Bluetooth-LE Analyzer

All-Channel, Full-Spectrum, Concurrent Synchronous Capture of Bluetooth 2.1 BR/EDR, Low Energy and HCI traffic.

The Ellisys Bluetooth® Explorer 400 (BEX400) is a revolutionary Bluetooth protocol analysis system for traffic monitoring, stacks and drivers debugging, interoperability verification and performance analysis. The BEX400 can significantly reduce your R&D development time by finding issues early and debugging more efficiently, and can improve quality and reliability by verifying compliance to the specifications.

Overview  |  Highlights  |  Software  |  Rainbow Technology  |  Specifications  |   How to buy

Overview

Unique Ellisys Features

• Robust capture without unexpected loss of synchronization, ever
• Non-intrusive sniffing - the analyzer does not interact with or disturb piconets under test
• Zero configuration - simply click the record button and start sniffing
• Capture any packet at any time, including all packets from paging, inquiry, and role switch
• Capture an unlimited number of neighboring piconets with a single unit
• Concurrent and synchronous capture of BR/EDR and Low Energy traffic with a single unit
• Concurrent and synchronous capture of BR/EDR and HCI traffic with a single unit

Product Highlights

• Visualize evolution of piconets and scatternets in Ellisys Instant Piconet view
• Visualize any packet with high accuracy in Ellisys Instant Timing view
• Decode all protocols and profiles automatically
• Export Bluetooth data to various formats, including audio waveforms
• See relationships between protocol levels and sequences of different protocols clearly in a single view, or in multiple synchronized views
• Determine PIN codes automatically and decrypt the data on the fly
• Free lifetime software updates - no maintenance fees
• Free full-featured viewer software to easily share annotated traces with colleagues and replay captured traffic
• Use Ellisys hardware on any computer without the need of additional licenses 

Software Overview

Ellisys Bluetooth Analysis Software overview

(click to enlarge)

Ellisys Instant Piconet

Ellisys Instant Piconet is a unique feature that is only made possible by the use of Ellisys Rainbow^TM hardware capture technology. As soon as the analyzer starts recording, the Instant Piconet view displays the current topology of physical channel characteristics created by all neighboring devices. Piconets, scatternets, pagings and inquiries are displayed using symbols inspired by the Bluetooth specification and augmented with relevant information: data transfer activity and throughput for both master-slave and slave-master directions, per device RSSI, device names and addresses, etc.

Ellisys Instant Timing

When using the Ellisys analysis application, Ellisys Instant Timing quickly becomes the central feature that one cannot imagine being deprived of, and that makes one wonder how it was ever possible to work without it. This view displays all captured packets as time ordered interactive graphical elements. Length represents duration, while height is proportional to data rate (basic or enhanced). Packets are color-coded for type, master/slave direction, error status, device sending or receiving the packet, etc. Slot durations are also represented.

Ellisys Protocol Overview

The easiest way to access any layer of the complex Bluetooth protocol and profile stack is the Ellisys Protocol Overview. This view displays all desired protocol elements in an easy-to-browse hierarchical tree view. The exact level of protocol decoding is easily configurable. It is searchable at will, and all columns can be used as filtering criteria to drill down data. Any fields displayed in the companion Detail Pane can be added and displayed as a whole column, for instant values comparison and custom filtering.
Testimonials

"We rely on Ellisys protocol test and analysis products to support our development of short-distance wireless communications software. The Ellisys Bluetooth products will greatly assist the developer ecosystem and our Bluetopia customers to ensure wireless product quality, robustness, and interoperability."
David G. Brenner, VP marketing, Stonestreet One

"Artimi uses Ellisys protocol analyzer products extensively to support a range of development tasks. Ellisys has done a fantastic job with this introduction of Bluetooth analysis products and has also provided great support to early adopters involved in the development of Bluetooth high speed technology."
Stratos Chatzikyriakos, principal engineer and standards architect, Artimi
See it in Action!

Ellisys is the selected Bluetooth UPF Debugging Sponsor, and as such, provides equipment and expertise at every event to ensure participants have the right tools at the right time. UPFs are also a good opportunity for seeing our revolutionary All-Channel Bluetooth Explorer 400 in action. Feel free to register and attend our one-to-one training session and our public Debug in Action training.

"Bluetooth Days are too short to waste time"

Traffic Analysis

Traffic analysis is one of the key day-to-day activities of Bluetooth engineers looking to rapidly test and debug their implementations. Unfortunately, Bluetooth over-the-air sniffing has always been some difficult task topic. Legacy sniffing methods suffered from major drawbacks, making them unreliable and unusable in some circumstances, therefore making Bluetooth engineers' lives difficult.

With its Bluetooth® Explorer^TM, Ellisys lifts protocol capture and analysis to new heights, radically overcoming drawbacks of those legacy approaches to Bluetooth sniffing. The new Ellisys All-Channel sniffer robustly records any packet, at any time, from any neighboring piconet, with zero-configuration and without being intrusive.

With the right tool, your Bluetooth Days will not seem too short anymore!
Why were Bluetooth systems previously so difficult to sniff?

Bluetooth wireless technology was originally designed to be robustly impervious to interference on the much-used ISM 2.4 GHz band, and was also designed to be non-easily sniffable for security reasons. The two main RF characteristics unique to the Bluetooth specification are:

Frequency Hopping: packets are transmitted on one chosen channel amongst 79, every 625us, following a pseudo-random sequence.

Data Whitening: packets are scrambled in order to produce an equal distribution of 1s and 0s, avoiding reception of plain packets from neighboring piconets or sniffers.

Rainbow Technology

A standard Bluetooth radio can receive or transmit on only one of the 79 channels at a given time. Legacy Bluetooth sniffers used a standard single-channel radio. Because of this inherent limitation, those sniffers had to connect to a piconet's master device using a mandatorily configured 48-bit address, retrieve the master's clock, and eventually follow the hopping sequence based on this information. Main drawbacks of this approach were:

• Complex configuration was required - needs expert users and some prior information
• Was intrusive - the analyzer must interact with the master
• Was non-reliable - loss of sync because of clock drift when master is not active
• Was limited to a single piconet - interference issues are out of scope
• Was not able of recording some connection steps such as paging and inquiry packets

Ellisys has created a revolutionary sniffer that overcomes all those drawbacks and adds innovative features, opening new horizons to Bluetooth debugging and interoperability testing.
Revolutionary Ellisys Rainbow^TM All-Channel Capture Technology

This multi-protocol, multi-band and multifaceted protocol analysis system is powered by the revolutionary Ellisys Rainbow^TM all-channel capture engine. With this breakthrough technology, Ellisys hardware is capable of capturing concurrently all 79 BR/EDR channels as well as all 40 Low-Energy channels, plus related HCI traffic for cross-analysis.

Former single-channels capture

Ellisys Rainbow All-Channel Capture

Ellisys Revolutionary Rainbow Bluetooth Radio

The above illustrations show how legacy sniffers received packets by listening
to a single channel at a time, compared to the Ellisys Rainbow All-Channel capture
catching all Bluetooth packets by listening to a 80 MHz wideband
frequency range concurrently

With this method the Ellisys Bluetooth® Explorer does not need to follow the hopping sequence of a given piconet; it can receive any packet from any neighboring device! Smart post-capture analysis groups packets into physical channels and determines devices states, displaying useful high-level information on master and slaves.

Stop Hopping - It Just Works!

What about security?

Ellisys developed smart security algorithms to further ease engineers' lives. The Ellisys software application will automatically determine PIN codes and Link Keys when pairing are detected. Resulting link keys can be stored, such that any further traffic capture from the same devices will be decrypted automatically.

SSP (Simple Secure Pairing) is also supported. SSP uses encryption methods similar to the methods used on the Internet, to secure sensitive information exchanges, such as banking transactions. No algorithm can help automatically determine the keys for decrypting packets. The link key must thus be specified to the analysis software for decryption. Ellisys eases this process by automating link key extraction from HCI traces.

System Specifications

Analyzer RF Characteristics

• Ellisys Rainbow^TM: Synchronous, concurrent capture of all BR/EDR/LE channels
• Frequency band: 2.402-2.480 GHz
• Sensitivity range: From -90 to +15 dBm
• Attenuation: Programmable from 0 to 45 dB
• Modulations: All BR/EDR/LE modulations (GFSK, p/4-DQPSK, 8‑DPSK)

Analyzer HCI Characteristics

• USB transport: Low, Full and High Speed
• UART transport: H4/H5/BCSP up to 8 Mbit/s

Generator Characteristics

• Single channel, dual-mode BR/EDR and LE standard radio
• Frequency band: 2.402-2.480 GHz
• Transmit power: Class1

Timing

• Clock: ±1ppm frequency accuracy
• BR/EDR/LE timestamp accuracy: 125ns
• USB HCI timestamp accuracy: 16.7ns

Embedded Memory

• 128 MB of FIFO memory
• Data is stored in highly optimized format
• Analyzed data is uploaded in real time through a USB 2.0 connection

Front-Panel Indicators

• Power: unit powered on
• Operating: unit performing requested task
• Trigger: trigger event detected
• Generate: BR/EDR and/or LE packet transmitted
• Capture: BR/EDR and/or LE packet captured
• HCI: HCI packet captured

Front-Panel Connectors

• Capture: Standard SMA female
• Generate: Standard SMA female
• HCI: USB 2.0 Standard-A and Micro-B

Rear-Panel Connectors

• Computer: USB 2.0 Standard-B
• Power: 12-17 VDC, max 18 W
• Trigger: SMA in and out, 50 Ω, max 5VDC
• IO Probe: supports HCI and logic analysis
• Inter-equipment: in and out, supports connection of several units

Power Supply

• Universal 100-240 VAC, 50-60 Hz 12 VDC, 18 W

Enclosure

• 174 x 111 x 58 mm (6.9 x 4.4 x 2.3'')
• 1.2 kg (2.6 lbs)

Hardware Upgrade

The Ellisys Rainbow^TM engine is automatically updated with each software release (no user intervention required)

Maintenance and Licensing

Free lifetime software updates - no maintenance fees
Free full-featured viewer software - easily share annotated traces between computers and colleagues and replay captured traffic
Use Ellisys hardware on any computer - no additional licenses needed

Warranty

Two-year limited warranty
Ellisys reserves the right to change the features and specifications of the product without notice.

Minimum Requirements

• Intel Pentium 4, 1 GHz or compatible processor
• 1 GBytes of RAM
• 1280 x 1024 display resolution with at least 65,536 colors
• USB 2.0 EHCI host controller
• Windows® XP Service Pack 2 or higher

Available Configurations

• BEX400    Ellisys Bluetooth Explorer 400
  Includes a hardware unit with Bluetooth 2.1 BR/EDR capture, accessories and carrying bag.
• BEX400LE  Ellisys Bluetooth Explorer 400+LE
  Includes a hardware unit with concurrent BR/EDR and Low Energy capture, accessories and carrying bag.
   

How to buy

For more information and prcing prease contact Gerard Fianen at INDES-IDS BV.

01-08-2011