Page 1
2403 Walsh Avenue, Santa Clara, CA 95051-1302 Tel: +1/408.727.6600 Fax: +1/408.727.6622
CATC Merlin Mobile
Bluetooth™Protocol Analyzer
User’s Manual
SW Version 2.0
™
18 March 2000
Page 2
Merlin Mobile User’s ManualCATC SW Version 2.0
Document Disclaimer
The information contained in this document has been carefully checked and
is believed to be reliable. However, no responsibility can be assumed for
inaccuracies that may not have been detected.
CATC reserves the right to revise the information presented in this
document without notice or penalty.
Trademarks and Servicemarks
CATC, Merlin, Merlin’s Wand, Merlin Mobile, BTTracer, BTTrainer,
Advisor, Chief, FireInspector, Inspector, Detective, Traffic Generator,
BusEngine,USB4DOS,UPT,HPT,UHT,IBTracer,andSATracer are
trademarks of Computer Access Technology Corporation.
Microsoft, Windows NT, Windows 2000, Windows 98SE, Windows Me,and
Windows XP are registered trademarks of Microsoft Inc.
All other trademarks are property of their respective companies.
Copyright
Copyright © 2003, Computer Access Technology Corporation (CATC); All
Rights Reserved.
Portions of this product are supplied courtesy of Richard Herveille.
Copyright (c) 2002, 2003 Richard Herveille, rherveille@opencores.org. All
rights reserved.
This document may be printed and reproduced without additional
permission, but all copies should contain this copyright notice.
FCC Conference Statement
This equipment has been tested and found to comply with the limits for a
Class A digital device and an intentional radiator, pursuant to Part 15 of the
FCC Rules. These limits are designed to provide reasonable protection
against harmful interference when the equipment is operated in a
commercial environment. This equipment generates, uses, and can radiate
radio frequency energy and, if not installed and used in accordance with the
instruction manual, may cause harmful interference to radio
communications. Operation of this equipment in a residential area is likely
to cause harmful interference in which case the user will be required to
correct the interference at their own expense. The end user of this product
should be aware that any changes or modifications made to this equipment
2
Page 3
Merlin Mobile User’s ManualCATC SW Version 2.0
without the approval of CATC could result in the product not meeting the
Class A limits, in which case the FCC could void the user's authority to
operate the equipment.
Important Notice: To comply with FCC RF exposure requirements
(sections 1.1307 and 1.310 of the Rules) only the antenna supplied by
CATC must be used for this device. The antenna must be located at least 20
cm away from all persons.
FCC Testing applies to FCC ID: KH7BT004APA-X.
EU Conference Statement
This equipment complies with the R&TT Directive 1999/5/EC. It has been
tested and found to comply with EN55022:1994/A1:1995/A2:1997 Class A,
EN61000-4-2:1995, EN61000-4-3:1995, EN61000-4-4:1995,
EN61000-4-5:1995, EN61000-4-6:1995, EN61000-4-11:1994,
EN61010-1:1993, and ESTI EN 300 328-1 V1.2.2 (2000-07).
Manual Version 2.0 Part number: 730-0032-00
3
Page 4
Merlin Mobile User’s ManualCATC SW Version 2.0
4
Page 5
Merlin Mobile User’s ManualCATC SW Version 2.0
TABLE OF CONTENTS
Chapter1 Overview.....................................1
BluetoothSpecification .............................................2
Merlin Mobile Analyzer System Components. . ..........................2
MerlinMobileSpecifications.........................................2
SystemRequirements...............................................3
UsingMerlinMobilewithMerlin’sWand ..............................3
MerlinMobileAutomation ..........................................3
HCITrace........................................................4
FeaturesofMerlinMobile...........................................4
Chapter2 GettingStarted................................7
InstallingMerlinMobile ............................................7
SoftwareInstallation.........................................7
HardwareInstallation...............................................7
StartingandStoppingMerlinMobile ..................................8
StartingtheApplication ......................................8
ExitingtheApplication.......................................8
StartingtheAnalyzerUnit ....................................8
ShuttingDowntheAnalyzerUnit...............................8
DisplayingHelp...................................................9
UpdatingtheBusEngineandFirmware.................................9
UpdatingtheDriver................................................9
UpdatingtheDriveronWindows2000 ..........................9
UpdatingtheDriveronWindows98SE ........................10
UpdatingtheDriveronWindowsMe...........................11
UpdatingtheDriveronWindowsXP...........................12
LicenseKeys ....................................................12
UpdateLicense............................................12
LicenseInformation ........................................13
InstallingtheHCIProbe............................................13
HCIProbeconfigurations....................................14
2-portRS232toUSBconverter ...............................16
YourFirstBluetoothRecording......................................17
InquiryRecording..........................................20
Chapter3 SoftwareOverview............................23
TheMainDisplayWindows ........................................23
Toolbar ........................................................26
StatusBar.......................................................28
RecordingProgress.........................................28
StatusBarPositionDefinitions: ...............................28
RecordingStatus...........................................29
AnalyzerStatus............................................30
SearchStatus..............................................31
ZoomIn..................................................31
1
Page 6
Merlin Mobile User’s ManualCATC SW Version 2.0
ZoomOut ................................................31
ToolTips .......................................................31
MerlinAnalyzerKeyboardShortcuts .................................31
Chapter4 RecordingWizard ............................33
StartingRecordingWizard...................................33
RecordingaTrafficonaNewPiconet.................................34
RecordinganExistingPiconet ......................................44
RecordinginTestMode............................................54
RecordinginReducedHoppingMode..........................54
RecordinginSingleFrequencyMode.................................59
Chapter5 RecordingOptions............................63
RecordingModes.................................................63
Piconetrecording ..........................................63
Inquiryrecording ..........................................63
IUT:HCImode ............................................64
OpeningtheRecordingOptionsDialogBox............................64
RecordingOptions-General........................................65
Recordingtype ............................................65
Options..................................................66
BufferSize ...............................................66
TriggerPosition ...........................................67
RecordingOptions-Piconet ........................................67
HopSequence.............................................68
SyncMethod..............................................69
AdditionalSettings.........................................73
Debug ...................................................75
RecordingOptions-Inquiry ........................................75
RecordingOptions-HCI...........................................76
HCIWindowLayout........................................77
RecordingHCITraffic.............................................79
RecordingOptions-Events.........................................80
PayloadLengthError.......................................87
RecordingOptions-Actions........................................87
ActionButtons-TheirFunctions..............................88
BlueDotMenus ...........................................90
SavingRecordingOptions..........................................95
RecordingBluetoothTraffic ........................................95
Chapter6 DisplayOptions ..............................97
GeneralDisplayOptions ...........................................98
SettingColor,Formatting,andHidingOptions..........................99
SettingColorDisplayOptions ................................99
ChangingFieldFormats....................................100
HidingDisplayOptions ....................................101
LevelHidingOptions.............................................101
2
Page 7
Merlin Mobile User’s ManualCATC SW Version 2.0
LevelHidingParameters....................................102
SavingDisplayOptions...........................................103
Chapter7 ReadingaCATCTrace.......................105
TraceViewFeatures .............................................105
InterpretingtheDisplayedInformation...............................105
Tooltips .......................................................106
SetMarker.....................................................106
EditorClearMarker .............................................107
ExpandedandCollapsedDataFormats...............................108
HideFrequencyHops.............................................110
HideNullsandPolls..............................................110
HideIDPackets.................................................111
HideVoice(SCO)Packets.........................................111
MenusinClickedFields...........................................111
HideUnassociatedTraffic.........................................111
Chapter8 DecodingProtocols...........................113
Introduction ....................................................113
LMPandL2CAPMessages........................................113
DecodingandViewingProtocolData................................114
DecodingViatheDecodingToolbar ..........................114
DecodingViatheDisplayOptionsDialogBox..................115
Tooltips .......................................................116
ViewingPacketsinLMPandL2CAPMessages........................116
TypesofLMPandL2CAPMessages ................................116
ViewingL2CAPChannelConnections...............................117
ViewingProtocolMessagesandTransactions..........................118
ViewingL2CAPMessagesinProtocolMessages................119
HowtoDecode...........................................119
ExpandingProtocolMessages ...............................119
ChangingProtocolAssignments ....................................120
UsingtheDecodingAssignmentsDialogBox...................120
RemovingUser-AssignedProtocolAssignments.................121
ManuallyAssigningProtocols ...............................122
OtherAssignments:OBEXClient/ServerStatus.................122
ChanginganOBEXClientorServerStatus.....................123
DecodingBNEP..........................................123
DecodingHID............................................123
OtherDecodingOptions....................................124
Chapter9 OtherFeatures..............................125
Search.........................................................125
GotoTrigger.............................................125
GotoPacket/Message/Protocol ..............................125
GotoMarker.............................................126
Goto...................................................127
3
Page 8
Merlin Mobile User’s ManualCATC SW Version 2.0
Error ...................................................130
SoftBitError.............................................130
LossofSync.............................................130
Find....................................................130
Event Groups . . ..........................................132
Union,Intersection,andExclusion............................136
UsingFind...............................................136
FindNext ...............................................138
DeviceList.....................................................139
EditComment ..................................................140
ExportingData..................................................140
FileInformation.................................................141
ErrorSummary..................................................142
TimingCalculations..............................................142
BusUtilization..................................................143
TrafficSummary ................................................147
Encryption .....................................................147
ConfiguringMerlinMobileforEncryption .....................148
Chapter10 HowtoContactCATC.......................151
Chapter11 WarrantyandLicense.......................151
Index . . . . . . . . ........................................153
4
Page 9
Merlin Mobile User’s ManualCATC SW Version 2.0
1. Overview
The CATC™ Merlin Mobile™ Bluetooth™ Protocol Analyzer blends powerful
piconet traffic recording and analysis abilities with compact, easily transportable
PC Card technology. Merlin Mobile is a development and test tool for products
using the Bluetooth wireless technology. Merlin Mobile non-intrusively monitors
piconet traffic and records and displays captured Bluetooth data.
Like its predecessor, the CATC Merlin™ Bluetooth Protocol Analyzer, Merlin
Mobile uses CATC's BusEngine™ technology, which incorporates a real-time
recording engine with programmable data, state, and error detection, and event
triggering, filtering, counting, and sequencing. This enables users to optimize
recording memory usage to capture the data that is most important.
The Merlin Mobile system consists of the analyzer hardware unit and the analyzer
software. The Merlin Mobile analyzer unit monitors and captures baseband packets
on a piconet in a non-intrusive manner. The packets can then be viewed and
decoded with the Merlin Mobile software. The software displays the piconet data in
CATC Trace™ format and is capable of decoding and organizing the data for these
Bluetooth protocol levels: Baseband, LMP, L2CAP, SDP, TCS, RFCOMM,
OBEX, AT, HDLC, PPP, BNEP, HID, AVCTP, AVDTP, IP, TCP, and UDP. In
addition, users can use the CATC Scripting Language (CSL) to create custom
decoders for specific development purposes.
The Merlin Mobile analyzer unit is configured and controlled by the analyzer
software. It can be used with portable computers for field service and maintenance,
as well as with desktop units in a development environment. Furthermore, Merlin
Mobile Automation™ and compatibility with the CATC Merlin's Wand™
Bluetooth Test Generator provide the capability for creating a fully-automated
testing environment.
The Merlin Mobile analyzer includes provisions for on-the-fly detection of, and
triggering on, numerous events. Such events include specific packet headers,
payload headers, data patterns, and many abnormal (error) traffic conditions.
Merlin Mobile continuously records the piconet data in a wrap-around fashion until
it is manually stopped or until the trigger event is detected. Upon detection of a
triggering event, the analyzer continues, as necessary, to record data until the
recording buffer is filled.
The Merlin Mobile application may be used with or without the analyzer box. When
used without the analyzer box, it functions as a CATC Trace™ viewer. As a Trace
viewer, it can be used to view, analyze and print CATC Trace files.
1
Page 10
Merlin Mobile User’s ManualCATC SW Version 2.0
1.1 Bluetooth Specification
Please refer to the Bluetooth Specification, version 1.1, for details on the Bluetooth
wireless technology protocol. The Bluetooth Specification is available from the
Bluetooth SIG at its web site: http://www.bluetooth.org.
1.2 Merlin Mobile Analyzer System Components
The Merlin Mobile analyzer package includes the following items:
• One Merlin Mobile analyzer unit
• Merlin Mobile software program installation CD
• Product documentation including on-line Help
1.3 Merlin Mobile Specifications
Package
Dimensions: 5.3 x 2.1 x 0.4 inches
(135x54x5millimeters)
Weight: 2 ounces
(57 grams)
Hardware Interfaces
Connectors: Standard 16-bit Type II PC Card
Antenna: 2.4 gigahertz external (ISM band)
Power Consumption
Idle: 300 milliamps (typical)
Active: 350 milliamps (typical)
Environmental Conditions
Operating Range: 0 to 55 °C (32 to 131 °F)
Storage Range: -20 to 80 °C (-4 to 176 °F)
Humidity: 10 to 90%, non-condensing
Recording Memory Size
32 MB DRAM for traffic data capture
32 MB DRAM for timing, state & other data
Certification
Bluetooth version 1.1 qualified
Class 2 designation with +4dBm transmit power and <-70 receiver sensitivity
2
Page 11
Merlin Mobile User’s ManualCATC SW Version 2.0
FCC and CE compliant
1.4 System Requirements
The following is the recommended configuration for the host machine that runs the
Merlin Mobile Analyzer application and is connected to the Merlin Mobile
Analyzer box.
• Operating system: Microsoft® Windows® 98 SE, Windows 2000, Windows
ME, or Windows XP operating system.
• Required setup: Microsoft Internet Explorer 4 or later must be installed.
• See readme.html for the latest system requirements.
1.5 Using Merlin Mobile with Merlin’s Wand
Merlin Mobile can be used in conjunction with the CATC Merlin's Wand™
Bluetooth Test Generator, which provides the ability to issue specific protocol
commands and test sequences on a piconet. Using Merlin Mobile and Merlin's
Wand together allows for real-time capturing of test sequence results as is required
by the Bluetooth SIG to provide evidence of product compliance to the
specification.
Merlin's Wand has built-in functionality for controlling Merlin Mobile. Through
Merlin's Wand, a Bluetooth recording session can be set up on Merlin Mobile, even
if the Merlin Mobile application runs on a remote computer.
For more information about using Merlin Mobile with Merlin's Wand, please
consult the Merlin's Wand documentation or contact CATC.
1.6 Merlin Mobile Automation
The Merlin Mobile software includes an Application Program Interface
(API) for developing testing programs and scripts in C++ and Visual Basic.
The API reproduces most of the commands embodied in the Merlin Mobile
trace viewer software. This API allows users to automate procedures that
otherwise have to be run manually via the trace viewer software. The
Automation API can be run locally on the PC attached to Merlin Mobile or
remotely over a network connection.
For further details, refer to the Automation API for CATC Bluetooth
Analyzers reference manual included in the installation CD-ROM. You can
also download the document from the CATC website.
3
Page 12
1.7 HCI Trace
In addition to the ability to record Bluetooth traffic off-the-air, using the
analyzer's hardware and radio module, the Merlin can record serial
Bluetooth HCI traffic from Bluetooth devices, or 'IUT's (Implementations
Under Test).
While the off-the-air traffic is captured by the analyzers hardware, the HCI
Traffic from the IUTs is captured by the analyzer application using an HCI
probe (provided by CATC) that is connected directly to the IUT hardware.
In a typical setup, the HCI commands and data to transmit are passed from
the Bluetooth application to the Bluetooth baseband (Host to Controller),
while events and data that was received are passed from the Bluetooth
baseband to the Bluetooth application (Controller to Host).
To capture the data, the HCI Probe should be connected to the respective
'Host to Controller' and 'Controller to Host' lines. When the recording of the
IUT's HCI is enabled and the application starts a recording, the serial data is
captured as incoming serial data. For this, up to two COM ports should be
configured for each IUT.
Merlin Mobile User’s ManualCATC SW Version 2.0
1.8 Features of Merlin Mobile
• Sophisticated software analyzes all piconet traffic
• Identifies & highlights abnormal bus conditions
• Decodes Baseband packets and provides decoding for 12 additional
protocol levels
• Complies with Bluetooth v.1.1 specification
• 64 MB of physical data recording memory nets 32 MB of raw Bluetooth traffic
• Programmable real-time event triggering and traffic capture filtering
• CATC Trace graphical presentation of captured data with extensive customization options
• Adjustable recording size
• Adjustable trigger position
• Comprehensive search functions
• Accurate timestamping of packets
• Field upgradeable firmware and BusEngine™
• Software operates as a stand-alone Trace viewer
• Connects to the host computer through an available Type II PC Card slot
• One-year warranty and hotline customer support
• Traffic Generation
4
Page 13
Traffic generation capability is provided by Merlin’s Wand.
• Bluetooth™ BusEngine
CATC’s BusEngine™ Technology is at the heart of the new Merlin Mobile
Analyzer. The revolutionary BusEngine core uses state-of-the-art EPLD
technology and incorporates both the real-time recording engine and the
configurable building blocks that implement data/state/error detection,
triggering, capture filtering, external signal monitoring and event counting
& sequencing. And like the flash-memory-based firmware that controls its
operation, all BusEngine logic is fully field upgradeable, using
configuration files that can be downloaded from the CATC Website.
Merlin Mobile User’s ManualCATC SW Version 2.0
5
Page 14
Merlin Mobile User’s ManualCATC SW Version 2.0
6
Page 15
Merlin Mobile User’s ManualCATC SW Version 2.0
2. Getting Started
This chapter describes how to install Merlin Mobile and its software, how to start
Merlin Mobile, and how to set up the analyzer unit.
2.1 Installing Merlin Mobile
Merlin Mobile can be installed on any PC or laptop computer that uses the Windows
98 SE, Windows Me, Windows 2000, or Windows XP operating system and has a
functioning PC Card slot.
Software Installation
The Merlin Mobile software can be installed from the installation CD-ROM or from
installation files downloaded from the CATC website.
Install from CD-ROM
Step 1 Insert the Merlin Mobile installation CD-ROM into the
CD-ROM drive of the computer that will be connected to the
Merlin Mobile analyzer unit.
The autorun program should start automatically. If it doesn’t
start, use Windows Explorer or My Computer to navigate to the
CD-ROM drive directory, double-click the file autorun.exe,
and proceed to Step 2. If it still doesn’t start, navigate to the
\Software directory on the CD-ROM, double-click the file
Setup.exe,andproceedtoStep3.
Step 2 Choose Install Software to start the setup program.
Step 3 Follow the on-screen instructions to complete the installation.
Install from installation download
Step 1 Select Start > Run... from the Windows taskbar and click the
Browse button, then navigate to the Disk 1 directory of the
Merlin Mobile installation download. Select the file Setup.exe
andclickOpen.
Step 2 Follow the on-screen instructions to complete the installation.
2.2 Hardware Installation
Step 1 Insert the Merlin Mobile analyzer unit into the PC Card slot on
the desktop or laptop computer that will be running the Merlin
Mobile software.
7
Page 16
Merlin Mobile User’s ManualCATC SW Version 2.0
Step 2 The New Hardware Wizard will automatically detect Merlin
Mobile and will guide you through the rest of the installation.
2.3 Starting and Stopping Merlin Mobile
Starting the Application
Use one of the following procedures to start the Merlin Mobile application:
• Select Start > Programs > CATC > CATC Merlin Mobile from the Windows taskbar.
• In Windows Explorer or My Computer, navigate to the directory that contains
Merlin Mobile, then double-click on the MerlinMobile.exe icon.
Exiting the Application
Any of the following actions will close the Merlin Mobile application:
• Clickonthe‘X’ in the upper right corner of the application window.
• Select File > Exit from the menu bar.
•PressAlt + F4.
• Double-click the Merlin Mobile control icon in the upper left corner of the
application window.
• Click the Merlin Mobile control icon to access the Control menu and choose
Close.
Starting the Analyzer Unit
The Merlin Mobile analyzer unit is powered on whenever it is connected to the host
computer via the PC Card slot and the host computer is on. The analyzer will
initialize itself and perform an exhaustive self-diagnostic test that lasts about five
seconds.
Shutting Down the Analyzer Unit
On Windows 98 SE and Windows Me
• Shut down the Merlin Mobile unit by removing it from the PC Card slot or by
shutting down the host computer.
On Windows 2000 and Windows XP
• Shut down the Merlin Mobile unit by shutting down the host computer.
-OR-
• Use the Add/Remove Hardware Wizard to stop Merlin Mobile so that it may
safely be removed from the PC Card slot.
8
Page 17
Merlin Mobile User’s ManualCATC SW Version 2.0
2.4 Displaying Help
The Merlin Mobile application has a Help file that is useful as an on-screen
reference. Access the Help file by choosing Help > Help Topics... from the menu
bar.
2.5 Updating the BusEngine and Firmware
The BusEngine core is the heart of the Merlin Mobile analyzer. Using
state-of-the-art PLD technology, it incorporates both the high speed recording
engine and the configurable building blocks that implement data/state/error
detections, triggering, capture filtering, external signal monitoring, and event
counting and sequencing. Both the BusEngine program and the firmware that
manage the internal microcontroller are fully field-upgradeable.
The most current BusEngine file and firmware file are included with the Merlin
Mobile installation software and are automatically installed with the software. They
are also updated anytime that the driver is updated.
2.6 Updating the Driver
The driver, BusEngine, and firmware are all automatically updated when the Merlin
Mobile software is installed or upgraded.
To find out the current driver version number, please consult Merlin Mobile’s
Readme file.
The driver may also be manually updated. The steps below explain how to manually
update the driver.
Note: The Merlin Mobile analyzer unit must be attached to the computer via the PC Card slot before
updating the driver.
Updating the Driver on Windows 2000
Step 1 Select Start > Settings > Control Panel from the desktop taskbar,
then double-click on Add/Remove Hardware in the Control
Panel window.
The Add/Remove Hardware Wizard will open.
Step 2 Click Next.
Step 3 Choose “Uninstall/Unplug a device” and click Next.
Step 4 Choose “Unplug/Eject a device” and click Next.
Step 5 Select CATC Merlin Mobile Bluetooth Protocol Analyzer from
the list of devices and click the Properties button.
The Properties window will open.
9
Page 18
Merlin Mobile User’s ManualCATC SW Version 2.0
Step 6 Select the Driver tab in the Properties window and click Update
Driver.
The Upgrade Device Driver Wizard will open.
Step 7 Click Next.
Step 8 Choose “Display a list of the known drivers for this device so
that I can choose a specific driver.” Then, click Next.
Step 9 Choose “Have disk” and click Next.
The Install from Disk window will open.
Step 10 Install from the Merlin Mobile installation CD-ROM:
Make sure that the installation CD is in the computer’s
CD-ROM drive, then click Browse and navigate to the \Software
directory on the CD, or type the drive letter followed by
\Software (e.g., “D:\Software”) in the combo box. Click OK.
Install from a directory on the computer’s hard drive:
Browse or enter the path to the Disk 1 directory of the Merlin
Mobile installation, then click OK.
The Install from Disk window will close.
Step 11 Select CATC Merlin Mobile Bluetooth Protocol Analyzer from
the list of devices in the Upgrade Device Driver Wizard and
click Next.
Step 12 Click Next to install the driver.
Step 13 Click Finish to close the Wizard.
Step 14 Check the driver version on the Driver tab of the Properties
window to make sure that the driver was successfully upgraded.
Step 15 Close the remaining open windows.
Updating the Driver on Windows 98 SE
Step 1 Select Start > Settings > Control Panel from the desktop taskbar,
then double-click on System Properties in the Control Panel
window.
The System Properties window will open.
Step 2 Select the Device Manager tab.
Step 3 Look in the CATC Analyzers directory and select CATC Merlin
Mobile Bluetooth Protocol Analyzer.
or
Look in the Universal Serial Bus Controllers directory and select
CATC Merlin Mobile Bluetooth Protocol Analyzer.
Step 4 Click the Properties button.
The Properties window will open.
10
Page 19
Merlin Mobile User’s ManualCATC SW Version 2.0
Step 5 Select the Driver tab and click on the Update Driver button.
The Update Device Driver Wizard will open.
Step 6 Click Next.
Step 7 Choose “Search for a better driver than the one your device is
using now.” and click Next.
Step 8 Enter or browse to the location of the driver and click Next.
Step 9 Click Next to install the driver.
Note: If a message appears saying that Windows cannot locate the driver,
click OK to close the message box and then enter or browse to the
location of the driver to continue.
Step 10 Click Finish.
Step 11 Click the Driver File Details button to check the driver version
and make sure that the driver was successfully upgraded.
Step 12 Close the remaining open windows.
Updating the Driver on Windows Me
Step 1 Select Start > Settings > Control Panel from the desktop taskbar,
then double-click on System Properties in the Control Panel
window.
The System Properties window will open.
Step 2 Select the Device Manager tab.
Step 3 Look in the CATC Analyzers directory and select CATC Merlin
Mobile Bluetooth Protocol Analyzer.
or
Look in the Universal Serial Bus Controllers directory and select
CATC Merlin Mobile Bluetooth Protocol Analyzer.
Step 4 Click the Properties button.
The Properties window will open.
Step 5 Select the Driver tab and click on the Update Driver button.
The Update Device Driver Wizard will open.
Step 6 Choose “Automatically search for a better driver.” and click
Next.
The Select Other Driver window will open.
Step 7 Select the newest driver and click OK.
The driver will install.
Step 8 Click Finish.
Step 9 Click the Driver File Details button to check the driver version
and make sure that the driver was successfully upgraded.
11
Page 20
Merlin Mobile User’s ManualCATC SW Version 2.0
Step 10 Close the remaining open windows.
Updating the Driver on Windows XP
Step 1 Select Start > Control Panel from the desktop taskbar, then
double-click Performance and Maintenance.
Step 2 Double-click on System.
The System Properties window will open.
Step 3 Select the Hardware tab and click the Device Manager button.
The Device Manager window will open.
Step 4 Look in the CATC Analyzers directory and select CATC Merlin
Mobile Bluetooth Protocol Analyzer.
or
Look in the Universal Serial Bus Controllers directory and select
CATC Merlin Mobile Bluetooth Protocol Analyzer.
Step 5 Select Action > Update Driver... from the Device Manager menu
bar.
The Hardware Update Wizard will open.
Step 6 Choose “Install from a list or specific location.”
Step 7 Choose “Don’t search” then click Have Disk.
Step 8 Enter or browse to the location of the driver and click OK.
Step 9 Select CATC Merlin Mobile Bluetooth Protocol Analyzer from
the list and click Next.
The driver will install.
Step 10 Click Finish.
Step 11 Select Action > Properties from the Device Manager menu bar
to check the driver version and make sure that the driver was
successfully upgraded.
Step 12 Close the remaining open windows.
2.7 License Keys
A License Key is necessary to enable software maintenance in Merlin Mobile.
License Keys must be obtained from CATC.
Update License
Follow these steps to install a license key:
Step 1 Select Help > Update License… from the menu bar.
The Update License dialog will come up.
12
Page 21
Merlin Mobile User’s ManualCATC SW Version 2.0
Step 2 Enter the path and filename for the License Key or use the
Browse button to navigate to the directory that contains the
License Key. Select the .lic file, and then click Update Device.
License Information
Licensing information for Merlin Mobile may be viewed by selecting Help >
Display License Information... from the menu bar. The License Information
window will open, displaying the maintenance expiration and features data for
Merlin Mobile.
2.8 Installing the HCI Probe
If you are planning to record HCI traffic, you will need to install an HCI
probe.
The HCI Probe allows you to connect the analyzer software to a single IUT.
If more IUTs are to be monitored (up to three) additional HCI Probes should
be used.
The probe is composed of the following components:
[a] HCITrace Probe Cable
[b] HCITrace RS232 Cable
[c] TTL to RS232 converter
[d] 2-port RS232 to USB converter
[e] USB cable
13
Page 22
HCITrace Probe Cable
The HCITrace Probe Cable has three probes:
‘Gnd’ – Should be connected to the reference/ground wire
•
• ‘Host’ – Should be connected to the wire that carries the down-link traffic from
the host to the controller.
• ‘BTC’– Should be connected to the wire that carries the up-link traffic from
the controller to the host.
HCITrace RS232 Cable
Has three DB-9 connectors:
•
RS-232/Probe - Should be connected to the HCITrace Probe Cable or to the
TTL to RS232 converter (depending whether the signal voltage in the IUT is
TTL or RS-232).
• COM A - Should be connected to one of the serial inputs of the 2-port RS232
to USB converter.
• COM B - Should be connected to one of the other serial input of the 2-port
RS232 to USB converter.
Merlin Mobile User’s ManualCATC SW Version 2.0
TTL to RS232 converter
Should be used only when the signal voltage in the IUT is TTL and not
RS-232.
The DB-9 connector marked with ‘TTL’ should be connected to the
HCITrace Probe Cable.
The DB-9 connector marked with ‘RS-232’ should be connected to the
'RS-232'/Probe connector of the HCITrace RS232 Cable.
2-port RS232 to USB converter -
This converter is used so the serial signals can be delivered to the host
machine through a USB input.
USB cable –
Connects the 2-port RS232 to USB converter to the Host machine USB
port.
HCI Probe configurations
The HCI Probe can be used in two configurations:
•
For monitoring UART level signals
• For monitoring RS232 level signals
14
Page 23
Merlin Mobile User’s ManualCATC SW Version 2.0
Monitoring UART Level Signals
For monitoring RS232 level signals, the TTL to RS-232 converter should be
used. To assemble the HCI probe for this configuration, perform the
following steps. Refer to the photo and component list shown previously
for references to components [a] through [e].
Step 1 Connect the DB-9 connector of the HCITrace Probe Cable [a] to
the connector marked with ‘TTL’ in the TTL to RS-232
converter [c].
Step 2 Connect the DB-9 connector marked with ‘RS-232’ in the TTL
to RS-232 converter [c] to the connector marked with
‘'RS-232/Probe’’ in the HCITrace RS-232 Cable [b].
Step 3 Connect the connector marked with ‘COM A’ in the HCITrace
RS-232 Cable [b] to ‘Connector A’ in the 2-port RS232 to USB
converter [d].
Step 4 Connect the connector marked with ‘COM B’ in the HCITrace
RS-232 Cable [b] to ‘Connector B’ in the 2-port RS232 to USB
converter [d].
Step 5 Connect the USB cable to the USB connector of the 2-port
RS232 to USB converter [e].
Monitoring RS232 level Signals
Legend for photo:
[a] HCI Probe Cable
[b] HCI Trace RS-232 Cable
15
Page 24
Merlin Mobile User’s ManualCATC SW Version 2.0
[c] Connectors A and B on the other end of the HCI Trace RS-232
Cable
[d] Two-Port RS-232 to USB Converter
For monitoring RS232 level signals do not use the converter. To assemble
the HCI probe for this configuration, perform the following steps:
Step 1 Connect the DB-9 connector of the HCITrace Probe Cable [a] to
the connector marked with ‘'RS-232/Probe’’ in the HCITrace
RS-232 Cable [b].
Step 2 Connect the connector marked with ‘COM A’ in the HCITrace
RS-232 Cable [c] to ‘Connector A’ in the 2-port RS232 to USB
converter [d].
Step 3 Connect the connector marked with ‘COM B’ in the
HCITrace RS-232 Cable [c] to ‘Connector B’ in the 2-port
RS232 to USB converter [d].
Step 4 Connect the USB cable [not shown] to the USB connector of the
2-port RS232 to USB converter [d].
2-port RS232 to USB converter
The 2-port RS232 to USB converter [d] allows the user to connect two serial
connectors to the host machine via a single USB connection. When
connected to the host machine the converter emulates two separate virtual
COM ports that can be used as other real COM ports. Prior of using this
converter as part of the HCI probe several drivers need to be installed. The
drivers are provided on the installation CD-ROM in the HCI Probe\Drivers
sub directory.
Once the converter is connected to a host machine the user is prompted to
provide the place where the system can install the drivers from.
16
Page 25
Merlin Mobile User’s ManualCATC SW Version 2.0
After installing the drivers two new COM ports are going to be available, as
seen in the following snapshot of the Device Manager.
2.9 Your First Bluetooth Recording
After installing and launching the software, you can test Merlin Mobile by
synchronizing to a piconet and then recording the traffic. In this inquiry test,
Merlin Mobile will issue a General Inquiry that asks local devices to
identify themselves. Merlin Mobile then records the responses.
Step 1 Click the down-arrow on the Record button
and select Piconet.
Step 2 From the menu, select Record > Recording Options.
The following dialog box will open showing factory default
settings. Merlin defaults to “Page Sync & Record." This setting
tells Merlin Mobile to
perform a General Inquiry and then collect sync
17
Page 26
Merlin Mobile User’s ManualCATC SW Version 2.0
information from the specified slave device when the slave responds. Merlin Mobile
then waits for the Master to begin paging the Slave devices. When paging begins,
Merlin Mobile synchronizes to the Master and begins recording.
Step 3 Select the General tab.
The Recording Options dialog box opens showing factory
default settings such as “manual trigger” and 8 MB buffer size.
For the General Inquiry recording you are about to create, leave
these settings unchanged.
18
Page 27
Merlin Mobile User’s ManualCATC SW Version 2.0
For this recording, leave most of these settings unchanged. If
you are recording a Hop Frequency that is not 79 Hops
Standard, you will need to select the appropriate standard from
the Hop Frequency menu below.
19
Page 28
Merlin Mobile User’s ManualCATC SW Version 2.0
Step 4 Click OK to close the Recording Options window and activate
the recording options you selected.
At this point, Merlin Mobile will be ready to record.
Inquiry Recording
Merlin Mobile can also record an inquiry process where the Merlin Mobile
performs a general inquiry and asks local devices to identify themselves.
Step 1 Click the down-arrow on the right side of the Record:Piconet
button on the toolbar .
A sub-menu appears with options for Piconet Recording Mode,
and Inquiry Recording Mode.
Step 2 Select Inquiry Recording Mode.
The button changes appearance and shows the label Record:
Inquiry
Step 3 From the menu, select Setup > Recording Options.
The Recording Options dialog opens with the Inquiry page
displaying.
Step 4 If desired, make any changes to the options, then click OK.
Step 5 Click the button (i.e. the button itself, and not
the down-arrow.)
20
Page 29
Merlin Mobile User’s ManualCATC SW Version 2.0
Merlin Mobile starts to record the Bluetooth traffic immediately
using the settings from the Piconet page in the Recording
Options dialog. The Bluetooth Inquiry process will proceed for
whatever amount of time is set for creating an Inquiry action (0
to 80 seconds). After the inquiry time has elapsed, the analyzer
will uploads the data and displays the packets.
After a few moments, the recording will terminate and the results
will display. The screen should look like the sample recording
below which shows the FHS packets generated during the
Inquiry process.
When the recording session is finished, the bus traffic is saved to
the hard drive as a file named data.tfb or whatever name you
assign as the default filename. While the file is being saved, you
should see a brown progress bar at the bottom of the screen.
When the bar turns white, it indicates that the data has been
savedtodisk.
Step 6 To save a current recording for future reference, Select Save As
under File on the Menu Bar.
OR
Click on the Tool Bar.
You see the standard Save As screen.
21
Page 30
Merlin Mobile User’s ManualCATC SW Version 2.0
Step 7 Give the recording a unique name and save it to the appropriate
directory.
22
Page 31
Merlin Mobile User’s ManualCATC SW Version 2.0
3. Software Overview
3.1 The Main Display Windows
While some of the analyzer’s Main Display window options are familiar,
many contain options specific to the analyzer program.
Table 1: Main Display Pull-Down Windows
Menu Function
File
Open… Opens a file
C
lose Closes the current file
Save A
s… Saves all or a specified range of packets from the current file with a
specified name
P
rint… Prints part or all of the current traffic data file
Print Prev
Pr
E
dit Comment… Creates or edits the Trace file comment field
Export
Text (Packet View
Format)
Export
CSV Text
Export
Streams
Last File Lists the last files that were opened
Ex
iew Produces an on-screen preview before printing
int Setup… Sets up your current or new printer
»Packets to
»Packets to
>>Audio
it Exits the Merlin program
Saves all or part of a trace to a text file
Saves all or part of a trace to a Comma Separated Values (CSV) file
suitable for viewing in a spreadsheet application
Saves audio data into a file. Presents options for setting the Audio
Source format, Output File format, Stream Direction, and Output
Sampling
Setup
Display Options Provides the control of various display options such as color, formats,
and filters.
ecording Options Opens a dialog box with checkboxes and drop-down menus for setting
R
up a recording.
Recording W
A
nalyzer Allows the operator to reset the Analyzer or update the BusEngine and
izard Starts a sequence of interactive dialog boxes that configures Merlin for
a recording. This utility provides an alternative to the Recording
Options dialog box.
Firmware.
Record
Start Causes the Analyzer to begin recording Bluetooth activity.
Stop
Causes the Analyzer to stop recording.
23
Page 32
Merlin Mobile User’s ManualCATC SW Version 2.0
Menu Function
Recording Mode Presents a drop-down menu with options for setting the analyzer's
recording mode:
Piconet Recording Mode -- Causes Merlin to monitor and record
piconet traffic. Merlin records the traffic data as specified in the
Recording Options, then uploads the data as a Trace file when the
recording is complete.
Inquiry Recording Mode -- Causes Merlin to perform an inquiry to
detects and records Bluetooth devices within range. After completing
the recording, Merlin uploads the trace to the PC and saves it as a Trace
file.
IUT: HCI Recording Mode -- Causes the Merlin software to record
HCI traffic from the IUT. In this mode, the Merlin software on the host
PC directly records IUT traffic without first going through the analyzer.
T Neighborhood
B
Inquiry
Displays Bluetooth Address and clock frequency for devices in range.
The expected Bluetooth clock frequency is 3200 Hz +/- 250 ppm.
Report
File Information Details such information about the recording as number of packets and
triggering setup.
rror Summary Displays an error summary of the current trace file and allows you to
E
go to a specific packet, and save the error file to a uniquely named file.
Timing C
T
alculation Starts the calculator dialog for calculating various timing and
bandwidth parameters in the recording file.
raffic Summary Details the number and type of packets were transferred during the
recording, as well as message-level statistics.
Search
Go to trigger Positions the display to show the first packet that follows the trigger
event.
Go to
P
acket/Message/
Protocol ...
Go to M
Go to » Enables quick searching for specific events using a cascade of pop-up
Find Allows complex searches.
Find N
Search Direction Allows you to specify a forward or backward search of a trace file.
arker » Positions the display to a previously marked packet.
ext Repeats the previous Find operation. Can also use F3 to find next.
Positions the display to the indicated packet, LMP/L2CAP message, or
Protocol Message (RFCOMM, TCS, or SDP protocols).
windows.
24
Page 33
Merlin Mobile User’s ManualCATC SW Version 2.0
Menu Function
View
Toolbars Presents a sub-menu with options for displaying/hiding the toolbars
and an option called Customize which allows the menus and toolbars to
be customized or reset to factory default.
tatus Bar Switches display of the Status Bar on or off.
S
Unhide Cells > Presents a menu of currently hidden cells. Allows you to unhides any
cells that were hidden through the Display Options dialog box (View >
Display Options > Color/Format/Hiding)
Zoom In
Zoom Out
rap Allows the display to wrap.
W
Device List
Real-time
Statistics
Decoding
Assignments
L2CAP Connections Lists current L2CAP connections.
Increases the size of the displayed elements.
Decreases the size of the displayed elements.
Displays a list of discovered Bluetooth devices and allows you to add
and delete devices and security settings by selecting the device,
pressing the security button, and modifying the settings.
Opens a dialog box with a graphical summary of the traffic currently
being recorded by the Analyzer. Real-time monitoring allows
continuous monitoring and displaying of traffic and related statistical
dada in a piconet. This processed data is displayed in a set of
configurable graphs.
Lists current L2CAP decoding assignments.
RFCOMM Channel
Assignments
L
evels Presents a menu of display levels. This menu replicates the
Lists current RFCOMM assignments.
Decode/Display buttons in the toolbar such as Packets, L2CAP, TCS
etc.)
Window
New Window Switches display of the Tool Bar on or off.
ascade Displays all open windows in an overlapping arrangement.
C
ile Arranges multiple trace windows as a series of strips across the main
T
display area or as a series of side-by-side tiles.
Arrange Icons Arranges minimized windows at the bottom of the display.
W
indows Displays a list of open windows.
25
Page 34
Merlin Mobile User’s ManualCATC SW Version 2.0
Help
Online Help Displays Help topic associated with current Merlin window.
H
elp Topics... Displays online help.
U
pdate License... Opens a dialog box for entering license key information for the
analyzer.
D
isplay License
Information...
A
bout Merlin... Displays version information about Merlin.
Displays current license information for the analyzer.
3.2 Toolbar
The Tool Bar provides access to the most popular program functions. Tool tips
describe icon functionality as the mouse arrow is moved over the icon/item.
Open file View/Hide L2CAP Message Level
Save As View/Hide SDP Message Protocol Level
Preview View/Hide SDP Transaction Protocol Level
Print… View/Hide TCS Protocol Level
SetupRecordOptions
Start
Recording - presents options
for recording piconet,
inquiry, or IUT:HCI traffic
Stop Recording View AT Commands Protocol Level
Execute manual trigger.
Causes analyzer to trigger
end of recording.
View/Hide RFCOMM Protocol Level
View/Hide OBEX Protocol Level
View/Hide HDLC Protocol
Start Recording Wizard
View/Hide PPP
26
Page 35
Merlin Mobile User’s ManualCATC SW Version 2.0
Bluetooth Neighborhood.
Performs an inquiry and then
lists the local devices that it
discovered
Start Merlin’s Wand View/Hide AVCTP
Setup Display Options View/Hide AVDTP
Zoom In View/Hide BNEP Protocol
Zoom Out View HID Protocol Layer
Wrap View IP Protocol Layer
Hide Frequency Hops View TCP Protocol Layer
View/Hide HCRP
Hide Nulls & Polls
Hide ID Packets Display device list
Hide Voice (SCO) Packets File Information Report
Hide devices that were
specified in the Display
Options dialog box
Hide Unassociated Traffic Timing Calculations
Complex Find Traffic Summary
Find Next
View Packet Level
(Baseband)
View/Hide LMP Message
Level
View UDP Protocol Layer
Error Summary
Display Bus Utilization graph
Display Real-Time Statistics
View HCI Protocol layer.
27
Page 36
3.3 Status Bar
The Status Bar is located at the bottom of the main display window.
Depending on the current activity, the bar can be divided into as many as
four segments. The figure below demonstrates the various displays in the
status bar.
Recording Progress
When you begin recording, the left-most segment of the Status Bar displays
a Recording Progress Indicator. The following figure displays the various
indications of the status bar:
Merlin Mobile User’s ManualCATC SW Version 2.0
Status Bar Position Definitions:
The following numbered definitions correspond to the number labels on the
above status bars.
1 Analyzer is not connected or not configured.
2 Idle mode: Analyzer is connected to the host machine, but is not doing any
attempts to synchronize to a piconet nor record Bluetooth traffic.
3 Analyzer is trying to synchronize to the piconet with the master device that has
BD_Address 00837163787.
4 Analyzer is synchronized to the piconet with the master device that has
BD_Address 00837163787.
5 Analyzer is recording the traffic of the piconet with the master device that has
BD_Address 00837163787. However, no triggering occurred.
28
Page 37
Merlin Mobile User’s ManualCATC SW Version 2.0
6 A trigger event occurred, and the analyzer is recording the traffic of the piconet
with the master device that has BD_Address 00837163787. However, no
triggering occurred.
7 Analyzer is performing a BT Neighborhood action, where it makes inquiries
for Bluetooth devices.
8 Merlin application uploads recorded data from the analyzer at the end of a
recording session.
As recording progresses, the Progress Indicator changes to reflect the
recording progress graphically:
• In the Progress Indicator, a black vertical line illustrates the location of the
Trigger Position you selected in Recording Options.
— Pre-Trigger progress is displayed in the field to the left of the Trigger
Position in the before-Trigger color specified in the Display Options.
— When the Trigger Position is reached, the progress indicator wiggles as it
waits for the trigger.
— After the trigger occurs, the field to the right of the Trigger Position fills
in the post-Trigger color specified in the Display Options.
— When recording is complete, the upper half of the progress indicator fills
in white, indicating the progress of the data upload to the host computer.
You should be aware of two exceptional conditions:
If a Trigger Event occurs during the before-Trigger recording, the
•
before-Trigger color changes to the after-Trigger color to indicate that not all
the expected data was recorded pre-Trigger.
• When you click Stop before or after a Trigger Event, the Progress Bar adjusts
accordingly to begin uploading the most recently recorded data.
The Progress Bar fills with color in proportion to the specified size and
actual rate at which the hardware is writing and reading the recording
memory. However, the Progress Indicator is normalized to fill the space
within the Status Bar.
Recording Status
During recording activity, the current Recording Status is temporarily
displayed in the next segment. When you activate the Record function, this
segment flashes one of the following messages (depending on the selected
Recording Options):
— Trigger?
— Triggered!
— Uploading
After recording stops,
29
Page 38
Merlin Mobile User’s ManualCATC SW Version 2.0
— The flashing message changes to Uploading data–x%done(x%
indicates the percentage completion of the data uploading process).
— The traffic data is copied to disk (overwriting any previous version of this
file) using the default file name data.tfb or a new name specified in the
Recording options.
To abort the upload process,
Click in the Tool Bar.
You are prompted to choose whether to keep the partially uploaded data or to
throw it away.
When the data is saved, the Recorded Data file appears in the main display
window and the Recording Status window is cleared.
• If the recording resulted from a Trigger Event, the first packet following the
Trigger (or the packet that caused the Trigger) is initially positioned second
from the top of the display.
• If the recording did not result from a Trigger Event, the display begins with the
first packet in the traffic file.
Analyzer Status
The third segment in the status bar displays analyzer status. The status will
display one of the following:
No Sync - the system is not synced to any piconet
Inquiring... - The system is performing an Bluetooth Inquiry
Syncingto[XXX]...-- The system is attempting to synchronize to a piconet
where the device with BD_Address XXX is the master.
Synced to [XXX] - The system is synchronized to a piconet where the
device with BD_Address XXX is the master.
Recording [XXX] - system is recording the Bluetooth traffic of the piconet
where the device with BD_Address XXX is the master.
After the analyzer has synchronized to the Bluetooth piconet under
observation, the Status Bar will display activity bars and the strength (in
dBm) of the radio signal that Merlin is receiving. The activity bars will
increase or decrease with activity. The signal strength readings will display
as five possible values:
•below-60dBm
• - 60 dBm
• - 50 dBm
• - 40 dBm
30
Page 39
• above - 40 dBm
The valid range for a signal is between -60 and - 40 dBm
Search Status
The rightmost segment displays the current search direction: Fwd (forward)
or Bwd (backward).
Zoom In
Zoom In increases the size of the displayed elements, allowing fewer (but
larger) packet fields per screen.
• Click on the Tool Bar.
Zoom Out
Zoom Out decreases the size of the displayed elements, allowing more (but
smaller) packet fields per screen.
• Click on the Tool Bar.
Merlin Mobile User’s ManualCATC SW Version 2.0
3.4 Tool Tips
Throughout the application, tool tips provide useful information.
To display a tool tip, position the mouse pointer over an item. The tool tip
displays in a short moment if present. Tool tips can also be found over the
Tool Bar and in areas of the packet view screen.
3.5 Merlin Analyzer Keyboard Shortcuts
Several frequently-used operations are bound to keyboard shortcuts.
Table 2: Keyboard Shortcuts
Key Combination Operation Key Combination Operation
Ctrl+O Open file Ctrl+P Print...
Ctrl+Home Jump to First packet Ctrl+End Jump to Last packet
Ctrl+F Search Forward Ctrl+B Search Backward
F3 Find Next Ctrl+L Search for Loss of Sync
Shift+I Goto ID packet Shift+R Goto Freq Hop packet
Shift+P Goto Poll packet Shift+N Goto Null packet
Shift+M Goto DM1 packet Shift+F Goto FHS packet
Shift+1 Goto HV1 packet Shift+H Goto DH1 packet
Shift+3 Goto HV3 packet Shift+2 Goto HV2 packet
Shift+A Goto AUX1 packet Shift+V Goto DV packet
Shift+5 Goto DH3 packet Shift+4 Goto DM3 packet
31
Page 40
Merlin Mobile User’s ManualCATC SW Version 2.0
Key Combination Operation Key Combination Operation
Shift+7 Goto DH3 packet Shift+6 Goto DM5 packet
Shift+S Search for Soft Error Shift+E Search Error
32
Page 41
Merlin Mobile User’s ManualCATC SW Version 2.0
5. Recording Wizard
Recording Wizard is an interactive utility that presents a series of
user-friendly dialog boxes for setting up a recording session. Recording
Wizard serves as an alternative method of configuring the Recording
Options dialog box. When you are finished using the Wizard, you can view
your settings in the Recording Options window. By providing data to the
prompts in the Wizard’s dialog boxes, you configure Merlin Mobile for a
recording session.
Starting Recording Wizard
To start the Recording Wizard,
Click on the Tool Bar or select Recording Wizard under Setup on the
•
Menu Bar.
You see the Recording Options window:
The Recording Options window has three buttons marked Next, Back,and
Cancel that allow you to move forward or backward through the wizard or
to cancel the wizard.
To begin advancing through the wizard,
• Click Next to see the options for the three types of recordings that the
Recording Wizard can make.
33
Page 42
Merlin Mobile User’s ManualCATC SW Version 2.0
The Wizard advances to the next screen which presents three options:
• I want to establish a new piconet and have Merlin Mobile record traffic
on that piconet.
This option causes Merlin Mobile to perform an Inquiry so it can discover local
devices and then establish a new piconet and record the piconet traffic.
• I want Merlin Mobile to record traffic on a piconet that has already been
established.
This option lets Merlin Mobile record traffic from an already established piconet.
• I am using Bluetooth Test Mode and want Merlin Mobile to record traffic
on my test piconet.
This option lets Merlin Mobile create either a single frequency range recording of
a range that you specify or create a recording of a limited hop frequency range
consisting of 5 frequency hops.
5.1 Recording a Traffic on a New Piconet
The New Piconet option shown in the previous screen presents users with
the means of recording the traffic from a new piconet. This option will
cause a sequence of screens to prompt you for information such as the
piconet Master address.
34
Page 43
Merlin Mobile User’s ManualCATC SW Version 2.0
The following steps shows you how to configure Merlin Mobile to record a
new piconet.
Step 1 From the screen shown in the previous screenshot, select the
first option: I want to establish a new piconet and have
Merlin Mobile record traffic on that piconet,thenpress
Next.
The following screen displays.
Step 2 Select Perform Inquiry Now,thenpressNext.
Selecting Perform Inquiry Now will cause Merlin Mobile to perform a General
Inquiry and collect addresses and other details about local Bluetooth devices. If
you already have address information for your Bluetooth devices you can choose
Skip Inquiry. Choosing Skip Inquiry will cause the Recording Wizard to
advance to Step 6. If you are not sure what option to select, choose Perform
Inquiry Now.
35
Page 44
Merlin Mobile User’s ManualCATC SW Version 2.0
The following screen will display.
You will see two options:
• I want to search for all Bluetooth devices within range
This option will cause Merlin Mobile to search for all Bluetooth devices that are
in range and ready to transmit and receive data (i.e., in Inquiry Scan Mode)
• I want to search only for devices corresponding to the following
(hexadecimal) DIAC:
This option will cause Merlin Mobile to search for the class of devices that you
specify in the DIAC text box. DIAC stands for Device Inquiry Access Code.
Values are entered in hexadecimal format. You can get DIAC values from the
Bluetooth Specification.
Step 3 Select the first option: I want to search for all Bluetooth devices
36
Page 45
Merlin Mobile User’s ManualCATC SW Version 2.0
within range,thenpressNext. The following screen will display.
You will see two options:
Step 4 In the text box, enter the length of time you want Merlin Mobile to
search for nearby devices.
The default value is 11. If you do not sure what time value to enter, use the default
value.
Step 5 Press Next.
Before the Inquiry, Merlin Mobile tests the hardware connection. In the case of
failure, the following screen will display.
Clicking OK will close the message box.
37
Page 46
Merlin Mobile User’s ManualCATC SW Version 2.0
If Merlin Mobile passes the hardware test, it will search for devices. The
Recording Wizard will display a progress bar and a message telling you that a
search is under way:
If no device is found, the Recording Wizard will display the following screen:
38
Page 47
Merlin Mobile User’s ManualCATC SW Version 2.0
If devices found, the Recording Wizard will display the following screen:
Step 6 Press Next.
The following window will display:
Step 7 Select from the drop-down menu the hexadecimal address for your
Master device. If you do not see your device’s address, you may
type it into the text box yourself.
39
Page 48
Merlin Mobile User’s ManualCATC SW Version 2.0
The following window will display:
Step 8 Select from the drop-down menu the hexadecimal address for your
slave device into the box labeled Piconet Slave Address. If you do
not see your slave’s address, you can type it into the box.
Step 9 Press Next.
The following screen will display.
This screen displays the settings you selected.
40
Page 49
Merlin Mobile User’s ManualCATC SW Version 2.0
The Advanced button on the right will open the Recording Options dialog box
shown below. This screen will show the settings you selected through the
Recording Wizard have been applied to the Recording Options dialog.
Step 10 Press Next to advance the Recording Wizard to the next screen.
The following screen displays:
Merlin Mobile pages the Master and if specified in Step 8, the Slave devices.
41
Page 50
Merlin Mobile User’s ManualCATC SW Version 2.0
If Merlin Mobile is unable to complete its pages, the following screen will display:
If Merlin Mobile is able to complete its pages, it will enter into a synchronizing
state and then wait for you to create the piconet. During this waiting period,
Merlin Mobile will display the following screen:
42
Page 51
Merlin Mobile User’s ManualCATC SW Version 2.0
Once you have created the piconet, Merlin Mobile will synchronize to the piconet
and begin recording. During the recording, Merlin Mobile will display the
following screen:
At the completion of the recording, Merlin Mobile will display the following
screen:
You can repeat the recording by pressing the Repeat button.
Step 11 To close the wizard, press the Close button.
43
Page 52
Merlin Mobile User’s ManualCATC SW Version 2.0
The wizard will close and your trace will display.
5.2 Recording an Existing Piconet
Using Recording Wizard to record an existing piconet is similar to recording
a new piconet. The main difference is that you will be asked if your Master
device can support multiple slave devices and whether it can respond to
pages once it has created a piconet with another device.
Step 1 To start the Recording Wizard, press or select Setup >
Recording Wizard from the menu.
44
Page 53
Merlin Mobile User’s ManualCATC SW Version 2.0
The Recording Wizard introductory page will open:
Step 2 Press Next to advance to the next screen.
You will see three choices:
Step 3 Select the second option: I want Merlin Mobile to record
traffic on a piconet that has already been established.
Step 4 Press Next.
45
Page 54
Merlin Mobile User’s ManualCATC SW Version 2.0
You will see two choices:
Step 5 Select Perform Inquiry Now.
You will see two choices:
Step 6 Select the first option: I want Merlin Mobile to search for
all Bluetooth devices within range.
46
Page 55
If you want to limit the inquiry to a class of devices, select the second option and
enter the hexadecimal value for the device class in the text box.
Step 7 Press Next.
The following screen will appear:
Merlin Mobile User’s ManualCATC SW Version 2.0
Step 8 If you want to change the search duration, type in a new
value into the text box. Otherwise, use the default value (20
seconds), then press Next.
47
Page 56
Merlin Mobile User’s ManualCATC SW Version 2.0
If Merlin Mobile cannot detect other devices, the following message will display:
If Merlin Mobile passes the hardware test, it will then goes onto conduct a
General Inquiry to locate local Bluetooth devices.
48
Page 57
Merlin Mobile User’s ManualCATC SW Version 2.0
If Merlin Mobile finds Bluetooth devices, it will display the following message:
Check the Device List to see if Merlin Mobile found all of the devices in your
piconet. If you feel that the list is incomplete, you can close this window and press
the button marked Repeat. This will cause Merlin Mobile to repeat the General
Inquiry and recollect information on local Bluetooth devices.
Step 9 Press Next to advance to the next screen.
The following screen will prompt you for the Master device’s address. The
address can be selected from the menu or typed into the box:
49
Page 58
Merlin Mobile User’s ManualCATC SW Version 2.0
Step 10 Select or type in the Master device’s address into the box
next to the label Piconet Master Address.
Step 11 Press Next.
The following screen will display. This screen asks you which of the following
two options apply to your Master device. For some devices, both options will
apply.
You can select either or both options. They are not mutually exclusive:
If the Master supports inquiries while in a connected state, select the first option.
This will set Merlin Mobile to use the 'Sync & Record' mode in its attempts to
synchronize to the Master. This will also cause the wizard to skip to step 8.
If the Master can support piconets with multiple slaves, select the second option.
If you select this box alone (i.e., you leave the first box unchecked), Merlin Mobile
will use the 'Passive Sync & Record' mode to synchronize to the Master. The
wizard will then advance to Screen 8*.
If the first checkbox was selected, Merlin Mobile will use 'Sync & Record' no
matter what was set in the second box.
Step 12 If you want to skip the Master verification, put a check in the
box. If you are in doubt, leave the box unchecked.
50
Page 59
Merlin Mobile User’s ManualCATC SW Version 2.0
If you selected only the second option in Step 12 (=’Passive Sync & Record’), the
following screen will display.
This screen asks you for the address of the Page Target device -- which in this case
is Merlin Mobile. Since the devices in your piconet are not able to respond to
inquiries, Merlin Mobile will not be able to page the devices and join the piconet.
Instead, you will assign Merlin Mobile an address here in this screen, then direct
your piconet Master device to connect to Merlin Mobile. The Master will attempt
to connect to Merlin Mobile and therein give Merlin Mobile the information it
needs to record the Master and slave devices.
Step 13 Type in an address of your choosing for Merlin Mobile (= Page
Target).
You are making up an address for Merlin Mobile that the Master will use to try to
connect to Merlin Mobile.
51
Page 60
Step 14 Press Next
Merlin Mobile will then display your current settings.
Merlin Mobile User’s ManualCATC SW Version 2.0
The Advanced button will open the Recording Options dialog box shown on
page 41 and described in detail in Chapter 7.
Step 15 Press Next to begin the recording.
If the Merlin Mobile hardware is not ready or connected or is in the process of
booting up, the following information message box will display:
Step 16 If the above information box opened, press OK to close it.
52
Page 61
Merlin Mobile User’s ManualCATC SW Version 2.0
The following dialog box will display:
Step 17 Press Retry or Back to re-attempt the process.
If the hardware failure described above do not occur, Merlin Mobile will conduct
an inquiry. The screen will show that Merlin Mobile is going to attempt a
recording in either ’Passive Sync & Record’ mode as shown below or in ’Sync &
Record’ mode depending on the options you selected in Step 15.
Step 18 If you are recording in ’Passive Sync & Record’ mode, you will
53
Page 62
Merlin Mobile User’s ManualCATC SW Version 2.0
need to direct your Master device to attempt a connection to Merlin
Mobile. This will provide Merlin Mobile with the information it
needs to record the piconet.
Once Merlin Mobile has the information it needs, it will begin recording. The
following screen will display:
The recording will end following a trigger event or when you press Stop
Recording button on the screen shown above or when you press the button on the
toolbar.
Step 19 When finished, press Close to close the Recording Wizard.
5.3 Recording in Test Mode
A Test Mode recording allows you to limit the frequency hopping range that
Merlin Mobile will record. Two Test Modes are available: Reduced
Hopping Mode and Single Frequency Mode. Reduced Hopping Mode
limits Merlin Mobile’s recording to the five frequency hops that are
described in the Bluetooth Specification. Single Frequency Mode limits
Merlin Mobile’s recording to a single frequency range that you specify in
the Recording Wizard.
Recording in Reduced Hopping Mode
To record in Reduced Hopping Mode, perform the following steps:
Step 1 Start the Recording Wizard by either pressing the button
or selecting Setup > Recording Wizard from the menu.
The Recording Wizard greeting screen will open.
54
Page 63
Merlin Mobile User’s ManualCATC SW Version 2.0
Step 2 Press Next to advance to the Recording Type screen.
The following screen will display:
Step 3 Select the third option: I am using Bluetooth Test Mode
and want Merlin Mobile to record traffic on my test
55
Page 64
piconet.
Step 4 Press Next.
The following screen will display:
Merlin Mobile User’s ManualCATC SW Version 2.0
Step 5 Select the option Reduced-hopping mode,thenpressNext.
The following screen will display:
Step 6 Select the address for your piconet’s Master device from the
drop-down menu. If you prefer, you can type in the address
56
Page 65
into the box.
Step 7 Press Next.
The following screen will display. This screen will show the current settings for
the recording:
Merlin Mobile User’s ManualCATC SW Version 2.0
The Advanced button will open the Recording Options dialog box. See Chapter
7 for details on the Recording Options dialog box.
Step 8 Press Next to begin the recording.
The following screen will display:
57
Page 66
Merlin Mobile User’s ManualCATC SW Version 2.0
Step 9 When the recording finishes, the following screen will display.
You can repeat the recording by pressing the Repeat button.
Step 10 To close the wizard, press Finish.
58
Page 67
Merlin Mobile User’s ManualCATC SW Version 2.0
5.4 Recording in Single Frequency Mode
Step 1 In the Recording Type window, select the third radio button
and click Next.
Step 2 In the Frequency Hopping Mode, window select the
Fixed-Frequency Mode radio button, enter the appropriate
values in the text boxes, and click Next.
Step 3 In the Master Device address box, enter the BD Address for
59
Page 68
Merlin Mobile User’s ManualCATC SW Version 2.0
your Master Device.
Step 4 Press Next.
Step 5 Press Next. Merlin Mobile then synchronizes with the
60
Page 69
Merlin Mobile User’s ManualCATC SW Version 2.0
Master device and begins recording.
61
Page 70
Merlin Mobile User’s ManualCATC SW Version 2.0
62
Page 71
Merlin Mobile User’s ManualCATC SW Version 2.0
6. Recording Options
The Recording Options dialog box provides an alternative method of
setting up a recording to the Recording Wizard, described in the previous
chapter. In this dialog box are all of the settings needed to make a recording.
Once you have selected your recording options, you then select the
recording mode by clicking the down-arrow on the Record button and
selecting from the two mode options: Piconet and Inquiry. Merlin Mobile
will then use the relevant Recording Options for the selected mode. For
example, if you select Piconet recording mode, Merlin Mobile will use the
options from the Piconet page in the Recording Options dialog box.
6.1 Recording Modes
Pressing the down-arrow on the Record button displays a menu with four
Recording Modes:
Selecting one of these modes tells the analyzer what sets of Recording
Options it should use when you begin a recording.
Note: Selecting a Recording Mode from the menu does not cause the
analyzer to begin recording. To begin recording, you must press the
Recording button itself.
Piconet recording
Selecting Piconet, configures Merlin Mobile to record piconet traffic using
the parameters set in the Piconet page in the Recording Options dialog box.
When you begin recording in this mode, Merlin Mobile will to try to
synchronize to a piconet that matches the Piconet parameters set in the
Recording Options. The recorded traffic is captured off-the-air.
Inquiry recording
This mode configures Merlin Mobile to record Inquiry traffic. When setting
the Merlin Mobile to Inquiry recording, the system is ready to perform a
Bluetooth 'General' or 'Dedicated' inquiry, according to the parameters
63
Page 72
Merlin Mobile User’s ManualCATC SW Version 2.0
specified in the 'inquiry' page of the Recording Options. The recorded traffic
would consist the transmitted packets as well as the responses received from
Bluetooth devices in the area.
IUT:HCI mode
Configures the system to exclusively record HCI traffic from IUTs. This
recording mode bypasses the analyzer: HCI traffic from the IUT is recorded
directly by the analyzer software without going through the analyzer. This
means that you can record HCI traffic even if the analyzer is not turned on.
To record HCI traffic, first enable the recording of HCI traffic from IUTs.
You do this in the HCI page of the Recording Options dialog. Then set the
recording mode to something other than IUT:HCI. If you want to prevent
the recording of HCI traffic from IUTs, disable it in the HCI page of the
Recording Options dialog.
6.2 Opening the Recording Options Dialog Box
To open the Recording Options menu, click on the Tool Bar or select
Recording Options under Setup on the Menu Bar.
64
Page 73
Merlin Mobile User’s ManualCATC SW Version 2.0
You see the Recording Options window. By default, the Piconet options
page displays:
You will need to set options for each of the Recording Options pages.
Generally, it is best to begin with the General and Piconet pages where you
can set the type of recording, and then move on to the Events and Actions
pages where you can set triggering events.
6.3 Recording Options - General
The General page controls the length of a recording and how it begins and
ends. It is shown in the previous illustration. The General page display four
boxes marked Recording Type, Buffer Size, Trigger Position, and Options.
Recording type
The Recording Type box presents options that control
how Merlin Mobile begins and ends a recording. The
options are: Snapshot, Manual Trigger, and Event
Trigger.
65
Page 74
Snapshot
A Snapshot is a fixed-length recording whose size is determined by the
"Buffer Size" box in the Recording Options dialog or by a manual click of
the Stop button. Recording begins by clicking on the
Tool Bar and ends when either the selected buffer size is filled or you press
the Stop button.
Manual Trigger
A Manual Trigger recording is a one that is manually begun and ended.
Recording is begun by pressing on the Tool Bar.
Recording continues in a circular manner within the limits set by the buffer
size. Recording ends when is clicked on the Tool Bar or the Trigger
button is pressed on the analyzer's front panel. If you press the Trigger
button, recording will continue until the post-trigger memory has been
filled.
Event Trigger
Merlin Mobile User’s ManualCATC SW Version 2.0
An Event Trigger recording is one that uses an event trigger to end the
recording. Before recording begins, you define the event trigger in the
Trigger Options dialog box. You begin the recording by clicking
on the Tool Bar. Recording continues in a circular
manner within the limits set by the buffer size. Once the trigger event
occurs, some post-trigger recording occurs, then the recording ends.
Note In this mode, the recording can be stopped manually in the same way as for
"manual trigger" mode.
Options
The Options box contains two options:
Beep When Trigger Occurs
Will cause the PC to beep when a trigger event
has occurred.
Save External Interface Signals
Will enable Merlin Mobile to record input signals from a breakout board as
fields in a trace.
Buffer Size
The Buffer Size box has a slide bar for adjusting the
recording buffer size from 0.4 megabytes to 512
megabytes.
66
Page 75
The Recording Type option determines how this buffer is used. Although
there are 512 megabytes of physical memory in the analyzer, the efficiency
of the recording ranges from 2:1 to 4:1 ratios of physical memory to actual
Bluetooth traffic. Shorter Bluetooth packets yield a less efficient recording.
The non-traffic portion of physical memory is utilized for control and timing
information.
Note The scale is not linear and affords more granularity in the smaller buffer sizes.
Trigger Position
The Trigger Position slide bar sets the amount of
post-trigger recording that Merlin Mobile will
perform. It also allows adjustment of the location of
the trigger within the defined buffer. You can adjust
the Triggering Position between 1 and 99%
post-Trigger. Trigger Position is available only when Manual Trigger or
Event Trigger is selected as Recording type.
Merlin Mobile User’s ManualCATC SW Version 2.0
As an example, if the buffer size is set to 16MB, then for the following
Trigger Position settings, the amount of pre- and post-Trigger data is
•
95% post-triggering: 0.8MB pre-trigger, 15.2MB post-trigger
• 75% post-triggering: 4MB pre-trigger, 12MB post-trigger
• 50% post-triggering: 8MB pre-trigger, 8MB post-trigger
• 25% post-triggering: 12MB pre-trigger, 4MB post-trigger
• 5% post-triggering: 15.2MB pre-trigger, 0.8MB post-trigger
Note When a Trigger occurs, recording continues until the post-Trigger amount of the
buffer is filled.
6.4 Recording Options - Piconet
The Recording Options dialog box has two pages for configuring how
Merlin Mobile records Bluetooth traffic: Piconet, which configures piconet
recording sessions, and Inquiry which configures inquiry recording
sessions.
67
Page 76
Merlin Mobile User’s ManualCATC SW Version 2.0
For recording in Piconet mode, the Piconet page lets you specify the type of
piconet you will be recording and how Merlin Mobile should synchronize
and record the piconet. This window is divided into four boxes marked Hop
Sequence, Sync Method, Additional Settings, and Debug.
Hop Sequence
The Hop Sequence menu presents the following three options:
•
79 Hops Standard - This is the option used for most recordings.
• Reduced Hop - Restricts Merlin Mobile to five hop frequencies defined in the
test mode specification of the Bluetooth Specification. When Reduced Hop or
Single Frequency is selected, the Sync method is set to Test Mode and cannot
be modified by the user.
• Fixed Frequency - Allows the transmit and receive frequency ranges to be
specified. Selecting this option highlights the "DUT Xmit" and "DUT Recv"
text boxes. When Reduced Hop or Single Frequency is selected, the Sync
method is set to Test Mode and cannot be modified by the user.
68
Page 77
Sync Method
To record Bluetooth traffic, Merlin Mobile needs to synchronize to the
piconet under observation. Merlin Mobile does not participate in the piconet
and behaves as a passive listener. It needs, however, to communicate briefly
with the devices in the piconet to learn the Master clock and frequency
hopping sequence.
Sync Method options let you configure how Merlin Mobile synchronizes to
the piconet under observation. There are three options:
•
Merlin Mobile User’s ManualCATC SW Version 2.0
Enter values into the two text boxes to the set the transmit and receive
frequency ranges:
• DUT Xmit Freq, MHz (+2402) – Allows the setting of the
transmit signal for the Device Under Test
• DUT Recv Freq, MHz (+2402) – Allows the setting of the
receive signal for the Device Under Test
Sync and Record
• PassiveSync&Record
• Page Sync & Record
Note If the selected Hop Sequence is "Reduced Hop" or "Single Frequency," the Sync
Method is set to "Test Mode" and cannot be modified by the user.
To the right of the Sync Method menu are two menus which let you select
or enter address for the devices in the piconet:
Master Address - Presents a drop-down list of Master devices found
previously. You can also enter address values in this box.
Page Target -- Presents a drop-down list of Page Target devices found
previously. You can also enter address values in this box.
Between the two text boxes is the following button:
- Swaps the Master and Page Target addresses.
When to Use the Different Piconet Recording Modes
Page Sync & Record is the preferred option and should be used whenever
possible. If Page Sync & Record can not be used, then Sync & Record
should be used. Passive Sync and Record should be used only if the first
two options can not be used.
69
Page 78
Sync & Record
Sync and Record works just like "Page Sync and Record" except that Merlin
Mobile takes its sync data directly from the Master instead of the Slave
devices. With Sync and Record, Merlin Mobile conducts a General Inquiry
to get hop frequency and clock information from the Master. Merlin Mobile
then waits to detect piconet traffic from the Master device’s piconet. When
the piconet is established, Merlin Mobile is able to synchronize to the
Master and begin recording. In contrast to "Page Sync and Record", "Sync
and Record" can be run with or without an established piconet.
Note This mode can only be used to find master devices that support Inquiry Scan.
To perform a "Sync and Record", follow the steps below:
Step 1 Turn on the Bluetooth devices under observation, and set up the
master device so it is ready to respond to Inquiry scan. For a typical
recording, ensure that the Master and Slave device(s) are not yet
connected.
Merlin Mobile User’s ManualCATC SW Version 2.0
Step 2 In the Modes tab under Recording Options, enter the Master
Device’s address.
Step 3 Start Merlin Mobile recording by pressing
the Record button on the toolbar.
Step 4 When the analyzer is able to Sync up to the Piconet Master Clock,
the Green Sync LED in the Merlin Mobile front panel will start
blinking.
Step 5 Establish connection between the Bluetooth devices under analysis.
Step 6 When Merlin Mobile senses Piconet traffic, the Green Sync light
goes ON solid, recording starts and the status bar in the bottom of
the analyzer screen shows activity.
Recording may be stopped manually or when the recording buffer is filled.
Note After the Sync light starts blinking, a connection between the Bluetooth
devices should be established within one (1) minute.
Passive Sync & Record
Passive Sync and Record is used in situations where the Master device and
slave devices do not support Inquiry Scan mode. When selected, Merlin
Mobile enters Inquiry Scan and Page Scan mode and waits for a page from
70
Page 79
Merlin Mobile User’s ManualCATC SW Version 2.0
the Master device. When the piconet Master pages Merlin Mobile, Merlin
Mobile obtains the information necessary for synchronization and then
attempts to synchronize to the piconet controlled by that Master.
"Passive Sync and Record" is designed to be used with established piconets
or private device networks.
Running "Passive Sync and Record" with Established Piconets
For most situations, "Passive Sync and Record" will be run after a piconet
has been established. The steps are as follows:
Step 1 Establish a connection between two or more Bluetooth devices.
Step 2 Under General Recording Options, select "Passive Sync & Record."
Step 3 Under the Modes tab in Recording Options, enter the address for the
piconet’s master device.
Step 4 Make up an address for Merlin Mobile and enter it into the Page
Target address in the Modes tab in Recording Options. Make sure
you do not select an address for any other local device.
Step 5 Press the record button on the toolbar in Merlin
Mobile to start a recording session.
Step 6 If necessary, have Master "discover" Merlin Mobile through a
General Inquiry.
Step 7 From the Master device, initiate a page to Merlin Mobile’s address.
This action will enable Merlin Mobile to synchronize to the piconet.
However, the analyzer will not complete the page sequence from the
Master. This will cause the Master to time out in this request.
Step 8 At the end of this sequence, the green Sync light will go on solid,
recording will begin and activity will be displayed on the status bar
in the bottom of the analyzer screen.
Running "Passive Sync and Record" with Private Device Piconets
Because private device networks do not allow other devices to join the
network, Merlin Mobile needs to temporarily assume the identity of a slave
in the network in order to join that network. To do this requires disabling the
slave and beginning the operation without an established piconet. The
following steps show the process.
Step 1 Turn the Master device on and the slave device off. You need the
slave device turned off so that Merlin Mobile can take its place in the
piconet.
Step 2 Enter the slave’s address into Merlin Mobile’s "Page Target" field
71
Page 80
in the Modes tab in the Recording Options dialog box.
Step 3 Run "Passive Sync and Record." The Master will then page the
slave’s address and Merlin Mobile will be able to sync.
Step 4 When Merlin Mobile synchronizes to the Master, turn the slave back
on. When the Master re-pages the address the slave is admitted into
the private network. Since Merlin Mobile is passive in this mode,
the slave and Merlin Mobile do not conflict over the shared address.
Merlin Mobile is then able to record the traffic between the Master
and slave.
Page Sync & Record
"Page Sync and Record" is the recommended method of recording. "Page
Sync and Record" should be implemented before a piconet is established.
This mode causes Merlin Mobile to perform a General Inquiry and collect
sync information from the specified slave device when it responds. Merlin
Mobile then waits for the Master to begin paging the Slave devices. When
paging begins, Merlin Mobile synchronizes to the Master and begins
recording.
Merlin Mobile User’s ManualCATC SW Version 2.0
Note In order for this mode to work, the intended Slave must support "inquiry scan".
The following steps describe the simplest way to use this mode:
Step 1 Place both the "intended master" as well as its first "intended slave"
into inquiry scan mode.
Step 2 Have Merlin Mobile perform a General Inquiry. You do this by
pressing the BT Neighborhood button
Step 3 After the General Inquiry completes, the addresses will populate the
menus marked Master Device and Page Target. Select or enter the
addresses for both your Master Device and Page Target.
Step 4 Click OK at the bottom of the window to close the Recording
Options dialog box.
Step 5 Press the button found on Merlin Mobile's
toolbar. After approximately 20 seconds, the "SYNC" light
on the front of Merlin Mobile will begin to flash, meaning
that Merlin Mobile has acquired all the information it needs
to fully synchronize with the piconet about to be established.
At this point, you should establish the piconet using the
devices previously defined as master and slave.
Note Inquiry Timeout is configurable (0 to 80 seconds) in the Recording Options
General page.
72
Page 81
Merlin Mobile User’s ManualCATC SW Version 2.0
Step 6 When the piconet is established, the "Sync" light on the front of
Merlin Mobile will change from flashing to solid, indicating that
Merlin Mobile is fully synchronized to the piconet and is currently
recording all traffic within that piconet.
Note If the "sync" light on the front of Merlin Mobile does not change from
flashing to solid it means that Merlin Mobile did not synchronize with the
piconet when it was established.
Additional Settings
Force Re-synchronization
"Force Re-Synchronization" forces Merlin Mobile to re-synchronize at the
beginning of each "Sync & Record," "Passive Sync & Record," or "Sync &
Record" operation. By default, "Force Re-Synchronization" is disabled
(i.e., unchecked).
Unchecking the "Force Re-Synchronization" checkbox tells Merlin Mobile
to use its existing data on Bluetooth devices, thereby bypassing the
synchronization process and saving a few seconds from the beginning of the
trace. If you know that Merlin Mobile’s data is correct, you can uncheck
this checkbox and cause Merlin Mobile to use the existing data. If the data
is incomplete or incorrect, however, Merlin Mobile will automatically
perform a refresh.
To examine Merlin Mobile’s Bluetooth data, open Device List: View
>Device List.
Follow Master/Slave Switch
If enabled, this option allows Merlin Mobile to follow a role switch between
a Master and Slave. This capability allows Merlin Mobile to keep track of
changes in a device’s role when it changes from one role to another.
Merlin Mobile is able to follow a role change by listening to the Slave
device’s Bluetooth clock and hop frequency as soon as it becomes a Master.
Match Clock Rate
Match Clock Rate is a useful option if the Master device’s clock is
inaccurate. Match Clock Rate causes Merlin Mobile to do a General Inquiry
to determine the Page Target's clock rate prior to synchronizing to the
piconet. If unchecked, Merlin Mobile will begin piconet synchronization
without first doing a General Inquiry.
This option only works with Page Sync and Record mode.
73
Page 82
Merlin Mobile User’s ManualCATC SW Version 2.0
Show Paging Traffic
Show Paging Traffic causes Merlin Mobile to capture paging traffic
between the Master and Page Target devices. This option is used only with
Page Sync and Record Mode.
Correlation Value (33-64)
This value tells Merlin Mobile how many bits in the sync word of each
received packet must be matched in order for Merlin Mobile to consider the
packet valid and start recording.
It is recommended that the Correlation Value be set to 57 bits.
Inquiry Timeout (0-80 secs)
Default value is 20 seconds.
This value specifies how long Merlin Mobile should perform the Inquiry
process for the General (unlimited) and Dedicated (limited) recording
modes. After the specified time has elapsed, Merlin Mobile will illuminate
the trigger light on the front of the analyzer.
Loss of Sync Timeout (1-30 secs)
This value specifies the amount of time that Merlin Mobile will wait for
piconet traffic before determining that synchronization has been lost.
Sync Window
The Sync Window slide bar controls the amount
of time that Merlin Mobile should wait between
receiving an Inquiry Response (which will cause
the Sync LED to blink) and detecting Master-Slave piconet traffic (which
will cause the Sync LED to turn solid.)
A "Narrow" setting means that the wait time will be minimal, a "Wide"
setting means it will be "maximal." The default is "Narrow" and this is
suitable for most recordings. However, if significant drift occurs between
Merlin Mobile’s clock and that of the Master, Merlin Mobile may not be
able to sync properly to the piconet. Under these conditions, you should
move the slide bar towards the "Wide" Setting. The slide bar has five
discrete settings.
After sync is established, Merlin Mobile will remain in sync as long as there
is piconet traffic.
74
Page 83
Merlin Mobile User’s ManualCATC SW Version 2.0
Debug
Enable CATC debug file
Checking this box enables the creation of a file that can be used by CATC
Support to aid in debugging. This option should always be disabled unless
you are requested to enable it by CATC personnel.
6.5 Recording Options - Inquiry
The Inquiry page configures how Merlin Mobile records Inquiry traffic.
Two main options are presented in the Sync Method drop-down menu:
General (Unlimited) Inquiry and Dedicated (Limited) Inquiry. These
options tell Merlin Mobile what kind of Inquiry traffic it should expect to
record.
This page includes settings only for Inquiry recording and BT
Neighborhood.
General (Unlimited)
"General" means "General Inquiry" and is used to search for ALL Bluetooth
devices that are within range, for the amount of time specified in the Inquiry
Timeout field. Completion of the inquiry process is indicated by
illumination of the "trigger" light on the front of the analyzer. All
responding packets will be displayed when data upload from the analyzer
completes.
Dedicated (Limited)
"Dedicated" means a specific class or group of Bluetooth devices
(designated by the DIAC field of the Recording Options dialog). Selecting
"Dedicated" causes Merlin Mobile to search for all devices from a specific
class or group that are within range, for the amount of time specified in the
Inquiry Timeout field. Completion of the inquiry process is indicated by
illumination of the "trigger" light on the front of the analyzer. All
responding packets will be displayed when stop is selected.
BT Neighborhood
These options configure how the BT Neighborhood command behaves. BT
Neighborhood is a utility that performs an Inquiry and then lists the local
devices that it discovered.
• Use Default settings -- Sets the analyzer to record a General Inquiry with an
Inquiry Timeout of 11 seconds.
• Match 'Inquiry' Recording Settings -- Sets the analyzer to use the settings
you chose above under Hop Sequence, Inquiry Type, and Additional Settings.
75
Page 84
Merlin Mobile User’s ManualCATC SW Version 2.0
Debug
Enables the creation of a file that can be used by CATC Support to aid in
debugging.
6.6 Recording Options - HCI
The HCI property page lets you include HCI traffic from IUTs into the trace.
HCI traffic consists of commands and other traffic that are sent by the IUT
to generate Bluetooth traffic. By default, this option is disabled - meaning
that HCI traffic is not shown in the trace.
HCI Traffic from the IUTs is captured by the analyzer application using an
HCI probe (provided by CATC) that is connected directly to the IUT
hardware. In a typical setup, the HCI commands and data to transmit are
passed from the Bluetooth application to the Bluetooth baseband (Host to
Controller), while events and data that was received are passed from the
Bluetooth baseband to the Bluetooth application (Controller to Host).
To capture the data, the HCI Probe should be connected to the respective
'Host to Controller' and 'Controller to Host' lines. When the recording of the
IUT's HCI is enabled and the application starts a recording, the serial data is
captured as incoming serial data. For this, up to two COM ports should be
configured for each IUT.
76
Page 85
HCI Window Layout
The HCI page displays a Debug checkbox, a Configurations List that is
made up of IUTs that were added via the Add button, and buttons labeled
Add, Edit,andDelete.
Debug
Enables the creation of a file that can be used by CATC Support to aid in
debugging.
Configurations List
The Configurations List displays the COM settings for the ports used to
connect the IUT to the host PC.
The Configurations List allows you to manage as list of up to three IUTs to
be recorded and set the parameters for each one. It also allows you to enable
or disable a specific IUT from being recorded. The settings are stored in the
recording options file, like the rest of the recording options.
Merlin Mobile User’s ManualCATC SW Version 2.0
The Configurations List is made up of the following fields:
• Name - Symbolic name of the IUT given by the user, for easy
identification.
• Controller => Host COM port - The port that is used for the
capturing of the up- link traffic.
• Host => Controller COM port - The port that is used for the
capturing of the down-link traffic.
• Rate - the bits per second rate the COM ports are configured for.
The list displays three possible states for each one of the entries:
• Enabled - The HCI traffic from the IUT is going to be recorded.
• Disabled - The HCI traffic from the IUT is not going to be
recorded.
• Invalid - The analyzer failed in opening the COM port for
accessing the IUT, with the listed parameters. In this case, you
should refer to Windows configuration of the COM ports or check
77
Page 86
Add ...
Merlin Mobile User’s ManualCATC SW Version 2.0
whether the same COM port(s) is (are) used by other applications in
the host machine or that the parameters are set correctly.
The Add button lets you add devices to the Configurations List. Clicking
Add causes the following dialog box to open:
Name - Symbolic name for easy identification of the device and connector.
Controller -> Host - COM port used for monitoring the HCI traffic from
the application to the bluetooth baseband.
Host -> Controller - COM port used for monitoring the HCI traffic from
the Bluetooth baseband (Controller) to the application (Host).
Rate - Sets the maximum rate in bits per second (bps) that you want data to
be transmitted through this port.
Data Bits - Changes the number of data bits you want to use for each
character that is transmitted and received. The computer or device you are
communicating with must have the same setting that you choose here. Most
characters are transmitted in seven or eight data bits.
Parity - Changes the type of error checking you want to use for the selected
port. The computer or device you are communicating with must have the
same setting that you choose here. You must choose one of the following:
• None - No parity bit will be added to the data bits sent from this
port. This will disable error checking.
• Even - Parity bit is set to 1 if it is needed to make the number of
ones in the data bits even. This will enable error checking.
• Odd - Parity bit is added if it is needed to make the number of ones
in the data bits odd. This will enable error checking.
• Mark - Parity bit is added but is always set to 1.
78
Page 87
Merlin Mobile User’s ManualCATC SW Version 2.0
Stop Bits - Changes the time between each character being transmitted
(where time is measured in bits).
Edit
The Edit button reopens the Add HCI Configurations dialog box so you
can edit your settings. Be sure to select an entry in the HCI Configurations
list before clicking Edit.
Delete
The Delete button allows entries to be deleted from the Configurations List.
6.7 Recording HCI Traffic
To record HCI traffic from an IUT, enter data in the HCI window.
Step 1 InRecordingOptions,gototheHCIpage,andclickAdd.
The Add HCI Trace Configuration dialog appears.
Step 2 Enter the pertinent data in the data fields, and click OK. The
HCI configuration is shown in the HCI page of Recording
79
Page 88
options.
Merlin Mobile User’s ManualCATC SW Version 2.0
To edit an entry in the Configurations List,
Step 1 In the HCI page of Recording Options, click Edit.The Edit
HCI Trace Configuration dialog appears.
Step 2 Change the data in the data fields according to your desired
changes, and click OK. The changes are reflected in the
Extern page of Recording Options.
6.8 Recording Options - Events
If you have selected Event Trigger mode under the General tabinthe
Recording Options screen, you may now select specific Bluetooth events
using the Events tab on the Recording Option Screen.Youcanalsousethe
Actions tab to define specific event sequences that will trigger Merlin
Mobile to record a Bluetooth session.
In addition, the Events and Actions screens allow you to specify which
packets you want to include or exclude from the recording.
•
Click the Events tabontheRecording Options screen.
80
Page 89
Merlin Mobile User’s ManualCATC SW Version 2.0
You see the Event Groups window:
The Event triggering and filtering options allow you to set event conditions
for errors and/or a variety of packet characteristics.
Clicking a check box causes further options to display in the right side of the
window.
Additional Timeslot Filtering
By default, Merlin Mobile records frequency hop and timestamp
information for all time slots in the Piconet under analysis, regardless of
whether the time slot contained a Bluetooth packet. This means that in
instances where there is little piconet traffic, Merlin Mobile will display row
after row of empty packets -- each representing an empty time slot. Through
the use of timeslot filtering, these empty packets can be filtered out.
Filtering out this information has the benefit of freeing memory so that more
traffic can be recorded.
Filter Empty Slots
If "Filter Empty Slots" is checked, Merlin Mobile will exclude all empty
time slots from a recording except for those that lie immediately in front of
Bluetooth communications packets. These remaining empty packets are
preserved to give timestamp and frequency hop reference data to the packets
that follow.
81
Page 90
Filter Slots on Packet Filter
If filters are used to exclude FHS, DM1 or other packets, Merlin Mobile will
exclude these packets from a trace and mark their locations with empty
packets. The result can be rows and rows of empty packets. The option
"Filter Empty Slots" will not exclude these empty slots because they lie
immediately in front of Bluetooth communications packets - even though
those packets were not recorded. To eliminate these empty packets, select
"Filter Slots on Packet Filter."
Packet Headers
Clicking "Packet Headers" opens three sets of check boxes and menus on
the right that represent fields within packet headers: Packet Type, Active
Member Address, Flow Control, Acknowledgment, and Sequence Number.
Select Packet Headers under Event Groups.
•
You see the Packet Headers window:
Merlin Mobile User’s ManualCATC SW Version 2.0
Packet Type
The Packet Type drop down menu lets you select the following packet types
for filtering or triggering: NULL, POLL, FHS, DM1, DH1, HV1, HV2,
HV3, DV, AUX1, DM3, DH3, 1100, 1101, DM5, or DH5.
Select “Don’t Care” if you want Merlin Mobile to ignore this field.
82
Page 91
Merlin Mobile User’s ManualCATC SW Version 2.0
AM_ADDR
(Active Member Address) The AM_ADDR is a three bit slave address. To
select packets from a particular slave device for filtering or triggering, enter
an address into the AM_ADDR text box. You can target up to three devices
using the three text boxes.
SEQN, ARQN, and Flow Control Bits
To set event conditions on SEQN, ARQN, and Flow control, uncheck
"Don't Care." Unchecking "Don't Care" sets the event condition to
SEQN=0 AND ARQN=0 AND Flow=0. This action also puts a checkmark
in the box marked "Packet Headers." A checkmark next to SEQN, ARQN,
or Flow changes the value of this field from zero to one. For example, if
SEQN is checked, the event condition becomes "SEQN=1 AND ARQN=0
AND Flow=0.
To cause Merlin Mobile to ignore this set of check boxes, choose "don't
care."
Payload Headers
Clicking "Payload Headers" causes a series of options to display on the right
for setting conditions on payload headers. You will see two sets of options
- one for single slot packets such as DM1 packets and a second for multi-slot
packets such as DM3 packets. Within each set is a menu for the Logical
Channel and sub-options for Flow Control, and Payload length. These latter
two options allow you to modify searches based on the Logical Channel.
An example would be "Trigger on a start L2CAP message whose flow
control bit is 1 and whose data field length is less than 20."
• Select Payload Headers under Event Groups.
83
Page 92
Merlin Mobile User’s ManualCATC SW Version 2.0
You see the Payload Headers window
L_CH (Logical Channel)
The "L_CH" drop down menu presents five options for
setting conditions on the Logical Channel:
Don’t care
•
• 00 Undefined
• 01 L2CAP continue
• 10 L2CAP start
• 11 LMP message
Select "Don’t care" if you do not want to set conditions on Logical Channel.
Flow
Three "radio buttons" are presented for
setting conditions based on Flow control:
•
0
• 1
• Don’t care
Flow works in conjunction with the Logical Channel (L_CH) menu - you
select an option from the L_CH menu and then select an option under Flow.
84
Page 93
Select "Don’t care" if you do not want to set conditions on Flow control.
Length (in bytes)
Using both the drop down menu and the text box, you
can set conditions based on data field length. The
maximum length for a single slot packet is 29 bytes. The
maximum length for multi-slot packets is 339 bytes.
The drop-down menu gives you options for selecting
operators such as "greater than" and "equal to." The text box to the right of
the drop-down menu lets you enter values.
The Length option works in conjunction with the Logical Channel (L_CH)
menu - you first select an option from the L_CH menu and then select an
option under Length.
Data Patterns
Clicking "Data Patterns" causes a text box to
appear for entering patterns to be matched in the
raw payload data. Patterns of up to eight
hexidecimal bytes can be entered.
Merlin Mobile User’s ManualCATC SW Version 2.0
Errors
Clicking "Errors" causes check boxes to appear for setting conditions for
triggering or filtering based on packet/signaling/protocol errors. You can
select one or a combination of errors.
Select Errors under Event Groups.
•
85
Page 94
Merlin Mobile User’s ManualCATC SW Version 2.0
You see the Errors window:
Use any combination of the listed packet/signaling/protocol errors as a Trigger.
CRC Error
A CRC error in the packet data payload of the previous Bluetooth data
packet.
HEC Error
An HEC (header error check) error in the packet header for the previous
Bluetooth data packet.
FEC Error
An uncorrectable FEC (Forward Error Correction) error in the packet
header for the previous Bluetooth data packet.
Threshold Exceeded
Indicates that the number of single-bit FEC errors detected since the current
recording started has exceeded the specified value.
Invalid Packet Type
An invalid value was detected in the 'packet type' field of the packet header
for the previous Bluetooth data packet.
86
Page 95
Merlin Mobile User’s ManualCATC SW Version 2.0
Header Length Error
Indicates that a received Bluetooth data packet was terminated before all
bits of the packet header were received.
Payload Length Error
Indicates that the payload of a received Bluetooth data packet was either
longer than expected, or that a Bluetooth data packet terminated before the
expected end of the payload data.
Sync Loss
When set, indicates that a loss of piconet synchronization occurred during
the frequency slot prior to this slot.
6.9 Recording Options - Actions
The Actions screen allows you to specify the type of action that Merlin
Mobile should perform when it encounters the events specified in the
Events window.
87
Page 96
Merlin Mobile User’s ManualCATC SW Version 2.0
Action Buttons - Their Functions
The Action buttons in the right side of the window provide the means of
setting triggers, filters, and restarts. To set an action, you simply drag your
mouse from an Event to an Action. As described further on, this movement
will link the two via an arrow.
Trigger
The Trigger button enables event triggering.
Filter In/Out
The Filter In/Out button allows events to be filtered in or out of the
recording. Filtering provides a useful method of excluding data from the
trace so you can conserve recording memory.
Restart
The Restart button causes the two counters Count1 and Count2 to be reset
to zero. It also causes the search for event sequences to restart. Event
sequences are sequences of events that trigger the end of the recording.
Restart buttons provide you with a way of saying "If you see a sequence of
A, B, C, and D, then trigger. However, if you see X anywhere during the
sequence, restart your search."
Count1, Count2
Count1 and Count2 are counters for specifying how many events must occur
before an event can cause a trigger. Counters allow conditions to be made
such as "Trigger after the 21st Poll packet" (see screenshot below).
The Actions window showing a condition based on a Poll packet and a counter.
This condition reads "Trigger after the 21st Poll packet."
88
Page 97
Merlin Mobile User’s ManualCATC SW Version 2.0
Connecting Events to Counters
To connect an event to a counter, click an Event button, then click one of the
two counter buttons. The Counter will reposition itself immediately below
the event. A line will the connect the counter to the Trigger button.
This latter connection between the Counter button and the Trigger button
occurs because counters always work in association with triggers. Counters
act as assistants to triggers.
Setting Multiple Conditions with Counters
You can create multiple event conditions by linking a counter to multiple
events or by linking two counters to two or more events.
Linking Multiple Events to One Counter - When two or more Events are
strung together and then connected to a counter, the event button that is
touching the counter gets counted. The example below reads "Trigger after
you see a sequence of a packet with the specified payload followed by a 21
null packets."
Linking Two Events to Two or More Counters - If an Event is linked to
Count1 and a second event is linked to Count2, it creates an "or" statement.
This statement reads "Trigger when Count1 OR Count2 has reached their
specified values."
89
Page 98
This example reads "Trigger when Count1 has counted 5 Poll packets or Count2
has counted 10 errors."
Blue Dot Menus
Count1, Count2 and a few other buttons in the Actions
window have blue dots in their top left-hand corners that
indicate the presence of context-sensitive menus. These menus
let you set the button’s values and/or operations. Click the left
mouse button on a dot to open the menu.
Merlin Mobile User’s ManualCATC SW Version 2.0
Counters Blue Dot Menu
The Count1 and Count2 blue dot menus allow the value of their counters
to be changed. The value you specify here tells Merlin Mobile how many
instances of an event must take place before a trigger occurs. The counter
can be set between 1 and 65,535.
To set a Counter,
Step 1 Click on the blue dot in the upper left corner of the Count
button.
You see the Change Counter Value menu:
90
Page 99
Merlin Mobile User’s ManualCATC SW Version 2.0
Step 2 Click Change Counter Value
You see the Input Counter Value menu
Step 3 Enter an input value to tell the Analyzer how many times this
event must occur before triggering the end of a recording
Step 4 Click OK.
Filter Out/In Blue Dot Menu
The Filter Out/In button toggles between "Filter Out" and "Filter In".
Filter In records ONLY those packets related to the specified event.
•
• Filter Out records all packets EXCEPT those related to the specified event.
To filter an event in or out of a recording,
Step 1 Click the blue dot on Filter Out. (Note: the button may say
Filter In depending on the last action specified.)
You see the Filter Out/In menu:
Use this menu to toggle the selection between Filter Out and Filter In.
Step 2 Select "Filter In".
The button changes to read "Filter In".
Blue Dot Menus for the Event Buttons
The Errors button and the first Headers button (marked "Hdr1") have the
same Blue Dot menus. These menus allow Merlin Mobile to trigger
external output.
To enable or disable external trigger output,
Step 1 Click the Blue Dot on an Event button such as Hdr1 or Errors.
91
Page 100
Merlin Mobile User’s ManualCATC SW Version 2.0
A menu similar to the one below will open. Your menu may say "Disable" instead
of "Enable."
Step 2 Select "Enable External Trigger Output" (or "Disable
External Trigger Output" if that is the choice presented.)
If you have chosen "Enable External Trigger Output", a
small arrow will appear on the right side of the button. This
arrow indicates that a condition has been set for creating an
external output signal. Choosing "Disable External Trigger"
will cause the arrow to disappear.
Enabling High Pulse, Low Pulse or Pulse Toggle Signal Outputs
Once External Trigger Output has been enabled, you can configure the
output signal to one of three formats:
Pulse High - This is the default format. The Pulse High setting causes the
Analyzer to transmit a 5 volt, 16.66 nanosecond signal.
Pulse Low - This format causes the Analyzer to transmit a -5 volt, 16.66
nanosecond signal.
Toggle - This format causes the Analyzer to transmit a signal that will
toggle with each trigger event between a continuous 5 volt signal and a
continuous -5 volt signal.
To configure the output signal,
Step 1 Click the blue dot on an Event button that has a small arrow
attached to it like the one shown above.
A Blue Dot Menu will open. "External Trigger Form" should be a choice
available. If it is not, you will need to choose "Enable External Trigger"and
then reopen the menu.
92
Loading...