodes, and displays baseband, LMP, L2CAP,
RFCOMM, SDP, OBEX, and TCS commands, events, and data
packets for effective visibility into higher protocol layers
H Enhances your control of the appl ication by supporting test
modes (in Independent mode, Version 2.1), data whitening, and
other low level acquisition parameters
Software and Data Fi les Included
You are provided with the following software applications and data
files on the CD-R that is shipped with the BPA100 Bluetooth
Protocol Analyzer:
1- 2
H Tektronix Bluetooth Data Collector
BPA100 Bluetooth Protocol Analyzer User Manua l
Getting Started
H Tektronix Bluetooth Packet Analyzer
H Digianswer Bluetooth Neighborhood (version 1.09)
H Digianswer HCI Terminal application
H Samples
H BPA100 User Manual.pdf
Bluetooth Data Collector. You use the Data Collector to set up a log
session during which you can intercept all the data transmitted
between the devices forming a Bluetooth piconet.
Bluetooth Packet Analyzer. You use the Bluetooth Packet Analyzer to
analyze the data logged during a session. The Packet Analyzer can
display all the baseband packets logged and isolate, de code, and
display LMP, L2CAP, RFCOMM, SDP, OBEX, and TCS packets.
Bluetooth Software Suite. The Bluetooth Software Suite is a collection
of Bluetooth applications created by Digi answer. It is composed of
the following applications:
H Bluetooth Neighborhood
H Bluetooth Configuration Tool
H Object Editor
Among other functions, you can use the Bluetooth Neighborhood
application to do the following:
H Device discovery. Find out which remote Bluetooth devices are
available within your range.
H Service discovery. Find out which services (applications) a
remote device facilitates.
H Links. Establish links to remote devices.
You can use the Bluetooth Configuration Tool to associate one or
more appropriate profiles with a Bluetooth COM port and then add
the COM port to your Local Services bar in the Bluetooth Neighborhood window.
BPA100 Bluetooth Protocol Analyzer User Manua l
1- 3
Getting Started
You can use the Object Editor to send objects like messages, notes,
or business cards if you do not have Microsoft Outlook installed on
your system.
For an overview (Beginner’s Guide) and detailed information when
using the Bluetooth Neighborhood, click the Help button in the
application. In addition, three portable document format (PDF) files
are installed with the Bluetooth software. These are printable
versions of the Help files and the BPA100 manual.
H Bluetooth Beginner’s Guide, An introduction to the Bluetooth
Technology
H Bluetooth Software Sui te User’s Manual
H BPA100 Bluetooth Protocol Analyzer User Manual
NOTE. While using the Bl uetooth Protocol Analyzer, you are advised
not to run applications on your computer other than the Packet
Analyzer, the Data Collector, and the Bluetooth Neighborhood.
HCI Terminal. This application allows you to interact with the
hardware using an interface similar to the interface provided by an
AT Terminal application when communicating with a modem. This
facilitates sending HCI commands from the computer to a Bluetooth
device and receiving responses. This allows you to test your own
Bluetooth hardware. The HCI T erminal Guide provides instructions.
NOTE. The HCI Terminal and the Bluetooth Neighborhood are
different means of creating c onnections and generating traffic. Only
one can be run at a time; you cannot run the HCI Terminal and
Bluetooth Neighborhood at the same time.
1- 4
BPA100 Bluetooth Protocol Analyzer User Manua l
Getting Started
Sample Data Files. The Samples folder has log data that you can open
and display in the Data Coll ector and Packet Analyzer without
actually having a piconet connection. This folder is not loaded by the
installer but can be copied from the CD--ROM.
BPA100 User Manual.pdf. This file is the B PA100 Bluetooth Protocol
Analyzer User Manual in Portable Document Format. You must use
the Adobe Acrobat Reader applicat ion to open and print this file. If
you do not have a copy of Acrobat Reader, you can download the
application from the Adobe web site.
Bluetooth Specification
The Bluetooth Specification is a standard containing the information
required to ensure that diverse devices supporting the Bluetooth
wireless technology can communicate with each other worldwide.
The document is divided into two parts: Vo lu me 1 , C ore and
Volume 2, Profiles:
H Volume 1, Core. This is a lengthy and detailed document that
specifies components such as the radio and baseband specifica-
tions, link manager protocol, service discovery protocol,
transport layer, and interoperability with different communication
protocols. It also provides three chapters on test and qualifica-
tion, including Bluetooth Test Mode, Bluetooth Compliance
Requirements,andTest Control Interface.
H Volume 2, Profiles. This document specifies the protocols and
procedures required for different types of Bluetooth applications,
such as service discovery, cordless telephony, serial port, and
synchronization profiles.
To access this two-- part specification on the Web, go to the following
URL address and make your selection:
http://www.bluetooth.com
Bluetooth Protocol Analyzer Configurations
The Bluetooth Protocol Analyzer can be used in two configurations:
independent mode or piconet mode.
BPA100 Bluetooth Protocol Analyzer User Manua l
1- 5
Getting Started
Independent Mode. Configured as an independent unit, the Bluetooth
Protocol Analyzer does not interact directly in the piconet. Instead,
after synchronizing to the piconet, it passively monitors the piconet,
logging all baseband packets transmitted between the master and the
slaves of the piconet. By using advanced triggering and filter
features, you can select data of interest to be logged and analyzed
after the session is completed. These features are discussed in detail
in the Operating Basics section.
Piconet Mode. Configured as a participa nt i n the piconet, the
Bluetooth Protocol Analyzer uses a fully-protocol stack and
participates as the master or a slave in the piconet.
As a master, the Bluetooth Protocol Analyzer logs all baseband
packets between itself and the piconet slave device(s). When set up
as a slave, it logs all packets between itself and the piconet master
device as well as between the master and all other slave devices.
System Requirements
To install and use the application software for the Bluetooth Protocol
Analyzer, it is recommended that your system meet the following
minimum requirements:
H Computer with a Pentium III (500 MHz or faster); a slower
microprocessor can be used but the Data Collector will operate
slower when Free Run mode is used
H Microsoft Windows 98, ME, or 2000 operating system
H 128 MB RAM
H Minimum of 200 MB of free space on the hard-disk
H Monitor resolution of 1024 by 768 pixels or higher
1- 6
BPA100 Bluetooth Protocol Analyzer User Manua l
Unpacking
The BPA100 Bluetooth Protocol Analyzer package contains the
following items (see Figure 1 --1):
1. BPA100 Bluetooth Air Probe
2. CD-ROM containing product software
3. BPA100 Bluetooth Protocol Analyzer User Manual
4. Custom USB cable
Getting Started
1
2
3
4
Figure 1- 1: Bluetooth Protocol Analyzer components
BPA100 Bluetooth Protocol Analyzer User Manua l
1- 7
Getting Started
CAUTION. To ensure compliance with regulatory statements, the
custom USB cable included wi th the BPA100 Bluetooth Protocol
Analyzer has additional shielding. Do not use a standard USB cable
with this product.
Replaceable Parts
You can order replacement parts for the following:
H BPA100 Bluetooth Protocol Analyzer User Manual (Tektronix
replacement part number 071-0904-01)
H Custom USB cable (Tektronix replaceme nt part number
174-4580-00)
H BPA100 Bluetooth Protocol Analyzer Product Software
Installation
The BPA100 installation includes installing hardware, drivers,
documentation, and software applications for the Bluetooth Protocol
Analyzer. If you are installing this software for the first time, see the
Installation Procedure for New Installs in this section.
When a new version of the BPA100 software is released, it may
necessary to update the firmware resident in the Bluetooth Air Probe
as well as the application software, if you are upgrading your
software from a previous version. See the Installation Procedure for
Upgrades in this section.
(Tektronix replacement part number 063--3469--01)
1- 8
BPA100 Bluetooth Protocol Analyzer User Manua l
Getting Started
NOTE. If a Digianswer Bluetooth DemoCard is installed on your
computer, you must uninstall it before you can install the Bluetooth
Protocol Analyzer. See Uninstalling Democard Software on
page 1--12. If you have an older version (v1.0) of the Bluetooth
software installed, see Uninstalling Earlier Bluetooth Software on
page 1--12. For later releases, the installation program uninstalls the
the older software for you.
Installation Procedure for New Installs
1. Insert the Bluetooth Protocol Analyzer CD-ROM.
2. Follow the on-screen steps to complete the installation of the
software. Restart your computer when prompted.
3. Connect the USB cable t o the Blue tooth Air Probe to an available
USB port on the computer.
4. Follow the instructions to install the necessary drivers.
NOTE. If the hardware requires Windows Ethernet drivers to be
installed, you may need your Microsoft Windows installation disk if
the necessary files are not located on the hard drive.
For Windows 2000 installation, the driver installation takes place
in several steps, including USB device, Bluetooth USB Device,
Bluetooth NAT Protocol, Bluetooth Ethernet Adapter, Blue tooth
RFCOMM Protocol, and Bluetooth SDP Protocol.
NOTE. If you must install any drivers manually, they are located on
the CD-ROM at D:\Drivers\Win9x for Windows 98 and ME and at
D:\Drivers\Win2K for Windows 2000 (where D: is your CD-ROM
drive).
5. Restart your computer. You are now ready to operate your
Bluetooth Protocol Analyzer.
BPA100 Bluetooth Protocol Analyzer User Manua l
1- 9
Getting Started
NOTE. When running Windows 2000, do not disconnect the Bluetooth
Probe from the computer unless all t he B luetooth Neighborhood and
Bluetooth Data Collector applications are first closed.
Installation Procedure for Upgrades
1. In the About screen in the Data Collector, note the version of
BPA100 software and firmware you are running.
1- 10
Figure 1- 2: Bluetooth Protocol Analyzer About screen
2. In the Help menu of the Data Collector select www.tek.com/
bpa_support. This connects you to the BPA100 website. Click on
the Software and Drivers link for information on the latest
BPA100 software version.
3. If needed, download the latest version from the website.
NOTE. A CD copy may also be ordered through your local Tektronix
representative.
4. Unzip the downloaded file into a directory of your choice.
BPA100 Bluetooth Protocol Analyzer User Manua l
Getting Started
5. Browse to the directory where you unzipped the file, and run the
usbflash.exe program. Click the Update Flash SW button and
follow the prompts. This upgrades the Bluetooth Airprobe
firmware to the latest version.
Figure 1- 3: USB Update Flash screen
6. Browse again to where you unzipped the files, and run the
setup.exe program.
7. The setup program a sks if you want to remove the previous
version of software. Follow the on-screen steps to remove the
previous version. When prompted, restart your computer.
8. The installation procedure should automatically restart after your
computer reboots. If not, run the setup.exe program to continue
the installation process. Follow the on-screen prompts and restart
you computer when prompted. You are now ready to operate your
Bluetooth Protocol Analyzer.
BPA100 Bluetooth Protocol Analyzer User Manua l
1- 11
Getting Started
Uninstalling DemoCard Software
If a Bluetooth Dem oCard is installed on your computer, you must
uninstall it before you can install the Bluetooth Protocol Anal yzer.
To uninstall the Bluetooth DemoCard:
1. Insert the Dem oCard.
2. Go to Settings/Control Panel in Windows.
3. Open the Add/Remove Program s icon.
4. Select Bluetooth DemoCard from the list, and follow the
on-screen instructions.
5. Remove the DemoCard.
6. Restart your computer.
Uninstalling Earlier Versions of Bluetooth Software
To uninstall the earlier version of the Bluetooth software:
1. Go to Settings/Control Panel.
2. Open the Add/Remove Program s icon.
3. Select the Bluetooth software from the list, and follow the
on-screen instructions. See the following note.
NOTE. As an alternate way to uninstall the older software, select the
Uninstall Bluetooth Software Suite in the program folder.
4. Restart your computer.
You can now install the Bluetooth Protocol Analyzer as described in
Installation Procedure for New Installs on page 1--9.
1- 12
BPA100 Bluetooth Protocol Analyzer User Manua l
Operating Basics
Operating Basics
This chapter describes the features and basic menus for the
Bluetooth Data Collector and the Bluetooth Packet Analyzer
applications.
Data Collector Operation
The purpose of the Bluetooth Data Collector is to monitor the
Bluetooth piconet to which it is connected and to create a log
containing all the baseband packets transmitted between the
Bluetooth devices participating in the piconet. With the Data
Collector, you can:
H Operate as a member of a piconet, as a stand-alone (independent)
unit, or independent with data decryption
H Select the master or slave to which the Bluetooth Protocol
Analyzer is synchronized
H Set the time for which the Protocol Analyzer tries to synchronize
to a piconet master
H Capture all baseband packets transmitted within a Bluetooth
piconet–including packets that are normally not visible for the
host, such as retransmitted packets–and view the status of each
packet and estimated clock and hop frequency
H Select any specified hopping pattern: Europe/USA, Japan,
France, or Spain
H Transmit and receive on a singl e user-defined frequency
H Set a correlation value
H Turn data whitening on and off
H Output data to a log file or view as a real-time display
H Start or stop log sessions manually
H Enable data decryption in Piconet or Indepe ndent Mode.
BPA100 Bluetooth Protocol Analyzer User Manua l
2- 1
Operating Basics
H Display paging sequence in Independent Mode.
H Filter packets during data acquisition (prior to l oggi ng), such as
ID, NULL, POLL, and Access Error packets
H Use high and low level trigger functions to log only the data in
which you are interested.
H Generate known errors for testing and debugging your design.
NOTE. When you use the Bluetooth Data Collector with Bluetooth
Neighborhood, you must use the piconet mode (working as a
participant in a piconet). When you use the Bluetooth Data Collector
in the independent mode (working as a passive listener), you cannot
use it with Bluetooth Neighborhood.
Main Window
Figure 2--1 shows the main window of the Bluetooth Data Coll ector.
Each of the m ajor areas of the main window is described in the text
associated with the number of the area.
2- 2
BPA100 Bluetooth Protocol Analyzer User Manua l
Operating Basics
1 2 3
5
4
Figure 2- 1: Main window of the Data Collector
1. Menu bar. The menu bar contains the File, View, Filter, Trigger,
Generation, and Help menus and their associated menu items.
From the File menu, you can:
H Open files (see Open Old Log Session from Disk on
page 2--5)
H Save Files (see Save Current Log Session to Disk on
page 2--5)
H Start a log session (see Start New Log Session on page 2--5)
BPA100 Bluetooth Protocol Analyzer User Manua l
2- 3
Operating Basics
H Stop a log session (see Stop Current Log Session on
H Quit the application
From the View menu, you can:
H Toggle Always on Top so that the Bluetooth Protocol
H Set default settings for the Data Collector by selecting
From the Filter menu, you can:
H Set up the data acquisition filter to remove unwanted
page 2--13)
Analyzer--Data Collector window appears on top of any other
application windows
Default Settings in the View menu
baseband packets before the data is logged (see Data
Acquisition Filter on page 2--13)
H Set up decryption. See t he Dec ryption of Data diagram on
page 2--33
From the Trigger menu, you can:
H Set the pre trigger and posttrigger buffer sizes (see Pre- Post
Trigger Setup on page 2--14)
H Set high level trigger sequences for RFCOMM and SDP
protocols (see High Level Trigger on page 2--25)
H Set low level trigger sequences for all protocols (see Low
Level Trigger on page 2--15)
From the Generation menu, you can set error packet generation
sequences for testing and debugging (see Error Packet Genera-
tion on pa ge 2--27).
From the Help menu, you can:
H Connect to the Tektronix web site
H Connect to the Digianswer web site
2- 4
H See information about the Bluetooth Data Col lector, such as
the version number and hardware BD address
BPA100 Bluetooth Protocol Analyzer User Manua l
Operating Basics
2. Toolbar buttons. These buttons are shortcuts to many of the
functions of the Bluetooth Data Collector. These buttons are
described in Data Collector Toolbar Buttons on page 2--5.
3. Bluetooth Packet Analyzer button. When you have logged a new
file or opened an old file from the Data Collector, clicking this
button will open the c orresponding file in the Bluetooth Packet
Analyzer.
4. Status bar. Displays the status of the Bluetooth Data Collector.
5. Data window. This window di splays information about the
current log file: location, start and end times, number of
baseband packets logged, log size, and date.
Data Collector Toolbar Buttons
Open Old Log Session from Disk. Click this button to browse in
Windows Explorer and open a previously stored log session.
Save Current Log Session to Disk. Click this button to save the current
log session. The Bluetooth Protocol Analyzer will save three files of
the log file with the following extensions:
H <Filename>.data contains only data. You can open files with this
extension with the Bluetooth Packet Analyzer.
H <Filename>.desc contains text from the Log Description field in
the Bluetooth Data Collector.
H <Filename>.snf are system files that the Bl uetooth Data
Collector uses to reference the log session, including the
associated .data and .desc files.
Start New Log Session. Click this but ton to open the Start new log
session... dialog box as shown in Figure 2--2.
The main sections of this dia log box are Logging Mode, Hopping
Mode, Correlation, Data Whitening, and Output. Each of these
sections are discussed in more detail.
BPA100 Bluetooth Protocol Analyzer User Manua l
2- 5
Operating Basics
Figure 2- 2: Start new log session... dialog box
Logging Mode. Before you can start a new session, decide if you are
going to operate the Bluetooth Protocol Analyzer as an active
member of a piconet (either as a master or as a slave) or as a
stand-alone unit that nonintrusively monitors data flowing across the
piconet. The choices for logging mode are:
H Piconet Member Mode. Use this mode with the Bluetooth
Neighborhood or HCI Terminal to set up the Bluetooth Protocol
Analyzer as an active participant in the piconet. When you start a
log session, the Data Collector logs all baseband packets sent
from and received by your computer, whether the Bluetooth
Protocol Analyzer is acting as a slave or a master.
H Independent Mode. Use this mode to set up the Bluetooth
Protocol Analyzer as a stand-alone unit. The window shown in
Figure 2--4 displays when synchronized in Independent Mode.
You can select one of three kinds of synchronization modes:
H Sync to piconet using master inquiry. In this mode the
synchronization is obtained by performing an inquiry and
using the clock information returned by the master to set the
clock of the protocol analyzer. (You choose the maste r in the
Select Master... dialog box that opens when you click the
Select button. See Figure 2--3.)
2- 6
BPA100 Bluetooth Protocol Analyzer User Manua l
Operating Basics
In some Bluetooth devices, the clock drifts away when the
device is not in conne ct mode; this synchronization mode can
be troublesome if you want to monitor negoti ations during the
connect phase. The problem occurs because there are often
several seconds of delay from the time when the protocol
analyzer obtains the master clock information until the master
actually connects to the slave. Likewise, if the inquiry scan
mode on the Bluetooth device is not impleme nted or disabled
during the connection, this mode cannot be used for
synchronization. See Resync on page 2--12.
H Sync to piconet using a fake connect ion response. This mode
can only be used during the connect phase, when the piconet
master connects to a new slave . T he protocol analyzer
operates as if it were the slave unit chosen in the Select
Slave... dialog box (see Figure 2--3) and obtains the master
clock information by initiating a new connection as if it were
that slave. Immediately after the clock information is
retrieved, the protocol analyzer stops transmitting, and the
piconet master continues the connection attempt with the true
slave.
NOTE. The HCI Terminal application provides user control of the
BPA100 in piconet member mode. See the HCI Terminal topic on
page 2--35.
H Sync to piconet using slave inquiry. This mode can only be
used during the connect pha se and is based on the same
principle as the method mentioned above in Sync to piconet
using fake connection response. Instead of pretending to be
the slave unit chosen in the Select Slave... dialog box (see
Figure 2--3), the protocol analyzer listens for the clock
information sent in the connect phase to the new piconet
slave, and, therefore, does not interfere with the piconet in
any way. To catch the clock information on the right
frequency, it is necessary to obtain the slave clock. This is
done by performing an inquiry to the slave.
BPA100 Bluetooth Protocol Analyzer User Manua l
2- 7
Operating Basics
Click Select in the Start new log session... di alog box (see
Figure 2--2) to select a master or slave. The Select Master... or Selec t
Slave... dialog box opens. Refer to Figure 2--3.
In the Inquiry Timeout dialog box, you can select how long the
Bluetooth Protocol Analyzer performs the inquiry process. The
default time is 12 seconds. However, you ca n set the time from 2
seconds to 60 seconds.
In the Inquiry Access Code dialog box, you can set an inquiry access
code (IAC). There are 64 IACs. The default is the General IAC
(GIAC) which is 0x9E8B33. The remaining 63 access codes are
Dedicated IACs (DIACs). You can set any of the 64 IACs. Although
the GIAC is normally used, you can use a DIAC in certain instances.
For example, a group of users might agree to set their devices to a
specific DIAC to make their devices easier to discover in an
environment with many Bluetooth devices.
Click the Discover button to carry out device discovery and display a
list of all active Bluetooth devices within range.
Click the Select button to synchronize to the device t hat you have
highlighted. Close the Select Master... dialog box after selecting the
device to which you want to synchronize.
In the Start new log session... dialog box (see Figure 2--2) you use
the Timeout (sec) field to set the number of seconds allowed to pass
after synchronization to the piconet when there is no activity in the
piconet. On time-out, the Bluetooth Protocol Analyzer will lose
synchronization and display the message, Out of sync with piconet!.
NOTE. When you use the Bluetooth Data Collector with Bluetooth
Neighborhood, you must use the piconet mode (working as a
participant in a piconet). When you use the Bluetooth Data Collector
in the independent mode working as a passive listener, you cannot
use it with Bluetooth Neighborhood.
2- 8
BPA100 Bluetooth Protocol Analyzer User Manua l
Operating Basics
Figure 2- 3: Select Master... and Select Slave... dialog boxes
BPA100 Bluetooth Protocol Analyzer User Manua l
2- 9
Operating Basics
Sync Indication Panel. When you select Independent Mode as the
logging mode, the Data Collector screen displays a Sync Indication
panel similar to Figure 2--4. The four indicators have the following
functionality:
H Indicator 1 = Inquiry. It is colored Green when the BPA100 starts
the inquiry procedure during master inquiry or slave inquiry. The
indicator is colored Red if the unit that is i nquired does not
answer within a 60-second timeout.
H Indicator 2 = PageScan. Indicator is colored Green when the
BPA100 enters the Page scan part of the synchronization
procedure. It is therefore only present if slave inquiry or fake
connection is chosen. No timeout is present in the part of the
synchronization procedure, therefore the user can only stop the
synchronization by clicking the stop current log session button on
the toolbar.
H Indicator 3 = Connect. Indicator is colored Green when the
BPA100 enters the c hannel hopping sequence (BPA100 searches
for first traffic on the piconet). If no traffic is recorded, the
indicator is colored Red, and the synchronization failed.
H Indicator 4 = In sync. Indicator is colored Green when the first
packet is received on the channel hopping sequence. If the
synchronization to the piconet is lost (41-second timeout) this
indicator is colored Red which means that the synchronization t o
the piconet is lost. When this happens, a screen similar to Figure
2--5 displays.
2- 10
BPA100 Bluetooth Protocol Analyzer User Manua l
Operating Basics
1
2
3
4
Figure 2- 4: Sync view in Independent Mode with values
Figure 2- 5: Out of Sync view i n Independent Mode
BPA100 Bluetooth Protocol Analyzer User Manua l
2- 11
Operating Basics
Hopping Mode. In this section of the Start new log session... dialog
box, you can select e ither Normal hopping or Rx/Tx on single
frequency. If you choose Normal hopping, you must also select the
hopping pattern for the ge ographical area you want (Europe/USA,
France, Spain or Japan).
Or you can select Rx/Tx on single-frequency and specify the desired
frequency (from 2402 MHz to 2480 MHz). This mode is useful for
testing and debugging.
NOTE. To meet FCC regulations, the transmit power is reduced from
20 dBm to 0 dBm when operating in the single -frequency mode.
Correlation. You can set a correlation value in this section of the Start
new log session... dialog box. The correl ation value sets the number
of bits in the sync word of each received packet that must be
matched for the packet to be valid. Normally, the radio uses 54 to 64
bits correlation. The de fault value is 54. The value can range from
40 to 64.
Resync. You can set a resync value in this section of the Start new log
session... dialog box. See Figure 2--2. The resync value sets the drift
in parts per million. If synchronization is lost during a connection,
for example when the link enters Park, Sniff or Hold mode, user can
enter the drift in PPM. Instead of the normal limit of 250 PPM that a
device may drift in Park, Sniff or Hold mode, the user can force the
BPA100 not to use ”window search” by setting the resync drift to 40
PPM (default). This is useful if the user knows that the device ha s a
small drift. This ensures that no packets are lost because of the
window search.
Data Whitening. Data whit ening can be turned on or off. By default,
the function is set to on, which is normal operation for Bluetooth
devices. Data whitening encrypts all data packets that are sent
between Bluetooth devices on a piconet to remove DC bias in the
transmitted data. However, for test purposes, you can turn off data
whitening. In this test situation all devices must have whitening
turned off, or you will get scrambled data.
2- 12
BPA100 Bluetooth Protocol Analyzer User Manua l
Operating Basics
Output. In this section of the Start new log session... dialog box, you
have two choices for where to send the data of the log session. You
can send the output of your log session to a log file, which you can
open later with the Packet Analyzer. Or if you select Free Run
Display (see Figure 2--2 on page 2--6), you can send the data
directly to the list view field in the Bluetooth Packet Analyzer main
window (see Figure 2--18 on page 2--37). When Free Run Display is
selected, the data is also sent to a log file.
Free Run Display. Allows you to continuously monitor the latest
session transactions with real-time screen updates while logging
directly to the hard disk of the PC. This includes the display of both
encrypted and decrypted data.
NOTE. Before starting a new log session using free run display (see
Figure 2--2 on page 2--6), you must first close the Bluetooth Packet
Analyzer application, if it is open.
Stop Current Log Session. Click this button to stop the current log
session. The Data Collector main window wil l now display
information on the start and end times of the log session, number of
baseband packets logged, and log size.
Data Acquisition Filter. Click this button to display the Data Acquisi-
tion Filter Setup... dialog box. See Figure 2--6. You ca n set up this
filter to remove the following baseband packets before the data is
logged: ID packets, NULL packets, POLL packets, and Access Error
packets.
BPA100 Bluetooth Protocol Analyzer User Manua l
2- 13
Operating Basics
Figure 2- 6: Data Acquisition Filter Setup... dialog box
Pre- Post Trigger Setup.
NOTE. This is a menu item under the Trigger menu. There is no
corresponding toolbar butt on for this function.
Select Pre- Post Trigger from the Trigger menu to display the dialog
box for setting pretrigger and posttrigger buffer sizes. See
Figure 2--7. You use this dialog box to set how many packets are
saved prior to the trigger eve nt (0 to 100,000) and how many packets
are saved after the trigger event (user-defined value). If you do not
check the Enable Post trigger box, posttrigger data is saved until you
manually stop the logging or t he hard disk become s full.
2- 14
BPA100 Bluetooth Protocol Analyzer User Manua l
Operating Basics
Figure 2- 7: Pre- Post Trigger Setup dialog box
Low Level Trigger
Click this button to display the L ow Leve l Trigger-Setup window.
See Figure 2--8. You use this window to set up the low level triggers.
Each of the m ajor areas of the Low Level Trigger-Setup window is
described in the text associated with the number of the area.
NOTE. Due to hardware limitations, y ou are allowed only 10
hardware patterns (slots 0 through 9) for low level triggers and/or
error packet generation. Also see Patterns in hardware property sheet
on page 2--24. This means you cannot use both l ow le vel trigger and
error packet generation functions simultaneously.
BPA100 Bluetooth Protocol Analyzer User Manua l
2- 15
Operating Basics
1 2 3 4 5
6 7 8
Figure 2- 8: Low Level Trigger-Setup window
1. Menu bar. T he m enu bar contains the File, Edit, and View menus
and their associated menu items. From the File menu, you can
open an existing Data Collector trigger setup file (*.dct) or save
the current trigger setup as an *.dc t file.
From the Edit menu, you can display the Customize Pattern
dialog box.
From the View menu, you can display the Patterns in hardware
property sheet.
2- 16
BPA100 Bluetooth Protocol Analyzer User Manua l
Operating Basics
2. Toolbar buttons. These buttons are shortcuts to menu items in the
Menu bar. E ach of the buttons has a corresponding menu item in
the menu bar. These buttons are described in Low Level Trigger
Toolbar Buttons on page 2--19.
3. Available patterns. This field displays the available patterns for
the selected tab. You can add a pattern to a sequence in one of
three ways:
H Double-click the pattern you want to add to the sequence
H Highlight the pattern you want to add to the sequence, and
then right-click to display a context-sensitive menu
H Drag the pattern you want to add to the sequence t o the
Patterns in sequence field
There are ten hardware slots into which you can load patterns.
See Patterns in hardware property sheet on page 2--24.
4. Sequences. This field displays the sequences that you have
created. You can create a maximum of four sequences, each of
which can contain a maximum of four patterns. The default
sequence is named Trigger. As you create additional sequences,
they will automatically be named Trigger1, Trigger2, and
Trigger3.
Each sequence is a potential trigger. Whiche ver sequence is
found first triggers the Bluetooth Data Collector to begin logging.
Occurrences of the remaining sequences are indicated in color
and function as markers in the Bluetooth Packet Analyzer
display.
The color codes are as follows:
H Yellow indicates a pattern in an active sequence
H Green indicates the final pattern (low and high-level t rigger
packets)
H Red indicates a time-out
BPA100 Bluetooth Protocol Analyzer User Manua l
2- 17
Operating Basics
For example, the following two seque nces are set up:
If you monitor a connection establishment followed by a
connection detachment, sequence2 will be found first and will be
the trigger. Sequence1 will function as a marker.
5. Patterns in sequence. This field shows the patterns that are
contained in the sequence that is highlighted in the Sequence
field. You can add four patterns to a sequence (see Available
Patterns on page 2--17).
Sequence1 (Status set to Single)
LMP_detach
NULL
Sequence2 (Status set to Single)
LMP_host_connection_request
LMP_accepted
6. Name. This field displays the name of the sequence that is
highlighted in the Sequences field. You can use this field to
change the default name of a sequence that you have created.
Additionally, the settings of the Timeout, Stat us, and Count fields
are applied to the sequence whose name is displayed in this field.
7. Timeout. You use this field to c ontrol how long the application
looks for the next pattern in a sequence. Enter the value as the
number of Bluetooth time units. A Bluetooth time unit is 625 s.
The range for this field is 0 to 65535 time units. If you enter 0,
you disable the time-out. If a time-out precludes a sequence from
completing, a red marker is indicated in the Bluetooth Packet
Analyzer list view and the seque nce is reset.
8. Status. You use this field to control the stat us of each of the
sequences that you have created. This is a different field from
Status in the Customize pattern dialog box. The following four
status selections are available:
H Off. When selected, the highlighted sequence i s disabled and
will not be recognized by t he Bl uetooth Protocol Analyzer.
2- 18
H Single. When single is selected, only the first occurring
sequence whose patterns occur in their listed order will be
marked in the Bluetooth Packet Analyzer display.
BPA100 Bluetooth Protocol Analyzer User Manua l
Operating Basics
H Repeat. Whenever the patterns in the specified sequence
occur in order, they will be marked in the Bluetooth Protocol
Analyzer display.
H Number. When you sel ect number as the status, an additional
field called Count is displayed. The value in this field
determines the number of times the sequence is marked. You
can enter a value from 2 through 200. In all cases, the first
sequence to complete triggers the Bluetooth Data Collector,
and the following sequences are marked in the Bluetooth
Packet Analyzer display.
Low Level Trigger Toolbar Buttons
Load Workspace. Click this button to display the Open dialog box that
allows you to browse and open a Data Collector trigger setup file
(*.dct).
Save Workspace. Click this button to display the Save As dialog box
that allows you to browse and save a Data Collector trigger setup file
(*.dct).
Customize Pattern. Click this button to access the Customize Pattern
dialog box in which you can set up advanced triggering parameters.
See Figure 2--9.
To activate the Customize Pattern button, you must do the following
in the L ow Leve l Trigge r-Setup dialog box (see Figure 2--8 on page
2--16):
H Check the Enable the specified low-level trigger box.
H Set up one or more sequences containing one or more patterns.
H Select the sequence containing the pattern that you want to
modify.
H Select the pattern that you want to modify.
BPA100 Bluetooth Protocol Analyzer User Manua l
2- 19
Operating Basics
Figure 2- 9: Customize Pattern dialog box
Other methods of accessing the Customize pattern dialog box are as
follows:
H Double-click a pattern in the Patterns in sequence field in the
Low Level Trigger-Setup dialog box (see Figure 2--8 on page
2--16).
H Highlight a pattern in the Patterns in sequence field in the Low
Level Trigger-Setup dialog box; right-click in the sequenc e field
to display a context-sensitive menu. Select Customize pattern
from the menu.
2- 20
BPA100 Bluetooth Protocol Analyzer User Manua l
Operating Basics
The fields in the Customize Pattern dialog box are described in the
following text:
Name. This field displays the name of the pattern that you selected to
customize in the Low Level Trigger-Setup dialog box (see
Figure 2--8 on page 2--16).
Status. This field contains information about the status of the pa cket.
This is a different field from Status in the Low Level Trigger-Setup
dialog box. Here Status indi cates whether the packet is an RX or TX
packet. For a receive packet, this field also may contain information
about errors that were in the packet (for example, Header Errors and
Payload Errors). There are no restrictions in what can be specified,
so it is possible to specify a trigger on a TX packet with ac cess error,
although this is not a combination that can occur. You can also
specify the bits to be “ don’tcare”.
All the fields in Customize pattern dialog box are used to set
conditions for trigger to occur. In the Status field you can set some
conditions like trigger only if an error oc curs. The following options
are available in the Status field:
H Access error
H Packet header error (1/3 FEC)
H Packet header error (HEC)
H Payload recoverable error
H Payload non-recoverable error
H Payload error
H Payload length error
H Packet transmit
By right-clicking you can enable and set the condition or make the
condition “don’t care.” For example, if you select the the third
option, then trigger on that pattern occurs only if there is an HEC
error in that pattern. If you select the eighth option, trigger occurs
only if that pattern is transmitted.
BPA100 Bluetooth Protocol Analyzer User Manua l
2- 21
Operating Basics
Estimated Clock. This is the Bluetooth clock for the master used in the
piconet. X specifies that four bits are “don’tcare”. For example,
XXXXXXXX causes the entire estimated clock is to be ignored in
the triggering.
Hop Frequency. In this two-part field, you can ente r a specific
frequency. In addition to the frequency, the channel is displayed (on
the right). The mapping from frequency to channel is (Freq =
2402+Channel), and the mapping goes both ways. For example, if
you specified channel 10, the frequency fiel d automatically displays
2412. You can also select “don’tcare” for these bits.
AM Address. This field set s the Active Member (AM) address. This
address is used to access different members in the piconet. Three bits
are used for this address, that is, eight di fferen t AM addresses are
available. AM_ADDR = 0 is used for broadcast. You can also select
“don’t care” for these bits.
Type. This field specifies the packet type. Four bits are used for the
packet type, that is, 16 different Packet types are available. You can
specify only the packets that are not reserved. You can also select
“don’t care” for these bits.
Flow. One bit is used for flow control in the header. Flow = 0 means
STOP; Flow = 1 means GO. You can also select “don’t care” for this
bit.
ARQN. One bit is used for acknowledgement of the last transmission.
If a packet is received correctly, the ARQN bit is set to 1 in the
return packet. You can also select “don’t care” for this bit.
SEQN. The SEQN is a sequential numbering used to detect
retransmission. You can also select “don’tcare” for this bit.
L_CH. This field specifies the Logical Channel. This field is two bits
and is used to indicate if the packet is a LMP message or a L2CAP
fragment.
Flow. This flow bit is used to control flow on the L2CAP level. One
bit is used for fl ow control in the payloa d. Flow = 0 means STOP;
Flow = 1 means GO. You can also select “don’t care” for this bit.
2- 22
Length. This field allows you to select a specific length to trigger on.
The length can be from 0--339, and you can also select “don’t care”.
BPA100 Bluetooth Protocol Analyzer User Manua l
Operating Basics
Data/Mask. This field spec ifies the payload data (the first row) and the
mask that is used with the data (the second row). A mask of FF will
mask in the whole byte and a mask of 00 wil l mask out the whole
byte. The position of the mask and Data is linked together so that the
value in data index 1 links to the mask at mask index 1 and so on.
Description. You can use this field to enter additional information
(notes) about th e specified patte rn.
Patterns in Hardware. Click this button to display the Patterns in
hardware property sheet, which shows information about the patterns
you have loaded i nto hardware. See Figure 2--10.
NOTE. Due to hardware limitations, y ou are only allowed 10
hardware patterns (slots 0 through 9) for low level triggers and/or
error packet generation. This means you cannot use both low level
trigger and error packet generation functions simultaneously.
BPA100 Bluetooth Protocol Analyzer User Manua l
2- 23
Operating Basics
Figure 2- 10: Patterns in hardware property sheet
2- 24
BPA100 Bluetooth Protocol Analyzer User Manua l
Operating Basics
High Level Trigger
Select High level Trigger... from the Trigger menus to open the High
Level Trigger Setup... dialog box. See Figure 2-- 11. You use this
dialog box to set up high level triggers for the RFCOMM protocol
and the Servi ce Discovery Protocol (SDP).
Figure 2- 11: Hi gh Level Trigger Setup... dialog box
To setup and/or trigger on RFCOMM or SDP protocols, you must
check the Trigger data check box near the top of the dialog box.
When you click the RFCOMM tab and select the Trig on RFCOMM
Data check box, you have the following information fields from
which you can select: SABM, UA, DM. DSC, and UIH. If you check
UIH, additional information fields become active.
BPA100 Bluetooth Protocol Analyzer User Manua l
2- 25
Operating Basics
You can also select Trig on Payload Data to set up a trigger on the
first 8 bytes of payload data. (Values for each byte are 0 through FF.)
Empty fields mean Don’t Care. For RFCOMM, the Payload data
starts from the second byte of the RFCOMM information field; for
SDP, the Payload data starts from the first byte of the SDP parameter
data part.
When you click the SDP tab in the dialog box and select the Trig on
SDP Data box, you can set up t riggers for SDP_PDU (Protocol Data
Unit) transactions, such as Trig on 0x01 SDP_ErrorResponse
between the server and the client. You can select the PDUs on which
you want to trigger by selecting the box next to the SDP_PDUs in
the list displayed in the PDUs section of the dialog box. You can also
select Trig on Payload Data to set up a tri gger on the first 8 bytes of
payload data. (Values for each byte are 0 through FF.)
Differences between High Level and Low Level Triggers
The main difference between Low Level Trigger (LLT) and High
Level Trigger (HLT) is the option to customize the pattern and the
ability to trigger at all layers of Bluetooth stack. Some of the other
features are:
H CIDs (Channel Identifiers) are logical endpoints used in the
L2CAP layer to connec t with other devi ces and are vendorspecific. From 0x0040--0xffff, a vendor can implement as needed.
H If you use a Bluetooth device other than Digianswer, the vendor
might have used a different CID in the L2CAP layer.
H For Digianswer, the SDP layer uses 0x0040 and the RFCOMM
layer uses 0x0041. This information is avai lable in the Description part of the Customize pattern dialog in LLT. This information also is found in the Packet Analyzer when doing service
discovery for SDP and business card exchange for RFCOMM.
H If a Bluetooth de vice has a different CID for SDP and RFCOMM,
you need to find the CID values and change them in Customize
pattern dialog in order to trigger on t hat pattern. For example, if
the Ericssont SDP CID is 0x0FFF then you have to change the
value in Customize Pattern Data field. You do not need to change
the mask value.
2- 26
BPA100 Bluetooth Protocol Analyzer User Manua l
Operating Basics
H For Digianswer:
DATA:000041000173
MASK:0000FFFF01FF
H For other vendor if CID is 0x0FFF
DATA:0000FF0F0173
MASK:0000FFFF01FF
H In HLT the application can find the CID value of the other
device. This occurs when bot h devices exchange the CID value
before establishing a L2CAP connection between the two
devices. It is important for the HLT to have a high pre trigger
buffer value set so t hat the triggers are marked when the log file
is loaded. This is the reason HLT sometimes fails to indicate or
mark, although it actually triggers at the specifi ed pattern.
Error Packet Generation. Click this button to display the Error Packet
Generation-Setup window. See Figure 2--12. This window allows you
to generate error packets for testing the handling of errors and
possible retransmissions. You can use error generation to cross-check
error-correcting algorithms, such as FEC, HEC, and CRC. You can
generate error packets for any baseband packet, such as DM1, DM3,
POLL, and so on. Errors are introduced by individual bits in the
header, payload, or in a custom-defined bit position of the packet.
BPA100 Bluetooth Protocol Analyzer User Manua l
2- 27
Operating Basics
Figure 2- 12: Error Packet Generation-Setup window
NOTE. Error packet generation and low level triggering settings (see
page 2--15) are similar functions. However, due to hardware limits,
you cannot use both functi ons at the same time. Also, see Patterns in
hardware property sheet on page 2--24.
With the exception of the the Error name field, which is explained
below, this window is identical to the Low L evel Trigger-Setup
window (see Figure 2--8 on page 2--16). Refer to Low Level Trigger
on page 2--15 for detailed information.
To generate an error in a sequence you have created, select the
sequence in which you want to insert an error, and then click the
button adjacent to the Error name field. This displays the Error select
dialog box shown in Figure 2--13.
NOTE. If you have more than one pattern in the sequence for which
you are generating an error, the error is sent with the last pattern in
the sequence.
2- 28
BPA100 Bluetooth Protocol Analyzer User Manua l
Figure 2- 13: Error Select dialog box
Operating Basics
You can select from one of the defined header or payl oad errors, or
you can select Custom and enter a bit position and bit operation of
your choosing.
NOTE. Error generation on packets that contain payload data may
not have errors introduced into the access code or into the first few
bytes of the header. This is because the first few bytes of the packet
will already have been transmitted by the time the error packet
generator recognizes this packet as one in which to introduce errors.
Header error. A header with a 1-bit error should be recoverable by
devices receiving the error packet. A 2- or 3-bit error results in an
unrecoverable error in the receiving device. Packets with recovered
errors are indicated in green text in the list window of the Bluetooth
Packet Analyzer; unrecovered errors are displayed in red text.
Payload error. CRC is used for error checking the payload. Similar
to header errors, a 1-bit error is recoverable; 2- and 3-bit errors are
not recoverable. Bit positions 126 and 127 correspond to the L_CH
of the payload header format. See Figure 2 --14.
BPA100 Bluetooth Protocol Analyzer User Manua l
2- 29
Operating Basics
LSB MSB126 127
Access code Header Payload
Figure 2- 14: Standard packet format
When generating a 2- or 3-bit error, it is recommended that you do
not use the Repeat sta tus (in the Error Packet Generation-Setup
window), since this will result in a continuous, unrecoverable error.
Instead, use the Number status and set the count to a desired value
(for example, set the count to 5).
Custom error . To enter the bit operation for a custom error, click the
Bit operation field to activate a pull down me nu from which you can
choose Forced 1, Forced 0, or Toggle as the bit operation. It is
recommended that you use Toggle instead of Forced 1 or Forced 0.
72 54 0--2745
2- 30
BPA100 Bluetooth Protocol Analyzer User Manua l
Operating Basics
Example of a Generated Error
In Figure 2--12 on page 2--28, the E rror Packe t Generation-Setup
window was used to create a sequence named Error Seq1 that
contained an LMP_host_connection_req pattern. A Payload error
with 3 bits toggled was set to be transmitted with this pattern. The
status was set to Single, which resulted in the error being transmitted
one time. Figure 2--15 shows the Bluetooth Packet Analyzer display
resulting from transmitting the error.
Under the index ta b, 11229 is highlighted (in blue in the application).
This indicates an error was transmitted. Following this error, 11231
shows that the LMP_host_connection_req pattern was transmitted
again but without the error. (For detailed information about the
Bluetooth Packet Analyzer, refer to Packet Analyzer Operation on
page 2--36.)
Figure 2- 15: Packet Analyzer display of error generated by the Data
Collector
BPA100 Bluetooth Protocol Analyzer User Manua l
2- 31
Operating Basics
Decryption
Click this button to display the Dec ryption window. You use this
window to enable decryption and enter se ttings. The procedure
follows on the next page. See Figure 2--16 and Figure 2--17.
Figure 2- 16: Decryption window
The Data Collector is responsible for detection of Kc’ (see Bluetooth
Specification 1.0B or 1.1). Selecting this option is similar to the
selection of piconet member mode in that the LinkKey and PIN
(code) are requested through a dialog box.
When a log session is started, data is logged to the log file with
packets for both encrypted and decrypted packets. The log file also
includes LinkKey or PIN information.
2- 32
BPA100 Bluetooth Protocol Analyzer User Manua l
Operating Basics
USB diver
All data from DSP
Logging mode
Log file
Free run mode
LOG file (both
encrypted and
decrypted data)
Data Collector
COM (encrypted and
decrypted data)
Packet Analyzer
Figure 2- 17: Decryption of Data diagram
The Packet Analyzer displays decrypted data in real time mode if
performance is critical, or it can open a log file and display either
decrypted or encrypted packets. In the case of encrypted packets, it
is possible to decrypt using the LinkKey or PIN used during
acquisition, or enter a LinkKey or PIN using the Decryption dialog
box. This is explained in the procedure that follows on page 2--34.
Decryption in Independent Mode. Bluetooth security supports
authentication (unidirectional or mutual) and encryption, which are
based on a secret LinkKey that is shared by a pair of devices. This
secret key is derived during initialization and is not disclosed.
Authentication. The size of the LinkKey is always 128 bit. In
encryption it may vary from 8--128 bits (the authentication key is
used in generating the encryption key).
Pairing. This is an authentication process. You do not have to
calculate the LinkKey using a complex algorithm. Enter the PIN
code (optional ASCII entry) used between maste r and slave for
authentication. In pairing, the K
value is calculated and used for
init
decrypting the data transaction between master and slave (see note).
BPA100 Bluetooth Protocol Analyzer User Manua l
2- 33
Operating Basics
NOTE. When using decryption in Independe nt Mode wit h the Pai ring
option, there are some keys generated that are displayed in the Data
Collector main window. The keys that are displayed are: Random
number, Kc, Kc prime, and LinkKey. See Figure 2--4.
Encryption Setup. The following setup has to be made in Bluetooth
Neighborhood to enable encryption.
1. In the Bluetooth menu, select Bluetooth Neighborhood
Properties-Security tab. For Security Mode, select Link level
security and enable the Encryption Mode option.
2. Once bonding is established bet ween master and slave, to use
decryption in independent mode, you need to expire bonding.
Right-click the device bonded in Bluetooth Neighborhood and
select expire bonding.
Enable Encryption Procedure. Use the following procedure to enable
decryption in the Data Collector:
1. From the Data Collector main window, select Decryption from
the Filter menu.
2. In the Decryption dialog box (see Figure 2--16), click the Enable
Decryption box.
3. Make your other selections from the foll owing:
H Authentication/Pairing. Choose either Authentication
(default) or Pairing and follow these guidelines:
H If using Authentication, enter the LinkKey.
H If using Pairing, enter the PIN. The BPA100 Protocol
Analyzer derives the LinkKey from the PIN. If entering
the PIN in ASCII, click the ASCII check box as shown in
Figure 2--16.
H Master. Enter the Master BD Address.
H AM Address specifi c. Choose Single session (default) or
Multi session.
2- 34
H LinkKey/PIN. See Authentication/Pairing above.
BPA100 Bluetooth Protocol Analyzer User Manua l
Operating Basics
H AM Address. Make selec tion.
H Slave BD Address. Enter the address.
4. Click OK. Example shows the Enable Decryption box checked.
HCI Terminal
The HCI Terminal application provides a hardware interface similar
to the interface provided by an AT terminal application when
communicating with a modem. The HCI Terminal application
provides control of the BPA100 in piconet member mode . This is
similar to using the Bluetooth Neighborhood from the Software
Suite.
How to create HCI scripts. The HCI Terminal Guide describes the
functionality of the script language. The sample scripts provided will
help you to understand HCI scripting.
NOTE. The HCI Terminal application and Bluetooth Neighborhood
cannot both be used at the same time. For error gene ration you are
advised to use the HCI terminal instead of Bluetooth Neighborhood.
Exiting the Data Collector
To exit a log session in the Data Collector, select Exit from the File
menu.
BPA100 Bluetooth Protocol Analyzer User Manua l
2- 35
Operating Basics
Packet Analyzer Operation
The Bluetooth Packet Analyzer analyzes and displays t he c ontents of
the log files created by the Data Collector. The Bluetooth Packet
Analyzer can do the following:
H Analyze and decode packet information at Baseband, LMP,
L2CAP, RFCOMM, SDP, OBEX, and TCS protocol levels
H Export data to .CSV (comma sepa rated value) files readable by
other applications, such as Microsoft Excel
H Display error packets and access errors
H Indicate trigger packets, defined sequences, and generate error
packets
H Display packets continuously as the packets are received and
logged (this free run mode is initiated in the Bluetooth Data
Collector application, see Figure 2--2 on page 2--6.)
Main Window
Figure 2--18 shows the main window of the Bluetooth Packet
Analyzer. Each of the maj or areas of the main window is described
in the text associated with the number of the area.
1. Menu bar. T he m enu bar contains the File, Edit, View, and Help
menus and their associated menu items.
From the File menu you can:
H Open files (see Opening a File on page 2--39)
H Export data to a comma separated value file (.csv)
H View the properties of the current log file, such as Name and
Size
H Exit the application
From the Edit menu you can:
H Switch a bookmark on or off (see Toggle Bookmark on
page 2--44)
2- 36
BPA100 Bluetooth Protocol Analyzer User Manua l
Operating Basics
H Set the L2CAP connect ion properties (see L2CAP Connection
Properties on page 2--45)
H Highlight L2CAP connections (see Highlight L2CAP
Connection on page 2--45)
1
2
7
6
3
4
5
Figure 2- 18: Main window of the Bluetooth Packet Analyzer
H Highlight AM_ADDR (see Highlight AM_ADDR on
page 2--45)
H Highlight fragmentation (see Highlight Fragmentation on
page 2--45)
BPA100 Bluetooth Protocol Analyzer User Manua l
2- 37
Operating Basics
H Switch the display of payload data between Hexadecimal or
H Clear toggled fields (see Clear Toggled Fields on page 2--45)
H Clear highlights (see Clear Highlights on page 2 --45)
From the View menu, you can:
H Switch the toolbar on or off
H View and change the filter setup (see Filter Setup on
H View and change the view setup (see View Setup on
ASCII format (see Toggle Hex/ASCII in Pay load on
page 2--45)
page 2--40)
page 2--41)
H Open the Bookmarks window (see Figure 2--23 on page 2--44)
H Go directly to any packet number that you want
H Search (Find and Find Next)
H Open and change the Packet Hex View window (see Hex View
on page 2--42).
H Switch the display of packet information on or off
From the Help menu you can:
H Connect to the Tektronix web site
H Connect to the Digianswer web site
H See information about the Bluetooth Packet Analyzer, such as
the version number
2. Toolbar buttons. These buttons are shortcuts to many of the
functions of the Bluetooth Packet Analyzer. Each of the buttons
has a corresponding menu item i n the me nu bar (except for the
Go One Level Back and Go to Next Level buttons). The buttons
are described in Packet Analyzer Toolbar Buttons on page 2--39.
2- 38
BPA100 Bluetooth Protocol Analyzer User Manua l
Operating Basics
3. Tabs. Use these tabs to select which packets of the current log
file you want to see–all baseband packets or specific types and
levels of packets, such as LMP, L2CAP, RFCOMM, and SDP.
The Triggers tab displays triggers and trigger-arming events that
you have defined. The OBEX tab displays file-transfer and
business card data. The TCS tab displays protocol discriminator,
message type, and other data (depending upon the message type).
4. Columns. These columns reflect the elements that you selected in
the view setup, where you can decide which elements you want
the list view to show. See View Setup on page 2--41 for more
information.
5. Status bar. The status bar displays the number of packets logged
of the type: Baseband, LMP, L2CAP, RFCOMM, SDP, OBEX,
and TCS. It also displays the number of trigger packets and
indicates whether a filter (see Filter Setup on page 2--40) is
selected for the packet type being displayed.
6. Packet data. This area displays information about the packet
currently highlighted in the list view. The type of information
that is displayed depends on the type and contents of the pa cket.
Various elements (columns) of packet data can be switched off or
on in the View Setup dialog box (see Figure 2--20 on page 2--41).
7. List view. The list view displays the contents of the current log
file as a list of the packet s that the fil e contains. If the Data
Collector is set to free run mode, the list view will display packet
data as it is rece ived and logged. You can start and stop the
automatic screen updates by pressing the Esc key on your
keyboard.
Packet Analyzer Toolbar Buttons
The following are descriptions of the t oolbar buttons available for
the Bluetooth Packet Analyzer:
Opening a File. Click this button to display the Open dialog box that
allows you to browse and open log files that have the .data
extension. The Protocol Analyzer features especially fast load of
files up to the available physical and virtual memory limitations.
Files exceeding this size will be loaded at a slower rate.
BPA100 Bluetooth Protocol Analyzer User Manua l
2- 39
Operating Basics
Filter Setup. Click this button to open the Filter Setup... dialog box
(see Figure 2--19). The filter function allows you to reduce the
amount of data displayed in the list view. In Baseband, for example,
you can choose to view only LMP and L 2CAP packet s, rather than
all of the transmitted packets. This function can greatly reduce the
number of packets in a log session, making it much easier for you to
work with the data.
2- 40
Figure 2- 19: Filter Setup dialog box
BPA100 Bluetooth Protocol Analyzer User Manua l
Operating Basics
The filter function can be selected for each of the Baseband, LMP,
L2CAP, RFCOMM, TCS, or SDP lists; applying a filter to one of
these lists does not affect the others.
In the Filter Setup dialog box, you can select the l ist of packets to
which the filter function is applied and which data is filtered. The
choice of data varies, depending on which list of packets is selected.
Figure 2--19 shows the dialog box as it appears when Baseband is
selected.
View Setup. Click this button to open the View Setup dialog box (see
Figure 2--20). For each of the tabs representing a packet type
(Baseband, LMP, L2CAP, RFCOMM, SDP, OBEX, and TCS), you
can select which elements are displayed in the list view. You can
click the Triggers tab to view triggers that you have set up. You can
also click the Format tab to change the display radix or type (for
example, decimal, hexadecimal, or binary).
Figure 2- 20: View Setup dialog box
BPA100 Bluetooth Protocol Analyzer User Manua l
2- 41
Operating Basics
In Figure 2--20, the following elements have been selected for
Baseband: Index, Slave/Master, AM_ADDR, and Hop Frequency. By
default, the Description and Payload Data tabs are always present in
the Packet Analyzer main window.
Hex View. Click this button to open the Packet Hex View window (see
Figure 2--21).
2- 42
Figure 2- 21: Packet Hex View window di splayed on top of Main window
The main window only shows the first several bytes of what a packet
contains. However, you can view the entire contents of a packet of
any length by openi ng the Packe t Hex View window. In the View
menu of this window, you can select Hex or Binary. Also, you can
select Stay On Top to keep the di alog box in front of any other
Bluetooth Packet Analyzer windows that are open.
BPA100 Bluetooth Protocol Analyzer User Manua l
Operating Basics
Go One Level Back. Click this button to go to the next lower protocol
(lowest level is baseband) for the packet highlighted in the list view.
You can also press the Backspace key to move to the next lower
protocol.
Go to Next Level. Click this button to go to the next higher level of
protocol for the packet highlighted in the list view. You can also
press the Enter key to go to the next higher level of protocol.
NOTE. Clicking the tabs will change levels of protocol but will not
maintain highlighting or necessarily display the same packet.
Context Menu
You can right-click in the list view area of the main window (see
Figure 2--18 on page 2--37) to display the context-sensitive menu
shown in Figure 2--22.
Figure 2- 22: List view context-sensitive menu
The menu items in the context-sensitive menu are discussed on the
following page.
BPA100 Bluetooth Protocol Analyzer User Manua l
2- 43
Operating Basics
Toggle Bookmark. Click this menu item to toggle a bookmark on or off
for the packet that you ha ve hi ghlighted in the list view. When a
bookmark is assigned to a packet, a large, blue bullet is placed at the
left side of the Index field for the highlight ed packet. See
Figure 2--23.
Bookmarks allow you to quickly display packe ts in which you are
interested. To move to a bookmarked packet, go to the View menu in
the Menu bar, a nd select Bookmarks. The Bookmarks dialog box is
displayed. See Figure 2--23.
Double-click the bookmarked packet that you want to display in the
list view.
2- 44
Figure 2- 23: Bookmarks dial og box
BPA100 Bluetooth Protocol Analyzer User Manua l
Operating Basics
You can measure the time between any two bookmarks in the
Bookmarks dialog box. First click one of the bookmarks to select it.
Then control-click the other bookmark to highlight it. Read the time
between the bookmarks at the bottom of the Bookmarks dialog box
(see Figure 2--23) displayed in hours, minutes, seconds, and
microseconds. Also, time is given in timeticks (625 s per timetick).
L2CAP Connection Properties. Click this menu item to set the L2CAP
packet type for acquisitions where the packet type cannot be decoded
from previous pac kets.
Highlight L2CAP Connection. Click this menu item to highlight the
L2CAP packets in Baseband.
Highlight AM_ADDR. Click this menu item to highlight the AM_ADDR
of active slaves that are connected to the master. AM_ADDR ranges
from 0 through 7.
Highlight Fragmentation. Click this menu item when you have a
fragmented packet selected to highlight all the fragmented packets.
Fragmentation occurs when the payload data is large enough that it
must be segmented and transmitted with more than one packet.
Toggle Hex/ASCII in Payload. Click this menu item to switch the display
of the payload da ta for the highlighted packet between hexadecimal
format and ASCII format.
Clear Toggled Fields. Click this item to return fields that you changed
with a toggle t o the ir original format (does not affect bookmarks).
Clear Highlights. Click this menu item to clear any highlights that you
have set, such as highlights for the AM_ADDR.
Exporting Data
1. On the menu bar click File , a nd then select Export.
2. In the Export dialog box, sele ct a path/folder, and name the file.
3. Click OK.
Exiting the Bluetooth Packet Analyzer
H On the menu bar click File, and then select Exit.
BPA100 Bluetooth Protocol Analyzer User Manua l
2- 45
Operating Basics
2- 46
BPA100 Bluetooth Protocol Analyzer User Manua l
Reference
Reference
This section provides technical information that you may need, such
as hardware specifications and Bluetooth radio specifications.
Hardware Specifications
The Bluetooth hardware specifications are as follows:
H Compliant with the USB Specification, Version 1.1
H Powered through USB cable connected between the host PC and
the Bluetooth Air Interface Probe
H Standby power consumption is 81 mA when Inquiry scan is
enabled; 400 A in Hibernation or Standby mode
H Active power consumption is less than 350 mA
Bluetooth Radio Specifications
The radio specifications for the Bluetooth Air Probe are as follows:
H Bluetooth-qualified device
H Transmit power is +20 dBm (100 mW) in normal mode; 0 dBm,
1 mW in Single Frequency mode
H Receiver sensitivity is better than --80 dBm
H Frequency range is 2.402 -- 2. 480 GHz
Environmental Specifications
The environmental specifications for the Bluetooth Air Interface
Probe are as follows:
H Temperature, operating: 41
H Temperature, nonoperating: --4
H Humidity: 20% to 80%
H Altitude, operating: 1000 ft to 10,000 ft (305 m to 3,050 m)
H Range: 0 ft to 820 ft (0--250 m)
°
F to 122°F(+5°Cto50°C)
°
F to 140°F(--20°Cto+60°C)
BPA100 Bluetooth Protocol Analyzer User Manua l
3- 1
Reference
Dimensions of the Bluetooth Air Probe
Figure 3--1 shows the dimensions of the Bluetooth Air Probe.
4.250 in
(110 mm)
2.750 in
(70 mm)
Figure 3- 1: Dimensions of the Bluetooth Air Probe
1.625 in
(42 mm)
3- 2
BPA100 Bluetooth Protocol Analyzer User Manua l
HCI Terminal Sample Scripts
Use the following samples as a guide to create your scripts.
Sniffer testscript for Master packet types.
report(Sniffer testscript for pa cket types [Master])
report( )
RESET(All)
SETDEBUGLEVEL(81)
SETMAXLOOPCOUNT(5000)
WAITCOMPLETE_ENABLED
//TIMESTAMPS_ENABLED
// Write Scan enable
// Set Event Filter
// Change connection packet type
Reference
TXCMD1A0C0100
WAITEVENT($0E,5000,[TestError])
TXCMD050C03020002
WAITEVENT($0E,5000,[TestError])
// Establish ACL connection
report( )
report(Establishing ACL connection)
label: Establish_one_connection
label: create_connection_retry#1
// NOTE:
// change the Bluetooth address in this command
// if your BD_Addr is 00 50 CD 00 93 38 then it should be reversed
as 38 93 00 CD 50 00
//Itsstarts| | itisreversed
TXCMD05040C389300CD500018CC00000000
WAITEVENT($03,20000,[TestError])
if byte[2] = $04 jump(create_connection_retry#1)
if byte[2] = $10 jump(create_connection_retry#1)
BPA100 Bluetooth Protocol Analyzer User Manua l
3- 3
Reference
report(ACL connection established!)
report( )
delay(1000)
//WAITEVENT($1B,5000,[TestError])
WAITEVENT($1C,5000,[TestError])
WAITEVENT($0B,5000,[TestError])
WAITEVENT($0C,5000,[TestError])
//TXCMD 0F 04 04 00 00 18 CC
//WAITEVENT($1D,5000,[TestError])
report(Connection packet type changed)
report( )
// switch from master to slave
TXCMD0B0807389300CD500000
WAITEVENT($12,1000,[TestError])
// Disconnect ACL connection
// This Device is Slave now so wait for Disconnect from master
label: Disconnect
//TXCMD 06 04 03 00 00 13
WAITEVENT($05,60000,[TestError])
report(ACL connection disconnected)
report( )
label: TestSuccess
report(Test passed!)
report( )
jump(end)
3- 4
label: TestError
report()
report(***************Test failed!*******************)
report()
BPA100 Bluetooth Protocol Analyzer User Manua l
label: end
REPORT(DONE!)
Sniffer testscript for Slave packet types.
report(Sniffer testscript for pa cket types [Slave])
report( )
RESET(All)
SETDEBUGLEVEL(81)
SETMAXLOOPCOUNT(5000)
WAITCOMPLETE_ENABLED
//TIMESTAMPS_ENABLED
// Write Scan enable
// Set Event Filter
// Wait for max slots changed event
Reference
TXCMD1A0C0103
//WAITEVENT($0E,5000,[TestError])
TXCMD050C03020002
WAITEVENT($0E,5000,[TestError])
// Establish ACL connection
report( )
report(Establishing ACL connection)
WAITEVENT($03,60000,[TestError])
report(ACL connection established from master!)
report( )
delay(1000)
WAITEVENT($1B,60000,[TestError])
WAITEVENT($1C,60000,[TestError])
WAITEVENT($0B,60000,[TestError])
WAITEVENT($0C,60000,[TestError])
BPA100 Bluetooth Protocol Analyzer User Manua l
3- 5
Reference
//WAITEVENT($1B,5000,[TestError])
//report(Connection packet type changed from master)
report( )
// ROLE Switch this device becomes master
//WAITEVENT($12,10000,[TestError])
delay(6000)
// Wait for master to disconnect ACL connection
// This device is m aster now so disconnect the connection
label: Disconnect
TXCMD060403000013
WAITEVENT($05,10000,[TestError])
report(ACL connection disconnected from master)
report( )
label: TestSuccess
report(Test passed!)
jump(end)
label: TestError
report()
report(****************Test failed!***************)
report()
label: end
REPORT(DONE!)
Sniffer testscript for Slave connection packet types.
report(BPA100 connection testscript for packet types [Slave])
report( )
3- 6
RESET(All)
SETDEBUGLEVEL(81)
SETMAXLOOPCOUNT(5000)
WAITCOMPLETE_ENABLED
BPA100 Bluetooth Protocol Analyzer User Manua l
Reference
//TIMESTAMPS_ENABLED
// Write Scan enable
// Set Event Filter
// Wait for max slots changed event
TXCMD1A0C0103
WAITEVENT($0E,5000,[TestError])
TXCMD050C03020002
WAITEVENT($0E,5000,[TestError])
REPORT(The following tests are from the test specification)
// Wait for events from master
// When master is done add 1 SCO HV1 connection and disconnect it
5.5.18.1.4 & 5.5.18.1.10
// Establish ACL connection
report( )
report(Establishing ACL connection)
WAITEVENT($03,60000,[TestError])
report(ACL connection established from master!)
report( )
WAITEVENT($1B,5000,[TestError])
report(Connection packet type changed from master)
report( )
// Set some payload
SETPAYLOAD(49 66 20 79 6F 75 20 63 61 6E 20 72 65 61 64 20 74
68 69 73 20 74 68 65 6E 20 79 6F 75 20 68 61 76 65 20 73 65 74 20
74 68 65 20 66 6F 72 6D 61 74 20 6F 66 20 74 68 65 20 70 61 79 6C
6F 61 64 20 74 6F 20 62 65 20 64 69 73 70 6C 61 79 65 64 20 69 6E
20 41 53 43 49 49 2E 20 53 6F 6D 65 74 69 6D 65 73 20 74 68 65
20 50 43 20 67 75 79 73 20 66 6F 72 67 65 74 73 20 74 6F 20 77 72
61 70 20 74 68 65 20 70 61 79 6C 6F 61 64 20 73 6F 20 79 6F 75 20
63 61 6E 20 6E 6F 74 20 73 65 65 20 69 74 20 61 6C 6C 20 61 74
20 6F 6E 65 20 74 69 6D 65 20 74 68 65 6E 20 79 6F 75 20 77 69
BPA100 Bluetooth Protocol Analyzer User Manua l
3- 7
Reference
6C 6C 20 68 61 76 65 20 74 6F 20 63 68 6F 73 65 20 48 45 58 20 76
69 65 77 20 74 6F 20 73 65 65 20 69 74 20 61 6C 6C 2E 20 49 20 74
68 69 6E 6B 20 74 68 69 73 20 73 68 6F 75 6C 64 20 62 65 20 63 68
61 6E 67 65 64 20 61 73 20 73 6F 6F 6E 20 61 73 20 70 6F 73 73 69
62 6C 65 2C 20 68 6F 77 65 76 65 72 20 69 66 20 79 6F 75 20 63 61
6E 20 72 65 61 64 20 74 68 69 73 20 6C 69 6E 65 20 74 68 65 20 70
72 6F 62 6C 65 6D 20 69 73 20 66 69 78 65 64 20 21)
// Test DM1, DH1, DM3, DH3, DM5, DH5 packets
label: NoSCO
REPORT(Testing for DM1, DH1, DM3, DH3, DM5, DH5 packets)
report( )
TXDATA(hCon:0,bc:0,pb:2,Len:1,cnt:500,Random:0)
TXDATA(hCon:0,bc:0,pb:2,Len:2,cnt:500,Random:0)
TXDATA(hCon:0,bc:0,pb:2,Len:3,cnt:500,Random:0)
TXDATA(hCon:0,bc:0,pb:2,Len:4,cnt:500,Random:0)
TXDATA(hCon:0,bc:0,pb:2,Len:5,cnt:500,Random:0)
TXDATA(hCon:0,bc:0,pb:2,Len:6,cnt:500,Random:0)
TXDATA(hCon:0,bc:0,pb:2,Len:7,cnt:500,Random:0)
TXDATA(hCon:0,bc:0,pb:2,Len:8,cnt:500,Random:0)
TXDATA(hCon:0,bc:0,pb:2,Len:9,cnt:500,Random:0)
TXDATA(hCon:0,bc:0,pb:2,Len:10,cnt:500,Random:0)
report()
report(Packets size = 1..10 ”passed”)
report()
// Wait for master to disconnect ACL connection
WAITEVENT($05,60000,[TestError])
report(ACL connection disconnected from master)
report( )
3- 8
label: TestSuccess
report(Test passed!)
jump(end)
BPA100 Bluetooth Protocol Analyzer User Manua l
label: TestError
report(Test failed!)
label: end
REPORT(DONE!)
Sniffer testscript for Master connection packet types.
report(BPA100 Connection testscript [Master])
report( )
RESET(All)
SETDEBUGLEVEL(81)
SETMAXLOOPCOUNT(5000)
WAITCOMPLETE_ENABLED
//TIMESTAMPS_ENABLED
Reference
// Write Scan enable
// Set Event Filter
// Change connection packet type
TXCMD1A0C0100
WAITEVENT($0E,5000,[TestError])
TXCMD050C03020002
WAITEVENT($0E,5000,[TestError])
// Establish ACL connection
report( )
report(Establishing ACL connection)
label: Establish_one_connection
label: create_connection_retry#1
// NOTE:
// change the Bluetooth address in this command
// if you BD_Addr is 00 50 CD 00 93 11 then it should be reversed as
11 93 00 CD 50 00
//Itsstarts| | itisreversed
TXCMD05040C119300CD500018CC00000000
WAITEVENT($03,20000,[TestError])
if byte[2] = $04 jump(create_connection_retry#1)
BPA100 Bluetooth Protocol Analyzer User Manua l
3- 9
Reference
if byte[2] = $10 jump(create_connection_retry#1)
report(ACL connection established!)
report( )
//TXCMD 0F 04 04 00 00 18 CC
//WAITEVENT($1D,5000,[TestError])
report(Connection packet type changed)
report( )
// Set some payload
SETPAYLOAD(49 66 20 79 6F 75 20 63 61 6E 20 72 65 61 64 20 74
68 69 73 20 74 68 65 6E 20 79 6F 75 20 68 61 76 65 20 73 65 74 20
74 68 65 20 66 6F 72 6D 61 74 20 6F 66 20 74 68 65 20 70 61 79 6C
6F 61 64 20 74 6F 20 62 65 20 64 69 73 70 6C 61 79 65 64 20 69 6E
20 41 53 43 49 49 2E 20 53 6F 6D 65 74 69 6D 65 73 20 74 68 65
20 50 43 20 67 75 79 73 20 66 6F 72 67 65 74 73 20 74 6F 20 77 72
61 70 20 74 68 65 20 70 61 79 6C 6F 61 64 20 73 6F 20 79 6F 75 20
63 61 6E 20 6E 6F 74 20 73 65 65 20 69 74 20 61 6C 6C 20 61 74
20 6F 6E 65 20 74 69 6D 65 20 74 68 65 6E 20 79 6F 75 20 77 69
6C 6C 20 68 61 76 65 20 74 6F 20 63 68 6F 73 65 20 48 45 58 20 76
69 65 77 20 74 6F 20 73 65 65 20 69 74 20 61 6C 6C 2E 20 49 20 74
68 69 6E 6B 20 74 68 69 73 20 73 68 6F 75 6C 64 20 62 65 20 63 68
61 6E 67 65 64 20 61 73 20 73 6F 6F 6E 20 61 73 20 70 6F 73 73 69
62 6C 65 2C 20 68 6F 77 65 76 65 72 20 69 66 20 79 6F 75 20 63 61
6E 20 72 65 61 64 20 74 68 69 73 20 6C 69 6E 65 20 74 68 65 20 70
72 6F 62 6C 65 6D 20 69 73 20 66 69 78 65 64 20 21)
3- 10
REPORT(Testing for DM1, DH1, DM3, DH3, DM5, DH5 packets)
report( )
TXDATA(hCon:0,bc:0,pb:2,Len:1,cnt:10,Random:0)
TXDATA(hCon:0,bc:0,pb:2,Len:2,cnt:10,Random:0)
TXDATA(hCon:0,bc:0,pb:2,Len:3,cnt:10,Random:0)
TXDATA(hCon:0,bc:0,pb:2,Len:4,cnt:10,Random:0)
TXDATA(hCon:0,bc:0,pb:2,Len:5,cnt:10,Random:0)
TXDATA(hCon:0,bc:0,pb:2,Len:6,cnt:10,Random:0)
TXDATA(hCon:0,bc:0,pb:2,Len:7,cnt:10,Random:0)
TXDATA(hCon:0,bc:0,pb:2,Len:8,cnt:10,Random:0)
BPA100 Bluetooth Protocol Analyzer User Manua l
TXDATA(hCon:0,bc:0,pb:2,Len:9,cnt:10,Random:0)
TXDATA(hCon:0,bc:0,pb:2,Len:10,cnt:10,Random:0)
report()
report(Packets size = 1..10 ”passed”)
report()
// Disconnect ACL connection
TXCMD060403000013
WAITEVENT($05,10000,[TestError])
report(ACL connection disconnected)
report( )
label: TestSuccess
report(Test passed!)
report( )
jump(end)
Reference
label: TestError
report(Test failed!)
label: end
REPORT(DONE!)
BPA100 Bluetooth Protocol Analyzer User Manua l
3- 11
Reference
3- 12
BPA100 Bluetooth Protocol Analyzer User Manua l
Appendices
Appendix A: Regulatory Statements
This product c omplies with any mandatory product specification in
any country where the product is sold. Addi tionally, the product
complies with the following:
United States of America and Canada
Tested to comply with FCC Standard FOR HOME OR OFFICE USE.
See FCC 47CFR, part 15.19(b)(2).
This device complies with part 15 of the FCC rules and with
RSS-210/RSS-139 of the Industry Canada. Operat ion is subject to the
following two conditions:
1. This device may not cause harmful interference.
2. This device must accept any interference received, including
interference that may cause undesired operat ion.
Note that any changes or modifications to this equipment not
expressly approved by the manufa cturer may void the FCC
authorization to operate this equipment.
European Union (EU) and EFTA
This equipment complies with the R&TTE directive and has been
provided with the CE ma rk ac cordingly.
Note that the radio frequency band used by this equipment has not
been harmonized in all of the EU.
BPA100 Bluetooth Protocol Analyzer User Manua l
A- 1
Appendix A: Regulatory Sta tements
A- 2
BPA100 Bluetooth Protocol Analyzer User Manua l
Glossary
Glossary
ACL
An acronym for Asynchronous Connection-Less link, this
provides a packet-switched connection (master to any slave).
Active Member Address (AM_ADDR)
The Active Member Address is a 3-bit number. This a ddress is
allocated by the master to each active slave in the piconet. The
address is used t o identify the specific slave for which a packet
is intended.
Authentication
Security mechanism that prevents access to critical data and
makes it impossible to falsify the origin of a message.
Authentication is performed for devices. In Bluetooth, this is
achieved by the authentication procedure based on the stored
link key or by pairing (entering a PIN).
AUX
An ACL (asynchronous connectionle ss) link packet type for
data. An AUX1 packet resembles a DH1 packet except it has no
CRC code. As a result it can carry up to 30 information bytes.
Baseband
The baseband describes the specifications of the Bluetooth link
controller, which carries out the baseband protocols and other
low-level link routines.
BD_ADDR
The Bluetooth Device Address is a unique, 48-bit number used
to identify a Bluetooth device. The Bluetooth device address is
also used in encryption and in generat ion of frequency hop
sequences. It is similar to an Ethernet MAC address.
BPA100 Bluetooth Protocol Analyzer User Manua l
Glossary- 1
Glossary
Bluetooth
An open specification for wireless communication of data and
voice. It is based on a low-cost, short-range radio link
facilitating protected ad hoc connections for stationary and
mobile communication environments.
Bluetooth Clock
Every Bluetooth unit has an internal system clock which
determines the timing and hopping of t he t ransceiver. It can be
implemented as a 28-bit counter, with the LSB ticking in units
of 312.5us, giving a clock rate of 3.2kHz.
Bluetooth Device Class
A parameter that indicates the type of device and which types of
services that are supported. The cla ss is received during the
discovery procedure.
Bluetooth Host
This is a computing device, peripheral, cellular te lephone,
access point to PSTN (public switched telephone network), etc.
This host attached to a Bluetooth unit may communicate with
other Bluetooth hosts attached to their Bluetooth units as well.
Bluetooth Neighborhood
A Bluetooth application created by Digianswer that provides an
interface for you to interact with Bluetooth systems. Its basic
functions are to perform device and service discovery and to
enable you to make service-oriented connections to other
Bluetooth devices.
Bluetooth Service Type
One or more services a device can provide to other devices. The
service information is defined in the service class field of the
Bluetooth device class parameter.
Bluetooth Unit
A voice/data circuit equipment for a short-range, wireless
communication link. It allows voice and data communications
between Bluetooth units.
Glossary- 2
BPA100 Bluetooth Protocol Analyzer User Manua l
Channel
A logical connection on the L2CAP level between two devices
serving a single application or higher layer protocol.
Channel (Hopping) Sequence
This is a pseudo-random sequence of 79 (23 for the 23MHz
system) frequencies. The frequency is calculated using the
BD_ADDR of the master of the piconet. The phase in the
sequence is derived from an estimate of the master clock. The
channel hopping sequence has a very long period length that
does not show repetitive patterns over a short time interval, but
which distributes the hop frequencies equally over the 79 MHz
(23 MHz for the 23 MHz system) during a short time interval.
See also Frequency sequenc e.
Glossary
CID (Channel Identifier)
An abbreviation for Channel Identifier. Used to identify L2CAP
connections.
CLK
An acronym for Clock, this is the master clock that defines the
timing used on a Bluetooth piconet.
CLKE
An estimate of the clock of another device.
CLKN
The native clock of a Bluetooth device. A slave device must add
an offset to its own CLKN to synchronize with the master clock
(CLK).
Coverage Area
The area where two Bluetooth units can exchange messages
with acceptable quality and performance.
Destination
The Bluetooth device receiving an action from another
Bluetooth device. The device sending the action is called the
source. The destination is typically part of an established link,
though not always (such as in inquiry/page procedures).
BPA100 Bluetooth Protocol Analyzer User Manua l
Glossary- 3
Glossary
Device Discovery
Before a link can be established, a Bluetooth device needs to
discover the other Bluetooth devices that are active within the
range. The mechanism to request and rece ive the Bluetooth
address, clock, class of device, used page scan, and names of
devices is referred to as device discovery.
Device Name
The name that a Bluetooth device presents when supplying
identity information to another device.
DH (Data-High Rate)
An ACL link data packet type for high rate data. DH1 packets
are similar to DM1 packets, except that the information in the
payload is not FEC encoded. This means the DH1 packet c an
carry up to 28 information bytes and covers a single time slot.
The DH3 is the same except it can cover up to 3 time slots and
contain up to 185 information bytes. The DH5 packet is the
same again except it can cover up to 5 time slots and contains
up to 341 information bytes.
Discoverable Device
A Bluetooth device in range that will respond to an inquiry
message.
DM (Data-Medium Rate)
An ACL link data packet type for medium rate data. DM1
packets carry information data only, containing a 16-bit CRC
code and up to 18 info bytes. They are encoded using 2/3 FEC
and the packet can cover up to a single time slot. DM3 packets
are the same except they can cover up to 3 time slots, and can
carry up to 123 information bytes. DM5 packets are the same
again except they can cover up to 5 time slots and can hold up to
226 information bytes.
Glossary- 4
BPA100 Bluetooth Protocol Analyzer User Manua l
Glossary
DV (Data Voice)
A SCO (synchronous connection oriented) link data packet type
for data and voice. It is divided into a voice field of 80 bits and
a data field of 150 bits. The voice field is not covered by FEC,
but the data field is covered by 2/3 FEC. The voice and data
fields are treated completely separate. The voice field is handled
like normal SCO data and is never retransmitted; that is, the
voice field is always new. The data field is checked for errors
and is retransmitted, if necessary.
Encryption
Security mechanism that prevents eavesdropping and maintai ns
link privacy.
FEC (Forward Error Correction)
The purpose of the FEC scheme on the data payload is to reduce
the number of retransmissions. Within Bluetooth, there are
2 versions of this: 1/3 FEC and 2/3 FEC. 1/3 FEC is a simple,
3-times repetition of each information bit. 2/3 FEC is a (15,10)
shortened Hamming code.
Frequency Hopping (Selection)
Bluetooth is characterized by its system of fast frequency hops.
10 different types of hopping sequences are defined, 5 of the
79 MHz range/79 hop system and 5 for the 23 MHz
range/23 hop system. The t wo range system hopping sequences
differ only in frequency range 79 MHz or 23 MHz, and segment
length: 32 hops (79 MHz system) or 16 hops (23 MHz system).
The individual hopping sequences include the pa ge sequence
and the page re sponse sequence. T hese are used in the page
procedure. Used in the inquiry procedure are the inquiry
sequence and the inquiry response sequence. Finally the main
hopping sequence used in the Bluet ooth system is the channel
hopping sequence.
BPA100 Bluetooth Protocol Analyzer User Manua l
Glossary- 5
Glossary
Frequency Hopping Synchronization (FHS) Packet
This a special control packet revealing, among other things, the
BD_ADDR and the clock of the source device. It contains
144 information bits and a 16-bit CRC code. The payload is
coded with a rate 2/ 3 FEC, which brings the total payload length
to 240 bits. The FHS packet covers a single time slot.
Gateway
A Bluetooth enabled base station that is connected to an external
network.
Hold Mode
Devices synchronized to a piconet can enter power-saving
modes in which devic e activity is lowered. The master unit ca n
put slave units into HOLD mode, where only an internal timer is
running. Slave units can a lso demand to be put into HOLD
mode. Data transfer restarts instantly when units transition out
of HOLD mode. It has an intermediate duty cycle (medium
power efficient ) for the 3 power saving modes (sniff, hold, and
park).
Host Controller Interface (HCI)
Allows higher layers of the stack, including applications to
access the baseband, link manager, and other hardware registers
through a single, sta ndard interface.
HV (High Quality Voice)
A SCO link voice packet. HV1 packets carry 10 information
bytes, which are protected by 1/3 FEC. HV2 packets carry 20
information bytes and are protected by 2/3 FEC. HV3 packets
carry 30 information bytes and not protected by FEC. HV
packets do not have a CRC or payload header.
Inquiry
A Bluetooth unit transmits inquiry messages to discover the
other Bluetooth units active within the coverage area. Units that
capture inquiry messages may send a response to the inquiring
Bluetooth unit. The response contains information about the
Bluetooth unit and its inquiring host.
Glossary- 6
BPA100 Bluetooth Protocol Analyzer User Manua l
Loading...