Computer Access Technology BT004APA-X Bluetooth Protocal Analyzer and Test Generator User Manual 01 BTTracer

Computer Access Technology Corporation Bluetooth Protocal Analyzer and Test Generator 01 BTTracer

Contents

Main User Manual

2403 Walsh Avenue, Santa Clara, CA 95051-1302 Tel: +1/408.727.6600 Fax: +1/408.727.6622For Software Version 1.0Manual Version 1.08 February, 2002CATC BTTracer™Bluetooth™Protocol AnalyzerUser’s Manual
2Merlin Protocol Analyzer User’s ManualCATC Version 1.0Document DisclaimerThe information contained in this document has been carefully checked andis believed to be reliable. However, no responsibility can be assumed forinaccuracies that may not have been detected.CATC reserves the right to revise the information presented in thisdocument without notice or penalty.Trademarks and ServicemarksCATC, Merlin, Merlin’s Wand, NetMate, Advisor, Chief, FireInspector,Inspector, Detective, Traffic Generator, BusEngine, USB4DOS, UPT, HPT,UHT, Galaxy, IBTracer,SATracer,andAndromeda are trademarks ofComputer Access Technology Corporation.Microsoft, Windows, and Windows NT are registered trademarks ofMicrosoft Inc.All other trademarks are property of their respective companies.CopyrightCopyright © 2002, Computer Access Technology Corporation (CATC); AllRights Reserved.This document may be printed and reproduced without additionalpermission, but all copies should contain this copyright notice.FCC Conference StatementThis equipment has been tested and found to comply with the limits for aClass A digital device and an intentional radiator, pursuant to Part 15 of theFCC Rules. These limits are designed to provide reasonable protectionagainst harmful interference when the equipment is operated in acommercial environment. This equipment generates, uses, and can radiateradio frequency energy and, if not installed and used in accordance with theinstruction manual, may cause harmful interference to radiocommunications. Operation of this equipment in a residential area is likelyto cause harmful interference in which case the user will be required tocorrect the interference at their own expense. The end user of this productshould be aware that any changes or modifications made to this equipmentwithout the approval of CATC could result in the product not meeting theClass A limits, in which case the FCC could void the user's authority tooperate the equipment.
3Merlin Protocol Analyzer User’s ManualCATC Version 1.0Important Notice: To comply with FCC RF exposure requirements(sections 1.1307 and 1.310 of the Rules) only the antenna supplied byCATC must be used for this device. The antenna must be located at least 20cm away from all persons.EU Conference StatementThis equipment complies with the R&TT Directive 1999/5/EC. It has beentested and found to comply with EN55022:1994/A1:1995/A2:1997 Class A,EN61000-4-2:1995, EN61000-4-3:1995, EN61000-4-4:1995,EN61000-4-5:1995, EN61000-4-6:1995, EN61000-4-11:1994,EN61010-1:1993, and ESTI EN 300 328-1 V1.2.2 (2000-07).Manual Version 1.8 Part number: 730-0017-00
4Merlin Protocol Analyzer User’s ManualCATC Version 1.0
iiiBTTracer Protocol Analyzer User’s ManualCATC Version 1.0TABLE OF CONTENTSChapter1 Overview.....................................1Bluetooth™Overview..............................................1GeneralDescription ...............................................2Automation.......................................................4Features .........................................................4General...................................................4Physical Components ........................................5DisplayOptions ............................................5RecordingOptions ..........................................5TrafficGeneration ..........................................5Bluetooth™BusEngine ......................................6Specifications.....................................................7Package...................................................7PowerRequirements.........................................7Environmental Conditions . ...................................7Switches ..................................................7LEDs ....................................................7RecordingMemorySize .....................................7Certification ...............................................7Chapter2 QuickInstallation .............................9SettingUptheAnalyzer.............................................9InstallingtheSoftware..............................................9YourFirstBluetooth™Recording....................................10Chapter3 DetailedInstallation...........................13System Components/Packing List . . ..................................13TheInstalledMerlinUnit...........................................13MerlinSystemSetup ..............................................14ACPowerSource.................................................14ExternalInterfaceBreakoutBoard....................................15BreakoutBoardExternalOutputSignallingPins..................16PrototypeReworkArea......................................17PCConnection...................................................17AntennaInformation ..............................................17AnalyzerPCRequirements .........................................17MerlinProgramInstallation.........................................18LoadingtheMerlinUSBDrivers..............................18InstallingtheMerlinApplicationProgram ......................18MerlinProgramStartup............................................19MakingaRecording...............................................20Chapter4 Updates.....................................21Software,Firmware,andBusEngineRevisions..........................21SoftwareUpdates.................................................22
ivBTTracer Protocol Analyzer User’s ManualCATC Version 1.0SoftwareLicenseUpdates..........................................22Viewinglicensinginformation................................23BusEngineandFirmwareUpdateUpdates..............................23AutomaticUpdates.........................................24ManualUpdatestoBusEngineandFirmware ....................25UpdatingtheBusEngine.....................................26UpdatingtheFirmware......................................27Chapter5 SoftwareOverview............................29TheMainDisplayWindows.........................................29ViewOptions....................................................31ToolBar..................................................31StatusBar.......................................................33RecordingProgress.........................................33RecordingStatus...........................................34AnalyzerStatus............................................34SearchStatus..............................................35ZoomIn..................................................35ZoomOut ................................................35ToolTips........................................................35MerlinAnalyzerKeyboardShortcuts .................................36Chapter6 RecordingWizard ............................37StartingRecordingWizard...................................37RecordingaTrafficonaNewPiconet.................................38RecordinganExistingPiconet ......................................49RecordinginTestMode............................................58RecordinginReducedHoppingMode..........................58RecordinginSingleFrequencyMode.................................62Chapter7 RecordingOptions............................63OpeningtheRecordingOptionsDialogBox .....................63RecordingOptions-General........................................64Recordingtype ............................................64Options..................................................65BufferSize ...............................................65TriggerPosition............................................65RecordingOptions-Modes.........................................66RecordingMode...........................................67InquiryRecording..........................................67PiconetRecording..........................................68HopSequence.............................................68SyncMethods.............................................69ForceRe-synchronization....................................72FollowMaster/SlaveSwitch..................................73MatchClockRate..........................................73ShowPagingTraffic........................................73
vBTTracer Protocol Analyzer User’s ManualCATC Version 1.0PiconetAddresses(MSB->LSB) .............................73OtherParameters...........................................74Debug/Test ...............................................75RecordingOptions-Events.........................................75EventsOptions ............................................75PayloadLengthError.......................................81RecordingOptions-Actions........................................82ActionsWindowLayout.....................................82ActionButtons-TheirFunctions..............................83Counting Buttons - Their Functions . . . .........................83BlueDotMenus ...........................................85SavingRecordingOptions..........................................91RecordingBluetoothTraffic ........................................92Chapter8 DisplayOptions ..............................95GeneralDisplayOptions ...........................................95TraceViewingLevel........................................96CreatingNewDisplayOptionsFiles ...........................96ColorDisplayOptions.............................................97FormatsDisplayOptions...........................................99Hiding.........................................................100SavingDisplayOptions...........................................101Chapter9 ReadingaCATCTrace.......................103TraceViewFeatures..............................................103InterpretingtheDisplayedInformation...............................103Tooltips........................................................104SetMarker .....................................................104EditorClearMarker .............................................105ExpandedandCollapsedDataFormats...............................106HideFrequencyHops.............................................107HideNullsandPolls..............................................108MenusinClickedFields...........................................108HideUnassociatedTraffic.........................................108Chapter10 DecodingHigherProtocols...................109Introduction ....................................................109LMPandL2CAPMessages........................................109DecodingandViewingHigherProtocolData..........................110DecodingViatheDecodingToolbar...........................110DecodingViatheDisplayOptionsDialogBox ..................111Tooltips........................................................112ViewingPacketsinLMPandL2CAPMessages........................112TypesofLMPandL2CAPMessages ................................112Viewing L2CAP Channel Connections . . .............................113ViewingProtocolMessagesandTransactions..........................114ViewingL2CAPMessagesinProtocolMessages ................115
viBTTracer Protocol Analyzer User’s ManualCATC Version 1.0HowtoDecode...........................................115ExpandingProtocolMessages ...............................115ChangingProtocolAssignments ....................................116UsingtheDecodingAssignmentsDialogBox...................116RemovingUser-AssignedProtocolAssignments.................117ManuallyAssigningProtocols...............................118OtherAssignments:OBEXClient/ServerStatus.................118ChanginganOBEXClientorServerStatus.....................119DecodingBNEP..........................................119DecodingHID............................................119Chapter11 OtherFeatures .............................121Search.........................................................121GotoTrigger.............................................121GotoPacket/Message/Protocol ..............................121GotoMarker.............................................122Goto...................................................122Error ...................................................126SoftBitError.............................................126LossofSync.............................................126Find....................................................126Event Groups . . ..........................................128Union,Intersection,andExclusion............................132UsingFind...............................................132FindNext ...............................................134EditComment ..................................................135Reports........................................................135FileInformation ..........................................135ErrorSummary...........................................136TimingCalculations .......................................136TrafficSummary .........................................137BTNeighborhood................................................139Encryption .....................................................139ConfiguringMerlinforEncryption............................140Chapter12 HowtoContactCATC.......................143Chapter13 WarrantyandLicense.......................143Index................................................145
1BTTracer Protocol Analyzer User’s ManualCATC Version 1.01. OverviewThe CATC BTTracer™ Protocol Analyzer is a member in CATC'sindustry-leading line of high performance, serial bus protocol analyzers.PrecededbyCATC’sUSBChief™ and IEEE 1394 FireInspector™Analyzers, BTTracer has been designed using the same modular softwareand hardware architecture that made its predecessors highly successful inthe serial bus protocol analyzer market worldwide.1.1 Bluetooth™ OverviewThe Bluetooth™ wireless technology is set to revolutionize the personalconnectivity market by providing freedom from wired connections. It is aspecification for a small-form factor, low-cost radio solution providing linksbetween mobile computers, mobile phones and other portable handhelddevices, and connectivity to the internet.The Bluetooth™ Special Interest Group (SIG), comprised of leaders in thetelecommunications, computing, and network industries, is drivingdevelopment of the technology and bringing it to market. The Bluetooth™SIG includes promoter companies 3Com, Ericsson, IBM, Intel, Lucent,Microsoft, Motorola, Nokia and Toshiba, and more than 2500 SIGmembers.Bluetooth™ is a radio technology specification designed to transmit bothvoice and data wirelessly, providing an easier way for a variety of mobilecomputing, communications and other devices to communicate with oneanother without the need for cables. Bluetooth™ could make possible whatis being called the personal-area network by allowing users to transmit smallamounts of data at 1M bit/sec with a range of 10 to 100 meters, dependingthe power of the radio, over the 2.4-GHz radio frequency. The key benefitsof the Bluetooth™ technology are robustness, low complexity, low powerand low cost. Bluetooth™ employs a rapid frequency hopping mechanismto minimize the effects of ‘collisions’ with other protocols and devicesoperating in the same frequency band. Mechanisms exist for a Bluetooth™device to determine all devices in range as well as to request connection toa piconet as either a master or a slave.Please refer to the Bluetooth™ Specification, version 1.1 for details on theprotocol. The Bluetooth™specification is available from the Bluetooth™SIG at its web site http://www.bluetooth.org/
2BTTracer Protocol Analyzer User’s ManualCATC Version 1.01.2 General DescriptionThe BTTracer Protocol Analyzer is designed as a stand-alone unit that canbe easily configured and controlled by a portable or desktop PC connectedvia its USB port. BTTracer provides customers with the familiar ‘CATCTrace’ user interface that is the de facto industry standard for documentingthe performance of high-speed serial protocols.BTTracer supports the functionality required to analyze all levels, includingthe baseband, of the Bluetooth™ wireless protocol. The featured RadioInterface allows users to probe and analyze transactions at the lowest levelwithin the Bluetooth™ architecture. By creating this "Point of Observation"or probing point within the radio level packet view, the user can analyze alllevels of the protocol stack.BTTracer is a non-intrusive testing tool for Bluetooth™ piconets providingnetwork traffic capture and analysis. Hardware triggering allows real-timeevents to be captured from a piconet. Hardware filtering allows the filteringout of fields, packets, and errors from the recording. Filtering allows usersto focus recordings on events of interest and to preserve recording memoryso that the recording time can be extended.Recorded data is presented in colored graphics in a trace viewer application.This application has advanced search and viewing capabilities that allow theuser to quickly locate specific data, errors and other conditions, therebyfocussing the user’s attention on events of interest.The BTTracer Protocol Analyzer functions with any personal computerusing the Windows 98, Windows 98SE, Windows 2000, Windows NT 4.0,Windows ME, or Windows XP operating systems and equipped with afunctional USB interface. For an updated set of system requirements for thehost machine, please refer to the readme file.The Analyzer is configured and controlled through a personal computerUSB port. It can be used with portable computers for field service andmaintenance as well as with desktop units in a development environment.The Analyzer is easily installed by connecting a cable between thecomputer’s USB port and the Analyzer’s USB port.
3BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Sample Bluetooth™ Piconet with BTTracer Protocol AnalyzerBTTracer provides on-the-fly detection of and triggering on such events asPacket Headers and Errors. Whether recording manually or with a specifiedtrigger condition, BTTracer continuously records the bus data in awrap-around fashion until manually stopped or until the Trigger Event isdetected and a specified post-Trigger amount of bus data is recorded.Upon detection of a triggering event, the analyzer continues to record dataup to a point specified by the user. Real-time detection of events can beindividually enabled or disabled to allow triggering on events as theyhappen. This includes predefined exception or error conditions and a
4BTTracer Protocol Analyzer User’s ManualCATC Version 1.0user-defined set of trigger events. The unit can also be triggered by anexternally supplied signal. An external DB-9 connector provides a path forexternally supplied data or timing data to be recorded along with bus traffic.This DB-9 connector also provides a path for BTTracer to transmitexternally two control, timing, or recovered signals for purposes of probingand use by other circuitry.The BTTracer software provides powerful search functions that enableinvestigation of particular events and allow the software to identify andhighlight specific events. In addition to immediate analysis, you can printany part of the data. Use the Save As feature to save the data on disk for laterviewing. The program also provides a variety of timing information anddata analysis reports.1.3 AutomationThe BTTracer software includes an Application Program Interface (API) fordeveloping testing programs and scripts in C++ and Visual Basic. The APIreproduces most of the commands embodied in the BTTracer trace viewersoftware. This API allows users to automate procedures that otherwise haveto be run manually via the trace viewer software. The Automation API canbe run locally on the PC attached to BTTracer or remotely over a networkconnection.For further details, download the BTTracer Automation ApplicationProgramming Interface User’s Manual from the CATC website:http://www.catc.com/support.html1.4 FeaturesGeneral• Flexible design - reconfigurable hardware for future enhancements.• User friendly - the Graphical User Interface software of BTTracerAnalyzer is designed to be consistent with the ‘CATC Trace’ using colorand graphics to display Bluetooth™ traffic.• Radio Level Point of Observation and Capture - traffic capture at theRadio Level for comprehensive analysis.• Complies with Bluetooth™ v1.1 specification.• Supports point-to-point and point-to-multipoint Bluetooth™ piconets.• Supports both 79 frequency hop and 23 frequency hop standards.• Automatic tracking of changes in the hopping scheme.
5BTTracer Protocol Analyzer User’s ManualCATC Version 1.0• Automatic tracking of whitened and non-whitened packets and traffic.• Free non-recording, view-only software available.• Power-on self-diagnostics.• Internal 100V to 240 V AC power supply.• Compliant with FCC class A requirements / meets all CE markrequirements.• One year warranty and hot-line customer support.Physical ComponentsNote For an updated description of requirements for the host machine, please refer to thereadme file.• Trace viewer software support for all of the above plus Windows 95.• Recording memory of 128MB - enough to record twenty five minutes ofhigh volume traffic.Display Options• Analyzes and displays a transaction-level view of piconet traffic withaccurate time-stamps and frequency hop information.• Software analysis and data presentation at several protocol levels:Baseband, LMP, L2CAP, SDP, RFCOMM, TCS, OBEX, HDLC, BNEP,PPP, AT, and HID Commands.Recording Options• Flexible advanced triggering capabilities including - multiple triggeringmodes, selective views, timing analysis, search functions, protocolpacket errors, transaction errors, packet type and destination device, datapatterns, or any of these trigger types in combination.• User defined trigger position.• Support for various piconet characteristics by enabling the user toconfigure the synchronization method and recording parameters.• Real-time hardware filtering of captured traffic for optimizing analyzermemory usage.Traffic GenerationTraffic generation capability is provided by BTTrainer.
6BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Bluetooth™ BusEngineCATC’s BusEngine™ Technology is at the heart of the new BTTracerAnalyzer. The revolutionary BusEngine core uses state-of-the-art EPLDtechnology and incorporates both the real-time recording engine and theconfigureable building blocks that implement data/state/error detection,triggering, capture filtering, external signal monitoring and event counting& sequencing. And like the flash-memory-based firmware that controls itsoperation, all BusEngine logic is fully field upgradeable, usingconfiguration files that can be downloaded from the CATC Website.
7BTTracer Protocol Analyzer User’s ManualCATC Version 1.01.5 SpecificationsPackagePower Requirements90-264VAC, 47-63Hz (universal input), 100W maximumEnvironmental ConditionsSwitchesLEDsRecording Memory Size128M x 8-bit DRAM for traffic data capture, timing, state and other data.CertificationFCC (Class A), CE MarkDimensions: 9.2 x 8.4 x 2.5 inches(23.4 x 21.3 x 6.4 cm)Connectors: AC power connectionexternal clock input (EXT CLK, BNC)host connection (USB, type ‘B’)data connector (Data In/Out, 9-pin DB)Weight: 2.8 lbs. (1.2 kg)Operating Range: 0 to 55 °C (32 to 131 °F)Storage Range: -20 to 80 °C (-4 to 176 °F)Humidity: 10 to 90%, non-condensingPower: on/offManual Trigger: when pressed forces a trigger eventPower (PWR): illuminated when the analyzer is powered on.Recording (REC): illuminated when the analyzer is actively recording trafficdata.Triggered (TRG): illuminated during power-on testing, and when the analyzerhas detected a valid trigger condition.Synchronized(SYNC):flashes during acquisition of the traffic hop sequence, illu-minated when the analyzer is locked to the hop sequence.
8BTTracer Protocol Analyzer User’s ManualCATC Version 1.0
9BTTracer Protocol Analyzer User’s ManualCATC Version 1.02. Quick InstallationThe BTTracer Protocol Analyzer components and software are easilyinstalled and quickly ready to run on most Windows-based personalcomputer systems. You can begin making Bluetooth™ recordings afterfollowing these initial steps. However, if you are new to personal computersand protocol analyzers, or if you are unsure about what to do after readingthe Quick Installation instructions, or if your analyzer does not work afteryou follow these instructions, read through the subsequent sections in thismanual.2.1 Setting Up the AnalyzerStep 1 Attach the Antenna to the ANT connection point. Theantenna should point up.Step 2 Connect the AC power cable to the rear of the analyzer.Step 3 Turn on the power switch on the rear of the analyzer.Step 4 Insert the BTTracer CD into the CD ROM drive of the PCthat will be administering the Analyzer. If you prefer toinstall from diskette, insert the first BTTracer diskette (Disk1 of 6) into the floppy disk drive.Step 5 Connect the USB cable between the USB port on the back ofthe analyzer and a USB port on the analyzing PC.Step 6 Follow Windows on-screen Plug-and-Play instructions forthe automatic installation of the BTTracer Analyzer as aUSB device on your analyzing PC (the required USB filesare included on the BTTracer CD and the first BTTracerdiskette).2.2 Installing the SoftwareStep 1 From the setup directory, run setup, and follow the on-screeninstructions to install the BTTracer application on theanalyzing PC hard disk.Step 2 To start the application, launch the CATC BTTracerprogram from the Start Menu:Start>Programs>CATC>BTTracer.
10BTTracer Protocol Analyzer User’s ManualCATC Version 1.02.3 Your First Bluetooth™ RecordingAfter installing and launching the software, you can test BTTracer bycreating a recording of a General Inquiry. In this test, BTTracer will issuea General Inquiry that asks local devices to identify themselves. BTTracerthen records the responses.Step 1 Select Recording Options under Setup on the Menu Bar.The Recording Options dialog box will open showing factory defaultsettings such as “manual trigger” and 1 Mbytes buffer size. For theGeneral Inquiry recording you are about to create, these settings can beleft unchanged.
11BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Step 2 Select the Modes tab.The following dialog box will open showing factory default settings.BTTracer defaults to “General Inquiry.” For this recording, leave mostof these settings unchanged. If you are recording a Hop Frequency thatis not 79 Hops Standard, you will need to select the appropriatestandard from the Hop Frequency menu below.Step 3 Click OK to close the Recording Options window andactivate the recording options you selected.At this point, BTTracer will be ready to record.Step 4 Click on the Tool Bar.BTTracer starts to record the Bluetooth™ traffic immediately. TheBluetooth™ Inquiry process will proceed for 20 seconds. After 20seconds has elapsed, the analyzer uploads the data and displays thepackets.Step 5 If you wish to terminate the recording before the snapshot
12BTTracer Protocol Analyzer User’s ManualCATC Version 1.0automatically completes, click on the Tool Bar.After a few moments, the recording will terminate and the results willdisplay. The screen should look like the sample recording below whichshows the FHS packets generated during the Inquiry process.When the recording session is finished, the bus traffic is saved to the harddrive as a file named data.blt or whatever name you assign as the defaultfilename. While the file is being saved, you should see a brown progressbar at the bottom of the screen. When the bar turns white, it indicates thatthe data has been saved to disk.Step 6 To save a current recording for future reference, Select SaveAs under File on the Menu Bar.ORClick on the Tool Bar.You see the standard Save As screen.Step 7 Give the recording a unique name and save it to theappropriate directory.
13BTTracer Protocol Analyzer User’s ManualCATC Version 1.03. Detailed Installation3.1 System Components/Packing List• One stand-alone BTTracer Analyzer module• One Antenna• One External Interface Breakout Board with a 9-pin ribbon cable• One 6-foot (2-meter) USB cable• BTTracer software program installation CD and diskettes• Product documentation3.2 The Installed BTTracer UnitThe BTTracer Analyzer has several user-accessible controls and LEDs onits front and rear panels of the OmniBus.Figure 1: Front Panel•RedPWR (power) indicator LED (lights when the unit power isswitched on).•GreenREC (recording) LED (lights when the unit is recording).• Yellow TRG (triggered) LED (lights when the unit triggers an event).Note TRG also lights during power-on testing and will be turned off at the end of thepower on cycle. If the LED blinks at the end of this cycle, the hardware is faulty.•GreenSYNC (synchronized) LED (lights when the unit is locked onto aspecific piconet, based on the Master Address).•Manual Trigger push-button (allows a manual Trace capture)—After beginning a recording session, press the Manual Trigger switch toforce a Trigger condition. The session completes when a specifiedpost-Trigger amount of bus data is recorded or when you manually stop arecording session.•ANT Bluetooth™ Antenna connector
14BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Figure 2: Rear Panel•Wide range AC connector module—Power socket—Enclosed 5x20 mm 2.0A 250 V fast acting glass fuseWarning: For continued protection against fire, replace fuse only with thetype and rating specified above.—Power on/off switch•External Clock (EXT CLK) input for future enhancement (Note: THIS PORTIS NOT USED)•USB type “B” host computer connector•Data In/Out DB-9 (9-pin) external interface connectorWarning: Do not open the BTTracer Analyzer enclosure. There are nooperator servicable parts inside. Refer servicing to CATC.3.3 BTTracer System SetupThe BTTracer Analyzer is designed to work with either desktop or laptopcomputers equipped with a functional USB interface. To set up the systemhardware,• Attach the Antenna to the ANT connector. Set the antenna topoint up.• Connect the Analyzer to an AC power source.• Connect the External Interface Breakout Board to the DataIn/Out connector (optional).• Connect to the analyzing PC via USB.3.4 AC Power SourceStep 1 Connect the Analyzer box to a 100-volt to 240-volt, 50 Hz to60 Hz, 100 W power outlet using the provided power cord.
15BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Note The Analyzer is capable of supporting supply voltages between 100-volt and240-volt, 50 Hz or 60 Hz, thus supporting all known supply voltages around theworld.Step 2 Use the power switch located on the rear panel to turn theanalyzer unit on and off.Note At power-on, the analyzer initializes itself in approximately ten seconds andperforms an exhaustive self-diagnostic that lasts about five seconds. The TriggerLED illuminates during the power-on testing and turns off when testing isfinished. If the diagnostics fail, the trigger LED blinks continuously, indicating ahardware failure. If this occurs, call CATC Customer Support for assistance.3.5 External Interface Breakout BoardThe External Interface Breakout Board is an accessory that allowsconvenient access to several potentially useful standard fast TTL output andinput signals. It also offers a simple way to connect logic analyzers or othertools to the BTTracer Analyzer unit. Four ground pins and one 5-volt pin areprovided.The Breakout Board connects via a ribbon cable to the Data In/Outconnector located on the rear of the analyzer box. Each pin is isolated by a100Ωseries resistor and a buffer inside the Analyzer box.Figure 3: Data In/Out ConnectorTable 1 lists the pin-out and signal descriptions for the Data In/Outconnector.Table 1: Data In/Out Connector – Pin-OutPin Signal Name Signal Description1 +5V +5 Volts, 250mA DC source2 TRG IN Trigger Input3 GP IN General Purpose Input4 TRG OUT Trigger Output5 GP OUT General Purpose Output
16BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Table 2: External Interface Breakout BoardBreakout Board External Output Signalling PinsThe "TRG OUT" and "G.P. OUT" pins found on the Analyzer’s BreakoutBoard have similar functions. Both pins serve to transmit output signalswhen a trigger event occurs. The main differences between the two pins isin the number of signals that the Analyzer will send through them (TRGOUT will transmit just one signal whereas G.P. OUT may transmit severalsequential signals), and in their initial state (TRG OUT is always enabled bythe Analyzer whereas G.P. OUT must be enabled in the recording optionsbefore it can be utilized).TRG OUTWhen an event trigger occurs, TRG OUT transitions from ground to acontinuous 5 V signal on the first instance of a trigger event. TRG OUT isa one-time event: it will not re-signal or change signals with subsequenttriggering events. When this first trigger event occurs, the Trigger LED willilluminate (so this pin can be thought of as a reflection of the state of thisLED).6 GND Ground7 GND Ground8 GND Ground9 GND GroundPin Signal Name Signal Description
17BTTracer Protocol Analyzer User’s ManualCATC Version 1.0G. P. O U TG.P. OUT needs to be enabled before it will output signalling. See “BlueDot Menus for the Event Buttons” on page 88 for details on how to enableoutput signalling.If enabled, G.P. OUT will provide signalling each time a trigger event isdetected by the Analyzer. G.P. OUT’s signalling can be set to three differentformats - "Pulse High" provides a 16.66 ns (ground to +5V) signal, "PulseLow" a 16.66 ns (+5 V to ground) signal or "Toggle", a signal with an initialHigh (+5V) state that alternates with each trigger event between continuousHigh (+5 V) and continuous Low (Ground). "Pulse High" is the defaultcondition. To change the format, see “Enabling High Pulse, Low Pulse orPulse Toggle Signal Outputs” on page 88 for details.Prototype Rework AreaThe Breakout Board contains a prototype rework area for making customcircuits for rapid development. The area consists of plated-through holes, 20columns wide by 27 rows long. The top row of holes is connected to GNDand the bottom row is connected to +5V. The remaining holes are notconnected. Use the rework area to insert custom components and wire-wraptheir respective signal, power, and ground pins.3.6 PC ConnectionUse the USB cable provided to connect the host computer to the BTTracerAnalyzer.3.7 Antenna InformationAccording to the Bluetooth™specifications, Bluetooth™Antennas shouldbe placed at least 10 cm apart. It is recommended that BTTracer be placedat least 1 meter away from the nearest device in the piconet underobservation.3.8 Analyzer PC RequirementsFor an updated description of requirements, please refer to the readme file.Note If installing BTTracer software on a Windows NT 4.0 system, you will need aseparate set of diskettes, which is available from CATC.
18BTTracer Protocol Analyzer User’s ManualCATC Version 1.03.9 BTTracer Program InstallationThe CATC BTTracer software is provided on a CD and also on six 3½ inchdiskettes. The software is also available on zip files at the CATC web site:http://www.catc.com/support.htmlIf you are downloading the files from the CATC web site, you will beretrieving several zipped files. The first of these has an executable calledinstall.exe. Double-click on this file and follow the on-screen instructions.Installation of the analyzer software requires a Windows 98, Windows98SE, Windows 2000, Windows ME, or Windows XP operating system. Ifyou are loading BTTracer onto Windows NT 4.0 you will need to get aseparate diskette and instructions from CATC.Loading the BTTracer USB DriversBefore you can install the BTTracer Windows application, you will need toinstall BTTracer as a USB device:Step 1 Insert the BTTracer program CD into the CD ROM drive ofthe PC that will be administering the Analyzer. If you preferto install from floppy diskette, install the floppy for youroperating system labeled Disk 1 of 6 into the a: drive.Step 2 Power-on the BTTracer Analyzer.Step 3 Connect the USB cable to the rear of the analyzer and to thepersonal computer.The host operating system detects the analyzer and begins to install theUSB driver.Step 4 Follow the installation instructions provided on your screento complete the installation of the driver.Note When Windows prompts you for a file, browse to the CATC floppy in the a: drive.Installing the BTTracer Application ProgramRun Setup.exe from the BTTracer CD or from the BTTracer floppy disk 1of 6.The CATC BTTracer Install Wizard automatically installs the necessaryfiles to the computer’s hard drive. BTTracer software is installed in theC:\Program Files\CATC\BTTracer directory unless you specify otherwise.Follow the installation instructions on your screen.
19BTTracer Protocol Analyzer User’s ManualCATC Version 1.03.10 BTTracer Program StartupYou can start the BTTracer program from the Desktop or from the installeddirectory. The program always begins with its main screen active:The software may be used with or without the analyzer box. When usedwithout an analyzer box attached to the computer, the program functions ina Trace Viewer mode to view, analyze, and print captured protocol traffic.When the program is used with the BTTracer Protocol Analyzer attached tothe computer, you can set trigger conditions, record, monitor and analyzethe activity of your Bluetooth™ device or piconet.
20BTTracer Protocol Analyzer User’s ManualCATC Version 1.03.11 Making a RecordingAfter installation, the software is configured to make a manual recording("Manual Trigger") of General Inquiry traffic.To make your first recording of this traffic,Step 1 Click on the Tool Bar.After 20 seconds, Inquiry timeout occurs and the analyzer will upload thedata and display the packets.To terminate the recording before Inquiry timeout occurs,Step 2 Click on the Tool Bar at any time before recordingautomatically terminates.When the recording session is finished, the traffic is saved to the harddrive as a file named data.blt or whatever name you assign as the defaultfilename.To save a current recording for future reference,Step 3 Select Save As under File on the Menu Bar.ORClick on the Tool Bar.You see the standard Save As screen.Step 4 Give the recording a unique name and save it to theappropriate directory.
21BTTracer Protocol Analyzer User’s ManualCATC Version 1.04. UpdatesFrom time to time as modifications are made to BTTracer, it is necessary toupdate the Firmware and/or BusEngine for optimal performance. Updatescan be performed two ways: either automatically or manually. This chapterdescribes both procedures.4.1 Software, Firmware, and BusEngine RevisionsThe Readme.htm or Readme.txt file on the first installation disk and in theinstalled directory gives last-minute updates about the current release.Included with each release are the most recent downloadable images of theFirmware and the BusEngine. The Readme file lists the latest versions andinforms you if new Firmware or a new BusEngine needs to be updated inyour hardware.Once the Analyzer has completed the self diagnostics and is connected tothe PC, you can check the latest revision of the software and BusEngine:•Selecting About Merlin… in the Help Menu.You see this screen:About Merlin details revisions of the following software and hardware:•Merlin Software Version•Merlin Firmware Version•BusEngine Version•Unit Serial NumberNote When contacting CATC for technical support, please have available all therevisions reported in the About Merlin window.
22BTTracer Protocol Analyzer User’s ManualCATC Version 1.04.2 Software UpdatesWhen a new software release is available, it is posted on the Support pageof the CATC website at www.catc.com/support.html.To update the software,Step 1 In the About Merlin screen,verifywhichversionofBTTracer Software you are currently running.Step 2 Find the latest released software version on the CATCwebsite under Support.If you are running the latest version of the software, no further action isneeded.If you are not running the latest version, continue to Step 3.Step 3 Click on the first link to download the zipped Disk 1 files foryour operating system.Step 4 Click on the second link to download the zipped Disk 2 files.Step 5 Unzip the files into your choice of directory.Step 6 Click Start, then Run, and browse to where you unzippedthe files.Step 7 Select the program named Setup and click Open.Step 8 Click OK to run the Setup and begin the installation.Step 9 Follow the on-screen instructions to complete theinstallation.Step 10 Read the Readme file for important information on changesin the release.4.3 Software License UpdatesA license key is a file that CATC provides to you when you enter amaintenance agreement. You use this file when you make updates to yourCATC software.
23BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Step 1 From the Help menu, select Update License.Step 2 Type the path and filename to the license key or click theBrowse button to map to the directory containing the licensekey.Step 3 Click Update Device.Viewing licensing informationYou can also view licensing information to see what version of the licenseyou are running.From the Help menu, select Display License Information.The following window appears containing information about the currentstatus of your analyzer’s license:4.4 BusEngine and Firmware UpdateUpdatesBusEngine and Firmware updates often need to be performed when youupdate the BTTracer software. These updates can be performedautomatically or manually. Both processes are described.
24BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Automatic UpdatesWhen BTTracer’s software is updated, the software may becomeincompatible with the BusEngine and Firmware. If a recording isattempted, BTTracer will display an error message and then automaticallybegin an update process for the BusEngine and Firmware. If you prefer, youcan abort this update and undertake the steps manually as described later inthis chapter.To perform an automatic BusEngine and Firmware update,Step 1 If needed, update the BTTracer software using the stepsoutlined in "Software Updates" described above.Step 1 Turn on the Analyzer.Step 2 On the toolbar, click the button.Since the BusEngine and/or the Firmware are incompatible with thecurrent BTTracer software version, an error message will appeardisplaying your current versions and indicating what versions you needto install.Step 3 Click Yes.The above window closes and the Analyzer Setup window opens.Step 4 Click Update BusEngine or Update Firmware on the
25BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Analyzer Setup screen.You can select only one item at this point. If both the BusEngine and theFirmware need to be updated, the update will complete for the first itemand then return to the above screen so the second update can beperformed.When the second update has finished, you will see the following messagetelling you that the update is complete.Step 5 Power cycle BTTracer to complete the update.Manual Updates to BusEngine and FirmwareYou can manually update BTTracer’s Firmware and/or BusEngine byperforming the following steps:Step 1 Select Analyzer under Setup on the Menu Bar.You see th e Analyzer Setup screen:Step 2 Click Reset AnalyzerThe Analyzer resets, performs self-diagnostics, and returns to service.Note The self-diagnostics should complete about five seconds after the trigger LEDlights. If the diagnostics fail, the trigger LED blinks on and off continually,indicating faulty hardware. If this occurs, contact CATC for customer support.
26BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Updating the BusEngineThe BusEngine core is the heart of the Merlin Analyzer. Usingstate-of-the-art PLD technology, it incorporates both the high speedrecording engine and the configurable building blocks that implementdata/state/error detections, triggering, capture filtering, external signalmonitoring, and event counting and sequencing. Both the BusEngineprogram and the Firmware that manages the internal microcontroller arefully field updateable.Within a new software release, it may be necessary to update the Analyzer’sBusEngine hardware for proper operation. The Readme file lets you knowif this is necessary.To update the BusEngine,Step 1 Click Update BusEngine on the Analyzer Setup screen.You see th e Select engine file window:The program has already automatically searched for the correct file anddisplays it in the File name field.Note The most current Primary BusEngine file (BTTracer.rbf) was copied to your\CATC\BTTracer directory when you installed the program.Step 2 Click Open.It is not necessary to restart the Analyzer. Once updated, the Analyzer takesapproximately 15 seconds to reinitialize, with Time Remaining displayedon the screen. During this time the Trigger LED is on, indicating that
27BTTracer Protocol Analyzer User’s ManualCATC Version 1.0power-on diagnostics are being run. If there is a hardware failure, theTrigger LED continues to blink after initialization is complete. If thisoccurs, contact CATC for customer support.Updating the FirmwareWithin a new software release, it may also be necessary to update theAnalyzer’s firmware for proper operation. The Readme file informs you ifthis is necessary.To update the firmware,Step 1 Click Update Firmware on the Analyzer Setup screen.You see th e Select firmware file window:The program has already automatically searched for the correct file anddisplays it in the File name field.Step 2 Click Open.The Analyzer updates the Firmware.Step 3 Unplug the USB cable from the back of the Analyzer boxand then reinsert it so the new Firmware update can takeeffect.
28BTTracer Protocol Analyzer User’s ManualCATC Version 1.0
29BTTracer Protocol Analyzer User’s ManualCATC Version 1.05. Software Overview5.1 The Main Display WindowsWhile some of the analyzer’s Main Display window options are familiar,many contain options specific to the analyzer program.Table 3: Main Display Pull-Down WindowsMenu FunctionFileOpen…Opens a fileClose Closes the current fileSave As…Saves all or a specified range of packets from the current file with aspecified namePrint…Prints part or all of the current traffic data filePrint Preview Produces an on-screen preview before printingPrint Setup…Sets up your current or new printerEdit Comment…Creates or edits the Trace file comment fieldExport »Packets toText (Packet ViewFormat)Saves all or part of a trace to a text file or to a Comma Separated Values(CSV) file suitable for viewing in a spreadsheet applicationExport »Packets toCSV TextSaves all or part of a trace to a Comma Separated Values (CSV) filesuitable for viewing in a spreadsheet applicationLast File Lists the last files that were openedExit Exits the BTTracer programSetupDisplay Options…Provides the control of various display options such as color, formats,and filters.RecordingOptions…Provides setup options for recording, triggering events and filteringevents.EncryptionOptions ...Allows a pin code to be assigned to a device to facilitate encryptiondecoding.Recording Wizard ... Starts a sequence of interactive dialog boxes that configures BTTracerfor a recording. This utility provides an alternative to the RecordingOptions dialog box.Analyzer…Allows the operator to reset the Analyzer or update the BusEngine andFirmware.RecordStart Causes the Analyzer to begin recording Bluetooth™ activity.Stop Causes the Analyzer to stop recording.Inquiry Provides a fast setting of the frequency hopping scheme and the inquirymode.Piconet Provides a fast way for setting the frequency hopping scheme and thesynchronization method.
30BTTracer Protocol Analyzer User’s ManualCATC Version 1.0ReportFile Information Details such information about the recording as number of packets andtriggering setup.Error Summary Displays an error summary of the current trace file and allows you togo to a specific packet, and save the error file to a uniquely named file.Timing Calculation Starts the calculator dialog for calculating various timing andbandwidth parameters in the recording file.Traffic Summary Details the number and type of packets were transferred during therecording, as well as message-level statistics.SearchGo to trigger Positions the display to show the first packet that follows the triggerevent.Go toPacket/Message/Protocol ...Positions the display to the indicated packet, LMP/L2CAP message, orProtocol Message (RFCOMM, TCS, or SDP protocols).Go to Marker » Positions the display to a previously marked packet.Go to » Enables quick searching for specific events using a cascade of pop-upwindows.Find Allows complex searches.Find Next Repeats the previous Find operation. Can also use F3 to find next.Search Direction Allows you to specify a forward or backward search of a trace file.ViewToolbars Displays list of available toolbars.Status Bar Switches display of the Status Bar on or off.Unhide cells Allows you to unhide cells.Zoom In Zoom in increases the size of the displayed elements.Zoom Out Zoom out decreases the size of the displayed elements.Wrap Allows the display to wrap.BT Neighborhood Displays Bluetooth™ Address and clock frequency for devices inrange. The expected Bluetooth™ clock frequency is 3200 Hz +/- 250ppm.DecodingAssignmentsDisplays current decoding assignments and provides options forchanging them.L2CAP connections Displays current L2CAP connections and provides options forchanging them.RFCOMM ChannelAssignmentsDisplays current RFCOMM Channel Assignments and providesoptions for changing them.Levels Displays the level you select.Menu Function
31BTTracer Protocol Analyzer User’s ManualCATC Version 1.05.2 View OptionsThe View feature in the Menu Bar allows you to•Control the display of the Tool Bar and the Status Bar.Tool BarThe Tool Bar provides access to the most popular program functions. Tool tipsdescribe icon functionality as the mouse arrow is moved over the icon/item.WindowNew Window Switches display of the Tool Bar on or off.Cascade Displays all open windows in an overlapping arrangement.Tile Displays all open windows in a side-by-side arrangement.Arrange Icons Arranges minimized windows at the bottom of the display.Windows Displays a list of open windows.HelpHelp Topics... Displays online help.Update License... Opens a dialog box for entering license key information for theanalyzer.Display LicenseInformation...Displays current license information for the analyzer.About BTTracer... Displays version information about BTTracer.Open file Hide Nulls & PollsSave As Hide Unassociated TrafficPreview Complex FindPrint… Find NextSetup Record Options File Information ReportMenu Function
32BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Setup Display Options Traffic SummaryStart Recording View Packet Level (Baseband)Stop Recording View/Hide LMP Message LevelBluetooth Neighborhood View/Hide L2CAP Message LevelSetup Encryption Options View/Hide SDP Message Protocol LevelRecording Wizard View/Hide SDP Transaction Protocol LevelZoom In View/Hide TCS Protocol LevelZoom Out View/Hide RFCOMM Protocol LevelWrap View/Hide OBEX Protocol LevelHide Frequency Hops View AT Commands Protocol LevelError Summary View/Hide PPPTiming Calculatons View/Hide HDLC ProtocolStart BTTracer’s Wand View/Hide BNEP ProtocolView HID Protocol Layer
33BTTracer Protocol Analyzer User’s ManualCATC Version 1.05.3 Status BarThe Status Bar is located at the bottom of the main display window.Depending on the current activity, the bar can be divided into as many asfour segments.Recording ProgressWhen you begin recording, the left-most segment of the Status Bar displaysa Recording Progress Indicator:As recording progresses, the Progress Indicator changes to reflect therecording progress graphically:•In the Progress Indicator, a black vertical line illustrates the location of theTrigger Position you selected in Recording Options.—Pre-Trigger progress is displayed in the field to the left of the TriggerPosition in the before-Trigger color specified in the Display Options.—When the Trigger Position is reached, the progress indicator wiggles as itwaits for the trigger.—After the trigger occurs, the field to the right of the Trigger Position fillsin the post-Trigger color specified in the Display Options.—When recording is complete, the upper half of the progress indicator fillsin white, indicating the progress of the data upload to the host computer.You should be aware of two exceptional conditions:•If a Trigger Event occurs during the before-Trigger recording, thebefore-Trigger color changes to the after-Trigger color to indicate that not allthe expected data was recorded pre-Trigger.•When you click Stop before or after a Trigger Event, the Progress Bar adjustsaccordingly to begin uploading the most recently recorded data.The Progress Bar fills with color in proportion to the specified size andactual rate at which the hardware is writing and reading the recordingmemory. However, the Progress Indicator is normalized to fill the spacewithin the Status Bar.
34BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Recording StatusDuring recording activity, the current Recording Status is temporarilydisplayed in the next segment. When you activate the Record function, thissegment flashes one of the following messages (depending on the selectedRecording Options):—Trigger?—Triggered!—UploadingAfter recording stops,—The flashing message changes to Uploading data–x%done(x%indicates the percentage completion of the data uploading process).—The traffic data is copied to disk (overwriting any previous version of thisfile) using the default file name data.blt or a new name specified in theRecording options.To abort the upload process,•Press Esc on your keyboardORAgain click in the Tool Bar.You are prompted to choose whether to keep the partially uploaded data or tothrow it away.When the data is saved, the Recorded Data file appears in the main displaywindow and the Recording Status window is cleared.•If the recording resulted from a Trigger Event, the first packet following theTrigger (or the packet that caused the Trigger) is initially positioned secondfrom the top of the display.•If the recording did not result from a Trigger Event, the display begins with thefirst packet in the traffic file.Analyzer StatusThe third segment in the status bar displays analyzer status. Duringsynchronization, the analyzer status will read:Inquiring – BTTracer is conducting a General InquirySyncing – BTTracer is syncing to the Master deviceNo Sync – BTTracer has not yet started syncing to the Master deviceAfter the analyzer has synchronized to the Bluetooth™ piconet underobservation, the Status Bar will display activity bars. The activity bars willincrease or decrease with activity. If there are no vertical bars, there is norecorded activity.
35BTTracer Protocol Analyzer User’s ManualCATC Version 1.0During uploading, this segment displays the percent of the upload processcompleted.Note If packets are filtered from the recording or data are truncated, the recordingactivity is reduced.In addition to showing activity, the third segment of the Status Bar will alsodisplay the radio signal strength in dBm received by the analyzer. BTTracercan display five possible values:•below-60dBm• - 60 dBm• - 50 dBm• - 40 dBm• above - 40 dBmThe valid range for a signal is between -70 and - 20 dBm.Search StatusThe rightmost segment displays the current search direction: Fwd (forward)or Bwd (backward).Zoom InZoom In increases the size of the displayed elements, allowing fewer (butlarger) packet fields per screen.•Click on the Tool Bar.Zoom OutZoom Out decreases the size of the displayed elements, allowing more (butsmaller) packet fields per screen.•Click on the Tool Bar.5.4 Tool TipsThroughout the application, tool tips provide useful information.To display a tool tip, position the mouse pointer over an item. The tool tipdisplays in a short moment if present. Tool tips can also be found over theTool Bar and in areas of the packet view screen.
36BTTracer Protocol Analyzer User’s ManualCATC Version 1.05.5 BTTracer Analyzer Keyboard ShortcutsSeveral frequently-used operations are bound to keyboard shortcuts.Table 4: Keyboard ShortcutsKey Combination Operation Key Combination OperationCtrl+O Open file Ctrl+P Print...Ctrl+Home Jump to First packet Ctrl+End Jump to Last packetCtrl+F Search Forward Ctrl+B Search BackwardF3 Find Next Ctrl+L Search for Loss of SyncShift+I Goto ID packet Shift+R Goto Freq Hop packetShift+P Goto Poll packet Shift+N Goto Null packetShift+M Goto DM1 packet Shift+F Goto FHS packetShift+1 Goto HV1 packet Shift+H Goto DH1 packetShift+3 Goto HV3 packet Shift+2 Goto HV2 packetShift+A Goto AUX1 packet Shift+V Goto DV packetShift+5 Goto DH3 packet Shift+4 Goto DM3 packetShift+7 Goto DH3 packet Shift+6 Goto DM5 packetShift+S Search for Soft Error Shift+E Search Error
37BTTracer Protocol Analyzer User’s ManualCATC Version 1.06. Recording WizardRecording Wizard is an interactive utility that presents a series ofuser-friendly dialog boxes for setting up a recording session. RecordingWizard serves as an alternative method of configuring the RecordingOptions dialog box. When you are finished using the Wizard, you can viewyour settings in the Recording Options window. By providing data to theprompts in the Wizard’s dialog boxes, you configure BTTracer for arecording session.Starting Recording WizardTo start the Recording Wizard,• Click on the Tool Bar or select Recording Wizard underSetup on the Menu Bar.You se e the Recording Options window:The Recording Options window has three buttons marked Next,Back,andCancel that allow you to move forward or backward through the wizard orto cancel the wizard.To begin advancing through the wizard,•ClickNext to see the options for the three types of recordings thatthe Recording Wizard can make.
38BTTracer Protocol Analyzer User’s ManualCATC Version 1.0The Wizard advances to the next screen which presents three options:•Establish a new piconet and have BTTracer record traffic onthat piconet.This option causes BTTracer to perform an Inquiry so it can discoverlocal devices and then establish a new piconet and record the piconettraffic.•Record traffic on a piconet that has already been established.This option lets BTTracer record traffic from an already establishedpiconet.•Record traffic in Test Mode on a test piconet.This option lets BTTracer create either a single frequency rangerecording of a range that you specify or create a recording of a limitedhop frequency range consisting of 5 frequency hops.6.1 Recording a Traffic on a New PiconetThe New Piconet option shown in the previous screen presents users withthe means of recording the traffic from a new piconet. This option willcause a sequence of screens to prompt you for information such as thepiconet Master address.
39BTTracer Protocol Analyzer User’s ManualCATC Version 1.0The following steps shows you how to configure BTTracer to record a newpiconet.Step 1 From the screen shown in the previous screenshot, select thefirst option: I want to establish a new piconet and haveBTTracer record traffic on that piconet,thenpressNext.The following screen displays.Step 2 Select the Frequency Hopping Mode for your country, thenpress Next.
40BTTracer Protocol Analyzer User’s ManualCATC Version 1.0The following screen displays.Step 3 Select Perform Inquiry Now,thenpressNext.Selecting Perform Inquiry Now will cause BTTracer to perform aGeneral Inquiry and collect addresses and other details about localBluetooth devices. If you already have address information for yourBluetooth devices you can choose Skip Inquiry. Choosing SkipInquiry will cause the Recording Wizard to advance to Step 6. If youare not sure what option to select, choose Perform Inquiry Now.The following screen will display.You will see two options:
41BTTracer Protocol Analyzer User’s ManualCATC Version 1.0•I want to search for all Bluetooth devices within rangeThis option will cause BTTracer to search for all Bluetooth devices thatare in range and ready to transmit and receive data (i.e., in Inquiry ScanMode)•I want to search only for devices corresponding to thefollowing (hexadecimal) DIAC:This option will cause BTTracer to search for the class of devices thatyou specify in the DIAC text box. DIAC stands for Device InquiryAccess Code. Values are entered in hexadecimal format. You can getDIAC values from the Bluetooth Specification.Step 4 Select the first option: I want to search for all Bluetooth deviceswithin range,thenpressNext. The following screen will display.You will see two options:Step 5 In the text box, enter the length of time you want BTTracer to searchfor nearby devices.The default value is 20. If you do not sure what time value to enter, usethe default value.
42BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Step 6 Press Next.Before the Inquiry, BTTracer tests the hardware connection. In the caseof failure, the following screen will display.Clicking OK will close the message box.If BTTracer passes the hardware test, it will search for devices. TheRecording Wizard will display a progress bar and a message telling youthat a search is under way:
43BTTracer Protocol Analyzer User’s ManualCATC Version 1.0If no device is found, the Recording Wizard will display the followingscreen:If devices found, the Recording Wizard will display the following screen:Two buttons will display:•Repeat - This button will cause BTTracer to repeat the GeneralInquiry•Show Devices Found - This button will cause a window to openand display details about the found devices.
44BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Step 7 Press the button marked Show Devices Found.The following screen will display:Step 8 Click OK to close the window.Step 9 Press Next.The following window will display:Step 10 Select from the drop-down menu the hexadecimal address for yourMaster device. If you do not see your device’s address, you maytype it into the text box yourself.
45BTTracer Protocol Analyzer User’s ManualCATC Version 1.0The following window will display:Step 11 Select from the drop-down menu the hexadecimal address for yourslave device into the box labeled Piconet Slave Address. If you donot see your slave’s address, you can type it into the box.Step 12 Press Next.The following screen will display.This screen displays the settings you selected.
46BTTracer Protocol Analyzer User’s ManualCATC Version 1.0The Advanced button on the right will open the Recording Optionsdialog box shown below. This screen will show the settings you selectedthrough the Recording Wizard have been applied to the RecordingOptions dialog.Step 13 Press Next to advance the Recording Wizard to the next screen.The following screen displays:BTTracer pages the Master and if specified in Step 8, the Slave devices.
47BTTracer Protocol Analyzer User’s ManualCATC Version 1.0If BTTracer is unable to complete its pages, the following screen willdisplay:If BTTracer is able to complete its pages, it will enter into asynchronizing state and then wait for you to create the piconet. Duringthis waiting period, BTTracer will display the following screen:
48BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Once you have created the piconet, BTTracer will synchronize to thepiconet and begin recording. During the recording, BTTracer willdisplay the following screen:At the completion of the recording, BTTracer will display the followingscreen:You can repeat the recording by pressing the Repeat button.Step 14 To close the wizard, press the Close button.
49BTTracer Protocol Analyzer User’s ManualCATC Version 1.0The wizard will close and your trace will display.6.2 Recording an Existing PiconetUsing Recording Wizard to record an existing piconet is similar to recordinga new piconet. The main difference is that you will be asked if your Masterdevice can support multiple slave devices and whether it can respond topages once it has created a piconet with another device.Step 1 To start the Recording Wizard, press or select Setup >Recording Wizard from the menu.The Recording Wizard introductory page will open:
50BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Step 2 Press Next to advance to the next screen.You will see three choices:Step 3 Select the second option: I want BTTracer to recordtraffic on a piconet that has already been established.Step 4 Press Next.You will see four choices:Select the hop mode appropriate to your area.Step 5 Select the hop mode appropriate to your area, then pressNext.
51BTTracer Protocol Analyzer User’s ManualCATC Version 1.0You will see two choices:Step 6 Select Perform Inquiry Now.You will see two choices:Step 7 Select the first option: I want BTTracer to search for allBluetooth devices within range.If you want to limit the inquiry to a class of devices, select the secondoption and enter the hexadecimal value for the device class in the textbox.
52BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Step 8 Press Next.You will see two choices:Step 9 If you want to change the search duration, type in a newvalue into the text box. Otherwise, use the default value (20seconds), then press Next.The PC-BTTracer hardware connection will be tested. If BTTracercannot be detected, the following message will display:
53BTTracer Protocol Analyzer User’s ManualCATC Version 1.0If BTTracer passes the hardware test, it will then goes onto conduct aGeneral Inquiry to locate local Bluetooth devices.If BTTracer finds Bluetooth devices, it will display the followingmessage:Step 10 To display a list of the discovered devices, press the button
54BTTracer Protocol Analyzer User’s ManualCATC Version 1.0marked Show Devices Found.A screen will display showing the devices that BTTracer discoveredthrough the General Inquiry:If you feel that the list is incomplete, you can close this window and pressthe button marked Repeat. This will cause BTTracer to repeat theGeneral Inquiry and recollect information on local Bluetooth devices.Step 11 Press OK to close the Bluetooth Neighborhood window.Step 12 Press Next to advance to the next screen.The following screen will prompt you for the Master device’s address.The address can be selected from the drop-down menu or typed into thebox:Step 13 Select or type in the Master device’s address into the box
55BTTracer Protocol Analyzer User’s ManualCATC Version 1.0next to the label Piconet Master Address.Step 14 Press Next.The following screen will display. This screen asks you which of thefollowing two options apply to your Master device. For some devices,both options will apply.You can select either or both options. They are not mutually exclusive:If the Master supports inquiries while in a connected state, select the firstoption. This will set BTTracer to use the 'Sync & Record' mode in itsattempts to synchronize to the Master. This will also cause the wizard toskip to step 8.If the Master can support piconets with multiple slaves, select the secondoption. If you select this box alone (i.e., you leave the first boxunchecked), BTTracer will use the 'Passive Sync & Record' mode tosynchronize to the Master. The wizard will then advance to Screen 8*.If the first checkbox was selected, BTTracer will use 'Sync & Record' nomatter what was set in the second box.Step 15 If you want to skip the Master verification, put a check in thebox. If you are in doubt, leave the box unchecked.
56BTTracer Protocol Analyzer User’s ManualCATC Version 1.0If you selected only the second option in Step 15 (=’Passive Sync &Record’), the following screen will display.This screen asks you for the address of the Page Target device -- whichin this case is BTTracer. Since the devices in your piconet are not ableto respond to inquiries, BTTracer will not be able to page the devices andjoin the piconet. Instead, you will assign BTTracer an address here inthis screen, then direct your piconet Master device to connect toBTTracer. The Master will attempt to connect to BTTracer and thereingive BTTracer the information it needs to record the Master and slavedevices.Step 16 Type in an address of your choosing for BTTracer (= Page Target).You are making up an address for BTTracer that the Master will use totry to connect to BTTracer.
57BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Step 17 Press NextBTTracer will then display your current settings.The Advanced button will open the Recording Options dialog boxshown on page 46 and described in detail in Chapter 7.Step 18 Press Next to begin the recording.If the BTTracer hardware is not ready or connected or is in the processof booting up, the following information message box will display:Step 19 If the above information box opened, press OK to close it.
58BTTracer Protocol Analyzer User’s ManualCATC Version 1.0The following dialog box will display:Step 20 Press Retry or Back to re-attempt the process.If the hardware failure described in Steps 20 and 21 do not occur,BTTracer will conduct an inquiry. The screen will show that BTTraceris going to attempt a recording in either ’Passive Sync & Record’ modeas shown below or in ’Sync & Record’ mode depending on the optionsyou selected in Step 15.Step 21 If you are recording in ’Passive Sync & Record’ mode, you willneed to direct your Master device to attempt a connection toBTTracer. This will provide BTTracer with the information it needsto record the piconet.
59BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Once BTTracer has the information it needs, it will begin recording. Thefollowing screen will display:The recording will end following a trigger event or when you press StopRecording button on the screen shown above or when you press thebutton on the toolbar.Step 22 When finished, press Close to close the Recording Wizard.6.3 Recording in Test ModeA Test Mode recording allows you to limit the frequency hopping range thatBTTracer will record. Two Test Modes are available: Reduced HoppingMode and Single Frequency Mode. Reduced Hopping Mode limitsBTTracer’s recording to the five frequency hops that are described in theBluetooth Specification. Single Frequency Mode limits BTTracer’srecording to a single frequency range that you specify in the RecordingWizard.Recording in Reduced Hopping ModeTo record in Reduced Hopping Mode, perform the following steps:Step 1 Start the Recording Wizard by either pressing the buttonor selecting Setup > Recording Wizard from the menu.The Recording Wizard greeting screen will open.
60BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Step 2 Press Next to advance to the Recording Type screen.The following screen will display:Step 3 Select the third option: I am using Bluetooth Test Modeand want BTTracer to record traffic on my test piconet.Step 4 Press Next.The following screen will display:
61BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Step 5 Select the option Reduced-hopping mode,thenpressNext.The following screen will display:Step 6 Select the address for your piconet’s Master device from thedrop-down menu. If you prefer, you can type in the addressinto the box.Step 7 Press Next.The following screen will display. This screen will show the currentsettings for the recording:The Advanced button will open the Recording Options dialog box. SeeChapter 7 for details on the Recording Options dialog box.
62BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Step 8 Press Next to begin the recording.The following screen will display:Step 9 When the recording finishes, the following screen willdisplay. You can repeat the recording by pressing theRepeat button.Step 10 To close the wizard, press Finish.
63BTTracer Protocol Analyzer User’s ManualCATC Version 1.06.4 Recording in Single Frequency ModeStep 1 In the Recording Type window, select the third radio buttonand click Next.Step 2 In the Frequency Hopping Mode, window select theSingle-Frequency Mode radio button, enter the appropriatevalues in the text boxes, and click Next.
64BTTracer Protocol Analyzer User’s ManualCATC Version 1.0
63BTTracer Protocol Analyzer User’s ManualCATC Version 1.07. Recording OptionsThe Recording Options dialog box lets you configure BTTracer forrecording Bluetooth™ data. This dialog box offers an alternative to theRecording Wizard described in the previous chapter. At the top of theRecording Options dialog box are four tabs that provide access to dialogboxes called General, Modes, Events, and Actions. Using these dialogboxes, you can configure BTTracer to create event triggers, increase ordecrease memory allocation for recording, and interact with otherBluetooth™ devices in different ways.Opening the Recording Options Dialog BoxTo open the Recording Options menu, click on the Tool Bar or selectRecording Options under Setup on the Menu Bar.You se e the Recording Options window:The Recording Options window has four tabs marked
64BTTracer Protocol Analyzer User’s ManualCATC Version 1.0•General•Modes•Events•Actions7.1 Recording Options - GeneralThe General tab is displayed by default when the Recording Options dialogbox is oppened. It is shown in the previous illustration. The General tabdisplay four boxes marked Recording Type, Buffer Size, Trigger Position,and Options.Recording typeThe Recording Type box presents three options thatallow you to set how BTTracer begins and ends arecording. The options are: Snapshot, Manual Trigger,and Event Trigger.SnapshotA Snapshot is a fixed-length recording whose size is determined by the"Buffer Size" box in the Recording Options dialog or by a manual click ofthe Stop button. Recording begins by clicking on the Tool Bar and endswhen either the selected buffer size is filled or you press the Stop button.Manual TriggerA Manual Trigger recording is a one that is manually begun and ended.Recording is begun by pressing on the Tool Bar. Recording continuesin a circular manner within the limits set by the buffer size. Recording endswhen is clicked on the Tool Bar or the Trigger button is pressed on theanalyzer's front panel. If you press the Trigger button, recording willcontinue until the post-trigger memory has been filled.Event TriggerAn Event Trigger recording is one that uses an event trigger to end therecording. Before recording begins, you define the event trigger in theTrigger Options dialog box. You begin the recording by clicking onthe Tool Bar. Recording continues in a circular manner within the limits setby the buffer size. Once the trigger event occurs, some post-triggerrecording occurs, then the recording ends.Note In this mode, the recording can be stopped manually in the same way as for"manual trigger" mode.
65BTTracer Protocol Analyzer User’s ManualCATC Version 1.0OptionsThe Options box contains two options:Beep When Trigger OccursWill cause the PC to beep when a trigger eventhas occurred.Save External Interface SignalsWill enable BTTracer to record input signalsfrom a breakout board as fields in a trace.Buffer SizeThe Buffer Size box has a slide bar for adjusting therecording buffer size from 0.1 megabytes to 128megabytes.The Recording Type option determines how this buffer is used. Althoughthere are 128 megabytes of physical memory in the analyzer, the efficiencyof the recording ranges from 2:1 to 4:1 ratios of physical memory to actualBluetooth™ traffic. Shorter Bluetooth™ packets yield a less efficientrecording. The non-traffic portion of physical memory is utilized for controland timing information.Note The scale is not linear and affords more granularity in the smaller buffer sizes.Trigger PositionThe Trigger Position slide bar sets the amount ofpost-trigger recording that BTTracer will perform. Italso allows adjustment of the location of the triggerwithin the defined buffer. You can adjust theTriggering Position between 1 and 99% post-Trigger.Trigger Position is available only when Manual Trigger or EventTrigger is selected as Recording type.As an example, if the buffer size is set to 16MB, then for the followingTrigger Position settings, the amount of pre- and post-Trigger data is
66BTTracer Protocol Analyzer User’s ManualCATC Version 1.0• 95% post-triggering: 0.8MB pre-trigger, 15.2MB post-trigger• 75% post-triggering: 4MB pre-trigger, 12MB post-trigger• 50% post-triggering: 8MB pre-trigger, 8MB post-trigger• 25% post-triggering: 12MB pre-trigger, 4MB post-trigger• 5% post-triggering: 15.2MB pre-trigger, 0.8MB post-triggerNote When a Trigger occurs, recording continues until the post-Trigger amount of thebuffer is filled.7.2 Recording Options - ModesThe tab marked Modes opens a window for setting recording mode options.This window is divided into six boxes marked Recording Mode, PiconetAddresses, Hop Frequency, Other Parameters, and Debug/Test.
67BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Recording ModeTo record Bluetooth™ traffic, the BTTracer analyzer needs to synchronizeto the piconet under observation. BTTracer does not participate in thepiconet and behaves as a passive listener. It needs, however, tocommunicate briefly with the devices in the piconet to learn the Masterclock and frequency hopping sequence.To synchronize to the piconet under observation, BTTracer can be set up indifferent recording modes: Inquiry Recording and Piconet Recording.Theoption you select affects the types of settings that display in the window.Inquiry RecordingSelecting the "Inquiry Redcording" button causes the Modes window todisplay the options shown in the previous screenshot.The "Inquiry Recording" option presents two choices for recordingInquiries: "General (Unlimited)" and "Dedicated (Limited)."General (Unlimited)"General" means "General Inquiry" and is used to search for ALLBluetooth™ devices that are within range, for the amount of time specifiedin the Inquiry Timeout field. Completion of the inquiry process is indicatedby illumination of the "trigger" light on the front of the analyzer. Allresponding packets will be displayed when data upload from the analyzercompletes.Dedicated (Limited)"Dedicated" means a specific class or group of Bluetooth™ devices(designated by the DIAC field of the Recording Options dialog). Selecting"Dedicated" causes BTTracer to search for all devices from a specific classor group that are within range, for the amount of time specified in theInquiry Timeout field. Completion of the inquiry process is indicated byillumination of the "trigger" light on the front of the analyzer. Allresponding packets will be displayed when stop is selected.
68BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Piconet RecordingThe "Piconet Recording" option presents three choices for recording piconettraffic: Sync and Record, Passive Sync & Record, and Page Sync & Record.A Help button next to the menu briefly explains these options.Page Sync & Record is the preferred option and should be used wheneverpossible. If Page Sync & Record can not be used, then Sync & Recordshould be used. Passive Sync and Record should be used only if the firsttwo options can not be used.Hop SequenceUntil recently, local regulations in Japan, France, and Spain defined aBluetooth™ frequency range that was different than the range used by therest of the world. We have included the selections for organizations fortesting of devices developed before all frequencies were made available onaworld-widebasis.To set BTTracer to the correct Hop Frequency, select from the drop-downmenu one of the following choices:
69BTTracer Protocol Analyzer User’s ManualCATC Version 1.0•79 Hops Standard• 23 Hops Japan• 23 Hops Spain• 23 Hops France• Reduced Hop - Restricts BTTracer to five hop frequenciesdefined in the test mode specification of the Bluetooth™Specification. When Reduced Hop or Single Frequency isselected, the Sync method is set to Test Mode and cannot bemodified by the user.• Single Frequency - Allows the the transmit and receive frequencyranges to be specified. Selecting this option highlights the "DUTXmit" and "DUT Recv" text boxes. When Reduced Hop orSingle Frequency is selected, the Sync method is set to Test Modeand cannot be modified by the user.• Enter values into the two text boxes to the set the transmit andreceive frequency ranges:• DUT Xmit Freq, MHz (+2402) – Allows the setting of thetransmit signal for the Device Under Test• DUT Recv Freq, MHz (+2404) – Allows the setting of thereceive signal for the Device Under TestSync MethodsNote If the selected Hop Sequence is "Reduced Hop" or "Single Frequency," the SyncMethod is set to "Test Mode" and cannot be modified by the user.Page Sync & Record"Page Sync and Record" is the recommended method of recording. "PageSync and Record" should be implemented before a piconet is established.This mode causes BTTracer to perform a General Inquiry and collect syncinformation from the specified slave device when it responds. BTTracerthen waits for the Master to begin paging the Slave devices. When pagingbegins, BTTracer synchronizes to the Master and begins recording.Note In order for this mode to work, the intended Slave must support "inquiry scan".The following steps describe the simplest way to use this mode:Step 1 Place both the "intended master" as well as its first "intended slave"into inquiry scan mode.
70BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Step 2 Have BTTracer perform a General Inquiry. You do this by selecting"General (Unlimited)" from the "Inquiry Recording" drop-downmenu on the "Modes" tab in the "Recording Options" window, andthen depressing the "REC" button found on BTTracer's toolbar.Step 3 After the General Inquiry completes, as indicated by the automaticuploading and displaying of a CATC trace (approximately 20seconds), reselect the "Modes" tab in the "Recording Options". Atthis point, the addresses of all Bluetooth™ devices that were inrange will be listed in the pull-down windows in the "PiconetAddresses" area of this window. Using the pull-down windowsselect both your "Intended BT Master" as well as your "IntendedSlave" address for display in their appropriate windows.Step 4 After closing this window by pressing the "OK" button at the bottomof the window, once again depress the "REC" button found onBTTracer's toolbar. After approximately 20 seconds, the "SYNC"light on the front of BTTracer will begin to flash, meaning thatBTTracer has acquired all the information it needs to fullysynchronize with the piconet about to be established. At this point,you should establish the piconet using the devices previouslydefined as master and slave.Step 5 When the piconet is established, the "Sync" light on the front ofBTTracer will change from flashing to solid, indicating thatBTTracer is fully synchronized to the piconet and is currentlyrecording all traffic within that piconet.Note If the "sync" light on the front of BTTracer does not change fromflashing to solid it means that BTTracer did not synchronize with thepiconet when it was established.Sync & RecordSync and Record works just like "Page Sync and Record" except thatBTTracer takes its sync data directly from the Master instead of the Slavedevices. With Sync and Record, BTTracer conducts a General Inquiry toget hop frequency and clock information from the Master. BTTracer thenwaits to detect piconet traffic from the Master device’s piconet. When thepiconet is established, BTTracer is able to synchronize to the Master andbegin recording. In contrast to "Page Sync and Record", "Page Sync andRecord" can be run with or without an established piconet.Note This mode can only be used to find master devices that support Inquiry Scan.
71BTTracer Protocol Analyzer User’s ManualCATC Version 1.0To perform a "Sync and Record", follow the steps below:Step 1 Turn on the Bluetooth™ devices under observation, and set up themaster device so it is ready to respond to Inquiry scan. For a typicalrecording, ensure that the Master and Slave device(s) are not yetconnected.Step 2 In the Modes tab under Recording Options, enter the MasterDevice’s address.Step 3 Start BTTracer recording by pressing REC icon in thetoolbar.Step 4 When the analyzer is able to Sync up to the Piconet Master Clock,the Green Sync LED in the BTTracer front panel will startblinking.Step 5 Establish connection between the Bluetooth™ devices underanalysis.Step 6 When BTTracer senses Piconet traffic, the Green Sync light goesON solid, recording starts and the status bar in the bottom of theanalyzer screen shows activity.Recording may be stopped manually or when the recording buffer is filled.Note After the Sync light starts blinking, a connection between theBluetooth™ devices should be established within one (1) minute.Passive Sync & RecordPassive Sync and Record is used in situations where the Master device andslave devices do not support Inquiry Scan mode. When selected, BTTracerenters Inquiry Scan and Page Scan mode and waits for a page from theMaster device. When the piconet Master pages BTTracer, BTTracerobtains the information necessary for synchronization and then attempts tosynchronize to the piconet controlled by that Master."Passive Sync and Record" is designed to be used with established piconetsor private device networks.Running "Passive Sync and Record" with Established PiconetsFor most situations, "Passive Sync and Record" will be run after a piconethas been established. The steps are as follows:Step 1 Establish a connection between two or more Bluetooth™ devices.Step 2 Under General Recording Options, select "Passive Sync & Record."Step 3 Under the Modes tab in Recording Options, enter the address for the
72BTTracer Protocol Analyzer User’s ManualCATC Version 1.0piconet’s master device.Step 4 Make up an address for BTTracer and enter it into the Page Targetaddress in the Modes tab in Recording Options. Make sure you donot select an address for any other local device.Step 5 Press the REC button on the toolbar in BTTracer to start a recordingsession.Step 6 If necessary, have Master "discover" BTTracer through a GeneralInquiry.Step 7 From the Master device, initiate a page to BTTracer’s address. Thisaction will enable BTTracer to synchronize to the piconet. However,the analyzer will not complete the page sequence from the Master.This will cause the Master to time out in this request.Step 8 At the end of this sequence, the green Sync light will go on solid,recording will begin and activity will be displayed on the status barin the bottom of the analyzer screen.Running "Passive Sync and Record" with Private Device PiconetsBecause private device networks do not allow other devices to join thenetwork, BTTracer needs to temporarily assume the identity of a slave in thenetwork in order to join that network. To do this requires disabling the slaveand beginning the operation without an established piconet. The followingsteps show the process.Step 1 Turn the Master device on and the slave device off. You need theslave device turned off so that BTTracer can take its place in thepiconet.Step 2 Enter the slave’s address into BTTracer’s "Page Target" field in theModes tab in the Recording Options dialog box.Step 3 Run "Passive Sync and Record." The Master will then page theslave’s address and BTTracer will be able to sync.Step 4 When BTTracer synchronizes to the Master, turn the slave back on.When the Master re-pages the address the slave will be admitted intothe private network. Since BTTracer is passive in this mode, theslave and BTTracer do not conflict over the shared address.BTTracer is then able to record the traffic between the Master and
73BTTracer Protocol Analyzer User’s ManualCATC Version 1.0slave.Force Re-synchronization"Force Re-Synchronization" forces BTTracer to re-synchronize at thebeginning of each "Page Sync & Record," "Passive Sync & Record," or"Sync & Record" operation. By default, "Force Re-Synchronization" isdisabled (i.e., unchecked).Unchecking the "Force Re-Synchronization" checkbox tells BTTracer touse its existing data on Bluetooth™ devices, thereby bypassing thesynchronization process and saving a few seconds from the beginning of thetrace. If you know that BTTracer’s data is correct, you can uncheck thischeckbox and cause BTTracer to try to use the existing data. If the data isincomplete or incorrect, however, BTTracer will automatically perform arefresh.To examine BTTracer’s Bluetooth™ data, open "BT Neighborhood" underthe View menu.Follow Master/Slave SwitchIf enabled, this option allows BTTracer to follow a role switch between aMaster and Slave. This capability allows BTTracer to keep track of changesin a device’s role when it changes from one role to another.BTTracer is able to follow a role change by listening to the Slave device’sBluetooth clock and hop frequency as soon as it becomes a Master.Match Clock RateMatch Clock Rate is a useful option if the Master device’s clock isinaccurate. Match Clock Rate causes BTTracer to do a General Inquiry todetermine the Page Target's clock rate prior to synchronizing to the piconet.If unchecked, BTTracer will begin piconet synchronization without firstdoing a General Inquiry.This option only works with Page Sync and Record mode.Show Paging TrafficShow Paging Traffic causes BTTracer to capture paging traffic between theMaster and Page Target devices. This option is used only with Page Syncand Record Mode.Piconet Addresses (MSB -> LSB)•Master Addr - Piconet Master Address for device underobservation. Used for all Piconet recording modes.•Page Target - User selectable address for the BTTracerAnalyzer. Used for Passive Sync & Record and Page Sync &
74BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Record.•DIAC LAP- Device Inquiry Access Code. Used for DeviceInquiry.•Swap - The "swap" button swaps the addresses between theMaster Addr and Page Target text boxes. This button will allowaddresses to be swapped even if the boxes are grayed out.Note GIAC - General Inquiry Access Code is hard-coded in the analyzer and does notrequire user selection.Other ParametersCorrelation Value (33-64)This value tells BTTracer how many bits in the sync word of each receivedpacket must be matched in order for BTTracer to consider the packet validand start recording.Inquiry Timeout (0-80 secs)Default value is 20 seconds.This value specifies how long BTTracer should perform the Inquiry processfor the General (unlimited) and Dedicated (limited) recording modes. Afterthe specified time has elapsed, BTTracer will illuminate the trigger light onthe front of the analyzer.Loss of Sync Timeout (1-16 secs)This value specifies the amount of time that BTTracer will wait for piconettraffic before determining that synchronization has been lost.Sync WindowThe Sync Window slide bar controls the amount of time that BTTracershould wait between receiving an Inquiry Response (which will cause theSync LED to blink) and detecting Master-Slave piconet traffic (which willcause the Sync LED to turn solid.)A "Narrow" setting means that the wait time will be minimal, a "Wide"setting means it will be "maximal." The default is "Narrow" and this issuitable for most recordings. However, if significant drift occurs betweenBTTracer’s clock and that of the Master, BTTracer may not be able to syncproperly to the piconet. Under these conditions, you should move the slidebar towards the "Wide" Setting. The slide bar has five discrete settings.
75BTTracer Protocol Analyzer User’s ManualCATC Version 1.0After sync is established, BTTracer will remain in sync as long as there ispiconet traffic.Debug/TestEnable CATC debug fileChecking this box enables the creation of a file that can be used by CATCSupport to aid in debugging. This option should always be disabled unlessyou are requested to enable it by CATC personnel.7.3 Recording Options - EventsIf you have selected Event Trigger mode under the General tabintheRecording Options screen, you may now select specific Bluetooth™ eventsusing the Events tab on the Recording Option Screen. You can also use theActions tab to define specific event sequences that will trigger BTTracer torecord a Bluetooth™ session.In addition, the Events and Actions screens allow you to specify whichpackets you want to include or exclude from the recording.Events Options• Click the Events tabontheRecording Options screen.You see th e Event Groups window:
76BTTracer Protocol Analyzer User’s ManualCATC Version 1.0The Event triggering and filtering options allow you to set event conditionsfor errors and/or a variety of packet characteristics.Clicking a check box causes further options to display in the right side of thewindow.Additional Timeslot FilteringBy default, BTTracer records frequency hop and timestamp information forall time slots in the Piconet under analysis, regardless of whether the timeslot contained a Bluetooth™ packet. This means that in instances wherethere is little piconet traffic, BTTracer will display row after row of emptypackets -- each representing an empty time slot. Through the use of timeslotfiltering, these empty packets can be filtered out. Filtering out thisinformation has the benefit of freeing memory so that more traffic can berecorded.Filter Empty SlotsIf "Filter Empty Slots" is checked, BTTracer will exclude all empty timeslots from a recording except for those that lie immediately in front ofBluetooth™ communications packets. These remaining empty packets arepreserved to give timestamp and frequency hop reference data to the packetsthat follow.Filter Slots on Packet FilterIf filters are used to exclude FHS, DM1 or other packets, BTTracer willexclude these packets from a trace and mark their locations with emptypackets. The result can be rows and rows of empty packets. The option"Filter Empty Slots" will not exclude these empty slots because they lieimmediately in front of Bluetooth™ communications packets - even thoughthose packets were not recorded. To eliminate these empty packets, select"Filter Slots on Packet Filter."Packet HeadersClicking "Packet Headers" opens three sets of check boxes and menus onthe right that represent fields within packet headers: Packet Type, ActiveMember Address, Flow Control, Acknowledgment, and Sequence Number.
77BTTracer Protocol Analyzer User’s ManualCATC Version 1.0• Select Packet Headers under Event Groups.You see the Packet Headers window:Packet TypeThe Packet Type drop down menu lets you select the following packet typesfor filtering or triggering: NULL, POLL, FHS, DM1, DH1, HV1, HV2,HV3, DV, AUX1, DM3, DH3, 1100, 1101, DM5, or DH5.Select “Don’t Care” if you want BTTracer to ignore this field.AM_ADDR(Active Member Address) The AM_ADDR is a three bit slave address. Toselect packets from a particular slave device for filtering or triggering, enteran address into the AM_ADDR text box. You can target up to three devicesusing the three text boxes.SEQN, ARQN, and Flow Control BitsTo set event conditions on SEQN, ARQN, and Flow control, uncheck"Don't Care." Unchecking "Don't Care" sets the event condition toSEQN=0 AND ARQN=0 AND Flow=0. This action also puts a checkmarkin the box marked "Packet Headers." A checkmark next to SEQN, ARQN,
78BTTracer Protocol Analyzer User’s ManualCATC Version 1.0or Flow changes the value of this field from zero to one. For example, ifSEQN is checked, the event condition becomes "SEQN=1 AND ARQN=0AND Flow=0.To cause BTTracer to ignore this set of check boxes, choose "don't care."Payload HeadersClicking "Payload Headers" causes a series of options to display on the rightfor setting conditions on payload headers. You will see two sets of options- one for single slot packets such as DM1 packets and a second for multi-slotpackets such as DM3 packets. Within each set is a menu for the LogicalChannel and sub-options for Flow Control, and Payload length. These lattertwo options allow you to modify searches based on the Logical Channel.An example would be "Trigger on a start L2CAP message whose flowcontrol bit is 1 and whose data field length is less than 20."• Select Payload Headers under Event Groups.You see the Payload Headers windowL_CH (Logical Channel)The "L_CH" drop down menu presents five options forsetting conditions on the Logical Channel:• Don’t care• 00 Undefined
79BTTracer Protocol Analyzer User’s ManualCATC Version 1.0• 01 L2CAP continue• 10 L2CAP start• 11 LMP messageSelect "Don’t care" if you do not want to set conditions on Logical Channel.FlowThree "radio buttons" are presented forsetting conditions based on Flow control:•0•1• Don’t careFlow works in conjunction with the Logical Channel (L_CH) menu - youselect an option from the L_CH menu and then select an option under Flow.Select "Don’t care" if you do not want to set conditions on Flow control.Length (in bytes)Using both the drop down menu and the text box, youcan set conditions based on data field length. Themaximum length for a single slot packet is 29 bytes. Themaximum length for multi-slot packets is 339 bytes.The drop-down menu gives you options for selectingoperators such as "greater than" and "equal to." The text box to the right ofthe drop-down menu lets you enter values.The Length option works in conjunction with the Logical Channel (L_CH)menu - you first select an option from the L_CH menu and then select anoption under Length.Data PatternsClicking "Data Patterns" causes a text box toappear for entering patterns to be matched in theraw payload data. Patterns of up to eighthexidecimal bytes can be entered.ErrorsClicking "Errors" causes check boxes to appear for setting conditions fortriggering or filtering based on packet/signaling/protocol errors. You canselect one or a combination of errors.
80BTTracer Protocol Analyzer User’s ManualCATC Version 1.0• Select Errors under Event Groups.You see the Errors window:Use any combination of the listed packet/signaling/protocol errors as a Trigger.CRC ErrorA CRC error in the packet data payload of the previous Bluetooth™ datapacket.HEC ErrorAn HEC (header error check) error in the packet header for the previousBluetooth™ data packet.FEC ErrorAn uncorrectable FEC (Forward Error Correction) error in the packetheader for the previous Bluetooth™ data packet.Threshold ExceededIndicates that the number of single-bit FEC errors detected since the currentrecording started has exceeded the specified value.Invalid Packet TypeAn invalid value was detected in the 'packet type' field of the packet headerfor the previous Bluetooth™ data packet.
81BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Header Length ErrorIndicates that a received Bluetooth™ data packet was terminated before allbits of the packet header were received.Payload Length ErrorIndicates that the payload of a received Bluetooth™ data packet was eitherlonger than expected, or that a Bluetooth™ data packet terminated beforethe expected end of the payload data.Sync LossWhen set, indicates that a loss of piconet synchronization occurred duringthe frequency slot prior to this slot.External Input SignalsClicking "External Input Signals" causes two check boxes to appear forsetting conditions based on breakout board input signals. The names of thetwo check boxes are the same ones you will find on the break out board:• Trigger Input [TRIG IN]• General Purpose Input [G.P. IN]
82BTTracer Protocol Analyzer User’s ManualCATC Version 1.07.4 Recording Options - ActionsThe Actions screen allows you to specify the type of action that BTTracershould perform when it encounters the events specified in the Eventswindow.Actions Window LayoutThe Actions window divides into three sections: a left, a center, and a rightsection.The left section displays Event buttons such as Header buttons and Errorbuttons. The number of Event buttons displayed depends on the number ofEvents you selected in the Events window. If you selected no Events, noEvent buttons will display. If all Events were selected, eight Event buttonswill display.The center section displays two Counter buttons marked Count1 andCount2. These buttons are used for counting events and are permanentfeatures of this section.
83BTTracer Protocol Analyzer User’s ManualCATC Version 1.0This center section can also hold Event buttons such as Errors and PayloadHdr1. Event buttons in this section are used to create triggers based on asequence of Events. Event Sequencing is explained later in the chapter.The right section has three permanent buttons for setting actions. Thesebuttons are Trigger,Filter Out/In,andRestart. These buttons allow youto set actions such as triggering or filtering.Arrows connect Event, Counting, and Action buttons. Arrows representthe current associations between actions and events. As will be describedfurther on, these associations can be easily changed with the mouse.Action Buttons - Their FunctionsThe Action buttons in the right side of the window provide the means ofsetting triggers, filters, and restarts. To set an action, you simply drag yourmouse from an Event to an Action. As described further on, this movementwill link the two via an arrow.TriggerThe Trigger button enables event triggering.Filter In/OutThe Filter In/Out button allows events to be filtered in or out of therecording.RestartThe Restart button causes the two counters Count1 and Count2 to be resetto zero.Counting Buttons - Their FunctionsThe center section of the Actions window has two buttons for countingevents called Count1 and Count2. Below these buttons, you can add Eventbuttons to create Event Sequencing.Count1, Count2Count1 and Count2 are counters for specifying how many events must occurbefore an event can cause a trigger. Counters allow conditions to be madesuch as "Trigger after the 21st Poll packet" (see screenshot below).
84BTTracer Protocol Analyzer User’s ManualCATC Version 1.0The Actions window showing a condition based on a Poll packet and acounter. This condition reads "Trigger after the 21st Poll packet."Connecting Events to CountersTo connect an event to a counter, click an Event button, then click one of thetwo counter buttons. An arrow will appear that will join the Event to theCounter and then to a trigger.This latter connection between the Counter button and the Trigger buttonoccurs because counters always work in association with triggers. Countersact as assistants to triggers.Setting Multiple Conditions with CountersYou can create multiple event conditions by linking a counter to multipleevents or by linking two counters to two or more events.Linking Multiple Events to One Counter - When two or more Events areconnected to a counter, it creates a condition that reads "Trigger when thecounter value is reached by any combination of the specified events."
85BTTracer Protocol Analyzer User’s ManualCATC Version 1.0The following example reads "Trigger after any combination of 5 Pollpackets and FHS packets have occurred."Linking Two Events to Two or More Counters - If an Event is linked toCount1 and a second event is linked to Count2, it creates an "or" statement.This statement reads "Trigger when Count1 OR Count2 has reached theirspecified values."This example reads "Trigger when Count1 has counted 5 Poll packets orCount2 has counted 10 FHS packets."Blue Dot MenusCount1,Count2 and a few other buttons in the Actionswindow have blue dots in their top left-hand corners thatindicate the presence of context-sensitive menus. These menuslet you set the button’s values and/or operations. Click the leftmouse button on a dot to open the menu.
86BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Counters Blue Dot MenuThe Count1 and Count2 blue dot menus allow the value of their countersto be changed. The value you specify here tells BTTracer how manyinstances of an event must take place before a trigger occurs. The countercan be set between 1 and 65,535.To set a Counter,Step 1 Click on the blue dot in the upper left corner of the Countbutton.You see th e Change Counter Value menu:Step 2 Click Change Counter ValueYou see th e Input Counter Value menuStep 3 Enter an input value to tell the Analyzer how many times thisevent must occur before triggering the end of a recordingStep 4 Click OK.You may connect as many Event buttons to a counter as you like.However, the Counter does not treat each event as a discrete specificationbut treats them all as one event.
87BTTracer Protocol Analyzer User’s ManualCATC Version 1.0As an example, look at the specifications set in the following screen:Counter 1 has been set to trigger four events after 15 occurrences. But theCounter does not count 15 occurrences for EACH event. It counts ALLevents as they happen to occur until it reaches a total of 15 and thentriggers.Filter Out/In Blue Dot MenuThe Filter Out/In button toggles between "Filter Out" and "Filter In".•Filter In records ONLY those packets related to the specifiedevent.•Filter Out records all packets EXCEPT those related to thespecified event.To filter an event in or out of a recording,Step 1 Click the blue dot on Filter Out. (Note: the button may sayFilter In depending on the last action specified.)You see the Filter Out/In menu:Use this menu to toggle the selection between Filter Out and Filter In.Step 2 Select "Filter In".The button changes to read "Filter In".
88BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Blue Dot Menus for the Event ButtonsThe Errors button and the first Headers button (marked "Hdr1") have thesame Blue Dot menus. These menus allow BTTracer to trigger externaloutput.To enable or disable external trigger output,Step 1 Click the Blue Dot on an Event button such as Hdr1 or Errors.A menu similar to the one below will open. Your menu may say"Disable" instead of "Enable."Step 2 Select "Enable External Trigger Output" (or "DisableExternal Trigger Output" if that is the choice presented.)If you have chosen "Enable External TriggerOutput", a small arrow will appear on the right sideof the button. This arrow indicates that a conditionhas been set for creating an external output signal.Choosing "Disable External Trigger" will cause the arrow to disappear.Enabling High Pulse, Low Pulse or Pulse Toggle Signal OutputsOnce External Trigger Output has been enabled, you can configure theoutput signal to one of three formats:Pulse High - This is the default format. The Pulse High setting causes theAnalyzer to transmit a 5 volt, 16.66 nanosecond signal.Pulse Low - This format causes the Analyzer to transmit a -5 volt, 16.66nanosecond signal.Toggle - This format causes the Analyzer to transmit a signal that willtoggle with each trigger event between a continuous 5 volt signal and acontinuous -5 volt signal.
89BTTracer Protocol Analyzer User’s ManualCATC Version 1.0To configure the output signal,Step 1 Click the blue dot on an Event button that has a small arrowattached to it like the one shown above.A Blue Dot Menu will open. "External Trigger Form" should be achoice available. If it is not, you will need to choose "Enable ExternalTrigger" and then reopen the menu.Step 2 Choose "External Trigger Form"A menu will appear with choices for "Pulse Low", "Pulse High", and"Toggle".Step 3 Choose an option not currently selected.The menu closes.Step 4 Reopen the menu.Note that your new selection is now checked.Elastic ArrowElastic arrows allow you to associate Events, Counters, and Actions. Tomake an association,Step 1 Click the left mouse button on an Event button such as Hdr1or Errors.
90BTTracer Protocol Analyzer User’s ManualCATC Version 1.0The elastic arrow appears.Step 2 Drag the arrow to the desired Action button.Step 3 With the pointer over an Actions button, click again the leftmouse button again.The arrow is replaced with a black line connecting the Event button tothe Action button.Event SequencingIf you drag your mouse from one event button to another, you will create acompound condition known as an Event Sequence. An event sequence is acondition that says "Trigger when you see the following sequence ofpackets." The example below may help to clarify.This example means "Trigger when you see a packet with an Null Headerfollowed by a packet with a FHS Header."
91BTTracer Protocol Analyzer User’s ManualCATC Version 1.0To create an event sequence, perform the following steps:Step 1 Select two events from the Events windowStep 2 Open the Actions window and click on one of the two Eventbuttons.An elastic arrow should appear.Step 3 Click on the other event.The arrow should connect to the second button and the second buttonshould instantly change locations to the center section of the window.7.5 Saving Recording OptionsTo complete your Recording Options settings, use the features at the bottomof the Recording Options screen. These features remain the same no matterwhich of the three Recording Options screens you are working in.•ClickSave to save the currently specified Recording Options foruse in future recording sessions. Any file name can be specified,
92BTTracer Protocol Analyzer User’s ManualCATC Version 1.0though use of the .rec is recommended; if no extension isspecified, .rec is added by default.•ClickLoad to load a previously saved *.rec file, thus restoring aprevious set of Recording Options.•TheSave as Default function is equivalent to the Save function,specifying the file name default.rec. Whenever you start up theAnalyzer, it automatically loads the default.rec file if one exists.•ClickOK to apply any changes and close this dialog box.•ClickCancel to cancel any immediate changes you have madeand exit the Recording Options menu.7.6 Recording Bluetooth TrafficTo start recording Bluetooth™ traffic once the appropriate RecordingOptions have been set,Step 1 Select Start under Record on the Menu BarORClick on the Tool Bar.Your recording session can continue until it has finished naturally or youmay need to stop manually by clicking on the Tool Bar, depending onhow you set the Recording Options.To manually stop recording,Step 2 Select Stop under Record on the Menu BarORClick on the Tool Bar.Note The manual Stop Recording feature is primarily of use when recordinglow-volume traffic, which can take a long time to fill the recording buffer.When the recording session is finished, the bus traffic is saved to the harddrive as a file named data.blt or whatever name you assign as the defaultfilename.To save a current recording for future reference,Step 3 Select Save As under File on the Menu Bar.OR
93BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Click on the Tool Bar.You see the standard Save As screen.Step 4 Give the recording a unique name and save it to theappropriate directory.
94BTTracer Protocol Analyzer User’s ManualCATC Version 1.0
95BTTracer Protocol Analyzer User’s ManualCATC Version 1.08. Display OptionsUse the Display Options menu to specify the way CATC Trace informationis displayed.To open the Display Options menu,•Select Display Options under Setup on the Menu BarOR•Click on the Tool BarYou see th e Display Options window:The Display Options window always opens with the screen for the Generaltab displayed.8.1 General Display OptionsUse the General Display Options to specify the basic appearance of a TraceView.•Zoom Level: Adjustable in discrete increments from 10% to 200% percent.•Enable Tool Tips: Select to enable tool tips with explanation text to pop upwhen you position your cursor over various fields in the Trace View.
96BTTracer Protocol Analyzer User’s ManualCATC Version 1.0•Wrap: Inhibits carriage returns in packets when they exceed the width of thewindow.•Trace Viewing Level: Enables different levels of transaction to be displayed.•Display Configuration Name:ACommentfieldassociatedwiththe*.opt filecontaining the current Display Options values. You can also create and storeyour unique Display Options for future use.•Fonts: Allows field fonts and data fonts to be changed. The fonts can beitalisized and/or bolded by pressing the Iand/or Bbuttons.Trace Viewing LevelTrace Viewing Level allows BTTracer to display ten levels of transaction:•PacketPacket is the default selection.•LMP Messages•L2CAP Messages•STP Messages•STP Protocol•TCS Messages•TCS Protocol•RFCOMM Protocol•OBEX Protocol•AT Commands Protocol•HDLC Frames•PPP•BNEPChanging the TraceView LevelTo change theTrace Viewing Level, use the decode buttons on the toolbar or select acheckbox in the Display Options dialog box.For further details on these viewing levels, see the Chapter 7: DecodingHigher Protocols.Creating New Display Options FilesTo create a new Display Options file,Step 1 Enter a comment for the new file in the DisplayConfiguration Name field.
97BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Step 2 Click Save...You see th e Save As window.Step 3 Specify a filename (*.opt).Step 4 Click Save.8.2 Color Display Options•Click the Colors tabontheDisplayOptionsscreen.You see th e Colors screen:Use this menu to customize the colors associated with each field in the TraceView. You can experiment with this option to achieve the color combinationbest suited to a particular graphic system. A brighter color might beappropriate for a specific field that should stand out in the display (e.g. thePacket Types).Note The colors of the following packet types cannot be changed: Invalid Data (packeterror) field (red) and Softbit Errors (yellow.)Two color fields are provided for packet number displays to differentiatebetween pre-Trigger traffic and post-Trigger traffic.
98BTTracer Protocol Analyzer User’s ManualCATC Version 1.0•The packet that causes the Trigger and all the packets before it are colored withthe -color.•The packet that follows a Trigger is colored with the +color.•All packets are colored with a +color when there is no Trigger.Use the color buttons labeled +and -under the Packet # section of theColors screen to select a Trigger color.To select or change a color,•Click the appropriate color button.You see the color palette:Use this palette to choose the desired color for the Packet Types,Miscellaneous, Integrity, Handshake, Packet #, Access Codes, Data, Idleand Timestamp.
99BTTracer Protocol Analyzer User’s ManualCATC Version 1.08.3 Formats Display Options•Click the Formats tabontheDisplay Options screen.You see th e Formats window:Select a number format corresponding to the column labels along the top ofthe screen for each number field that labels the rows along the left of thescreen. The number format changes in the respective location in the packetview window. You can also select the bit ordering to be displayed. Not everynumber format is available for every number field.
100BTTracer Protocol Analyzer User’s ManualCATC Version 1.08.4 Hiding•Click the Hiding tabontheDisplay Options screen.You see th e Hiding window:Use the Hiding window to hide various fields, packets, messages, andprotocols from the Trace View screen. You can modify these settings at willto display a specific area of a Trace.Hiding FieldsThe "Hide Fields" checkboxes allow individual fields to be hidden within atrace. Click the checkbox(es) of your choice to hide one or more fields.Hiding Packets, Messages, and ProtocolsThe "Hide Packets and Transactions" box contains two grids of checkboxesfor hiding whole packets, messages, protocols, and traffic from individualdevices. The grids are labeled "Devices to Hide" and "Levels to Hide".Devices to HideThe "Devices to Hide" grid lets you hidetraffic according to device address. Thegrid devides into columns whichrepresent different devices.
101BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Columns labeled "0" through "7" and "All" represent the Active MemberAddress of a device. By checking one of the boxes in a column, you hidethe traffic of the selected device (or traffic from all devices if you haveselected All.)The row in which you place your checkmark determines whether you arehiding traffic going to or from a device.• Master - Hide traffic from a Master to selected Slaves• Slave - Hide traffic from selected Slaves to the Master• Both - Hide all traffic between the Master and selected SlaveExample: to hide all traffic from a Master to a Slave device with an addressof six, click the checkbox under column 6on the row marked Master.Levels to HideThe "Levels to Hide" grid divides into rows whichrepresent the different packet, message, and protocollevels. Clicking a checkbox will cause BTTracer to hideall traffic of a selected level.Hiding PacketsAt the bottom of the Hiding tab of the Display Optionswindow, check boxes are available for hiding HOPs,POLLs, NULLs, and other kinds of traffic.8.5 Saving Display OptionsTo complete your Display Options settings, use the features at the bottom ofthe Display Options screen. These features remain the same no matterwhich of the four Display Options screens you are working in.•Click Save to save the currently specified Display Options for use in futuresessions. Any file name can be specified, but you must use the .opt extension.If no extension is specified, .opt is added by default.•Click Load to load a previously saved *.opt file, thus restoring a previous setof Display Options.
102BTTracer Protocol Analyzer User’s ManualCATC Version 1.0•The Save as Default function is equivalent to the Save function, specifying thefile name default.opt. Whenever you start up the analyzer, it automaticallyloads the default.opt file if one exists.•Click OK to apply any changes you have made to Display Options and closethis dialog box.•Click Cancel to cancel any immediate changes you have made and exit theDisplay Options menu.•Click Apply to apply your changes.
103BTTracer Protocol Analyzer User’s ManualCATC Version 1.09. Reading a CATC Trace9.1 Trace View Features•The BTTracer packet view display makes extensive use of color and graphicsto fully document the captured traffic.•Packets are shown on separate rows, with their individual fields both labeledand color coded.•Packets are numbered (sequentially, as recorded), time-stamped, andhighlighted to show the device status (master or slave).•Display formats can be named and saved for later use.•Pop-up Tool Tips annotate packet fields with detailed information about theircontents.•Data fields can be collapsed to occupy minimal space in the display (which canin turn be zoomed in and out to optimize screen utilization).•The display software can operate independent of the hardware and so canfunction as a stand-alone Trace Viewer that may be freely distributed.9.2 Interpreting the Displayed InformationThe following table describes the abbreviations used in the Merlin display.Packet #0 is described from left to right:Packet:# Packet/Event NumberT/M, T/S M =Master Device TransmittingS = Slave Device TransmittingFreq Current Hop Frequency (in MHz)Pre Preamble of the Sync word
104BTTracer Protocol Analyzer User’s ManualCATC Version 1.09.3 TooltipsYou can get additional information abouteach field in a trace by holding yourmouse pointer over a field. A tooltip willappear with details about the field.9.4 Set MarkerNote The Set Marker works in conjunction with the Go to Marker feature.You can define a unique Marker for each packet.To place a marker on a packet,Step 1 Left-click on Packet # for the packet you wish to mark.CAC Channel Access CodeTrail Access Code Trailer of the Sync wordAddr Active Member AddressDM1 DM1 Packet TypeFlow ACL Link Flow ControlArqn Acknowledgment Indication FlagSeqn Sequential NumberingHEC Header Error Correction CodeL_CH LMP MessageL2FL L2CAP Flow Control FlagLen Message Length in Bytes including OpcodeTID LMP Transition initiated by MasterOpcode LMP-host_connection_reqCRC Cyclic Redundancy CheckAck’d Packet Acknowledgment based on subsequent packet’s ARQN withsame AM_ADDRIdle Idle Time in nanosecondsTime Stamp Decimal in Seconds.Milliseconds.Microseconds*10This is the analyzer internal clock as a reference with resolution of100 ns.Packet:# Packet/Event Number
105BTTracer Protocol Analyzer User’s ManualCATC Version 1.0You see th e Packet menu:Step 2 Select Set Marker.You see th e Edit Marker Comment window where you can enter aunique comment about this packet.:Step 3 Enter your comment.Step 4 Click OK.A marked packet is indicated by a vertical red bar along the left edge of thepacket # block:9.5 Edit or Clear MarkerTo clear or edit the comments associated with a packet marker,Step 1 Left-click on Packet # for the chosen packet.You see th e Packet menu:To edit the Marker Comment,
106BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Step 2 Select Edit marker.You see th e Edit marker comment window:Step 3 Edit the comment as desired.Step 4 Click OK.To clear a Marker,Step 5 Click Clear marker.The vertical red Marker bar disappears.9.6 Expanded and Collapsed Data FormatsThe data field can be expanded to display greater detail or collapsed to acompact view. The Expand/Collapse Data feature operates as a toggle.There are three ways to toggle between the two views.Double-ClickingYou can expand or collapse a Data field by double-clicking anywhere in theData field of a packet.Left-clicking a Field ArrowMany fields have small arrows in the top left corner. If you left-click thisarrow, the field will toggle back and forth between collapsed and expandedviews.If you click and hold down the left mouse button on one of these arrows, youcan collapse or expand the field for ALL packets, messages or protocols.Using the Shortcut MenuIf you left-click on a Data field, a menu will open for expanding orcollapsing data fields.Step 1 Left-click on Data in the Data packet you want to expand orcollapse.dataLeft-facingfield arrowwill collapse Expanded DataRight-facingarrow willexpand data Collapsedthe field
107BTTracer Protocol Analyzer User’s ManualCATC Version 1.0If your Data Trace View is currently expanded, you see the CollapseData menu:If your Data Trace View is currently collapsed, you see the Expand Datamenu:Note that you can choose to expand or collapse•Only the Data in the selected Data packetOR•All Data Fields in the Trace View.Step 2 Select the desired Expand Data or Collapse Data menu item.The Trace View is repositioned with the selected packet(s) adjusted in theformat you have specified.9.7 Hide Frequency HopsYou can hide Frequency Hops (Hops) from a trace by pressing the HideHops button on the Tool Bar:
108BTTracer Protocol Analyzer User’s ManualCATC Version 1.0From the Tool Bar•Click to hide all Hop packets.9.8 Hide Nulls and PollsYou can hide Nulls and Polls from a trace by pressing the Hide Nulls andPolls button on the Tool Bar.From the Tool Bar•Click to hide all Nulls and Polls.9.9 Menus in Clicked FieldsYoucandisplaythefollowingmenuwhenyouclickinafieldinatrace.9.10 Hide Unassociated TrafficYou can hide all traffic that is not associated with the current decode levelby pressing the Hide Unassociated Traffic button on the Tool Bar.From the Tool Bar•First, click one or more decode buttons such as the View L2CAP Messages. This button will cause BTTracer to decode the trace and displayselected level of decode.•Next, click to hide all unassociated traffic.The Hide Unassociated Traffic button will cause BTTracer to hide alltraffic except for the selected decode messages or protocols. In the exampleabove, all packets would be hidden and only L2CAP messages woulddisplay.
109BTTracer Protocol Analyzer User’s ManualCATC Version 1.010. Decoding Higher Protocols10.1 IntroductionBTTracer can decode LMP and L2CAP messages, and RFCOMM, SDP,TCS, HDLC, PPP, and OBEX protocols. The default is packet leveldecoding, which means that baseband packets will be displayed when youfirst view a trace. If these packets are carrying LMP, L2CAP or higherprotocols, the protocols will display as undecoded fields such as the L2CAPpacket below.By issuing a decode command, BTTracer can decode these LMP and higherfields and display the data in summary statements called LMP/L2CAPMessages,Protocols Messages, and Protocol Transactions.10.2 LMP and L2CAP MessagesLMP and L2CAP Messages are lines in a trace that summarize LMP andL2CAP actions such as an LMP connection request. LMP and L2CAPMessages summarize the type of action, the number of packets involved inUndecoded L2CAP fields
110BTTracer Protocol Analyzer User’s ManualCATC Version 1.0the action, and the device performing the action. If the message is carryinghigher protocol data such as RFCOMM, TCS, OBEX or SDP data, themessage displays this data in an undecoded format that can be decoded later.10.3 Decoding and Viewing Higher Protocol DataHigher protocol data can be decoded two ways: by clicking a decode buttonon the toolbar or by selecting a decode command from a pull down menu.Decoding Via theDecoding ToolbarThe Decoding Toolbar has ten buttons for decoding packets, messages, andprotocols:•Pkt (Display Packets)•LMP(Display LMP Messages)•L2CAP (Display L2CAP Messages)•SDP Msg (Display SDP Protocol Messages)•SDPTra (Display SDP Transactions)•TCS(Display TCS Protocol messages)•RFCOMM(Display•OBEX (Display OBEX Protocol)•AT(Display AT Commands Protocol)•HDLC(Display HDLC Protocol)• PPP (Display Point to Point Protocol)•BNEP(Display Bluetooth Network Encapsulation Protocol)•HID(Display HID Protocol)For example, to display LMP messages, click .Note Once a decode has been performed, it will probably be necessary to scroll throughthe display to find the decoded messages or protocols. You can shorten yoursearch by first clicking the Hide Unassociated Traffic button .Undecoded higher protocol data
111BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Decoding Via the Display Options Dialog BoxThe Display Options dialog box has three options for issuing decodecommands. To issue a command,Step 1 Fromthemenubar,selectSetup>Decoding OptionsStep 2 Select the option for the desired level of decoding.Step 3 Click OK or Apply.
112BTTracer Protocol Analyzer User’s ManualCATC Version 1.010.4 TooltipsAdditional information about fields can be attained by positioning yourmouse pointer over a field of interest. A tooltip will appear that will providedetails about the field. In some cases, there can be a considerable amountof information available.10.5 Viewing Packets in LMP and L2CAP MessagesLMP and L2CAP Messages can be "opened" to revealtheir constituent packets by double-clicking the firstcell in of the message or clicking once on the smallarrow on that same cell. The packets will then display below the message.The following screenshot shows an example of a message and its packets.10.6 Types of LMP and L2CAP MessagesIf you scroll through a trace, you will see three kinds of message:•LMP Signalling Message•L2CAP signalling Message•L2CAP Data Transfer MessageMessagePacketsmaking upthemessage
113BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Each message has the same basic message header but differs in its payload.LMP and L2CAP Signalling messages have payloads of commands forestablishing LMP and L2CAP channels. L2CAP Data-Transfer messageshave a payload that may include RFCOMM, SDP, or TCS data. In order toview higher protocol data, you will need to decode the messages (shown inthe next section). The decoded data will appear as new lines in the tracecalled "Protocol Messages."10.7 Viewing L2CAP Channel ConnectionsOnce L2CAP messages have been decoded and displayed, you can check orchange their L2CAP channel connections by opening the L2CAP DecodingConnections dialog box.To view or change an L2CAP channel connection,Step 1 Select from the menu barView>Decoding AssignmentsLMP Signalling MessageL2CAP Signalling MessageL2CAP Data Transfer MessagePayloadPayloadHeader PayloadHeaderHeader
114BTTracer Protocol Analyzer User’s ManualCATC Version 1.0The following dialog box will open.Step 2 Click on a channel assignment and then look at the Connectand Disconnect buttons on the far right of the dialog box.If the Connect and Disconnect buttons are grayed-out, it means thatBTTracer made the channel assignments using data in the trace. You canverify that BTTracer performed the assignments by looking at the text inthe "Slave Channel" box in the lower left corner of the dialog box. Ifyou see "Connection Recorded" it means that BTTracer performed thechannel assignments.If BTTracer was not able to make these channel assignments, then theConnect and Disconnect buttons on the right side of the dialog box willbe active. You can then assign and edit channel connections.Step 3 Open the drop-down menu labeled AM_Addr (ActiveMember Address). If possible, select an address other thanthe currently displayed address.The connections for the ’new’ device should now display.10.8 Viewing Protocol Messages and TransactionsBy pressing a button such as or , you can cause BTTracer to decodethe higher level protocol data contained within L2CAP messages anddisplay them as packet-like rows called Protocol Messages.ProtocolMessages have headers marked "protocol" and fields that vary inappearance and content depending on the type of protocol.Some Protocol Messages can be grouped into a higher level entity called aProtocol Transaction. A Protocol Transaction is a row in a trace thatsummarizes the higher level protocol data that is transmitted between aMaster and Slave device when one sends a request and the other sends back
115BTTracer Protocol Analyzer User’s ManualCATC Version 1.0a response. For example, if you press ,BTTracer will locate SDPrequests and responses between a Master and Slave device summarize theirdata.Viewing L2CAP Messages in Protocol MessagesIf the protocol heading is double-clicked, the L2CAP data-transfermessages that make up the protocol will display below the protocol. Youcan also expand the protocol by left-clicking the small downward pointingarrow on the protocol header.How to DecodeDecoding Protocol messages is the same process as decoding LMP andL2CAP messages.Using the Toolbar - To decode using the Toolbar, press one of the protocoldecode buttons such as: . .Using the Menu - To decode using the menu, select:Setup>Display OptionsThen select one of the decode checkboxes.Once a decode command has been issued, BTTracer will create ProtocolMessages in the trace. You will probably have to hide hops, polls, and nullpackets and then scroll through the trace in order to find Protocol messages.Expanding Protocol MessagesProtocol messages can be expanded to reveal their constituent packets usingany of the following methods:•Left-click the small downward pointing arrow inthe message/protocol header•Double-click a message/protocol header•Left-click the message/protocol header and choose "Expand Transaction"from the short-cut menu
116BTTracer Protocol Analyzer User’s ManualCATC Version 1.010.9 Changing Protocol AssignmentsIf a sequence of messages is assigned the wrong protocol, errors willdisplay. To change or remove a protocol assignment, you will need toaccess the Assignment menu and issue an Add Assignment command.Step 1 Click to display L2CAP messages.Note You need to view L2CAP Messages in order to have access to the "A" field thatpermits reassigning protocols.Step 2 Scroll through the trace until you have located an L2CAPmessage with a field marked "A."Step 3 Left-clickthefieldmarked"A."An Assignment menu will open for assigning, re-assigning, orun-assigning protocols to messages. This menu is context-sensitive andwill vary in content depending on the protocols in the trace.Step 4 From the menu, select one of the "Add Assignment" optionsnot already selected.At this point, the protocol assignment will change to your selection.Using the Decoding Assignments Dialog BoxYou can get a complete list of all protocol assignments by opening theDecoding Assignments dialog box. This dialog box will tell you whichprotocol assignments were made by BTTracer and which are user-assigned.User-assigned protocols can be reassigned if need be using this dialog box.Left-clickThe Assignment MenuCurrent assignmentSelect another assignmentto change assignment fromthis point downwardthrough the traceWill let one or all protocolassignments be removed
117BTTracer Protocol Analyzer User’s ManualCATC Version 1.0To open the Decoding Assignments dialog box and reassign a protocol,Step 1 Select from the menuView>Decoding assignmentsThe Decoding Assignments dialog box will open. A status message inthe bottom left corner of the dialog box will indicate who assigned theprotocol.Step 2 Click on one of the displayed assignments.If the protocol was assigned by BTTracer, the Assign buttons on the rightwill be grayed out and unavailable. If you want to change theseassignments, you will have to use the pop-up menus described in theprevious section. If a protocol has been manually assigned by a user, theAssign buttons will become active and allow you to make a change inassignment.Step 3 If possible, click the appropriate Assign button.Removing User-Assigned Protocol AssignmentsAs you practice assigning and reassigning protocols, you will find that oneof the more useful commands is "Remove All User Assignments." Thiscommand allows you to undo all of your assignments.To remove some or all user-assigned protocol assignments,Step 1 Double-click any Protocol Message header to open viewL2CAP messages.Step 2 Locate a message with a field marked "A."Step 3 Left-click on the "A" field to open the Assignment menu.Step 4 Select "Remove All User assignments" or "Remove thisassignment."
118BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Manually Assigning ProtocolsIf a recording does not capture the beginning of a dialog between a Masterand Slave devices, BTTracer may not have the L2CAP messages it needs todetermine the correct protocol assignments. In this case, L2CAP messageswill display an "N" in the Assignment field that means "Not Assigned."If you know what the protocol assignment should be for the missingassignments, you can manually add them by right-clicking your mouse overthe A field shown above and selecting from the pop-up Assignment menushown on the previous page.Other Assignments: OBEX Client/Server StatusOBEX messages carry a status that indicates whether the transmittingdevice is an OBEX client or OBEX server.To view an OBEX message’s client/server status,Step 1 Open an OBEX trace file such as the sample file"OBEXsample.blt" in C:\Program files\CATC\BTTracer.Step 2 Press . , and to hide Hops, NAKs, and unassociatedtraffic.Step 3 Press to decode OBEX.Step 4 Left-click your mouse over the field marked Type.A pop-up menu will appear indicating whether the message wasproduced by an OBEX client or server. If the menu items appeargrayed-out (as they do in this example) it means that BTTracer assignedthe client or server status based on data it found in the trace. If the menuitems appear in black, it means that the user assigned the status and istherefore free to change the assignment.N=Protocol not assignedAn L2CAP message without a protocol assignment for the higher protocol data.Left-click over the Type field to open the OBEX Client/Server Assign menu.
119BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Changing an OBEX Client or Server StatusIf the beginning sequence of traffic is not recorded in a trace, theclient/server status of the transmitting devices will not be preserved in thetrace. In this case, the OBEX Client/Server pop-up menu will becomeactive and you will be able to change the assignment.Decoding BNEPBNEP (Bluetooth Network Encapsulation Protocol) is a protocol that allowsdevices to encapsulate network protocols such as IP. Since BNEP can carrydifferent types of network protocols, you need to tell BTTracer whatprotocol the BNEP is going to be carrying. You do this via a script filecalled bnep.dec that is read during the initialization of the BTTracersoftware. This file tells BTTracer how to decode BNEP fields. Once read,BNEP can be correctly decoded by pressing the button on the toolbar.If the decode file is not read at initialization, BTTracer will display the datain an undecoded format.For more information on BNEP decoding, see a supplemental document onBNEP in the support directory on the CATC web site:http://www.catc.com/products/support/sup_BTTracerbluetooth.htmlDecoding HIDHID (Human Interface Device) is a profile associated with traffic fromdevices such as a mouse or a keyboard. To decode HID traffic, you willneed to tell BTTracer what types of HID traffic it will be recording. You dothis by editing a script file called hid.dec. BTTracer reads this file during theinitialization of the BTTracer software. This file tells BTTracer how todecode the HID fields. Once read, HID can be correctly decoded bypressing the button. If the decode file is not read at initialization,BTTracer will display the data in an undecoded format.BTTracer has the capability to decode HID (Human Interface Deviceprofile) based on version 0.90b of the specifications.
120BTTracer Protocol Analyzer User’s ManualCATC Version 1.0
121BTTracer Protocol Analyzer User’s ManualCATC Version 1.011. Other Features11.1 SearchThe Search feature provides several options for searching through recordedtraffic, allowing you to find specific packets based on triggering status,packet number, marking, or content.To view the Search options,•Click Search in the Menu bar.You see the Search drop-down menu:Go to TriggerTo display a triggering event, select Go to Trigger under Search on theMenu bar. The Trace Viewer display will reposition the trace to show thetriggering event at the top of the screen.Go to Packet/Message/ProtocolTo display a specific packet, Message or ProtocolStep 1 Select Go to Packet/Message/Protocol under Search on theMenu Bar.You see th e Go to Packet/Message/Protocol window:
122BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Step 2 Enter the number of the packet, message or protocol you want todisplay.Step 3 Click OK.The Trace View repositions to show the packet at the top of your screen.Go to MarkerTo instruct the analyzer to display a marked packet,Step 1 Select Go to Marker under Search on the Menu Bar.You see a drop-down menu listing the marked packets in that Trace View:Step 2 Select the desired packet from the displayed list.The Trace View repositions to show the packet at the top of your screen.Note The Go to Marker feature functions in conjunction with the Set Marker feature.The comments within the parentheses following each marked packet are added oredited with the Set Marker feature.Go toThe Go To feature takes you directly to an event in a Trace.Step 1 Select Go To under Search on the Menu Bar.
123BTTracer Protocol Analyzer User’s ManualCATC Version 1.0You see th e Go To drop-down menu:Step 2 Select the event you want to go to and enter the necessaryinformation.Packet TypesSelect the type of packet you want to go to.
124BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Header AM_AddrSelect an Active Member Address from the list.DataLengthAllows searching based on data length in bytes from the recording.
125BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Lmp OpcodeSelect the Link Management Protocol Operational Code (Lmp Opcode) that youwant to go to.L2Cap Signalling CommandSelect the type of L2Cap Signalling Command that you want to go to.
126BTTracer Protocol Analyzer User’s ManualCATC Version 1.0L2Cap CIDSelect the L2Cap Channel ID (L2 Cap CID) that you want to go to.ErrorMoves trace view to next uncorrected error.Soft Bit ErrorMoves trace view to next soft (corrected) error.Loss of SyncMoves trace viewer to the next loss of sync.FindFind is a utility within MBTTracerat allows you to conduct searches of oneor more events within a trace. Find allows you to search differenthierarchical levels within the trace - packets, LMP Messages, L2CAPmessages etc.To start find,• Select Find... under Search on the Menu BarORClick in the Tool Bar.
127BTTracer Protocol Analyzer User’s ManualCATC Version 1.0You see th e User-Defined Find Events screen:The Find window divides into three areas:Left area -- Controls the search level, search direction and search origin.Find All - Extracts the results and place them in a separate trace.Search In Hidden - Searches all packets including packets that havebeen hidden.Center area -- Controls the event groups to be searched. The selection youmake will display further choices on the right side of the Find window. Atthe bottom are three options called Union, Intersection, and Exclusion thatare used with multi-criteria searches. These options are explained below.Right area -- Controls the specific events to be searched within the trace.The box in this right section displays events from the selected Event Group.The right area is context sensitive -- the Event Group selected in the Centerarea will determine what events will display on the right. For example, ifyou select Packet Type, the Right area will show you a list of packet types.Bold entries in the list represent items that actually occurred in the trace.
128BTTracer Protocol Analyzer User’s ManualCATC Version 1.0In the screenshot shown above, for example, AM Address is selected. Onthe right, you see that only Address 1 is in bold. This indicates that only asingle device was transmitting traffic in the displayed trace.Event GroupsEvent Groups are categories of events that can occur in a trace. Clicking onan Event Group will display a list of Event types on the right side of the Findwindow that occur within each Event Group.AM AddressContains a list of seven Active Member addresses. Bold entries representdevices that occur in the trace.Master/SlaveContains two options labeled Master and Slave. Selecting an option willcause BTTracer to search for traffic based on the selected role.Packet TypeContains a list of all Bluetooth packet types. If a packet type occurs in thetrace, it will appear in bold.AcknowledgeContains a list of three Acknowledge types: Explicit NACK,ImplicitNACK,andACK. The three Acknowledge types are responses a devicecan issue to attempts to transmit packets to it.A device can send an Acknowledgment in two ways: through setting theARQN field to 0 (= explicitly not acknowledged), to 1 (explicitlyacknowledged) or by sending an empty packet that does not have an ARQNfield (= implicitly not acknowledged).Explicit NACK - Explicitly not acknowledged. An Explicit NACK is anexplicit response by a device that it did not receive a data packet. TheExplicit NACK is transmitted in the ARQN field (=AcknowledgmentRequest Negotiation field). ARQN=0 means ’Explicit NACK.’Implicit NACK - Implicitly not acknowledged. An Implicit NACK is aNACK that is implied rather than explicitly stated. If a device respondsto a data packet by sending an empty packet, the NACK is implied.ACK - Acknowledged. If a data packet is successfully transmitted to atarget device, the target device acknowledges the received packet bysetting the ARQN field to 1.
129BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Acknowledgments are easily seen in BTTracer traces because BTTraceradds an Ack’d field on data packets of the transmitting device. This meansthat you do not have to hunt through the trace to see if the packet wasacknowledged.The following screenshot shows two examples of Acknowledgments.Implicit NACK - Packet 14577 is a data packet sent by the piconet Masterdevice. Packet 14579 should have been a data packet with anacknowledgment. Instead, it is an empty packet. This Master interprets thisempty packet as an Implicit NACK (i.e., implicitly not acknowledged).BTTracer summarizes this packet exchange by adding an Ack’d fieldtotheMaster’s data packet and setting the Ack’d field to Imp Nak.ACK - Packet 14580 is the Master’s retransmission of the data sent inpacket 14577. Packet 14582 is the reply by the Slave device. This replycontains an ARQN field with a value of (= Acknowledge). BTTracersummarizes this packet exchange by setting the Ack’d field on packet14580 to Ack.
130BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Data LengthContains a list of all data lengths that occur in the trace.
131BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Data PatternSearches for the next packet that has a specified data pattern.Searching for Bit PatternsYou search for a bit pattern by using the box labeled Bitmask. Enter one ofthe three following values:•X = 'Don't care,'•0 = 'Match a 0',•1 = 'Match a 1.'Example -- xxxxxx01 means 'Look for a data pattern where the first 6 bitscan be any value but the last two bits must be 01.'Searching for Long PatternsYou can search for long pattern sequences by entering patterns into multiplerows within the editor. Entering a pattern on one row and skipping severalrows before entering the second pattern tells BTTracer to search for theentire pattern between the two specified rows.Example - Enter xxxxxx01 in row 1 and 11xxxxxx in row 2. This patternmeans 'Look for the pattern xxxxxx0111xxxxxx.'
132BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Example - If you enter xxxxxx01 into row 0 and11xxxxxx into row 4, it means 'Look for the patternxxxxxx01 xxxxxxxx xxxxxxxx xxxxxxxx11xxxxxx.'Searching for Hexadecimal PatternsThe columns marked Match and Mask allow youto specify a pattern in hex. You enter the patternyou want to match in the column marked Match,and enter the mask in the column marked Mask. The Mask column allowsyou to specify which bits you are searching for.Example - A Match of 03 and a Mask of '0F' tells BTTracer that you arelooking for the hex pattern of 03 occurring in the last four bits of the pattern.If you enter these values in the Match and Mask columns, the Bitmasksection will automatically display the equivalent bit values: XXXX0011.Union, Intersection, and ExclusionIf you select multiple events, you will need to use the options Union orIntersection to conduct the search.Union is used to search for any selected event: "Find x or y." Union letsyou tell the analyzer to search the trace for any of any of the selected items.Intersection is used to search for all selected events: "Find x and y."Intersection lets you tell the analyzer to search the trace for any packethaving all of the selected events.Exclusion is used to exclude selected traffic from the trace. Exclusion isused with Union and Intersection --i.e., you select Exclusion with Union orIntersection.•Exclusion + Union -- tells BTTracer to exclude packets with any of thespecified events.•Exclusion + Intersection -- tells BTTracer to exclude packets with all of thespecified events.Using FindStep 1 Select the display level to be searched from the Search Forbox on the left side of the window.For example, to search through L2CAP messages, select L2CAP. Thedisplay level that you select will affect options presented in the EventsGroup box.
133BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Step 2 Select a search direction and origin.Step 3 Select one or more events from the Events Group box.Your choices will affect options presented in the box on the right side ofthe screen.Step 4 If you have selected two or more criteria, then select either :•Union: Find all packets that match ANY of the specified events. Anexample would be to find packets with either X or Y.•Intersection: Find all packets that match ALL of the specifiedevents. An example would be to find all packets with X and Y.If you want to selected events from the trace, then select:•Exclusion: Exclude all packets that match any of the specifiedevents. This option works in cunjunction with Union and Intersection.Select an exclusion plus one of the other two options. If you selectExclusion and Union, it means Exclude packets in any of thefollowing events. An example would be to exclude packets witheither X or Y.Step 5 Click OK.The search will then occur. Afterwards, the packets meeting the search criteriawill display.Some Find ExamplesSearch for all DM1 and Poll packets with an Active Member Address of 7.Step 1 From the Event Group, select Packet Types.Step 2 From the box on the right, select DM1 and Poll.Step 3 From the Event Group, select Header AM_Addr.Step 4 From the box on the right, select AM_Addr=7.Step 5 From the Center area, select Intersection.Selecting Intersection tells BTTracer to find packets with ALL of theselected traits.
134BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Step 6 Press OK.The trace should reposition to the first DM1 or Poll packet that has anActive Member address of 7.Exclude all DM1 and Poll Packets with Active Member Addresses of 7.Step 1 Select Packet Types from the From the Event GroupStep 2 Select DM1 and Poll from the box on the right.Step 3 Select Header AM_Addr from the Event Group.Step 4 Select AM_Addr=7 from the box on the right.Step 5 From the Center area, select Intersection and ExclusionStep 6 Press OK.The trace will redisplay so that it excludes DM1 packets with AM_Addr=7 andPoll packets with AM_Addr=7.Exclude all packets with ANY of the following attributes: DM1, Poll, orAM_Addr=7.Step 1 Select Packet Types from the Event Groups.Step 2 Select DM1 and Poll from the box on the right.Step 3 Select Header AM_Addr from Event Group.Step 4 Select AM_Addr=7 from the box on the rightStep 5 Select Union and Exclusion.Selecting Union causes the analyzer to search for any of the selectedevents.Step 6 Press OK.The trace will redisplay so that it excludes DM1s, Polls, or any packet withAM_Addr=7.Find NextTo apply the previous Find parameters to the next search,•Select Find Next under Search on the Menu BarORClick on the Tool Bar.
135BTTracer Protocol Analyzer User’s ManualCATC Version 1.011.2 Edit CommentYou can create, view, or edit the 100-character comment field associatedwith each Trace file.Step 1 Select Edit Comment under File on the Menu Bar.You see th e Edit comment for trace file window:Step 2 Create, view, or edit the comment.Step 3 Click OK.11.3 ReportsThe Report menu provides several reports to assist you in analyzingBluetooth™ traffic recorded by the analyzer.File InformationTo display a File Information report,•Select File Information under Report in the Menu BarORClick in the Tool Bar.You see the File Information screen:
136BTTracer Protocol Analyzer User’s ManualCATC Version 1.0The File Information report provides valuable information about how therecording was made, what the buffer settings were, what the trigger optionswere, and what version of all the analyzer hardware was used to make therecording.Error SummaryThe Error Summary command displays an error summary of the currenttrace file and allows you to go to a specific packet, and save the error file toa uniquely named file.Timing CalculationsStarts the modeless calculator dialog for calculating various timing andbandwidth parameters in the recording file.To display a File Information report,•Select Timing Calculations under Report in the Menu BarORClick in the Tool Bar.
137BTTracer Protocol Analyzer User’s ManualCATC Version 1.0You see the Timing and Bus Usage Calculator screen:To calculate bus usage and bit rate errors,Step 1 Enter the range of packets to be examined in the text boxesmarked "From packet" and "To packet."Step 2 If you wish to limit your calculations to a single device,select the device’s address from the AM Address drop-downmenu.Step 3 Click the "Calculate" button.At this point, bus usage will be calculated.Traffic SummaryThe Traffic Summary dialog box displays a text summary of traffic capturedin the current trace.The Traffic Summary window divides into two main sections: a short topsection (shown above in the top left corner of the window) that summarizestraffic for each protocol level, and a long section below describing the trafficdetails for each protocol level.
138BTTracer Protocol Analyzer User’s ManualCATC Version 1.0The second section is scrollable: click on an item below one of the headingsto display scroll arrows. The arrows will allow you to scroll through thepackets or transactions within that section. As you scroll, the trace willsimultaneously jump to the packet or transaction that is listed.At the bottom of the Traffic Summary window is a button marked "TextualSummary." Clicking this button will cause WordPad to open and display thecurrent Traffic Summary, as shown below. This data can then be printed orsaved.
139BTTracer Protocol Analyzer User’s ManualCATC Version 1.011.4 BT NeighborhoodThe BT Neighborhood status box displays information about knownBluetooth™ devices. This command is accessible through the View menuin the menu bar. Three types of data are displayed: Device Address, Classof Device (COD), and the Bluetooth™ Clock Frequency for eachdiscovered device. The expected Bluetooth™ clock frequency is 3200 Hz+/- 250 PPM.11.5 EncryptionBluetooth encryption is a multi-staged process that provides devices withsecure, encrypted communications. The process begins with a deviceprompting the user for a Personal Identification Number (PIN). When theright PIN is entered, the Slave begins an encryption setup dialogue with theMaster. At the beginning of this dialogue, the Slave and the Master agreeon a Link Key. A Link Key is a 128-bit value that the two devices use forauthentication. When the Slave and Master agree on a Link Key, the Slavethen negotiates for the transfer of the Encryption Key from the Masterdevice. The Encryption Key is used to encrypt and decrypt messages. Oncethe Encryption Key is transferred, both devices use it to encrypt allsubsequent communications.In order for BTTracer to decode encrypted traffic, it needs the Link Key foreach Master-Slave connection for which encryption will be used. If youknow the Link Key, you can enter the Key into the Encryption Optionsdialog box. If you do not know it, you give BTTracer the PIN for a device
140BTTracer Protocol Analyzer User’s ManualCATC Version 1.0and allow BTTracer to discover the Link Key on its own. Once BTTracerhas the Link Key, it can capture the rest of what it needs by listening to theMaster and Slave devices as they negotiate for the Encryption Key.Configuring BTTracer for EncryptionFor BTTracer to successfully decrypt traffic, two steps need to beperformed: 1) BTTracer needs to be given the PIN or Link Key for eachMaster-Slave connection; and 2) Recording needs to be begun before theSlave connects to the Master. If recording is begun prior to the creating theMaster-Slave connection, BTTracer will be able to obtain the encryptionkey and decode encrypted traffic.The following steps show how to configure BTTracer for encrypted traffic.Note Be sure to begin the following process prior to connecting your Slave device tothe Master or BTTracer will not be able to capture the Link Key.Step 1 Select Setup >Encryption Options ...The following dialog box opens.Step 2 Click the button marked Add Slave Device.When you click this button, a list of devices will appear in the SlaveDevice Address drop-down menu.Step 3 Select an address from the drop-down menu marked SlaveDevice Address or enter the Device Address manually if itis not in the list.Step 4 Enter the appropriate Personal Identification Number (PIN)for the selected device to the box marked PIN Code. ThisPIN allows BTTracer to learn the Link Key. If you do not
141BTTracer Protocol Analyzer User’s ManualCATC Version 1.0havethePIN,skiptoStep5.Note The PIN you provide should be the same used by the Slave. For example, if yourSlave device requires a PIN of "1234", then enter the same PIN in the dialog boxshown above.Step 5 If you do not have the PIN, or if the Master and Slave have alreadyagreed upon the Link Key, manually enter a Link Key as a 128 bit(sixteen byte) hex value into the box marked Current Link Key.Ifyou have the PIN, you can skip this step.Note If the Master and Slave were previously connected, they may already agree on theLink Key. In this case, you will need to provide BTTracer with the Link Key andnot simply the PIN.Step 6 Click ApplyThe changes you have made are applied and the information is displayedin the dialog box as shown below. Four fields will display: DeviceAddress, PIN, the Link Key, and Link Key status.Link Key status may read:Mstr (=Master unit’s Link Key)Slve (=Slave unit’s Link Key)Comb (=Combination Key)Init (=Initialization Key)Temp (=Temporary Key)User (=User-defined Key)Step 7 Click OK.The dialog box closes.
142BTTracer Protocol Analyzer User’s ManualCATC Version 1.0
143BTTracer Protocol Analyzer User’s ManualCATC Version 1.0How to Contact CATCWarranty and LicenseComputer Access Technology Corporation(hereafter CATC) warrants this product to be freefrom defects in material, content, andworkmanship, and agrees to repair or replace anypart of the enclosed unit that proves defectiveunder these terms and conditions. Parts and laborare warranted for one year from the date of firstpurchase.The CATC software is licensed for use on a single personal computer. Thesoftware may be copied for backup purposes only.This warranty covers all defects in material or workmanship. It does notcover accidents, misuse, neglect, unauthorized product modification, or actsof nature. Except as expressly provided above, CATC makes no warrantiesor conditions, express, implied, or statutory, including without limitationthe implied warranties of merchantability and fitness for a particularpurpose.CATC shall not be liable for damage to other property caused by any defectsin this product, damages based upon inconvenience, loss of use of theproduct, loss of time or data, commercial loss, or any other damages,whether special, incidental, consequential, or otherwise, whether undertheory of contract, tort (including negligence), indemnity, product liability,or otherwise. In no event shall CATC's liability exceed the total amount paidto CATC for this product.CATC reserves the right to revise these specifications without notice orpenalty.Type o f Service ContactCall for technical support… US and Canada: 1 (800) 909-2282Worldwide: 1 (408) 727-6600Fax your questions… Worldwide: 1 (408) 727-6622Write a letter… Computer Access Technology Corp.Customer Support2403 Walsh AvenueSanta Clara, CA 95051-1302Send e-mail… support@CATC.comVisit CATC’s web site… http://www.CATC.com/
144BTTracer Protocol Analyzer User’s ManualCATC Version 1.0
145BTTracer Protocol Analyzer User’s ManualCATC Version 1.0INDEXNumerics1100 packet 771101 packet 77AAbort upload 34About Merlin 21Acknowledge 128Action buttons 31, 83Actions tab 82Addr 104AddressesAM_ADDR 77Bluetooth 54piconet 73slave device 44swap 74target 55AM Address 128Analyzerdescribing Bluetooth 2requirements 17set up 9status 34updates 24API 4Application installation 9, 18Architecture of Piconet 3Arqn 104ARQN condition 77AT 110AT commands protocol 96Authentication 139Automatic updates 24Automation Feature 4AUX1 packet 77BBasic installation 9Bit pattern, searching 131Blue dot menus 85Bluetoothantenna 13BusEngine 6described 1device address 54first recording 10limited search 67neighborhood 139recording traffic 92search for device 51searching for devices 40target address 55BNEP 96, 110Breakout board 15BT neighorhood 139Bubble help 35Buffer size 10, 65BusEngineautomatic updates 24Bluetooth 6general updates 21, 23manual updates 25Buttonscounting 83toolbar 31CCAC 104Calculations, timing 136Capturing a trace 20CATC Technical Support 143Certification 7Changing trace view 96Channel connections, L2CAP 113Circuits, custom 17Clicked fields, menus in 108Clock rate, match 73Collapse data 106Colors 97Comments, editing 135Components, physical 5Configuring encryption 140Connecting events 84Connectors
146BTTracer Protocol Analyzer User’s ManualCATC Version 1.0data 7, 15physical 7, 15Correlation Value 74Countersconnecting events 84value 85, 86Counting buttons 83CRC 104CRC error 80Creating Display Option Files 96Custom circuits 17DDataconnector 15decoding 110expand, collapse 106filename 10length 79pattern 75, 79searching by length 124searching by pattern 131transfer message 112DB-9 15Debug file 11, 75Decoding 110Dedicated inquiry 11Description of Merlin 2Detailed installation 13Deviceaddress 139Bluetooth address 54general search 42hiding 100inquiry 74search 40search for Bluetooth 51search results 53slave address 44DH1,2,3packet77DIAC LAP 74Display configuration name 96Display optionscolors 97creating files 96formats 99general 95hiding 100saving 101Displaying information 103, 135DM1 104DM1, 2, 3 packet 77Drivers, loading USB 18Duration of search 51DUT Recv/Xmit Freq 69DV packet 77EEditing comments 135Enabledebug file 75tooltips 95Encryption 139, 140Environmental Conditions 7Error summary 136ErrorsCRC 80FEC 80header length 81HEC 80invalid packet 80payload length 81Searching for 126setting conditions for 80sync loss 81threshold exceeded 80types of 75Established Piconets 71Eventsconditions 77connecting 84options 75sequencing 90tab 75trigger 10, 64Exclusion search 132Existing Piconet, recording 49Expand data 106
147BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Explicit NACK 128Externalinput signals 75, 81interface 15trigger form 89FFeatures 4FEC Error 80FHS packet 77File information, displaying 135File menu 29Filename and data 10Filter In/Out button 83Filter Out/In 87Filtering 76, 77Find feature, using 132Finding 126Finding devices 40Firmware updates 21, 23, 24, 25, 27Flow 104Fonts 96Force resynchronization 73Formats tab 99Found devices 43, 53France hops 69Frequencies, DUT 69Frequency hops, hiding 107frequency mode 50GG.P. OUT 17General description 2General features 4General inquiry 11, 67, 70General optionsdisplay 95recording 63General purpose output 89Generating reports 135Go toDataLength 124error 126Header AM_Addr 124L2Cap CID 126Lmp Opcode 125marker 122packet types 123packet/Message/Protocol 121Groups, events 75HHDLC 110HDLC frames 96HeadersAM_Addr 124length error 81packets 76payload 78HEC 104HEC Error 80Help menu 31Hexadecimal patterns, searching 131HID 110Hiding 100, 107, 108Higher protocols, decoding 109High-pulse output 88Hop 50Hopshiding 107reduced mode 58sequence 11, 68Hot keys 36Humidity 7HV1,2,3packet77IIdle 104Implicit NACK 128In/Out connector 15Information, interpreting 103Input signals 75, 81Inquirydedicated 11general 67perform/skip 39recording 11, 67timeout 11, 74
148BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Installationbasic 9detailed 13Merlin 18Interpreting a trace 103Intersection search 132Introduction 1Invalid packet type error 80JJapan hops 69KKeyboard shortcuts 36LL_CH (Logical Channel) 78, 104L2CAPchannel connections 113CID, searching 126described 110messages 96, 108, 109, 112L2FL 104Len 104Length of data 79License 143information 23update software 22Limited inquiry 11Linking events 84LMPdescribed 110messages 96, 109, 112Opcode 125Logical Channel 78Long pattern, searching 131Loss of syncsearching for 126timeout 74Low-pulse output 88MManual trigger 7, 10, 64Manual updates 25Markersediting and clearing 105searching 122setting 104Masteraddress 73and slave 128device, syncing to 34switch 73Master/address 54Match clock rate 73Memory, Recording 7Menusblue dots in events 85clicked fields 108pulldown 29Merlinconfigure encryption 140description of 2installation 18installing software 18program startup 19rear panel 14setup 14Messagesearching 121Messageshiding 100LMP, L2CAP 109, 112transfer 112Mode, recording 67Modestest, recording in 58Modes tab 66NNeighborhood, BT 139Nine-pin connector 15NULL packet 77Nulls, hiding 108OOBEX 110OBEX protocol 96Opcode 104
149BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Operating temperature 7Optionsgeneral display 95general recording 63name 10Piconet recording 68search 56Output signaling pins 16Output signals, enabling 88Overview 1, 29PPackage dimensions 7Packets1100, 1101 77AUX1 77DM1, 2, 3 77DV 77FHS 77headers 75, 76headers in 76hiding 100, 101HV1,2,377invalid type error 80NULL 77POLL 77searching 121, 123types 77, 128viewing 112Pagesync and record 68, 69target 73Paging traffic 73Passivesyncandrecord71Patterns, data 79Payloadheaders 75, 78length error 81PC requirements 17Percentage of triggering 66Perform inquiry 50Phone numbers, Technical Support 143Physical Components 5Piconetaddresses 73established devices 71master address 54private device 72recordiing 68recording 11, 45, 49recording traffic on 38sample 3search options 56slave address 44sync and record 71synchronizing 45target address 55Wizard 46PIN 139Pin-out description 15Pins, output signaling 16Pkt 110Pollshiding 108POLL packet 77Position of trigger 65Post triggering, percentage 66PowerLED 7Switch 7PPP 96, 110Pre-triggering 66Private Device Piconets 72Programinstallation 9, 18starting Merlin 19Progress indicator, recording 33ProtocolAnalyzer 2Architecture 3decoding 110hiding 100searching 121Prototype rework area 17Pull-down menus 29Pulse low signal 88Pulse toggle signal 88
150BTTracer Protocol Analyzer User’s ManualCATC Version 1.0RRadio strength 35Reading a trace 103Record inquiry 67Record menu 29Recordingatrace20Bluetooth traffic 10, 92existing Piconet 49LED 7memory 7mode 11mode, inquiry 67Piconet 45piconet 68progress indicator 33reduced hop mode 58session 12type 64Recording Optionsevents 75general 10, 63, 64in Wizard 45Piconet 68saving 91synchronization methods 66Recording type 49Recv, DUT freq 69Reduced hops 58, 69Reportsgenerating 135menu 29Requirements, Analyzer and PC 17Restart button 83Results of search 53Resynchronization, forced 73Revisions 21Rework area, for prototype 17RFCOMM 110RFCOMM protocol 96SSamplePiconet 3recording 12Savingdisplay options 101recording options 91SDP Msg 110Search 42duration of 51general 52Search menu 29Search options 56Search results 53Search type 40, 51Searchingby data pattern 131complex 126data length 124for bit pattern 131for bit patterns 131for errors 126Header AM_Addr 124L2Cap CID 126Lmp Opcode 125packet types 123recorded traffic 121Security 139SEQN condition 77Sequenceevent 90hop 68Set marker 104Setupmenu 29Merlin 14Shortcuts, keyboard 36Signallingmessage 112output pins 16Signalsinput 75, 81outputs, enabling 88strength, radio 35Single frequency hops 69
151BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Size of buffer 65Skip inquiry 50Slave device, address 44Slave switch 73Snapshot 10, 64Soft Bit Error, searching 126Softwareautomatic updates 24installation 9, 18license updates 22overview 29regular updates 21starting Merlin 19Spain hops 69Special Interest Groups (SIGs) 1Specifications 7Standard hops 69Starting Merlin 19Status bar 33Status of Analyzer 34Storage temperature 7STP messages, protocol 96Strength of signal 35Summaryerror 136traffic 137Support, technical 143Swapping addresses 74Switches 7, 73Syncand record 70, 71loss error 81loss of, searching 126methods 68, 69timeout, loss of 74to a master device 34window 74Synchronization, forced 73Synchronize Piconet 45Synchronized LED 7System setup, Merlin 14TTabsdisplay colors 97display formats 99general display 95hiding display 100recording events 75recording, general 10, 63recording, modes 11, 66recording, options 63Target, page 73TCS messages, protocol 96Technical Support 143Temperature tolerances 7Test debug 75Test mode, recording in 58Threshold Exceeded error 80TID 104Time Stamp 104Timeoutinquiry 74loss of sync 74Timeslot filtering 76Timing calculations 136Tips, tool 35, 95Toggle signal 88Toolbar 31Tooltips 35, 95, 104, 112Traceaddresses 74filename 10reading 103recording 20sample 12view level, changing 96TrafficBluetooth 92generation 5hiding 108on Piconet 49paging 73recording 20, 56recording on piconet 38searching 121summary 137
152BTTracer Protocol Analyzer User’s ManualCATC Version 1.0Trail 104Transfer message, data 112TRG OUT 16Triggerevent 64external form 89LED 7position 10, 65post triggering 66recording, manual 64Type of recording 64UUnassociated traffic, hide 108Union search 132Updatesautomatic 24firmware, BusEngine 23software license 22software, firmware, BusEngine 21USB drivers, loading 18VValues, changing counters 85Viewmenu 29options 31packets 112WWarranty 143Weight 7Window menu 31WizardPiconet 46Wrap 96XXmit,DUTfreq69ZZoom 35, 95

Navigation menu