Javascript Menu by

Bluetooth Tester


Ellisys Bluetooth Explorer 400 All-in-One Bluetooth Protocol Analysis System


Whole-band BR/EDR and Low Energy sniffer, with concurrent capture of spectrum, HCI (USB, UART, SPI), WCI-2, logic signals, and Audio I2S.

more about Ellisys BEX400 Support for Bluetooth 4.1 Secure Connection and Connectionless Broadcast!


  • All-in-One: concurrent capture of BR/EDR, Low Energy, spectrum, HCI, logic, Audio I2S, and WCI-2, all synchronized to nanoseconds precision
  • Whole-Band Capture: easy and rock-solid capture of any traffic, including discovery / connection traffic and SSP pairing
  • Reprogrammable Digital Radio: support for new specifications without hardware changes
  • Multi-Piconet Support: see multiple piconets and scatternets, without limitations
  • All Protocols and Profiles: best-of-breed protocol decoding
  • Integrated Audio Analysis: listen to captured audio over-the-air, including HCI audio and I2S, within the software, in sync with all other traffic
  • Spectrum Display: characterize the wireless environment and visualize coexistence issues
  • Message Sequence Chart: create charts automatically from the powerful Ellisys protocol display
  • Free Maintenance: Free lifetime software updates as well as free fully-featured viewer software with unlocked hardware that can be used on any computer.

Traffic analysis is one of the key day-to-day activities for Bluetooth engineers looking to rapidly test and debug their prototypes and products. Unfortunately, Bluetooth over-the-air sniffing has always been difficult to perfect. Legacy sniffing methods suffered from major technological drawbacks, making them unreliable and even unusable in several circumstances, making Bluetooth engineers' tasks much more difficult.

With its revolutionary whole-band Digital Radio, Ellisys lifts protocol capture and analysis to new heights, radically overcoming the drawbacks of those legacy approaches to Bluetooth sniffing. The Ellisys all-in-one whole-band sniffer robustly records any packet, at any time, from any neighboring piconet, with zero-configuration and without being intrusive.

Ellisys BEX400
Ellisys BEX400

Ellisys BEX400 DatasheetPDF Datasheet

Product Highlights    
  • Visualize evolution of piconets and scatternets in Ellisys Instant Piconet view
  • Visualize any packet with high accuracy in Ellisys Instant Timing view
  • Decode all protocols and profiles automatically
  • Export Bluetooth data to various formats, including audio waveforms
  • See relationships between protocol levels and sequences of different protocols clearly in a single view, or in multiple synchronized views
  • Determine PIN codes automatically and decrypt the data on the fly
  • Free lifetime software updates – no maintenance fees
  • Free full-featured viewer software to easily share annotated traces with colleagues and replay captured traffic
  • Use Ellisys hardware on any computer without the need of additional licenses
  Ellisys Software Overview
Software overview (click to enlarge)
Ellisys Instant Piconet is a unique feature that is only made possible by the use of Ellisys Rainbow hardware capture technology. As soon as the analyzer starts recording, the Instant Piconet view displays the current topology of physical channel characteristics created by all neighboring devices. Piconets, scatternets, pagings and inquiries are displayed using symbols inspired by the Bluetooth specification and augmented with relevant information: data transfer activity and throughput for both master-slave and slave-master directions, per device RSSI, device names and addresses, etc.   Ellisys Instant Piconet
Instant Piconet
When using the Ellisys analysis application, Ellisys Instant Timing quickly becomes the central feature that one cannot imagine being deprived of, and that makes one wonder how it was ever possible to work without it. This view displays all captured packets as time ordered interactive graphical elements. Length represents duration, while height is proportional to data rate (basic or enhanced). Packets are color-coded for type, master/slave direction, error status, device sending or receiving the packet, etc. Slot durations are also represented.   Ellisys Protocol Overview
Instant Timing (click to enlarge)
The easiest way to access any layer of the complex Bluetooth protocol and profile stack is the Ellisys Protocol Overview. This view displays all desired protocol elements in an easy-to-browse hierarchical tree view. The exact level of protocol decoding is easily configurable. It is searchable at will, and all columns can be used as filtering criteria to drill down data. Any fields displayed in the companion Detail Pane can be added and displayed as a whole column, for instant values comparison and custom filtering.   Ellisys Protocol Overview
Ellisys Protocol Overview (click to enlarge)

“We rely on Ellisys protocol test and analysis products to support our development of short-distance wireless communications software. The Ellisys Bluetooth products will greatly assist the developer ecosystem and our Bluetopia customers to ensure wireless product quality, robustness, and interoperability.”
David G. Brenner, VP marketing, Stonestreet One

  “Artimi uses Ellisys protocol analyzer products extensively to support a range of development tasks. Ellisys has done a fantastic job with this introduction of Bluetooth analysis products and has also provided great support to early adopters involved in the development of Bluetooth high speed technology.”
Stratos Chatzikyriakos, principal engineer and standards architect, Artimi
Bluetooth Days are too short to waste time    

Traffic analysis is one of the key day-to-day activities of Bluetooth engineers looking to rapidly test and debug their implementations.  Unfortunately, Bluetooth over-the-air sniffing has always been some difficult task topic.  Legacy sniffing methods suffered from major drawbacks, making them unreliable and unusable in some circumstances, therefore making Bluetooth engineers' lives difficult. 



With its Bluetooth® Explorer, Ellisys lifts protocol capture and analysis to new heights, radically overcoming drawbacks of those legacy approaches to Bluetooth sniffing.  The new Ellisys All-Channel sniffer robustly records any packet, at any time, from any neighboring piconet, with zero-configuration and without being intrusive. 

With the right tool, your Bluetooth Days will not seem too short anymore!

Why were Bluetooth systems previously so difficult to sniff?

Bluetooth wireless technology was originally designed to be robustly impervious to interference on the much-used ISM 2.4 GHz band, and was also designed to be non-easily sniffable for security reasons.  The two main RF characteristics unique to the Bluetooth specification are:

  • Frequency Hopping: packets are transmitted on one chosen channel amongst 79, every 625us, following a pseudo-random sequence.
  • Data Whitening: packets are scrambled in order to produce an equal distribution of 1s and 0s, avoiding reception of plain packets from neighboring piconets or sniffers.

A standard Bluetooth radio can receive or transmit on only one of the 79 channels at a given time.  Legacy Bluetooth sniffers used a standard single-channel radio.  Because of this inherent limitation, those sniffers had to connect to a piconet's master device using a mandatorily configured 48-bit

  address, retrieve the master's clock, and eventually follow the hopping sequence based on this information.  Main drawbacks of this approach were:
  • Complex configuration was required – needs expert users and some prior information
  • Was intrusive – the analyzer must interact with the master
  • Was non-reliable – loss of sync because of clock drift when master is not active
  • Was limited to a single piconet – interference issues are out of scope
  • Was not able of recording some connection steps such as paging and inquiry packets

Ellisys has created a revolutionary sniffer that overcomes all those drawbacks and adds innovative features, opening new horizons to Bluetooth debugging and interoperability testing. 


Revolutionary Ellisys Rainbow All-Channel Capture Technology

This multi-protocol, multi-band and multifaceted protocol analysis system is powered by the revolutionary Ellisys Rainbow all-channel capture engine.  With this breakthrough technology, Ellisys hardware is capable of capturing concurrently all 79 BR/EDR channels as well as all 40 Low-Energy channels, plus related HCI traffic for cross-analysis.   
Former single-channel capture
With this method the Ellisys Bluetooth® Explorer does not need to follow the hopping sequence of a given piconet; it can receive any packet from any neighboring device!  Smart post-capture analysis groups packets into physical channels and determines devices states, displaying useful high-level information on master and slaves.  
Ellisys Rainbow All-Channel Capture
The above illustrations show how legacy sniffers received packets by listening to a single channel at a time, compared to the Ellisys Rainbow All-Channel capture catching all Bluetooth packets by listening to a 80 MHz wideband frequency range concurrently
What about security?    

Ellisys developed smart security algorithms to further ease engineers' lives.  The Ellisys software application will automatically determine PIN codes and Link Keys when pairing are detected.  Resulting link keys can be stored, such that any further traffic capture from the same devices will be decrypted automatically.

SSP (Simple Secure Pairing) is also supported. 


SSP uses encryption methods similar to the methods used on the Internet, to secure sensitive information exchanges, such as banking transactions.  No algorithm can help automatically determine the keys for decrypting packets. The link key must thus be specified to the analysis software for decryption.  Ellisys eases this process by automating link key extraction from HCI traces. 

System Specifications    
Analyzer RF Characteristics
  • Ellisys Rainbow: Synchronous, concurrent capture of all BR/EDR/LE channels
  • Frequency band: 2.402-2.480 GHz
  • Sensitivity range: From -90 to +15 dBm
  • Attenuation: Programmable from 0 to 45 dB
  • Modulations: All BR/EDR/LE modulations (GFSK, p/4-DQPSK, 8‑DPSK)

Analyzer HCI Characteristics

  • USB transport: Low, Full and High Speed
  • UART transport: H4/H5/BCSP up to 8 Mbit/s

Generator Characteristics

  • Single channel, dual-mode BR/EDR and LE standard radio
  • Frequency band: 2.402-2.480 GHz
  • Transmit power: Class1


  • Clock: ±1ppm frequency accuracy
  • BR/EDR/LE timestamp accuracy: 125ns
  • USB HCI timestamp accuracy: 16.7ns

Embedded Memory

  • 128 MB of FIFO memory
  • Data is stored in highly optimized format
  • Analyzed data is uploaded in real time through a USB 2.0 connection

Front-Panel Indicators

  • Power: unit powered on
  • Operating: unit performing requested task
  • Trigger: trigger event detected
  • Generate: BR/EDR and/or LE packet transmitted
  • Capture: BR/EDR and/or LE packet captured
  • HCI: HCI packet captured

Front-Panel Connectors

  • Capture: Standard SMA female
  • Generate: Standard SMA female
  • HCI: USB 2.0 Standard-A and Micro-B

Rear-Panel Connectors

  • Computer: USB 2.0 Standard-B
  • Power: 12-17 VDC, max 18 W
  • Trigger: SMA in and out, 50 Ω, max 5VDC
  • IO Probe: supports HCI and logic analysis
  • Inter-equipment: in and out, supports connection of several units

Power Supply

  • Universal 100-240 VAC, 50-60 Hz 12 VDC, 18 W


  • 174 x 111 x 58 mm (6.9 x 4.4 x 2.3'')
  • 1.2 kg (2.6 lbs)

Hardware Upgrade

  • The Ellisys Rainbow engine is automatically updated with each software release  (no user intervention required)

Maintenance and Licensing

  • Free lifetime software updates – no maintenance fees
  • Free full-featured viewer software – easily share annotated traces between computers and colleagues and replay captured traffic
  • Use Ellisys hardware on any computer – no additional licenses needed


  • Two-year limited warranty

Ellisys reserves the right to change the features and specifications of the product without notice.


Minimum Requirements

  • Intel Pentium 4, 1 GHz or compatible processor
  • 1 GBytes of RAM
  • 1280 x 1024 display resolution with at least 65,536 colors
  • USB 2.0 EHCI host controller
  • Windows® XP Service Pack 2 or higher

Ellisys BTX Explorer    

The Ellisys BTX Explorer is a Bluetooth stack analysis tool for traffic monitoring, stacks and drivers debugging, interoperability verification and performance analysis. The BTX Explorer can significantly reduce your R&D development time by finding issues early and debugging more efficiently, and can improve quality and reliability by verifying compliance to the specifications.

The Ellisys BTX offers convenient ways to sniff the Bluetooth traffic:

  • Abstract probing: Abstract probing is a means for sniffing Bluetooth protocol via a software source. Logs of a known format can be imported and converted to an Ellisys trace. A powerful application programming interface (API) is included, and enables writing vendor-specific Bluetooth sources for real-time live import to the analysis software.

  • USB HCI probing: USB HCI probing is a convenient way of sniffing a Bluetooth USB dongle. The USB analyzer connects non-intrusively on any link and supports all speeds defined by the USB 2.0 specification.
  • UART HCI probing: UART HCI probing is helpful for sniffing an embedded system consisting of a Bluetooth radio chip connected to a microprocessor though UART. The UART analyzer has various ways to connect to the wires, either with flying leads or with DB-9 connectors. The two UART-based protocols defined by the Bluetooth 2.1 specification are supported, as well as CSR-specific BlueCore Serial Protocol (BCSP). All UART speeds are supported (from 300 to 6 Mbps).

  • SD HCI probing: SD HCI probing enables sniffing an SDIO Bluetooth card connected to an embedded host. The SD probe connects with an interposer board to the system under test and supports all speeds up to 50 MHz.

  • Over-the-air UWB probing: UWB is a high-speed wireless technology considered by the Bluetooth SIG for the upcoming revision of the specification. UWB will be used as high-speed endpoint enabling new multimedia applications. The UWB probe enables over-the-air sniffing of any next generation Bluetooth UWB endpoint.

more Ellisys products.

Screen Shot.

Bluetooth Software Download.

 © dhs ELMEA tools BV
 fon +31 345 531-112  l  fax +31 345 545 - 530  l  e-mail