Ubertooth tools

Overview

The Ubertooth One is an open-source hardware platform for experimenting with and sniffing the 2.4GHz spectrum, most notably Bluetooth Classic and Bluetooth Low Energy. The ubertooth-* command-line utilities that ship with the host-side software talk to the device to scan for piconets, follow Bluetooth Classic connections, capture BLE advertising/connection traffic, and dump raw spectrum data — filling a gap most Wi-Fi-focused wireless kits can’t touch.

Common Usage

Confirm the device is detected and check firmware version

ubertooth-util -v

Passive scan for nearby Bluetooth Classic piconets (LAP discovery)

ubertooth-scan

Follow an existing Bluetooth Classic connection once a UAP/LAP is known

ubertooth-follow -l <LAP> -u <UAP>

Sniff BLE advertising packets (discovery mode)

ubertooth-btle -f

Follow a specific BLE connection by target address

ubertooth-btle -f -t <BD_ADDR>

Capture raw 2.4GHz spectrum data for analysis

ubertooth-specan -g

Capture to PCAP for Wireshark

Dump BLE traffic straight into a pcap for offline analysis

ubertooth-btle -f -c capture.pcap

Open in Wireshark

wireshark capture.pcap

Tips

• ubertooth-scan gives you the LAP (Lower Address Part); pair it with ubertooth-follow to actually trail an active Classic connection.
• BLE capture (ubertooth-btle) is generally more reliable than Classic sniffing since BLE’s frequency-hopping scheme is simpler to predict.
• Combine with crackle to break BLE Legacy Pairing encryption on captured connection traffic.

ubertooth-util [options]
  -v    Print firmware version
  -r    Reset device
  -f    Flash firmware

ubertooth-scan [options]
  -x    Output in Wireshark-compatible format
  -t N  Scan timeout in seconds

ubertooth-follow [options]
  -l LAP    Lower Address Part of target piconet
  -u UAP    Upper Address Part of target piconet

ubertooth-btle [options]
  -f            Follow/sniff mode
  -t ADDR       Target device BD_ADDR
  -c FILE       Write capture to pcap file
  -A CHANNEL    Advertising channel to sniff (37/38/39)

ubertooth-specan [options]
  -g    Output for RF spectrum GUI/graph tools

Vue d’ensemble

L’Ubertooth One est une plateforme matérielle open source pour expérimenter avec et sniffer le spectre 2,4 GHz, notamment le Bluetooth Classic et le Bluetooth Low Energy. Les utilitaires en ligne de commande ubertooth-* fournis avec le logiciel côté hôte communiquent avec le périphérique pour scanner les piconets, suivre des connexions Bluetooth Classic, capturer du trafic d’advertising/connexion BLE, et extraire des données de spectre brutes, comblant un vide que la plupart des kits sans fil orientés Wi-Fi ne couvrent pas.

Utilisation courante

# Confirmer que le périphérique est détecté et vérifier la version du firmware
ubertooth-util -v

# Scan passif des piconets Bluetooth Classic à proximité (découverte de LAP)
ubertooth-scan

# Suivre une connexion Bluetooth Classic existante une fois un UAP/LAP connu
ubertooth-follow -l <LAP> -u <UAP>

# Sniffer les paquets d'advertising BLE (mode découverte)
ubertooth-btle -f

# Suivre une connexion BLE spécifique par adresse cible
ubertooth-btle -f -t <BD_ADDR>

# Capturer des données de spectre 2,4 GHz brutes pour analyse
ubertooth-specan -g

Capture vers PCAP pour Wireshark

# Extraire directement le trafic BLE dans un pcap pour analyse hors ligne
ubertooth-btle -f -c capture.pcap

# Ouvrir dans Wireshark
wireshark capture.pcap

Conseils

• ubertooth-scan donne le LAP (Lower Address Part) ; l’associer à ubertooth-follow pour réellement suivre une connexion Classic active.
• La capture BLE (ubertooth-btle) est généralement plus fiable que le sniffing Classic, le schéma de saut de fréquence de BLE étant plus simple à prédire.
• Combiner avec crackle pour casser le chiffrement BLE Legacy Pairing sur le trafic de connexion capturé.

ubertooth-util [options]
  -v    Print firmware version
  -r    Reset device
  -f    Flash firmware

ubertooth-scan [options]
  -x    Output in Wireshark-compatible format
  -t N  Scan timeout in seconds

ubertooth-follow [options]
  -l LAP    Lower Address Part of target piconet
  -u UAP    Upper Address Part of target piconet

ubertooth-btle [options]
  -f            Follow/sniff mode
  -t ADDR       Target device BD_ADDR
  -c FILE       Write capture to pcap file
  -A CHANNEL    Advertising channel to sniff (37/38/39)

ubertooth-specan [options]
  -g    Output for RF spectrum GUI/graph tools