← retour aux outils back to tools

# Ubertooth tools

Utilitaires en ligne de commande pour l'Ubertooth One, une plateforme open source 2,4 GHz utilisée pour la surveillance et le sniffing du Bluetooth Classic et BLE. Command-line utilities for the Ubertooth One, an open-source 2.4GHz platform used for Bluetooth Classic and BLE monitoring and sniffing.

↗ https://github.com/greatscottgadgets/ubertooth

## Overview

The Ubertooth One is an open-source hardware platform for experimenting with and sniffing the 2.4GHz spectrum, most notably Bluetooth Classic and Bluetooth Low Energy. The `ubertooth-*` command-line utilities that ship with the host-side software talk to the device to scan for piconets, follow Bluetooth Classic connections, capture BLE advertising/connection traffic, and dump raw spectrum data — filling a gap most Wi-Fi-focused wireless kits can’t touch.

## Common Usage

Confirm the device is detected and check firmware version

    ubertooth-util -v

Passive scan for nearby Bluetooth Classic piconets (LAP discovery)

    ubertooth-scan

Follow an existing Bluetooth Classic connection once a UAP/LAP is known

    ubertooth-follow -l <LAP> -u <UAP>

Sniff BLE advertising packets (discovery mode)

    ubertooth-btle -f

Follow a specific BLE connection by target address

    ubertooth-btle -f -t <BD_ADDR>

Capture raw 2.4GHz spectrum data for analysis

    ubertooth-specan -g

## Capture to PCAP for Wireshark

Dump BLE traffic straight into a pcap for offline analysis

    ubertooth-btle -f -c capture.pcap

Open in Wireshark

    wireshark capture.pcap

## Tips

- `ubertooth-scan` gives you the LAP (Lower Address Part); pair it with `ubertooth-follow` to actually trail an active Classic connection.
- BLE capture (`ubertooth-btle`) is generally more reliable than Classic sniffing since BLE’s frequency-hopping scheme is simpler to predict.
- Combine with `crackle` to break BLE Legacy Pairing encryption on captured connection traffic.

Help / Man page

    ubertooth-util [options]
      -v    Print firmware version
      -r    Reset device
      -f    Flash firmware

    ubertooth-scan [options]
      -x    Output in Wireshark-compatible format
      -t N  Scan timeout in seconds

    ubertooth-follow [options]
      -l LAP    Lower Address Part of target piconet
      -u UAP    Upper Address Part of target piconet

    ubertooth-btle [options]
      -f            Follow/sniff mode
      -t ADDR       Target device BD_ADDR
      -c FILE       Write capture to pcap file
      -A CHANNEL    Advertising channel to sniff (37/38/39)

    ubertooth-specan [options]
      -g    Output for RF spectrum GUI/graph tools

## Vue d’ensemble

L’Ubertooth One est une plateforme matérielle open source pour expérimenter avec et sniffer le spectre 2,4 GHz, notamment le Bluetooth Classic et le Bluetooth Low Energy. Les utilitaires en ligne de commande `ubertooth-*` fournis avec le logiciel côté hôte communiquent avec le périphérique pour scanner les piconets, suivre des connexions Bluetooth Classic, capturer du trafic d’advertising/connexion BLE, et extraire des données de spectre brutes, comblant un vide que la plupart des kits sans fil orientés Wi-Fi ne couvrent pas.

## Utilisation courante

    # Confirmer que le périphérique est détecté et vérifier la version du firmware
    ubertooth-util -v

    # Scan passif des piconets Bluetooth Classic à proximité (découverte de LAP)
    ubertooth-scan

    # Suivre une connexion Bluetooth Classic existante une fois un UAP/LAP connu
    ubertooth-follow -l <LAP> -u <UAP>

    # Sniffer les paquets d'advertising BLE (mode découverte)
    ubertooth-btle -f

    # Suivre une connexion BLE spécifique par adresse cible
    ubertooth-btle -f -t <BD_ADDR>

    # Capturer des données de spectre 2,4 GHz brutes pour analyse
    ubertooth-specan -g

## Capture vers PCAP pour Wireshark

    # Extraire directement le trafic BLE dans un pcap pour analyse hors ligne
    ubertooth-btle -f -c capture.pcap

    # Ouvrir dans Wireshark
    wireshark capture.pcap

## Conseils

- `ubertooth-scan` donne le LAP (Lower Address Part) ; l’associer à `ubertooth-follow` pour réellement suivre une connexion Classic active.
- La capture BLE (`ubertooth-btle`) est généralement plus fiable que le sniffing Classic, le schéma de saut de fréquence de BLE étant plus simple à prédire.
- Combiner avec `crackle` pour casser le chiffrement BLE Legacy Pairing sur le trafic de connexion capturé.

Aide / Page de manuel

    ubertooth-util [options]
      -v    Print firmware version
      -r    Reset device
      -f    Flash firmware

    ubertooth-scan [options]
      -x    Output in Wireshark-compatible format
      -t N  Scan timeout in seconds

    ubertooth-follow [options]
      -l LAP    Lower Address Part of target piconet
      -u UAP    Upper Address Part of target piconet

    ubertooth-btle [options]
      -f            Follow/sniff mode
      -t ADDR       Target device BD_ADDR
      -c FILE       Write capture to pcap file
      -A CHANNEL    Advertising channel to sniff (37/38/39)

    ubertooth-specan [options]
      -g    Output for RF spectrum GUI/graph tools