Starting from version 7.16.0 Bluetooth Framework includes the Bluetooth LE Sniffer - the class that allows your application to capture Raw Bluetooth LE frames. It captures not only Bluetooth LE advertisements but the complete data exchange between Bluetooth LE central (client) and peripheral (server) devices including but not limited with control and data frames.
The BLE Sniffer requires CC2540 based Bluetooth LE USB dongle. It is recommended to use the CC2540EMK-USB TI dongle as it is shipped with pre-flashed required firmware. However you can use any China clone from AliExpress or any other CC2540 based USB dongle. The firmware can be found on the Texas Instruments site.
It is required that the dongle uses WinUSB drivers. By default the dongle uses proprietary (Cebal) driver. Below you find the detailed instructions how to install WinUSB driver.
- 1. Download Zadig.
- 2. Start the Zaig application.
- 3. Make sure that the List All Devices menu item is checked in the Options menu.
- 4. Select CC2540 USB Dongle in the drop down list box
- 5. Make sure that the source driver is Cebal (blue circle on the picture above).
- 6. Make sure that the target driver is WinUSB (green circle on the picture above).
- 7. Click the Replace Driver button.
- 8. Once driver installation finished you will see the "The driver was installed successfully."
Now you can use your CC2540 USB dongle to capture Bluetooth LE communications. To revert the original driver back:
- 1. Open the Device Manager
- 2. Find the CC2540 USB Dongle device under the USB Devices node.
- 3. Delete the device.
- 4. Refrsh devices. This re-found the device and installs the original Cebal driver.
Bluetooth Framework includes the BleSniffer demo application that shows how to use new wclBleSniffer class. Starting from 7.16.1 the BleSniffer can parse advertising PDUs:
Data PDUs and any other unknown packets are reported as raw.
At startup you should provide the advertising channel number. It can be channel 37, 38 or 39. Once connection request captured the sniffer will automatically follows the channel changes to capture control and data frames.
Check out the BleSniffer demo application from Bluetooth Framework package to find out more details about how it works.