|
|
|
 |
|
|
|
|
|
Ellisys Bluetooth Explorer 400
All-in-One Bluetooth Protocol Analysis System |
|
|
|
Whole-band BR/EDR and Low Energy sniffer, with concurrent capture of spectrum, HCI (USB, UART, SPI), WCI-2, logic signals, and Audio I2S.
Support for Bluetooth 4.1 Secure Connection and Connectionless Broadcast!
Features:
- All-in-One: concurrent capture of BR/EDR, Low Energy, spectrum, HCI, logic, Audio I2S, and WCI-2, all synchronized to nanoseconds precision
- Whole-Band Capture: easy and rock-solid capture of any traffic, including discovery / connection traffic and SSP pairing
- Reprogrammable Digital Radio: support for new specifications without hardware changes
- Multi-Piconet Support: see multiple piconets and scatternets, without limitations
- All Protocols and Profiles: best-of-breed protocol decoding
- Integrated Audio Analysis: listen to captured audio over-the-air, including HCI audio and I2S, within the software, in sync with all other traffic
- Spectrum Display: characterize the wireless environment and visualize coexistence issues
- Message Sequence Chart: create charts automatically from the powerful Ellisys protocol display
- Free Maintenance: Free lifetime software updates as well as free fully-featured viewer software with unlocked hardware that can be used on any computer.
|
|
Traffic analysis is one of the key day-to-day activities for Bluetooth engineers looking to rapidly test and debug their prototypes and products. Unfortunately, Bluetooth over-the-air sniffing has always been difficult to perfect. Legacy sniffing methods suffered from major technological drawbacks, making them unreliable and even unusable in several circumstances, making Bluetooth engineers' tasks much more difficult.
With its revolutionary whole-band Digital Radio, Ellisys lifts protocol capture and analysis to new heights, radically overcoming the drawbacks of those legacy approaches to Bluetooth sniffing. The Ellisys all-in-one whole-band sniffer robustly records any packet, at any time, from any neighboring piconet, with zero-configuration and without being intrusive.

Ellisys BEX400
PDF Datasheet
|
|
|
|
Product Highlights
|
|
|
-
Visualize evolution of piconets and scatternets in Ellisys
Instant Piconet view
-
Visualize any packet with high accuracy in Ellisys Instant
Timing view
-
Decode all protocols and profiles automatically
-
Export Bluetooth data to various formats, including audio
waveforms
-
See relationships between protocol levels and sequences of
different protocols clearly in a single view, or in multiple
synchronized views
-
Determine PIN codes automatically and decrypt the data on
the fly
-
Free lifetime software updates – no maintenance fees
-
Free full-featured viewer software to easily share annotated
traces with colleagues and replay captured traffic
-
Use Ellisys hardware on any computer without the need of
additional licenses
|
|

Software overview (click to enlarge)
|
|
|
|
Screenshots
|
|
|
|
|
|
Ellisys Instant Piconet is a unique
feature that is only made possible by the use of Ellisys Rainbow
hardware capture technology. As soon as the analyzer starts
recording, the Instant Piconet view displays the current
topology of physical channel characteristics created by all
neighboring devices. Piconets, scatternets, pagings and
inquiries are displayed using symbols inspired by the Bluetooth
specification and augmented with relevant information: data
transfer activity and throughput for both master-slave and
slave-master directions, per device RSSI, device names and
addresses, etc.
|
|

Instant Piconet
|
|
|
|
When using the Ellisys analysis application, Ellisys
Instant Timing quickly becomes the central
feature that one cannot imagine being deprived of, and that
makes one wonder how it was ever possible to work without it.
This view displays all captured packets as time
ordered interactive graphical elements. Length
represents duration, while height is proportional to data rate
(basic or enhanced). Packets are color-coded for type,
master/slave direction, error status, device sending or
receiving the packet, etc. Slot durations are also represented.
|
|

Instant Timing (click
to enlarge)
|
|
|
|
The easiest way to access any layer of the complex Bluetooth
protocol and profile stack is the Ellisys Protocol
Overview. This view displays all desired protocol
elements in an easy-to-browse hierarchical tree view.
The exact level of protocol decoding is easily configurable. It
is searchable at will, and all columns can be used as filtering
criteria to drill down data. Any fields displayed in the
companion Detail Pane can be added and displayed as a whole
column, for instant values comparison and custom filtering.
|
|

Ellisys Protocol Overview (click
to enlarge)
|
|
|
|
Testimonials
|
|
|
“We rely on Ellisys protocol test and analysis products
to support our development of short-distance wireless
communications software. The Ellisys Bluetooth
products will greatly assist the developer ecosystem and our
Bluetopia customers to ensure wireless product quality,
robustness, and interoperability.” David
G. Brenner, VP marketing, Stonestreet One
|
|
“Artimi uses Ellisys protocol analyzer products
extensively to support a range of development tasks. Ellisys has
done a fantastic job with this introduction of Bluetooth
analysis products and has also provided great support to early
adopters involved in the development of Bluetooth
high speed technology.” Stratos
Chatzikyriakos, principal engineer and standards architect,
Artimi
|
|
|
|
Bluetooth Days are too short to waste time
|
|
|
Traffic analysis is one of the key day-to-day activities of
Bluetooth engineers looking to rapidly test
and debug their implementations. Unfortunately, Bluetooth
over-the-air sniffing has always been some difficult task
topic. Legacy sniffing methods suffered from major
drawbacks, making them unreliable and unusable in some
circumstances, therefore making Bluetooth
engineers' lives difficult.
|
|
With its Bluetooth® Explorer, Ellisys
lifts protocol capture and analysis to new heights, radically
overcoming drawbacks of those legacy approaches to Bluetooth
sniffing. The new Ellisys All-Channel sniffer robustly
records any packet, at any time, from any neighboring piconet,
with zero-configuration and without being intrusive.
With the right tool, your Bluetooth Days
will not seem too short anymore!
|
|
|
|
Why were Bluetooth systems previously so
difficult to sniff?
|
|
|
|
Bluetooth wireless technology was originally
designed to be robustly impervious to interference on the
much-used ISM 2.4 GHz band, and was also designed to be
non-easily sniffable for security reasons. The two main
RF characteristics unique to the Bluetooth
specification are:
-
Frequency Hopping: packets are
transmitted on one chosen channel amongst 79, every 625us,
following a pseudo-random sequence.
-
Data Whitening: packets are
scrambled in order to produce an equal distribution of 1s
and 0s, avoiding reception of plain packets from neighboring
piconets or sniffers.
A standard Bluetooth radio can receive or
transmit on only one of the 79 channels at a given time.
Legacy Bluetooth sniffers used a standard
single-channel radio. Because of this inherent
limitation, those sniffers had to connect to a piconet's
master device using a mandatorily configured 48-bit
|
|
address, retrieve the master's
clock, and eventually follow the hopping sequence based on this
information. Main drawbacks of this approach were:
-
Complex configuration was required
– needs expert users and some prior information
-
Was intrusive – the analyzer
must interact with the master
-
Was non-reliable – loss of
sync because of clock drift when master is not active
-
Was limited to a single piconet –
interference issues are out of scope
-
Was not able of recording some connection steps
such as paging and inquiry packets
Ellisys has created a revolutionary sniffer that
overcomes all those drawbacks and adds
innovative features, opening new horizons to Bluetooth
debugging and interoperability testing.
|
|
|
|
Revolutionary Ellisys Rainbow All-Channel Capture Technology
|
|
|
|
This multi-protocol, multi-band and multifaceted protocol
analysis system is powered by the revolutionary Ellisys Rainbow
all-channel capture engine. With this breakthrough
technology, Ellisys hardware is capable of capturing
concurrently all 79 BR/EDR channels as well as all 40 Low-Energy
channels, plus related HCI traffic for cross-analysis.
|
|
 Former single-channel capture
|
|
|
|
With this method the Ellisys Bluetooth®
Explorer does not need to follow the hopping sequence of a given
piconet; it can receive any packet from any neighboring device!
Smart post-capture analysis groups packets into physical
channels and determines devices states, displaying useful
high-level information on master and slaves.
|
|
 Ellisys Rainbow All-Channel Capture
|
|
|
|
The above illustrations show how
legacy sniffers received packets by listening to a single
channel at a time, compared to the Ellisys Rainbow All-Channel
capture catching all Bluetooth packets by listening to a 80 MHz
wideband frequency range concurrently
|
|
|
|
What about security?
|
|
|
Ellisys developed smart security algorithms to further ease
engineers' lives. The Ellisys software application will
automatically determine PIN codes and Link Keys when pairing
are detected. Resulting link keys can be stored, such
that any further traffic capture from the same devices will be
decrypted automatically.
SSP (Simple Secure Pairing) is also supported.
|
|
SSP uses encryption methods similar to the methods used on the
Internet, to secure sensitive information exchanges, such as
banking transactions. No algorithm can help
automatically determine the keys for decrypting packets. The
link key must thus be specified to the analysis software for
decryption. Ellisys eases this process by automating
link key extraction from HCI traces.
|
|
|
|
System Specifications
|
|
|
|
|
|
Analyzer RF Characteristics
-
Ellisys Rainbow: Synchronous, concurrent capture of all
BR/EDR/LE channels
-
Frequency band: 2.402-2.480 GHz
-
Sensitivity range: From -90 to +15 dBm
-
Attenuation: Programmable from 0 to 45 dB
-
Modulations: All BR/EDR/LE modulations (GFSK, p/4-DQPSK, 8‑DPSK)
Analyzer HCI Characteristics
-
USB transport: Low, Full and High Speed
-
UART transport: H4/H5/BCSP up to 8 Mbit/s
Generator Characteristics
-
Single channel, dual-mode BR/EDR and LE standard radio
-
Frequency band: 2.402-2.480 GHz
-
Transmit power: Class1
Timing
-
Clock: ±1ppm frequency accuracy
-
BR/EDR/LE timestamp accuracy: 125ns
-
USB HCI timestamp accuracy: 16.7ns
Embedded Memory
-
128 MB of FIFO memory
-
Data is stored in highly optimized format
-
Analyzed data is uploaded in real time through a USB 2.0
connection
Front-Panel Indicators
-
Power: unit powered on
-
Operating: unit performing requested task
-
Trigger: trigger event detected
-
Generate: BR/EDR and/or LE packet transmitted
-
Capture: BR/EDR and/or LE packet captured
-
HCI: HCI packet captured
Front-Panel Connectors
-
Capture: Standard SMA female
-
Generate: Standard SMA female
-
HCI: USB 2.0 Standard-A and Micro-B
|
|
Rear-Panel Connectors
-
Computer: USB 2.0 Standard-B
-
Power: 12-17 VDC, max 18 W
-
Trigger: SMA in and out, 50 Ω, max 5VDC
-
IO Probe: supports HCI and logic analysis
-
Inter-equipment: in and out, supports connection of several
units
Power Supply
-
Universal 100-240 VAC, 50-60 Hz 12 VDC, 18 W
Enclosure
-
174 x 111 x 58 mm (6.9 x 4.4 x 2.3'')
-
1.2 kg (2.6 lbs)
Hardware Upgrade
-
The Ellisys Rainbow engine is automatically updated with
each software release (no user intervention required)
Maintenance and Licensing
-
Free lifetime software updates – no maintenance fees
-
Free full-featured viewer software – easily share
annotated traces between computers and colleagues and replay
captured traffic
-
Use Ellisys hardware on any computer – no additional
licenses needed
Warranty
-
Two-year limited warranty
Ellisys reserves the right to change the features and
specifications of the product without notice.
Minimum Requirements
-
Intel Pentium 4, 1 GHz or compatible processor
-
1 GBytes of RAM
-
1280 x 1024 display resolution with at least 65,536 colors
-
USB 2.0 EHCI host controller
-
Windows® XP Service Pack 2 or higher
|
|
|
|
|
|
|
|
Ellisys BTX Explorer
|
|
|
|
|
|
The Ellisys BTX Explorer is a Bluetooth
stack analysis tool for traffic monitoring, stacks and drivers
debugging, interoperability verification and performance
analysis. The BTX Explorer can significantly reduce your R&D
development time by finding issues early and debugging more
efficiently, and can improve quality and reliability by
verifying compliance to the specifications.
The Ellisys BTX offers convenient ways to sniff the
Bluetooth traffic:
-
Abstract probing: Abstract
probing is a means for sniffing Bluetooth
protocol via a software source. Logs of a known format can
be imported and converted to an Ellisys trace. A powerful
application programming interface (API) is included, and
enables writing vendor-specific Bluetooth
sources for real-time live import to the analysis
software.
-
USB HCI probing: USB HCI probing
is a convenient way of sniffing a Bluetooth
USB dongle. The USB analyzer connects non-intrusively on any
link and supports all speeds defined by the USB 2.0
specification.
|
|
-
UART HCI probing: UART HCI
probing is helpful for sniffing an embedded system
consisting of a Bluetooth radio chip
connected to a microprocessor though UART. The UART
analyzer has various ways to connect to the wires, either
with flying leads or with DB-9 connectors. The two
UART-based protocols defined by the Bluetooth
2.1 specification are supported, as well as CSR-specific
BlueCore Serial Protocol (BCSP). All UART speeds are
supported (from 300 to 6 Mbps).
-
SD HCI probing: SD HCI probing
enables sniffing an SDIO Bluetooth card
connected to an embedded host. The SD probe connects with
an interposer board to the system under test and supports
all speeds up to 50 MHz.
-
Over-the-air UWB probing: UWB is
a high-speed wireless technology considered by the
Bluetooth SIG for the upcoming revision of the
specification. UWB will be used as high-speed endpoint
enabling new multimedia applications. The UWB probe
enables over-the-air sniffing of any next generation
Bluetooth UWB endpoint.
|
more
Ellisys products.
Screen Shot.
Bluetooth Software Download.
|
|