Ellisys Bluetooth Explorer 400
All-in-One Bluetooth® Protocol Analysis System

	Download the datasheet »
	Download the software »

Whole-band BR/EDR and Low Energy sniffer, with concurrent capture of spectrum, HCI (USB, UART, SPI), WCI-2, logic signals, and Audio I2S.

NEW Support for Bluetooth 4.2 core specification! Press release » 

Key Points

• All-in-One: concurrent capture of BR/EDR, Low Energy, spectrum, HCI, logic, Audio I2S, and WCI-2, all synchronized to nanoseconds precision
• Whole-Band Capture: easy and rock-solid capture of any traffic, including discovery / connection traffic and SSP pairing
• Reprogrammable Digital Radio: support for new specifications without hardware changes
• Multi-Piconet Support: see multiple piconets and scatternets, without limitations
• All Protocols and Profiles: best-of-breed protocol decoding
• Integrated Audio Analysis: listen to captured audio over-the-air, including HCI audio and I2S, within the software, in sync with all other traffic
• Spectrum Display:  characterize the wireless environment and visualize coexistence issues 
• Message Sequence Chart: create charts automatically from the powerful Ellisys protocol display
• Free Maintenance: Free lifetime software updates as well as free fully-featured viewer software with unlocked hardware that can be used on any computer.

Innovative Tool for Demanding Users

Traffic analysis is one of the key day-to-day activities for Bluetooth engineers looking to rapidly test and debug their prototypes and products. Unfortunately, Bluetooth over-the-air sniffing has always been difficult to perfect. Legacy sniffing methods suffered from major technological drawbacks, making them unreliable and even unusable in several circumstances, making Bluetooth engineers' tasks much more difficult.

With its revolutionary whole-band Digital Radio, Ellisys lifts protocol capture and analysis to new heights, radically overcoming the drawbacks of those legacy approaches to Bluetooth sniffing. The Ellisys all-in-one whole-band sniffer robustly records any packet, at any time, from any neighboring piconet, with zero-configuration and without being intrusive. 

“Test and characterization of new Bluetooth silicon and end-products is a comprehensive process requiring a diverse set of engineering expertise and an array of specialized, analytical tools,” said Muthu Kumar, Wireless Firmware Engineer, Intel Corporation.  “The Ellisys Bluetooth Explorer plays an important role in this process by delivering a clear and complete understanding of the behavior of the ever-evolvingBluetooth technology from both hardware and software perspectives, all while providing exceptional ease of use.”

“The new advanced features provided by Ellisys provide our teams with tools that substantially increase visibility into the workings of Bluetooth technology,” said Miles Louis Smith, Senior R&D Engineer, Test Group, Nordic Semiconductor. “We use the sniffer to diagnose complex timing issues that other sniffers might not be able to capture. Due to the unique radio architecture of the Ellisys sniffer we can capture all packets regardless of the timing. The reconfigurable hardware is very flexible, and the Ellisys team provides great support to help us get products to market sooner.”

Industry’s Only Whole-Band Capture

Bluetooth wireless technology was originally designed to be robustly impervious to interference on the much-used 2.4 GHz ISM band. It was also designed to be difficult to sniff, for security reasons. To meet these criteria, aBluetooth radio uses 79 channels pseudo-randomly according to a hopping sequence defined at the piconet’s connection time.

A hopping sniffer tries to actively synchronize on a specific hopping sequence, and captures the packets only after a successful synchronization. This kind of sniffer has several inherent limitations, making it more difficult to use, less reliable, and usable only in a limited set of scenarios.

Ellisys has created a revolutionary sniffer that overcomes all of these drawbacks and adds innovative and ground-breaking features, opening new horizons for Bluetooth debugging and interoperability testing. The whole-band capture approach is as simple as it is powerful: instead of listening to just a few channels, the sniffer captures all channels concurrently. The sniffer thus does not need to synchronize to a piconet; it will listen passively to all nearby Bluetooth piconets and scatternets, without any required configuration.

Industry’s Only Reconfigurable Bluetooth Digital Radio

With its innovative reconfigurable radio, the Ellisys sniffer can uniquely beupdated by software to support changes in the specification, without any change to the hardware, and even without any interaction from the user. For instance, this flexibility allowed for the addition of next generation Bluetoothbaseband features (such as enhanced AES security and Connectionless Broadcast) several months before the specification was officially released. Additionally, the Ellisys BEX400 comes with free lifetime software updates, so all customers can benefit from these great additions free-of-charge!

Industry’s Only All-in-One Sniffer

Capturing wireless traffic is a very important aspect of Bluetooth debugging, but other information is equally important for understanding the big picture. This is another aspect where the Ellisys sniffer excels.

The Ellisys Bluetooth Explorer 400 sniffer supports one-click concurrent capture of:

• Classic Bluetooth BR/EDR
• Low Energy Bluetooth
• 2.4 GHz Spectrum [PRO]
• USB HCI (1 port), UART HCI (2 ports) and SPI HCI (2 ports) [PRO]
• Logic signals [PRO]
• Audio I2S [PRO]
• Wireless Coexistence Interface 2 (WCI-2) [PRO]

Protocols and Profiles

Bluetooth protocols and profiles are displayed in an easy-to-understand, high-level procedures-oriented chronological format in the Overview windows and fully detailed to the lowest bit/byte level in the linked Details view. Classic Bluetooth, Low Energy, and HCI traffic is displayed in designated Overviews real-time, as capture progresses.

The user is provided various controls to easily customize any Overview, including powerful filtering and coloring capabilities designed to quickly isolate specific protocols, profiles, or communications of interest. Traffic can be presented at the highest level of abstraction and the user can drill down to show all intermediate levels, down to the most basic elements, such as packet-only views.

Click the image to expand it

Message Sequence Charts

While the analyzer’s powerful protocols and profiles display is most efficient for engineers, Message Sequence Charts are usually preferred for creating reports or sharing technical information with specification experts or others not typically involved in using protocol analysis tools. The Ellisys solution is to create a Message Sequence Chart representation from a previously filtered and annotated protocols view. With this approach, engineers can include precisely the information they want, the way they want, and create a clear depiction showing exactly the information desired.

Click the image to expand it

HCI Analysis [PRO]

Wireless traffic is of course one of the most useful elements of debugging information for Bluetooth engineers, but Host Controller Interface (HCI) traffic is an equally important complement of information for getting a clear and complete picture of the situation.

The HCI is an electrical interface defined by the Bluetooth specification for communications between the host controller and the radio. The Ellisys BEX400 supports capture of USB HCI, UART HCI and SPI HCI. Any and all HCI traffic is captured concurrently with the wireless traffic using the same precision clock for perfect synchronization and timing analysis, and is displayed in the highly-optimized Ellisys analysis software.

HCI capture is also a very convenient feature when working with devices that implement Secure Simple Pairing (SSP). The Ellisys analysis softwareautomatically extracts any Link Key exchanged over HCI and uses it to decrypt the wireless traffic, all without any user interaction.

Click the image to expand it

Spectrum Analysis [PRO]

The 2.4 GHz ISM band used by Bluetooth is quite busy. Other users of this band include WiFi, LTE, ZigBee, ANT and a broad range of other proprietary and commercial technologies. All of these users interfere with each other and it is often necessary to have a better understanding of the wireless environment.

The spectrum display offered by the Ellisys sniffer is the perfect tool for coexistence debugging, wireless characterization, or simply for visualizing the RF environment. It captures the spectrum signal strength (RSSI) in allBluetooth channels with a configurable precision of up to 1 microsecond, and displays this information in synchronization with the Bluetooth packets.

Click the image to expand it

Logic Analysis [PRO]

The logic analysis feature enables capture of any logic signal, in synchronization with the wireless and HCI traffic. Any digital signal is supported, including general-purpose I/Os or dedicated pins such as TX/RX Active. Another of the many applications for this feature is keeping track of a device’s power consumption in various states, by using dedicated hardware such as comparators for determining whether key thresholds are exceeded.

These signals can then be visualized with 5-nanosecond precision and compared with the other captured streams in the powerful Instant Timing view of the Ellisys software.

Click the image to expand it

Audio Analysis

The Ellisys analysis software includes integrated Audio analysis. Any captured audio stream can be quickly and easily played back, even live, during capture. Finding the packet carrying a specific audio portion or seeing event and topology changes at specific audio positions becomes child’s play.

With the PRO Edition, audio captured over HCI or with the Audio I2S capture can be played back as well. This enables characterization of the complete audio chain, from the uncompressed audio provided to the source radio chip, to the audio transmitted wirelessly, and the decoded audio received by the receiver radio chip.

Click the image to expand it

Automated and Long-Term Capture

There are various user applications that require the use of the analyzer in an automated fashion, often under control of user-defined software applications performing a variety of tasks. These applications may include long-term test environments, integration of the analyzer into a mobile platform, and other usage models.

Thanks to the ease-of-use and robustness provided by the Ellisys Digital Radio, the BEX400 is the perfect system for these tasks. The analyzer can be controlled with a simple yet powerful Remote Control API (Application Programming Interface) to programmatically start / stop / save captures, and extract specific captured information that can be used for various purposes, including go/no-go testing , all without any manual operation.

A unique segmentation feature works seamlessly with the API to allow forextremely long captures, segmenting captures into smaller more manageable slices while maintaining topology and contextual information from capture to capture.

Software Overview

Click the image to expand it

System Specifications

RF Characteristics

• Ellisys Rainbow™: Wideband, concurrent capture of all BR/EDR/LE channels
• Frequency band: 2.402-2.480 GHz
• Sensitivity range: From -90 to +15 dBm
• Gain: Programmable from -30 to +15 dB
• Modulations: All BR/EDR/LE modulations (GFSK, p/4-DQPSK, 8-DPSK)
• Baseband: Support of Bluetooth 4.0, upgradeable by software

Logic Capture Characteristics

• Maximum bandwidth: 50 MHz
• Sampling precision: 5 ns
• Supported input voltage: 1.8 to 7V

HCI Capture Characteristics

• USB transport: Low, Full, and High Speed, with automatic detection
• UART transport: Up to 8 Mbit/s, automatic detection of all parameters
• SPI transport: Up to 8 Mbit/s, automatic detection of all parameters

Timing

• Clock: ±1ppm frequency accuracy over -10 to +60 degrees Celsius range
• BR/EDR/LE timestamp accuracy: 125ns
• USB HCI timestamp accuracy: 16.7ns
• Logic timestamp accuracy: 5ns

Embedded Memory

• 128 MB of FIFO memory
• Data is stored in highly optimized format
• Analyzed data is uploaded in real time through a USB 2.0 connection

Front-Panel Indicators

• Power: unit powered on
• Operating: unit performing requested task
• Trigger: trigger event detected
• Capture: BR/EDR and/or LE packet captured
• HCI: HCI packet captured

Front-Panel Connectors

• Capture: Standard SMA female
• HCI: USB 2.0 Standard-A and Micro-B

Rear-Panel Connectors

• Computer: USB 2.0 Standard-B
• Power: 12-17 VDC, max 18 W
• Trigger: SMA in and out, 50 Ω, max 5VDC
• IO Probe: supports UART / SPI HCI, WCI-2 and logic analysis
• Inter-equipment: in and out, supports connection of several units

Power Supply

• Universal 100-240 VAC, 50-60 Hz
• 12 VDC, 18 W

Enclosure

• 174 x 111 x 58 mm (6.9 x 4.4 x 2.3'')
• 1.0 kg (2.0 lbs)

Hardware Upgrade

• The Ellisys Rainbow™ engine is automatically updated with each software release  (no user intervention required)

Maintenance and Licensing

• Free lifetime software updates – no maintenance fees
• Free full-featured viewer software – easily share annotated traces between computers and colleagues and replay captured traffic
• Use Ellisys hardware on any computer – no additional licenses needed

Warranty

• Two-year limited warranty

Ellisys reserves the right to change the features and specifications of the product without notice.

Minimum Requirements

• Intel Pentium 4, 1 GHz or compatible processor
• 1 GBytes of RAM
• 1280 x 1024 display resolution with at least 65,536 colors
• USB 2.0 EHCI host controller
• Windows® XP Service Pack 2 or higher