Industry’s First Reconfigurable Bluetooth Digital Radio

With its innovative reconfigurable radio, the Ellisys sniffer can uniquely be updated by software to support changes in the specification, without any change to the hardware, and even without any interaction from the user. For instance, this flexibility allowed for the addition of next generation Bluetooth baseband features (such as enhanced AES security, Connectionless Broadcast, and more recent features like Bluetooth LE Coded and LE 2M support) several months before these features were officially released in an updated specification. Additionally, the Ellisys BEX400 comes with free lifetime software updates, so all customers can benefit from these great additions free-of-charge!

Industry’s First Whole-Band Capture

Bluetooth wireless technology was originally designed to be robustly impervious to interference on the much-used 2.4 GHz ISM band. It was also designed to be difficult to sniff, for security reasons. To meet these criteria, a Bluetooth radio uses from 40 (LE) to 79 (Classic) channels pseudo-randomly according to a hopping sequence defined at the piconet’s connection time.

A hopping sniffer tries to actively synchronize on a specific hopping sequence, and captures the packets only after a successful synchronization. This kind of sniffer has several inherent limitations, making it more difficult to use, less reliable, and usable only in a limited set of scenarios.

Ellisys has created the industry’s first wideband sniffer in 2010 that overcomes all of these drawbacks and adds innovative and ground-breaking features, opening new horizons for Bluetooth debugging and interoperability testing. The whole-band capture approach is as simple as it is powerful: instead of listening to just a few channels, the sniffer captures all channels concurrently. The sniffer thus does not need to synchronize to a piconet; it will listen passively to all nearby Bluetooth piconets, scatternets, and other topologies such as mesh, without any required configuration.

Protocols and Profiles

Bluetooth protocols and profiles are displayed in an easy-to-understand, high-level procedures-oriented chronological format in the Overview windows and fully detailed to the lowest bit/byte level in the linked Details view. Classic Bluetooth, Low Energy, and HCI traffic is displayed in designated Overviews real-time, as capture progresses.

The user is provided various controls to easily customize any Overview, including powerful filtering and coloring capabilities designed to quickly isolate specific protocols, profiles, or communications of interest. Traffic can be presented at the highest level of abstraction and the user can drill down to show all intermediate levels, down to the most basic elements, such as packet-only views.

Message Sequence Charts

While the analyzer’s powerful protocols and profiles display is most efficient for engineers, Message Sequence Charts are usually preferred for creating reports or sharing technical information with specification experts or others not typically involved in using protocol analysis tools. The Ellisys solution is to create a Message Sequence Chart representation from a previously filtered and annotated protocols view. With this approach, engineers can include precisely the information they want, the way they want, and create a clear depiction showing exactly the information desired.

HCI Analysis (PRO)

Wireless traffic is of course one of the most useful elements of debugging information for Bluetooth engineers, but Host Controller Interface (HCI) traffic is an equally important complement of information for getting a clear and complete picture of the situation.

The HCI is an electrical interface defined by the Bluetooth specification for communications between the host controller and the radio. The Ellisys BEX400 supports capture of USB HCI, UART HCI and SPI HCI. Any and all HCI traffic is captured concurrently with the wireless traffic using the same precision clock for perfect synchronization and timing analysis, and is displayed in the highly-optimized Ellisys analysis software.

HCI capture is also a very convenient feature when working with devices that implement BR/EDR Secure Simple Pairing (SSP) or BLE Secure Connections. The Ellisys analysis software automatically extracts any Link Key exchanged over HCI and uses it to decrypt the wireless traffic, all without any user interaction.

Spectrum Analysis (PRO)

The logic analysis feature enables capture of any logic signal, in synchronization with the wireless and HCI traffic. Any digital signal is supported, including general-purpose I/Os or dedicated pins such as TX/RX Active. Another of the many applications for this feature is keeping track of a device’s power consumption in various states, by using dedicated hardware such as comparators for determining whether key thresholds are exceeded.

These signals can then be visualized with 5-nanosecond precision and compared with the other captured streams in the powerful Instant Timing view of the Ellisys software.

Logic Analysis (PRO)

The logic analysis feature enables capture of any logic signal, in synchronization with the wireless and HCI traffic. Any digital signal is supported, including general-purpose I/Os or dedicated pins such as TX/RX Active. Another of the many applications for this feature is keeping track of a device’s power consumption in various states, by using dedicated hardware such as comparators for determining whether key thresholds are exceeded.

These signals can then be visualized with 5-nanosecond precision and compared with the other captured streams in the powerful Instant Timing view of the Ellisys software.

Audio Analysis

Captured audio streams can be easily played back, even during capture. LC3 traffic is automatically detected using a test equipment-grade LC3 codec, even without capture of LC3 configuration traffic. Finding packets carrying specific audio portions or at specific events is easily done.

Audio captured over HCI or from an Audio I2S input [PRO] can be played back. This enables characterization of the complete audio chain, including the uncompressed audio provided to the source, the audio transmitted wirelessly, and the decoded audio at the receiver device. Audio streams are exportable to WAV format.

Automated and Long-Term Capture

There are various user applications that require the use of the analyzer in an automated fashion, often under control of user-defined software applications performing a variety of tasks. These applications may include long-term test environments, integration of the analyzer into a mobile platform, and other usage models.

Thanks to the ease-of-use and robustness provided by the Ellisys Digital Radio, the BEX400 is the perfect system for these tasks. The analyzer can be controlled with a simple yet powerful Remote Control API (Application Programming Interface) to programmatically start / stop / save captures, and extract specific captured information that can be used for various purposes, including go/no-go testing , all without any manual operation.

A unique segmentation feature works seamlessly with the API to allow for extremely long captures, segmenting captures into smaller more manageable slices while maintaining topology and contextual information from capture to capture.