Signal analyzer Bluetooth

Bluetooth is a wireless communication technology used for short-range data exchange between devices. It operates in the 2.4 GHz frequency band and is commonly used in headphones, speakers, smartphones, and other short-distance connection electronic devices.

Bluetooth Low Energy (BLE) is a power-efficient version of Bluetooth designed for devices that require low energy consumption. It is ideal for battery-powered devices such as sensors, smartwatches, fitness trackers, and IoT applications. BLE enables wireless communication while significantly extending battery life.

The Bluetooth analyzer can only decode channels that fall sufficiently inside the current I/Q passband.

BLE and Classic support

For Bluetooth LE, the analyzer decodes CRC-valid primary-channel advertising on channels 37 (2402 MHz), 38 (2426 MHz), and 39 (2480 MHz). It supports legacy advertising, scan, response, directed, connection-request, and extended-advertising PDUs. Extended advertising headers, including AUX channel pointers and PHY, can activate an in-passband auxiliary advertising decoder for LE 1M, LE 2M, or LE Coded packets.

After a CRC-valid CONNECT_IND, the analyzer passively follows that LE connection while its predicted data channels remain inside the current I/Q window. It tracks CSA #1 or CSA #2 hopping, channel-map and connection-parameter updates, PHY updates, encryption state, and termination. LE 1M, LE 2M, and LE Coded data packets are decoded when the sample rate and channel coverage are sufficient. Complete unencrypted L2CAP PDUs are reassembled; clear-text ATT/GATT traffic is used for additional identification. Encrypted payloads remain visible as encrypted traffic but cannot be interpreted.

Bluetooth Classic BR/EDR is scanned passively in the same I/Q window. The analyzer validates access codes, decodes inquiry FHS packets, and can decode headers and selected payloads after an identity has supplied the required UAP. Classic packet processing can recover a BD_ADDR, Class of Device, EIR data, remote-name fragments, and LMP version responses when those packets are captured. Classic channels are scanned round-robin, so this is not a full-band or guaranteed hop-following receiver.

Packet decoding needs at least 1.1 MS/s for LE 1M, LE Coded, and Classic BR/EDR. LE 2M needs at least 2.2 MS/s. At lower rates the analyzer switches to narrowband activity mode: it reports adaptive noise level, peak, burst count and rate, duty cycle, burst-duration statistics, and the median interval between burst starts. It separately counts bursts whose measured duration is compatible with a primary LE 1M advertising packet. This is only a rejection aid: short non-Bluetooth RF activity can look the same, so narrowband observations are never presented as decoded packets.

Device table and identification

The session table combines BLE and Classic observations by address where a full address is available. Its default leading columns are Name, PHY, Company / ID, ID, Model / version, RSSI, BT version, and Device type. BLE is used in the PHY column rather than the protocol shorthand LE; Classic observations are labelled Classic BR.

The analyzer can show:

• advertising name, flags, GAP Appearance, advertised services, transmit power, public-address OUI, and manufacturer-specific company ID/data;
• device-type evidence from GAP Appearance, Class of Device, standard service UUIDs, EIR, and selected assigned manufacturer/service identifiers;
• connection access address, CRC initialization, interval, latency, timeout, channel map, hop increment, channel-selection algorithm, and observed connection state;
• clear-text GATT identity information, including device name, Appearance, manufacturer, model, serial, firmware, hardware, software, PnP ID, System ID, and discovered services;
• Bluetooth Core version from a captured BLE LL_VERSION_IND or Classic LMP version response;
• relative packet level, carrier-frequency offset, channel, packet count, and last-seen time.

Device type and its Identification evidence column make the source of a type explicit. A type is shown only when it comes from decoded advertising, EIR, Class of Device, service, or GATT data; it is not guessed from an address or RF appearance. Similarly, BT version is blank until the relevant version control packet is passively captured.

The table supports multiple sort keys. Active sort columns have a coloured heading with an up/down arrow and, for multiple keys, their priority. Right-clicking an active sort heading removes just that key; right-clicking a non-sorted heading clears all sorting. Left-click selects a row normally. Right-clicking a device row enables tracking, gives that row an inverse highlight, and plays a chime when a later packet for it arrives; right-clicking it again disables tracking. Column order, widths, and sort order are kept in hackrf-iq-analyzer.ini.

Coverage and limitations

An instantaneous 20 MHz HackRF capture cannot contain all three primary advertising channels at once, and it covers only part of the 79 MHz Bluetooth band. The analyzer reports the BLE and Classic channel centers covered by the current I/Q passband, but it cannot retune automatically or decode packets outside that passband. A captured connection can therefore be followed only on its in-band channels.

Local Name, Appearance, version, and GATT identity values are optional. If the relevant advertising field, Classic packet, or unencrypted GATT exchange is absent, the analyzer cannot recover it from an address alone. Phone and operating-system device lists may additionally use active scanning, GATT reads, pairing data, cached information, or proprietary signature databases; those data sources are deliberately not used by this passive analyzer.