nccgroup / Sniffle

A sniffer for Bluetooth 5 and 4.x LE
https://www.nccgroup.trust/us/our-research/sniffle-a-sniffer-for-bluetooth-5/?research=Public+tools
GNU General Public License v3.0
869 stars 129 forks source link

Preliminary questions before commitment of Sniffle #9

Closed joma74 closed 4 years ago

joma74 commented 4 years ago

Currently we are after decent audio bluetooth pairs of devices on a consumer level. Such pairs are mainly in-ears and mobiles with android/ios. On our way about the how and why of such pairs we were pretty disenchanted, missing a lot of reasonable information from the vendors. Without diving too deep into the Bluetooth workings or crafting software ourselves, we would like to learn more with the help of your package plus a CC1352R1 TI board, within the above described context. Would appreciate if you advise us if answers to the following questions are possible regarding usage of Sniffle. Also, for additional workflow hints regarding tools before and thereafter along the questions, we thank you in advance.

Regarding connection details finding out

Regarding transmission details finding out

sultanqasim commented 4 years ago

This would be an interesting thing to examine, however Sniffle is probably not the right tool for the job right now. While the LE Audio specification is coming out in conjunction with Bluetooth 5.2, and in the future headphones will make use of it, all current Bluetooth Audio devices use A2DP over Bluetooth Classic - essentially Bluetooth 2.1 and older. Headphones that use Bluetooth 2.1 can call themselves compatible with Bluetooth 4.x or 5.x because the newer specifications are a superset of the older specifications. Sniffle only supports Bluetooth LE, not Classic. I do plan on eventually supporting the isochronous connection features of Bluetooth 5.2 that are used for LE audio, but devices using this are at least an year out.

Unfortunately, there are no good cheap sniffers for Bluetooth Classic. The only cheap BT Classic sniffer I'm aware of is the Ubertooth, but it only supports basic rate (1M) and its classic support is very crude. There are limited low cost options due to a combination of somewhat uncommon modulation for the EDR modes, fast channel hopping (tight timing requirements), and limited interest in putting in new development effort for a legacy protocol that is being replaced.

For sniffing A2DP over Bluetooth Classic, you'd probably be best off with a commercial sniffer from Ellisys or Teledyne-Lecroy/Frontline.