BPA100 Protocol Analyzer

Characteristics

Frontline Test Equipment, Inc. has acquired the BPA100 and BPA105 Bluetooth Protocol Analyzer products, along with existing customer service, support, and warranty responsibilities from Tektronix. Please visit the Frontline Test Equipment Web site for more information.

Modes of Operation

Independent Mode - As an independent (sniffer) unit, the Protocol Analyzer does not participate directly in the piconet. Instead, after synchronizing to the piconet it passively listens in and logs all baseband packets transmitted between the master and slaves of the piconet. Through the use of advanced triggering and filters, selected data of interest to the developer can be logged and analyzed.

Piconet Mode - In Piconet Mode, the Protocol Analyzer uses its fully Bluetooth qualified protocol stack and participates as the master or a slave in a piconet. As a master, the Protocol Analyzer logs all baseband packets between itself and the slaves. When setup as a slave, it logs all packets between itself and the piconet master device. Piconet mode is useful when the developer requires a known reference device in the piconet or needs to generate user-defined errors and packets for stress testing. Another useful feature in Piconet Mode is the ability to log FHS packets before connection is established.

Protocol Analyzer Software Version 2.2

The Tektronix Bluetooth Protocol Analyzer software is an integrated application that performs baseband traffic data acquisition and display. The user can also display transactions and packet data at higher levels in the Bluetooth protocol stack such as LMP, L2CAP, RFCOMM, OBEX, HDLC, PPP, TCS, and SDP including service attributes. By using powerful triggering and filtering features, the user can selectively choose what data to acquire, log to disk, or display on the screen. In the Free Run display mode, packet data is viewed as it is acquired. Protocol Analyzer supports testing of proper security setup and authentication between devices using data decryption. Data decryption is supported in both piconet mode and independent mode, independent mode will require the input of the link-key, pin code, or KC code information.

The HCI Terminal Application allows direct access to the BPA100 hardware through the Host Controller Interface layer. The HCI Terminal makes it easy to send commands to a BPA100 and to receive responses from a Bluetooth device. Data statistics are available showing transfer rates and number of packets sent and received. HCI traffic can be viewed displaying the sequence of packet traffic between the BPA100 and another device. Details of an individual packet are available in an easy-to-read format by selecting the desired packet in the traffic window. Scripting with control flow capabilities allow for consistent and repetitive testing to be done on devices.

The Digianswer™ Bluetooth Neighborhood bundled with the protocol analyzer software provides developers with a robust application that can be used in conjunction with the piconet mode of operation. If piconet mode is selected, then the Bluetooth Neighborhood is used for controlling the communication between the Protocol Analyzer as either a master or slave and the other devices in the piconet. In this mode, the protocol analyzer can be used to generate traffic, introduce errors, and help test for proper overall operation. The Bluetooth Neighborhood is an intuitive application that allows the user to quickly discover other devices within range, make connections by simply dragging and dropping device icons, and perform other tasks such as transferring data between devices. In independent mode, the protocol analyzer synchronizes to the master and logs the packet traffic without actually becoming part of the piconet.

Single Interface for Control

Acquisition Setup Display

The BPA application software v2.2 integrates the data collector and packet analyzer applications. This provides the user with a single interface for controlling the BPA100 and analyzing packets.

• Ability to capture all baseband packets within a Bluetooth piconet including retransmitted packets
• Logging of data directly to the hard drive file on the host PC
• Capable of transmitting and receiving on a single user-defined frequency
• Ability to turn data whitening on and off

Packet Analysis

• Provides packet status - access error, packet header error, estimated clock, and hop frequency
• Analyzes baseband packets and displays ID, IQ, NULL, POLL, FHS, DMx, DHx, AUX1, HVx, and DV packets
• Isolates, decodes, and displays baseband, LMP, L2CAP, RFCOMM, OBEX, HDLC, PPP, TCS, and SDP commands including services attributes, events, and data packets
• View wide range of filters to display data of interest
• Export of postfiltered data for the total logged session into a comma separated (.CSV) file for documentation

Bluetooth Network Neighborhood

• An intuitive Microsoft® Windows application from Digianswer that allows the user to quickly discover other devices within range
• Make connections by simply dragging and dropping device icons
• Perform other tasks such as transferring data between devices

HCI Terminal Application

• Command line interface allows low-level control of HW
• Enter HCI commands to bypass middleware for direct access to transport layer
• Use the HCI scripting capability for repetitive tests
• Create HCI Scripts to insure consistency in testing

Trigger Functionality

Triggering enables the user to selectively acquire data based on occurrence of specific events, errors, sequences, or patterns, thereby getting to the source of the problem more quickly.

Trigger on BB, LMP, and L2CAP Packets

• Trigger on user-defined sequences or patterns
• Trigger on errors

Trigger on RFCOMM Packets

• Control Field - SABM, DM, UIH, UA, DISC
• Information Field - DATA, PN, Test, FCon, FCoff, MSC, NSC, RPN, RLS
• Payload Data - 1 to 8 bytes of payload data
• Available in free running mode

Trigger on SDP Packets

• PDU upcode 1 to 7
• 1 to 8 bytes of payload data
• Available in free running mode

Trigger Positioning

• Pretrigger: 0 - 100,000 packets
• Posttrigger: 0 - unlimited packets (manual stop)

Filtering

Filtering can be enabled preacquisition for selective logging to disk or postacquisition for selective display of acquired data from the log file.

• Options for viewing combinations of Error, ID, NULL, POLL, FHS, DXX, HVX, AUX, DV, etc., packets, including LMP and L2CAP at baseband
• Filters at each protocol level; Baseband, LMP, L2CAP, RFCOMM, or SDP

• Extensive postacquisition filtering, combined with large disk based record size ensures that customers can see all the data and yet filter it for optimal analysis
• Preacquisition filtering on baseband Access Error, ID, NULL, and POLL packets greatly minimizes disk usage

Synchronization

User Can Select From the Following Modes To Synchronize To a Piconet:

• Sync to piconet using master inquiry
• Sync to piconet using fake connection response
• Sync to piconet using slave inquiry

Independent-Mode Packet Capture and Tracking

When used in independent mode the BPA100 captures the normal traffic of the piconet that is being monitored. There are specific sequences of events of interest between two devices under test, which the BPA100 can capture while it is monitoring them in independent mode.

• Track the test mode 5-frequency hopping sequence between two devices while monitoring them in Independent Mode
• Ability to follow the Master/Slave switch between two devices while monitoring them in Independent Mode
• Capture the paging sequence (ID, ID, FHS, ID) between two devices in Independent Mode

Error Data Generator

When in piconet mode, the protocol analyzer can introduce the following errors into baseband packets. This is very useful when bringing up the baseboard/radio portion of the design or when stress testing network operation.

• Header FEC 1/3 error
• Header HEC error
• Payload FEC 1/3 and 2/3 recoverable error
• Payload FEC 2/3 nonrecoverable error
• Payload CRC error

The above errors may also be introduced based on user-defined sequence criteria (errors only generated if criteria met). Some of the criteria parameters that can be used are:

• Estimated clock
• Hop frequency
• Header type
• Header AM_ADDR
• Header flow
• ARQN, SEQN, L_CH
• Payload flow, Payload length

Free Run Display

In Free Run Display, the protocol analyzer updates the data list box continuously with the latest packets received. The user can halt the real-time updating at any time and scroll through the received data. This is particularly useful when debugging traffic flow at higher levels in the protocol stack.

Extended Error Packet Decoding

Header Delivered to Packet Analyzer:

• Header HEC error
• Payload packet length error
• FEC nonrecoverable error

In other cases, the whole packet is delivered to the Packet Analyzer.

Baseband Parameter Controls

• Inquiry time-out, user selectable in the interval of 1-41 sec
• Correlation value between 40 and 64 to indicate the value for accepting a received packet

Data Decryption

• Dialog for entering the key in hexadecimal

Other

• General/Unlimited Inquiry - GIAC LAP code 0x9E8B33
• Limited dedicated Inquiry Access - LIAC LAP code 0x9E8B00

System Requirements

The Tektronix Bluetooth Protocol Analyzer Requires the Following User PC Configuration:

• Microsoft Windows 98, ME, or 2000
• Intel Pentium III, 800 MHz or above
  • Lower processor speeds are acceptable if Decryption and Free Run mode are not used
• 256 MB of RAM
• Minimum of 200 MB of free space on hard drive

Hardware Specifications

• Compliant with the USB specification version 1.1
• Power is supplied to Bluetooth Air Interface Probe through USB cable and host PC
• Standby power consumption: <20 mA
• Active power consumption: <350 mA

Bluetooth Radio Specifications

• Bluetooth V1.1 qualified device
• Transmit Power: +20 dBm
• Receiver Sensitivity: <-80 dBm
• Frequency Range: 2.402 - 2.480 GHz
• Compliant with FCC 47CFR part 15.19 USA
• Compliant with RSS-210/RSS-139 Industry Canada
• Compliant with R&TTE directive European Union (EU) and EFTA
• See web site for complete list of regulatory compliance

Physical Characteristics

Environmental - Bluetooth Air Interface Probe

Temperature -

Operating: +5 °C to +50 °C

Nonoperating: -20 °C to +60 °C

Humidity - 20% to 80%

Altitude -

Operating: -1000 ft. to 10,000 ft. (-305 meters to 3,050 meters)