A.2 Getting the Android Link Key for Classic Decryption297
vFrontline BPA 600 Hardware & Software User Manual
TELEDYNE LECROY
A.2.1 What You Need to Get the Android Link Key297
A.2.2 Activating Developer options297
A.2.3 Retrieving the HCI Log298
A.2.4 Using the ComProbe Software to Get the Link Key299
A.3 Decrypting Encrypted Bluetooth®data with ComProbe BPA 600303
A.3.1 How Encryption Works in Bluetooth303
A.3.2 Legacy Pairing (Bluetooth 2.0 and earlier)303
A.3.3 Secure Simple Pairing (SSP) (Bluetooth 2.1 and later)305
A.3.4 How to Capture and Decrypt Data (Legacy Pairing)305
A.3.5 How to tell if a device is in Secure Simple Pairing Debug Mode307
A.4 Decrypting Encrypted Bluetooth® low energy311
A.4.1 How Encryption Works in Bluetooth low energy311
A.4.2 Pairing311
A.4.3 Pairing Methods312
A.4.4 Encrypting the Link313
A.4.5 Encryption Key Generation and Distribution313
A.4.6 Encrypting The Data Transmission314
A.4.7 Decrypting Encrypted Data Using Frontline® BPA 600 low energy Capture314
A.5 Bluetooth® low energy Security321
A.5.1 How Encryption Works in Bluetooth low energy322
A.5.2 Pairing322
A.5.3 Pairing Methods323
A.5.4 Encrypting the Link324
A.5.5 Encryption Key Generation and Distribution324
A.5.6 Encrypting The Data Transmission325
A.5.7 IRK and CSRK Revisited325
A.5.8 Table of Acronyms326
A.6 Bluetooth Virtual Sniffing327
A.6.1 Introduction327
A.6.2 Why HCI Sniffing and Virtual Sniffing are Useful327
A.6.3 Bluetooth Sniffing History328
A.6.4 Virtual Sniffing—What is it?328
A.6.5 The Convenience and Reliability of Virtual Sniffing329
A.6.6 How Virtual Sniffing Works329
Frontline BPA 600 Hardware & Software User Manualvi
TELEDYNE LECROY
A.6.7 Virtual Sniffing and Bluetooth Stack Vendors329
A.6.8 Case Studies: Virtual Sniffing and Bluetooth Mobile Phone Makers330
A.6.9 Virtual Sniffing and You330
viiFrontline BPA 600 Hardware & Software User Manual
Chapter 1 Frontline Hardware & Software
Frontline Test Equipment family of protocol analyzers work with the following technologies.
l Classic Bluetooth
l Bluetooth low energy
l Dual Mode Bluetooth (simultaneous Classic and low energy)
l Bluetooth Coexistence: Bluetooth with 802.11 Wi-Fi
l Bluetooth HCI (USB, SD, High Speed UART)
l NFC
l 802.11 (Wi-Fi)
l SD
l HSU (High Speed UART)
The Frontline hardware interfaces with your computer that is running our robust software engine called the
ComProbe Protocol Analysis System or Frontline software. Whether you are sniffing the air or connecting
directly to the chip Frontline analyzers use the same powerful Frontline software to help you test,
troubleshoot, and debug communications faster.
Frontline software is an easy to use and powerful protocol analysis platform. Simply use the appropriate
Frontline hardware or write your own proprietary code to pump communication streams directly into the
Frontline software where they are decoded, decrypted, and analyzed. Within the Frontline software you see
packets, frames, events, coexistence, binary, hex, radix, statistics, errors, and much more.
This manual is a user guide that takes you from connecting and setting up the hardware through all of the
Frontline software functions for your Frontline hardware. Should you have any questions contact the
Frontline Technical Support Team.
Frontline BPA 600 Hardware & Software User Manual1
The Frontline User Manual comprises the following seven chapters. The chapters are organized in the
sequence you would normally follow to capture and analyze data: set up, configure, capture, analyze, save.
You can read them from beginning to end to gain a complete understanding of how to use the Frontline
hardware and software or you can skip around if you only need a refresher on a particular topic. Use the
Contents, Index, and Glossary to find the location of particular topics.
l Chapter 1 Frontline Hardware and Software. This chapter will describe the minimum computer
requirements and how to install the software.
l Chapter 2 Getting Started. Here we describe how to set up and connect the hardware, and how to apply
power. This chapter also describes how to start the Frontline software in Data Capture Methods. You will
be introduced to the Control window that is the primary operating dialog in the Frontline software.
l Chapter 3 Configuration Settings. The software and hardware is configured to capture data. Configuration
settings may vary for a particular Frontline analyzer depending on the technology and network being
sniffed. There are topics on configuring protocol decoders used to disassemble packets into frames and
events.
l Chapter 4 Capturing and Analyzing Data. This Chapter describes how to start a capture session and how
to observe the captured packets, frames, layers and events.
l Chapter 5 Navigating and Searching the Data. Here you will find how to move through the data and how
to isolate the data to specific events, often used for troubleshooting device design problems.
l Chapter 6 Saving and Importing Data. When a live capture is completed you may want to save the
captured data for future analysis, or you may want to import a captured data set from another developer
or for use in interoperability testing. This chapter will explain how to do this for various data file formats.
l Chapter 7 General Information. This chapter provides advanced system set up and configuration
information, timestamping information, and general reference information such as ASCII, baudot, and
EBCDIC codes. This chapter also provides information on how to contact Frontline's Technical Support
team should you need assistance.
1.2 Computer Minimum System Requirements
Frontline supports the following computer systems configurations:
l Operating System: Windows 7/8/10
l USB Port: USB 2.0 High-Speed or or later
The Frontline software must operate on a computer with the following minimum characteristics.
l Processor: Core i5 processor at 2.7 GHz
l RAM: 4 GB
l Free Hard Disk Space on C: drive: 20 GB
1.3 Software Installation
Download the installation software from FTE.com. Once downloaded, double-click the installer and follow the
directions.
Use this link: http://www.fte.com/bpa600-soft.
2Frontline BPA 600 Hardware & Software User Manual
Chapter 2 Getting Started
In this chapter we introduce you to the Frontline hardware and show how to start the Frontline analyzer
software and explain the basic software controls and features for conducting the protocol analysis.
2.1 BPA 600 Hardware
2.1.1 Attaching Antennas
When you remove the Frontline BPA 600 hardware from the box, the first step is to attach the antennas
(Figure 2.1).
Figure 2.1 - BPA 600 Antenna Connectors
1. Attach antennas to the SMA connectors.
Figure 2.2 - Frontline BPA 600 with both antennas attached
Frontline BPA 600 Hardware & Software User Manual3
TELEDYNE LECROYChapter 2 Getting Started
2.1.1.1 Status LED
The Frontline BPA 600 has two Status LEDs on the RF panel. In the front panel center are the LOW ENERGY
and BR/EDR LEDs.
Figure 2.3 - BPA 600 Hardware LEDs
Table 2.1 - Frontline BPA 600 LED Status
LED ColorFrontline BPA 600 Activity
LED OffFrontline BPA 600 device is idle.
GreenFrontline BPA 600 is actively sniffing waiting for configured devices to connect.
BlueThe configured devices have connected (Asynchronous Connectionless Link (ACL)).
Intermittent
Blue
Configured devices are in "Sniff mode" (slave is listening at a reduced rate, conserving
device power).
2.1.2 Connecting/Powering the Frontline BPA 600 Hardware
Once you have attached the antennas, the next step is to power up and connect the Frontline BPA 600
hardware to the computer.
1. Insert the USB cable into the USB port on the Frontline BPA 600 hardware. The Frontline BPA 600
analyzer requires no external power (Figure 2.4).
Figure 2.4 - BPA 600 USB Connector
2. Insert the other end of the USB cable into the PC.
The next thing to do is to turn on the devices that you will be testing.
2.1.3 BPA 600 ProbeSync
Any Frontline hardware with ProbeSync™ can be connected together to run off of a common clock, ensuring
precise timestamp synchronization.
Simply plug the supplied Cat 5 cable into the OUT connector on the sniffer that will be supplying the clock
and connect the other end to the IN connector on the sniffer receiving the clock. ( Figure 2.5 - ). If using a
BPA 600 analyzer with a different Frontline analyzer, the BPA 600 analyzer must provide the clock. Combined
cable length of all the ProbeSync cables connected at a given time should not exceed 1.5 meters (4.5 feet).
4Frontline BPA 600 Hardware & Software User Manual
Connect the CAT 5 cable before connecting the USB cable to the BPA 600 hardware. If you must change the
ProbeSync connections it may be necessary to cycle the power to the devices to ensure proper
synchronization.
Should the CAT5 cable be connected incorrectly, that is OUT to OUT or IN to IN, an error message will
appear when the BPA 600 software is run. Refer to on page 67
2.2 Data Capture Methods
This section describes how to load TELEDYNE LECROY Frontline Protocol Analysis System software, and how
to select the data capture method for your specific application.
2.2.1 Opening Data Capture Method
On product installation, the installer creates a folder on the windows desktop labeled "Frontline <version #>".
1. Double-click the " Frontline <version #>" desktop folder
This opens a standard Windows file folder window.
Figure 2.6 - Desktop Folder Link
2. Double-click on Frontline ComProbe Protocol Analysis System and the system displays the SelectData Capture Method... dialog.
Frontline BPA 600 Hardware & Software User Manual5
TELEDYNE LECROYChapter 2 Getting Started
Note: You can also access this dialog by selecting Start > All Programs > Frontline
(Version #) > Frontline ComProbe Protocol Analysis System
Figure 2.7 - Example: Select Data Capture Method..., BPA 600
Three buttons appear at the bottom of the dialog; Run, Cancel, and Help.
Select Data Capture Method dialog buttons
ButtonDescription
Becomes active when a capture method is selected. Starts the selected capture
method.
Closes the dialog and exits the user back to the computer desktop.
Opens Frontline Help. Keyboard shortcut: F1.
3. Expand the folder and select the data capture method that matches your configuration.
4. Click on the Run button and the Frontline Control Window will open configured to the selected
capture method.
Note: If you don't need to identify a capture method, then click the Run button to start the
analyzer.
Creating a Shortcut
A checkbox labeled Create Shortcut When Run is located near the
bottom of the dialog. This box is un-checked by default. Select this
checkbox, and the system creates a shortcut for the selected method, and
6Frontline BPA 600 Hardware & Software User Manual
Chapter 2 Getting StartedTELEDYNE LECROY
places it in the "Frontline ComProbe Protocol Analysis System <version#>" desktop folder and in the start
menu when you click the Run button. This function allows you the option to create a shortcut icon that can be
placed on the desktop. In the future, simply double-click the shortcut to start the analyzer in the associated
protocol.
Supporting Documentation
The Frontline <version #>directory contains supporting documentation for development (Automation,
DecoderScript™, application notes), user documentation (Quick Start Guides and the Frontline User Manual),
and maintenance tools.
2.2.2 Frontline BPA 600 Data Capture Methods
Frontline Protocol Analysis System has different data capture methods to accommodate various applications.
Figure 2.8 - BPA 600 Data Capture Dialog
l BR/EDR - low energy Air Sniffing
l This method requires one Frontline BPA 600 and is used to capture combined BR/EDR and Bluetooth® low
energy data.
l Used for typical applications to capture Classic Bluetooth and Bluetooth low energy data.
l Modes include:
l LE Only - Bluetooth low energy only
l Classic Only Single Connection
l Dual Mode - Classic Bluetooth and Bluetooth low energy.
l Classic Only Multiple Connections
Frontline BPA 600 Hardware & Software User Manual7
TELEDYNE LECROYChapter 2 Getting Started
l Classic/low energy/802.11 Air Sniffing (optional)
l Two 802.11 and One BPA600
l This method requires one Frontline BPA 600 and two Frontline 802.11 hardware.
l An Frontline 802.11 hardware is included with the Wi-Fi Option.
l Used for Bluetooth Classic/low energy/802.11 coexistence analysis.
l Captures Bluetooth Classic, low energy, and 802.11 data and displays in the Frame Display and
Coexistence View.
l 802.11/Classic/low energy Coexistence
l This method requires one Frontline BPA 600 and one Frontline 802.11 hardware.
l Captures Bluetooth Classic, low energy, and 802.11 data and displays in the Frame Display and
Coexistence View.
2.2.3 Frontline ProbeSync™ for Coexistence and Multiple Frontline Device
Capture
ProbeSync™ allows multiple Frontline analyzers to work seamlessly together and to share a common clock.
Clock sharing allows the analyzers to precisely synchronize communications streams and to display resulting
packets in a single shared or coexistent view.
l Classic and low energy Bluetooth sniffing, and 802.11
l ProbeSync configurations include
o
Two BPA 600 units
o
One BPA 600 unit and one 802.11 unit.
o
One BPA 600 unit and one HSU unit.
o
One BPA 600 unit, one HSU unit, one 802.11 unit
Refer to the Frontline product for specific information on using ProbeSync.
2.2.4 Virtual Sniffing
The Virtual Sniffer is a live import facility within Frontline®software that makes it possible to access any layer
in a stack that the programmer has access to and feed this data into the Virtual Sniffer. Please refer to the
“Show Live Import Information“button on the Virtual Sniffer Datasource window in Frontline software. More
information is available in the Live Import Developer's Kit located in the Development Tools folder in Frontline
Protocol Analysis System desktop folder, and a white paper is available at Bluetooth Virtual Sniffing
l FTS Side
o
No hardware required.
o
Frontline software acquires data via user-developed software.
l IEEE 11073+
o
No hardware required
o
for sniffing data virtually from the continua Enabling Software Library (CESL) IEEE 11073 tester.
8Frontline BPA 600 Hardware & Software User Manual
Chapter 2 Getting StartedTELEDYNE LECROY
2.3 Control Window
The analyzer displays information in multiple windows, with each window presenting a different type of
information. The Control window opens when the Run button is clicked in the Select Data CaptureMethod window. The Control window provides access to each Frontline analyzer functions and settings as
well as a brief overview of the data in the capture file. Each icon on the toolbar represents a different data
analysis function. A sample Control Window is shown below.
Figure 2.9 - Control Window
Because the Control window can get lost behind other windows, every window has a Home iconthat
brings the Control window back to the front. Just click on the Home icon to restore the Control window.
When running the Capture File Viewer, the Control window toolbar and menus contain only those
selections needed to open a capture file and display the About box. Once a capture file is opened, the
analyzer limits Control window functions to those that are useful for analyzing data contained in the current
file. Because you cannot capture data while using Capture File Viewer, data capture functions are
unavailable. For example, when viewing Ethernet data, the Signal Display is not available. The title bar of the
Control window displays the name of the currently open file. The status line (below the toolbar) shows the
configuration settings that were in use when the capture file was created.
2.3.1 Control Window Toolbar
Toolbar icon displays vary according to operating mode and/or data displayed. Available icons appear in color,
while unavailable icons are not visible. Grayed-out icons are available for the Frontline hardware and software
configuration in use but are not active until certain operating conditions occur. All toolbar icons have
corresponding menu bar items or options.
Table 2.2 - Control Window Toolbar Icons
IconDescription
Open File - Opens a capture file.
I/O Settings - Opens settings
Save - Saves the capture file.
Clear - Clears or saves the capture file.
Event Display - (framed data only) Opens a Event Display, with the currently selected bytes
highlighted.
Frontline BPA 600 Hardware & Software User Manual9
TELEDYNE LECROYChapter 2 Getting Started
Table 2.2 - Control Window Toolbar Icons (continued)
IconDescription
Frame Display - (framed data only) Opens a Frame Display, with the frame of the currently
selected bytes highlighted.
Notes - Opens the Notes dialog.
Cascade - Arranges windows in a cascaded display.
Bluetooth Packet Timeline - Opens the Packet Timeline dialog.
Coexistence View - Opens the Coexistence View dialog.
Low energy - Opens the low energy Timeline dialog.
Extract Data/Audio - Opens the Extract Data/Audio dialog.
MSC Chart - Opens the Message Sequence Chart
Bluetooth low energy Packet Error Rate Statistics - Opens the Packet Error Rate Statistics
window.
Bluetooth Classic Packet Error Rate Statistics - Opens the Packet Error Rate Statistics
window.
Protocol Expert System - Opens Bluetooth Protocol Expert System window
Audio Expert System - Opens Audio Expert System window
2.3.2 Configuration Information on the Control Window
The Configuration bar (just below the toolbar) displays the hardware configuration and may include I/O
settings. It also provides such things as name of the network card, address information, ports in use, etc.
2.3.3 Status Information on the Control Window
The Status bar located just below the Configuration bar on the Control window provides a quick look at
current activity in the analyzer.
l
o
Not Active means that the analyzer is not currently capturing data.
o
Paused means that data capture has been suspended.
o
Running means that the analyzer is actively capturing data.
l
% Used
10Frontline BPA 600 Hardware & Software User Manual
Chapter 2 Getting StartedTELEDYNE LECROY
The next item shows how much of the buffer or capture file has been filled. For example, if you are
capturing to disk and have specified a 200 Kb capture file, the bar graph tells you how much of the
capture file has been used. When the graph reaches 100%, capture either stops or the file begins to
overwrite the oldest data, depending on the choices you made in the System Settings.
l
Utilization/Events
The second half of the status bar gives the current utilization and total number of events seen on the
network. This is the total number of events monitored, not the total number of events captured. The
analyzer is always monitoring the circuit, even when data is not actively being captured. These graphs
allow you to keep an eye on what is happening on the circuit, without requiring you to capture data.
2.3.4 Frame Information on the Control Window
Frame Decoder information is located just below the Status bar on the Control window. It displays two pieces
of information.
l Frame Decoder (233 fps) displays the number of frames per second being decoded. You can toggle this
display on/off with Ctrl-D, but it is available only during a live capture.
l #132911 displays the total frames decoded.
l 100% displays the percentage of buffer space used.
2.3.5 Control Window Menus
The menus appearing on the Control window vary depending on whether the data is being captured live or
whether you are looking at a .cfa file. The following tables describe each menu.
Table 2.3 - Control Window File Menu Selections
ModeSelection
Live
Capture
File
Close
Go Live
Reframe
Unframe
Recreate
Companion File
Hot
Key
Description
Closes Live mode.
Returns to Live mode
If you need to change the protocol stack used to interpret a
capture file and the framing is different in the new stack, you
need to reframe in order for the protocol decode to be correct.
Reframing on page 73
See
Removes start-of-frame and end-of-frame markers from your
data. See
Unframing on page 73
This option is available when you are working with decoders. If
you change a decoder while working with data, you can
recreate the ".frm file", the companion file to the ".cfa file".
Recreating the ".frm file" helps ensure that the decoders will
work properly.
Reload Decoders
The plug-ins are reset and received frames are decoded again.
Frontline BPA 600 Hardware & Software User Manual11
TELEDYNE LECROYChapter 2 Getting Started
Table 2.3 - Control Window File Menu Selections (continued)
ModeSelection
Live &
Capture
File
Open Capture File
Hot
Key
Ctrl--OOpens a Windows Open file dialog. at the default location
"...\Public Documents\Frontline Test Equipment\My Capture
Files\". Capture files have a .cfa extension.
Description
Save
Exit ComProbe
Protocol Analysis
System
Recent capture filesA list of recently opened capture files will appear.
The View menu selections will vary depending on the Frontline analyzer in use.
Table 2.4 - Control Window View Menu Selections
ModeSelectionHot keyDescription
Live &
Capture
File
Event Display
Frame Display
Bluetooth Timeline
Coexistence View
Ctrl-SSaves the current capture or capture file. Opens a Windows
Save As dialog at the default location "...\Public
Documents\Frontline Test Equipment\My Capture Files\".
Shuts down the ComProbe Protocol Analysis System and all
open system windows.
CtrlShift-E
CtrlShift-M
Opens the Event Display window for analyzing byte level
data.
Opens the Frame Display window for analyzing protocol
level data
Opens the
protocol level data in a packet chronological format and in
packet throughput graph.
Opens the
simultaneously display Classic
energy, and 802.11 packets and thourghput.
Bluetooth Timeline window
Coexistence View window
for analyzing
that can
Bluetooth,Bluetooth
low
Bluetooth low
energy Timeline
Extract Data Audio...
Bluetooth low
energy Packet Error
Rate Statistics
Classic Bluetooth
Packet Error Rate
Statistics
Bluetooth Protocol
Expert
Audio Expert
System
Opens the
analyzing protocol level data in a packet chronological
format and in packet throughput graph.
Opens the
from decoded
Opens the
show a dynamic graphical representation of the error rate
for each low energy channel.
Opens the Classic
a dynamic graphical representation of the error rate for
each channel.
Opens the
assist in the analysis of Bluetooth protocol issues.
Opens the
of detecting and reporting audio impairments.
Bluetooth low energy Timeline window
Data/Audio Extraction
Bluetooth
Bluetooth
Bluetooth Protocol Expert System window
Audio Expert System window
protocols.
low energy
Bluetooth PER Stats window
dialog for pulling data
PER Stats window
for the purpose
for
to show
to
to
12Frontline BPA 600 Hardware & Software User Manual
Chapter 2 Getting StartedTELEDYNE LECROY
Table 2.5 - Control Window Edit Menu Selections
ModeSelection
Capture
File
ModeSelection
The following two rows apply to all Frontline products except Set in Target.
Notes
Table 2.6 - Control Window Live Menu Selections
Hot-
key
CtrlShiftO
Hot-
Key
Description
Opens the
comments to a capture file.
Notes window
Description
that allows the user to add
Live
The following rows apply to all Frontline products
LiveClearShift-
Start Capture
Stop Capture
Shift-F5Begins data capture from the configured wireless devices.
F10Stops data capture from the configured wireless devices.
Clears or saves the capture file.
F10
Frontline BPA 600 Hardware & Software User Manual13
TELEDYNE LECROYChapter 2 Getting Started
Table 2.6 - Control Window Live Menu Selections (continued)
ModeSelection
Live &
Capture
File
Hardware Settings
I/O Settings
Hot-
Key
Description
0 - Classic
1 - Bluetooth low energy
0 - Classic
1 - Bluetooth low energy
System Settings
Directories...
Check for New
Releases at Startup
Side Names...
Protocol Stack...
Set Initial Decoder
Parameters...
AltEnter
Opens the System Settings dialog for configuring capture
files.
Opens the
the default file locations.
When this selection is enabled, the program automatically
checks for the latest Frontline protocol analyzer software
releases.
Opens the
names of the slave and master wireless devices.
Opens the
protocol stack they want the analyzer to use when
decoding frames.
Opens the
may be times when the context for decoding a frame is
missing. For example, if the analyzer captured a response
frame, but did not capture the command frame, then the
decode for the response may be incomplete. The Set Initial
Decoder Parameters dialog provides a means to supply the
context for any frame. The system allows the user to define
any number of parameters and save them in templates for
later use.Each entry in the window takes effect from the
beginning of the capture onward or until redefined in the Set
Subsequent Decoder Parameters dialog. This selection is
not present if no decoder is loaded that supports this
feature.
File Locations dialog
Side Names dialog
Select a Stack dialog
Set Initial Decoder Parameters window
where the user can change
used to customize the
where the user defines the
. There
Set Subsequent
Decoder
Parameters...
Automatically
Request Missing
Decoder
Information
Enable/Disable
Bluetooth Protocol
Expert
14Frontline BPA 600 Hardware & Software User Manual
Opens the
where the user can override an existing parameter at any
frame in the capture. Each entry takes effect from the
specified frame onward or until redefined in this dialog on a
later frame. This selection is not present if no decoder is
loaded that supports this feature.
When checked, this selection opens a dialog that asking for
missing frame information. When unchecked, the analyzer
decodes each frame until it cannot go further and it stops
decoding. This selection is not present if no decoder is loaded
that supports this feature.
When enabled, the
otherwise it is not available. Only available when a
Bluetooth Protocol Expert licensed device is connected.
Set Subsequent Decoder Parameters dialog
Bluetooth Protocol Expert
is active,
Chapter 2 Getting StartedTELEDYNE LECROY
Table 2.6 - Control Window Live Menu Selections (continued)
ModeSelection
Enable/Disable
Audio Expert
System
The Windows menu selection applies only to the Control window and open analysis windows: Frame
Display, Event Display, Message Sequence Chart, Bluetooth Timeline, Bluetooth low energy
Timeline, and Coexistence View. All other windows, such as the datasource, are not affected by these
selections.
Table 2.7 - Control Window Windows Menu Selections
ModeSelection
Live &
Capture
File
Cascade
Close All Views
Hot-
Key
When enabled, the
wise it is not available. Only available when an Audio
Expert System licensed device is connected.
HotKey
Ctrl-WArranges open analysis windows in a cascaded view with
window captions visible.
Closes Open analysis windows.
Description
Audio Expert System
Description
is active, other
Minimize Control
Minimizes All
Frame Display
Event Display
ModeSelectionHot-KeyDescription
Live &
Capture
File
Help Topics
About Frontline
Protocol Analysis
System
Support on the Web
and
Table 2.8 - Control Window Help Menu Selections
When checked, minimizing the Control window also
minimizes all open analysis windows.
When these windows are open the menu will display these
selections. Clicking on the selection will bring that window
to the front.
Opens the Frontline Help window.
Provides a pop-up showing the version and release
information, Frontline contact information, and copyright
information.
Opens a browser to
fte.com
technical support page.
2.3.6 Minimizing Windows
Windows can be minimized individually or as a group when the Control window is minimized. To minimize
windows as a group:
1.
Go to the Window menu on the Controlwindow.
2. Select Minimize Control Minimizes All. The analyzer puts a check next to the menu item,
indicating that when the Control window is minimized, all windows are minimized.
3. Select the menu item again to deactivate this feature.
4. The windows minimize to the top of the operating system Task Bar.
Frontline BPA 600 Hardware & Software User Manual15
Chapter 3 Configuration Settings
In this section the Frontline software is used to configure an analyzer for capturing data .
3.1 BPA 600 Configuration and I/O
3.1.1 BPA 600 - Update Firmware
When you select the Update Firmware on the BPA 600 Information, the Update ComProbe BPA 600
firmware dialog appears. You use this dialog to update your ComProbe hardware with the latest firmware.
It is very important that you update the firmware. If the firmware versions are not the same, you will not be
able to start sniffing.
Figure 3.1 - BPA 600 Update Firmware Dialog
1. Make sure the cabling is attached to the ComProbe hardware.
2. Select Flash Device.
The download begins, with the Status bar displaying the progress. When the download is complete,
you can check the firmware version by checking the Status dialog.
Frontline BPA 600 Hardware & Software User Manual16
TELEDYNE LECROYChapter 3 Configuration Settings
3.1.2 BPA 600 IO Datasource Settings
3.1.2.1 Classic Bluetooth® Roleless Connection
When configuring the ComProbe BPA 600 devices for a Classic Bluetooth connection it is no longer necessary
to assign a “Master” or “Slave” role to each of the devices. All Classic connection are “roleless”. For example,
suppose you have a phone and a speaker as shown below:
Figure 3.2 - Example of BPA 600 "roleless" Connection
Alternatively, you can enter the devices as follows where Classic Device drop down controls have
reversed the devices under test shown in the previous image.
It does not matter which position you enter the device. After you have started sniffing and a connection is
made, the arrow will indicate the direction of the connection. In the following screen shot the phone has
connected as the “Master” to the speaker as the “Slave”.
17Frontline BPA 600 Hardware & Software User Manual
Chapter 3 Configuration SettingsTELEDYNE LECROY
Should the roles change during the connection the arrow will change to show the new "Master/Slave"
connection. In the following screen shot the speaker has connected as the “Master” to the phone as the
“Slave”.
Figure 3.5 - Arrow Showing Results of Role Switch
3.1.2.2 Datasource Toolbar/Menu
The Datasource dialog toolbar and menu options are listed below.
Table 3.1 - BPA 600 datasource Toolbar
IconDescription
Start Sniffing button to begin sniffing. All settings are saved automatically when
you start sniffing. Selection of devices is disabled during sniffing. To select
another device stop sniffing.
Pause button to stop sniffing
When you select the Discover Devices button, the software lists all the
discoverable Bluetooth devices on the Device Database and LE DeviceDatabase tabs.
Save button to save the configuration if you made changes but did not begin
sniffing. All settings are saved automatically when you start sniffing.
Help button opens the help file.
Grayed-out icons are inactive and do not apply to ComProbe BPA 600
The Devices Under Test dialog has all the setup information the analyzer needs in order to synchronize
with the piconet and capture data. The analyzer requires information on the clock synchronization method
and the device address of the device to initially sync to. You must also choose what to sniff.
Frontline BPA 600 Hardware & Software User Manual18
TELEDYNE LECROYChapter 3 Configuration Settings
Figure 3.6 - BPA 600 Datasource Devices Under Test Dialog
You can choose to capture data using:
l low energy only
l Classic Only, Single Connection
l Dual Mode - Combination of Classic and low energy
l Classic Only, Multiple Connections
Select one of these links above for explanations on how to configure each option.
There are a couple of other functions on the dialog that you need to understand.
Advanced
Click here to see the BPA 600 Advanced Classic Settings.
Channel Map (Classic Bluetoot h)
The Channel Map shows which channels are available for Adaptive Frequency Hopping.
l
Channel MapClick this button to toggle on/off the display of the Channel Map.
Figure 3.7 - Classic Bluetooth Channel Map
This display is used to determine which channels are available with
19Frontline BPA 600 Hardware & Software User Manual
Chapter 3 Configuration SettingsTELEDYNE LECROY
Table 3.3 - BPA 600 Channel Map Color Codes
Channel
Color
WhiteChannel is currently available for use.
Description
Red
Blue
The Clear button resets each indicator back to the White state. The indicators are also reset whenever a
new Channel Map goes into effect.
Status Window
A status window at the bottom of the dialog displays information about recent activity.
When Adaptive Frequency Hopping is in use, red indicates that the channel is marked
as unavailable
Indicates that a packet was captured on the channel.
Note: Channel Map is not available for LE Only.
3.1.2.4 BPA 600 Devices Under Test
3.1.2.4.1 BPA 600 Devices Under Test - LE Only
By selecting the "LE Only" radio button under the "Devices Under Test" tab you can configure the BPA 600
protocol analyzer for sniffing Bluetooth low energy communications.
Frontline BPA 600 Hardware & Software User Manual20
TELEDYNE LECROYChapter 3 Configuration Settings
Figure 3.8 - BPA 600 Devices Under Test - low energy
The default value in the LE Device drop down is Sync with First Master. To begin sniffing Bluetooth low
energy simply click the red button to start. The analyzer will capture packets from the first Master that makes
a connection . To capture the advertising traffic and the connection(s), you must specify a device address.
Specifying the LE Device Address and Encryption
21Frontline BPA 600 Hardware & Software User Manual
Chapter 3 Configuration SettingsTELEDYNE LECROY
1. If you would like you may specify the LE device
you are testing by typing in or choosing its
address (BD_ADDR). You can type it directly into
the drop down, or choose it from the existing
previous values list in the drop down.
To enter the device manually type the address 12 digit hex number (6 octets). The "0x" is automatically typed in the drop down control.
Once you have the devices address identified, the next step is to identify the Encryption.
2. Enter the Long Term Key for the LE Encryption.
The Long Term Key is similar to the Link key in Classic. It
is a persistent key that is stored in both devices and used
to derive a fresh encryption key each time the devices
go encrypted.
Learn more about the Long Term Key.
The Long Term Key is similar to the Link key in Classic; it
is a persistent key that is stored in both devices and used
to derive a fresh encryption key each time the devices
go encrypted.
There are a few differences though:
In Classic the Link key is derived from inputs from both
devices and is calculated in the same way independently by both devices and then stored persistently. The
link key itself is never transmitted over the air during pairing.
In LE, the long term key is generated solely on the slave device and then, during pairing, is distributed to a
master device that wants to establish an encrypted connection to that slave in the future. Thus the long term
key is transmitted over the air, albeit encrypted with a one-time key derived during the pairing process and
discarded afterwards (the so called short term key).
Unlike the link key, this long term key is directional, i.e. it is only used to for connections from the master to
the slave (referring to the roles of the devices during the pairing process). If the devices also want to connect
the other way round in the future, the device in the master role (during the pairing process) also needs to
send its own long term key to the device in the slave role during the pairing process (also encrypted with the
short term key of course), so that the device which was in the slave during the pairing process can be a
master in the future and connect to the device which was master during the pairing process (but then would
be in a slave role).
Since most simple LE devices are only ever slave and never master at all, the second long term key exchange
is optional during the pairing process.
Note: If you use Copy/Paste to insert the Long Term Key , Frontline will auto correct
(remove invalid white spaces) to correctly format the key.
3. Enter a PIN or out-of-band (OOB) value for Pairing.
This optional information offers alternative pairing methods.
One of two pieces of data allow alternative pairing:
Frontline BPA 600 Hardware & Software User Manual22
Loading...
+ 318 hidden pages
You need points to download manuals.
1 point = 1 manual.
You can buy points or you can get point for every manual you upload.