Home

CATC Merlin Mobile User`s Manual

1. Back Cancel Help Step5 Select the option Reduced hopping mode then press Next The following screen will display Recording Wizard Test mode Specify Master Device Step 2 of 4 Gg x Device Address Please select the Bluetooth device address of the master device for the piconet to be recorded The list below includes devices that Merlin Mobile haz recently encountered pour master device i not already in this list you may type in its device address a six digit hes value yourself Piconet Master Address lt Back Cancel Help Step6 Select the address for your piconet s Master device from the drop down menu If you prefer you can type in the address 56 CATC Merlin Mobile User s Manual SW Version 2 0 into the box Step7 Press Next The following screen will display This screen will show the current settings for the recording Recording Wizard Test mode Step 3 of 4 a x System is Ready Initiate SearchAecord Merlin Mobile 13 now ready to synchronize to the test piconet using Bluetooth Test mode and start recording IF your piconet le not curently established please establish it now Or you can establish it ight after proceeding to the nest page while Merlin Mobile tries to synchronize to the piconet The following options will be used Synchronization Method Test mode Frequency Band Reduced hopping mode Master address 008037168464 Initial De Whitening st
2. You can select either or both options They are not mutually exclusive If the Master supports inquiries while in a connected state select the first option This will set Merlin Mobile to use the Sync amp Record mode in its attempts to synchronize to the Master This will also cause the wizard to skip to step 8 If the Master can support piconets with multiple slaves select the second option If you select this box alone 1 e you leave the first box unchecked Merlin Mobile will use the Passive Sync amp Record mode to synchronize to the Master The wizard will then advance to Screen 8 If the first checkbox was selected Merlin Mobile will use Sync amp Record no matter what was set in the second box Step 12 If you want to skip the Master verification put a check in the box If you are in doubt leave the box unchecked 50 CATC Merlin Mobile User s Manual SW Version 2 0 If you selected only the second option in Step 12 Passive Sync amp Record the following screen will display Recording Wizard Existing piconet Specify Page Target Device Step 7 of 9 x Device Address Please select the Bluetooth device address of the page target device for the piconet to be recorded The list below includes devices that Merlin Mobile has recently encountered If pour page target device ts not already in this list you may type in its device address a st digit hex value yourself Page Target Addres
3. Merlin Mobile 13 now attempting to synchronize and to record traffic on the test piconet using Bluetooth Test Mode EA riquirirg Select Cancel to terminate the recording and to close the wizard Back Erie Cancel Help 61 CATC Merlin Mobile User s Manual SW Version 2 0 62 CATC Merlin Mobile User s Manual SW Version 2 0 6 Recording Options The Recording Options dialog box provides an alternative method of setting up a recording to the Recording Wizard described in the previous chapter In this dialog box are all of the settings needed to make a recording Once you have selected your recording options you then select the recording mode by clicking the down arrow on the Record button and selecting from the two mode options Piconet and Inquiry Merlin Mobile will then use the relevant Recording Options for the selected mode For example 1f you select Piconet recording mode Merlin Mobile will use the options from the Piconet page in the Recording Options dialog box 6 1 Recording Modes Pressing the down arrow on the Record button displays a menu with four Recording Modes ES Piconet Recording Mode ge Inquiry Recording Mode REL LUT HCI Recording Mode Selecting one of these modes tells the analyzer what sets of Recording Options 1t should use when you begin a recording Note Selecting a Recording Mode from the menu does not cause the analyzer to begin recording To begin recording yo
4. While the off the air traffic 1s captured by the analyzers hardware the HCI Traffic from the IUTs is captured by the analyzer application using an HCI probe provided by CATC that is connected directly to the IUT hardware In a typical setup the HCI commands and data to transmit are passed from the Bluetooth application to the Bluetooth baseband Host to Controller while events and data that was received are passed from the Bluetooth baseband to the Bluetooth application Controller to Host To capture the data the HCI Probe should be connected to the respective Host to Controller and Controller to Host lines When the recording of the UT s HCI is enabled and the application starts a recording the serial data is captured as incoming serial data For this up to two COM ports should be configured for each IUT 1 8 Features of Merlin Mobile Sophisticated software analyzes all piconet traffic e Identifies amp highlights abnormal bus conditions e Decodes Baseband packets and provides decoding for 12 additional protocol levels Complies with Bluetooth v 1 1 specification 64 MB of physical data recording memory nets 32 MB of raw Bluetooth traffic Programmable real time event triggering and traffic capture filtering CATC Trace graphical presentation of captured data with extensive customiza tion options Adjustable recording size Adjustable trigger position Comprehensive search functions Accurate timestamping of packets Fi
5. CATC Merlin Mobile User s Manual SW Version 2 0 Filter Slots on Packet Filter If filters are used to exclude FHS DM1 or other packets Merlin Mobile will exclude these packets from a trace and mark their locations with empty packets The result can be rows and rows of empty packets The option Filter Empty Slots will not exclude these empty slots because they lie immediately in front of Bluetooth communications packets even though those packets were not recorded To eliminate these empty packets select Filter Slots on Packet Filter Packet Headers Clicking Packet Headers opens three sets of check boxes and menus on the right that represent fields within packet headers Packet Type Active Member Address Flow Control Acknowledgment and Sequence Number e Select Packet Headers under Event Groups You see the Packet Headers window Recording Options l l x General Piconet Inquiry HCI Events Actions Event Groups Header 1 MM Packet Headers ae Payload Headers Packet Type Dont care M SEBN Data Pattern M SRON E M FLOW AM_ADDR HE rrars i W Don t care Header 2 Packet Type Dont care SEGUN ARGH AM ADDR E D Faw W Don t care Header 3 Packet Type Dont care M SEGN F ARGH T FLO AM ADORA E W Dont care Uncheck All Select packet header field Additional Timezlot Filtering T Filter Empty Timeslots Filter Timeslots on Packet Filter Save Sa
6. Controller gt Host Hast Controller Rate Marr Bluetooth Headset 57600 bps LJ IUT Lab 115200 bps gt Edit Delete Debug T Enable CATC debug file Save Save s Default Load Ok To edit an entry in the Configurations List Cancel Step 1 In the HCI page of Recording Options click Edit The Edit HCI Trace Configuration dialog appears Step 2 Change the data in the data fields according to your desired changes and click OK The changes are reflected in the Extern page of Recording Options 6 8 Recording Options Events If you have selected Event Trigger mode under the General tab in the Recording Options screen you may now select specific Bluetooth events using the Events tab on the Recording Option Screen You can also use the Actions tab to define specific event sequences that will trigger Merlin Mobile to record a Bluetooth session In addition the Events and Actions screens allow you to specify which packets you want to include or exclude from the recording e Click the Events tab on the Recording Options screen 80 Merlin Mobile User s Manual SW Version 2 0 You see the Event Groups window Recording Options E x General Piconet Inquiry HCI Events Actions Event Groups Header 1 MPacket Headers eae Payload Headers Packet Type Dont care M SEON Data Pattern SRON FLOW SM_ADDR Ses S 4 Don t care Header 2 Packet Type
7. Device Address Please select the Bluetooth device address of the master device for the piconet to be recorded The list below include devices that Merlin Mobile has recently encountered IF pour master device ls not already in this list pou may type in its device address a six digi hes value yourself Piconet Master Address 000 87 640084 lt Back Cancel Help 49 CATC Merlin Mobile User s Manual SW Version 2 0 Step 10 Select or type in the Master device s address into the box next to the label Piconet Master Address Step 11 Press Next The following screen will display This screen asks you which of the following two options apply to your Master device For some devices both options will apply Recording Wizard Existing piconet Step 6 of 9 i x Record Existing Piconet Enter master characteristics In order for Merlin Mobile to capture traffic on an already established piconet the piconet master device must support one of the two operating conditions listed below Please check the boxes that apply to your master device If nether condition applies press Back to select a different recording mode iv My piconet master device will respond to ingquines from other devices while it Is Ina connected state Syne amp record mode C My piconet master device can establish a piconet consisting of more than one slave device Passive Sync amp Record mode lt Back Cancel Help
8. Di 0x4 0xB00010EDDE 28F19 AS T Discon resp Select the type of L2Cap Signalling Command that you want to go to 129 CATC Merlin Mobile User s Manual SW Version 2 0 L2Cap CID Go to Trigger eM KY VETO Os Go to PacketiMessage Protocal Go to Marker d Packet Type Header AM_Addr j Ag CRE Nv Find Next FS DataLength j Lmp Opcode j Search Direction Forward l l Leap Signalling Command di Select the L2Cap Channel ID L2 Cap CID that you want to go to Error Moves trace view to next uncorrected error Soft Bit Error Moves trace view to next soft corrected error Loss of Sync Moves trace viewer to the next loss of sync Find Find is a utility that allows you to conduct searches of one or more events within a trace Find allows you to search different hierarchical levels within the trace packets LMP Messages L2CAP messages etc To start find e Select Find under Search on the Menu Bar OR Click WE in the Tool Bar 130 CATC Merlin Mobile User s Manual SW Version 2 0 You see the User Defined Find Events screen Search for LHP Messages L2CAP Messages SDPmsqg Items SDP Transactions Packets To Search For Event Groups AM A d cress Master Slave W Facket Type AM Addresses AM Addr 0 AM Addr 1 Abi Addr 2 TCS Items Acknowledge Abi Addr 3 RFCOMM Items AM Addr 4 OBEX ah
9. Computer Access Technology A Corporation eg es 2403 Walsh Avenue Santa Clara CA 95051 1302 Tel 1 408 727 6600 Fax 1 408 727 6622 CATC Merlin Mobile Bluetooth Protocol Analyzer User s Manual CE J Je MOD al etooth protocol An u CATC Merlin Mobile User s Manual SW Version 2 0 Document Disclaimer The information contained in this document has been carefully checked and 1s believed to be reliable However no responsibility can be assumed for inaccuracies that may not have been detected CATC reserves the right to revise the information presented in this document without notice or penalty Trademarks and Servicemarks CATC Merlin Merlin s Wand Merlin Mobile BTTracer BTTrainer Advisor Chief Firelnspector Inspector Detective Traffic Generator BusEngine USB4DOS UPT HPT UHT IBTracer and SATracer are trademarks of Computer Access Technology Corporation Microsoft Windows NT Windows 2000 Windows 98SE Windows Me and Windows XP are registered trademarks of Microsoft Inc All other trademarks are property of their respective companies Copyright Copyright O 2003 Computer Access Technology Corporation CATC All Rights Reserved Portions of this product are supplied courtesy of Richard Herveille Copyright c 2002 2003 Richard Herveille rherveille opencores org All rights reserved This document may be printed and reproduced without additional permission but a
10. Recording Type Select the desired wizard recording type Please select the type of recording you wish to make The wizard s recording type combined with other parameters you will be asked to set in the following pages will be used to determine the synchronization method for this session e want to establish a new piconet and have Merlin Mobile record traffic on that piconet want Merlin Mobile to record traffic on a piconet that has already been established am using Bluetooth Test Mode and want Merlin Mobile to record traffic on my test piconet lt Back Cancel Help and click Next Step2 In the Frequency Hopping Mode window select the Fixed Frequency Mode radio button enter the appropriate values in the text boxes and click Next Recording Wizard Test mode Step 1 of 4 Gg E x Frequency Hopping Hode Select hopping mode Most Bluetooth devices use the standard 9 frequency hopping mode however some legacy devices may use one of the 23 frequency hopping modes specific to certain countries Please select the frequency hopping mode used by your Bluetooth devices Notice that you can choose the Heduced or Fired hopping mode for test mode C Standard 79 hop mode C Reduced hopping mode 0 Fised freguency mode DIT rt frequency 2402 MHz DUT s Recy frequency 404 MHz Back Cancel Help Step3 Inthe Master Device address box enter the BD Address for 59 CATC Merlin Mobi
11. Recording Type Select the desired wizard recording type Please select the type of recording you wish to make The wizard s recording type combined with other parameters you will be asked to set in the following pages will be used to determine the synchronization method for this session oO want to establish a new piconet and have Merlin Mobile record traffic on that piconet lwant Merlin Mobile to record traffic on a piconet that has already been established am using Bluetooth Test Mode and want Merlin Mobile to record traffic on my test piconet Back Cancel Help e I want to establish a new piconet and have Merlin Mobile record traffic on that piconet This option causes Merlin Mobile to perform an Inquiry so it can discover local devices and then establish a new piconet and record the piconet traffic e I want Merlin Mobile to record traffic on a piconet that has already been established This option lets Merlin Mobile record traffic from an already established piconet e Iam using Bluetooth Test Mode and want Merlin Mobile to record traffic on my test piconet This option lets Merlin Mobile create either a single frequency range recording of a range that you specify or create a recording of a limited hop frequency range consisting of 5 frequency hops 5 1 Recording a Traffic on a New Piconet The New Piconet option shown in the previous screen presents users with the means of recording the traffic from
12. 1 e you select Exclusion with Union or Intersection e Exclusion Union tells Merlin Mobile to exclude packets with any of the specified events e Exclusion Intersection tells Merlin Mobile to exclude packets with all of the specified events Using Find Step1 Select the display level to be searched from the Search For box on the left side of the window For example to search through L2CAP messages select L2CAP The display level that you select will affect options presented in the Events Group box 136 CATC Merlin Mobile User s Manual SW Version 2 0 Step2 Select a search direction and origin Step3 Select one or more events from the Events Group box Your choices will affect options presented in the box on the right side of the screen Step4 If you have selected two or more criteria then select either 2 Union Find all packets that match ANY of the specified events An example would be to find packets with either X or Y Intersection Find all packets that match ALL of the specified events An example would be to find all packets with X and Y If you want to selected events from the trace then select 2 Exclusion Exclude all packets that match any of the specified events This option works in conjunction with Union and Intersection Select an exclusion plus one of the other two options If you select Exclusion and Union 1t means Exclude packets in any of the following events An example wou
13. C CAC 116 Calculations timing 151 CATC Technical Support 163 Certification 7 Channel connections L2CAP 127 Clicked fields menus in 121 Clock rate match 81 Collapse data 118 Comments editing 150 Components physical 5 Configuring encryption 159 Connecting events 98 Connectors data 7 physical 7 Correlation Value 82 Counters connecting events 98 value 100 CRC 116 CRC error 94 D Data decoding 124 expand collapse 118 filename 18 length 93 pattern 88 93 searching by length 138 searching by pattern 145 154 SW Version 2 0 CATC Merlin Mobile User s Manual transfer message 126 Debug file 19 83 Decoding 124 Dedicated inquiry 19 Description of Merlin 2 Device Bluetooth address 60 general search 48 search 46 search for Bluetooth 56 slave address 50 DH1 2 3 packet 90 Displaying information 115 150 DM1 116 DM1 2 3 packet 90 Duration of search 56 DUT Recv Xmit Freq 77 DV packet 90 E Editing comments 150 Enable debug file 83 Encryption 159 Environmental Conditions 7 Error summary 151 Errors CRC 94 FEC 94 header length 95 HEC 94 invalid packet 94 payload length 95 Searching for 140 setting conditions for 94 sync loss 95 threshold exceeded 94 types of 88 Established Piconets 79 Events conditions 91 connecting 98 sequencing 103 tab 88 155 SW Version 2 0 CATC Merlin Mobile User s Manual trigger 18 74 Exclusion search 146 Existing Piconet recording 54 Expand
14. Existing piconet Step 9 of 9 1 j x 5 3 Merlin Mobile had synchronized to the piconet and started recording Recording Press Stop Recording to stop the recording Pressing the Close button closes the wizard but Merlin Mobile continues to record traffic To stop the recording in the application you can use the Stop icon in the toolbar Stop Recording Press Close to close the wizard The recording will end following a trigger event or when you press Stop Recording button on the screen shown above or when you press the button on the toolbar Step 19 When finished press Close to close the Recording Wizard Recording in Test Mode A Test Mode recording allows you to limit the frequency hopping range that Merlin Mobile will record Two Test Modes are available Reduced Hopping Mode and Single Frequency Mode Reduced Hopping Mode limits Merlin Mobile s recording to the five frequency hops that are described in the Bluetooth Specification Single Frequency Mode limits Merlin Mobile s recording to a single frequency range that you specify in the Recording Wizard Recording in Reduced Hopping Mode To record in Reduced Hopping Mode perform the following steps Step1 Start the Recording Wizard by either pressing the button x or selecting Setup gt Recording Wizard from the menu The Recording Wizard greeting screen will open 54 CATC Merlin Mobile User s Manual SW Version 2 0
15. Hop Sequence Syne Method Master Address Page Target Page 5ync amp Record Joon 02000003 fe DO040S000006 MSB gt L5B Additional Settings Correlation Value 33 64 57 Force Re Synchronizatior pr W Follow Master Slave Switch Match Clock Rate Loss of sync Timeout 1 16 sec f MT Show Paging Traffic Syng Window Initial De whitening State Inquiry Timeout 0 60 sec Narrow i De whitening On Deawwhitening Off Debug T Enable CATC debug file EEN Save Save As Default Load Step 3 Select the General tab The Recording Options dialog box opens showing factory default settings such as manual trigger and 8 MB buffer size For the General Inquiry recording you are about to create leave these settings unchanged 18 CATC Recording Options Merlin Mobile User s Manual General Piconet Inquiry HCI Events Actions Recording type Options SW Version 2 0 O Snapshot Manual Trigger Event Trigger Buffer Size 8 000 ME Trigger Position 50 post tiggenng Beep When Trigger Occurs Save External Interface Signals JH Options Name Trace Filename amp Path Defaut Change Default Location Save s Default Load Save A Cancel Ok For this recording leave most of these settings unchanged If you are recording a Hop Frequency that is not 79 Hops Standard you will nee
16. Remove this assignment 121 CATC Merlin Mobile User s Manual SW Version 2 0 Manually Assigning Protocols If a recording does not capture the beginning of a dialog between a Master and Slave devices Merlin Mobile may not have the L2CAP messages it needs to determine the correct protocol assignments In this case L2ZCAP messages will display an N in the Assignment field that means Not Assigned Add Lzl en L2cIo A i Data Time 4 0000 03 00 01 00 09 00 01 00 A oo0s 01 00 01 00 00 00 N Protocol not assigned An L2CAP message without a protocol assignment for the higher protocol data If you know what the protocol assignment should be for the missing assignments you can manually add them by right clicking your mouse over the A field shown above and selecting from the pop up Assignment menu shown on the previous page Other Assignments OBEX Client Server Status OBEX messages carry a status that indicates whether the transmitting device is an OBEX client or OBEX server To view an OBEX message s client server status Step1 Open an OBEX trace file such as the sample file OBEXsample tfb in C Program files CATC Merlin Mobile Step2 Press Be Ml and Ex to hide Hops NAKs and unassociated traffic Step3 Press R to decode OBEX Step4 Left click your mouse over the field marked Type 122 CATC Merlin Mobile User s Manual SW Version 2 0 A pop up menu will appear indicating whether the message was
17. m ddr slave CID 0004 7 7 Assign to SOF Assign to TCS Assign to UNDEFINED Assignment into There if no assignment for this channel File Base Assignments BNEP Set Do not apply changes Step 2 Click on a channel assignment and then look at the Connect and Disconnect buttons on the far right of the dialog box Ifthe Connect and Disconnect buttons are grayed out 1t means that Merlin Mobile made the channel assignments using data in the trace You can verify that Merlin Mobile performed the assignments by looking at the text in the Slave Channel box in the lower left corner of the dialog box If you see Connection Recorded it means that Merlin Mobile performed the channel assignments If Merlin Mobile was not able to make these channel assignments then the Connect and Disconnect buttons on the right side of the dialog box will be active You can then assign and edit channel connections Step3 Open the drop down menu labeled AM_Addr Active Member Address If possible select an address other than the currently displayed address The connections for the new device should now display 9 8 Viewing Protocol Messages and Transac tions By pressing a button such as EA or B you can cause Merlin Mobile to decode the higher level protocol data contained within L2CAP messages and display them as packet like rows called Protocol Messages Protocol Messages have headers marked protocol and fields th
18. master slave Assign to RFCOMM 17 AmAdd A IA A 19 Am ddr master CID 0x004 RFCOMM Assign to SDP 20 Am Add 7 slave CID 00041 AFCOMM 34 AmAdd slave CID 0800417 endof assignment Assign to TCS 36 m ddr slave CID 00040 end of assignment Assign to UNDEFINED Assignment into Manual assignment Do not apply changes Step 2 Step 3 left corner of the dialog box will indicate who assigned the protocol Click on one of the displayed assignments Ifthe protocol was assigned by Merlin Mobile the Assign buttons on the right will be grayed out and unavailable If you want to change these assignments you will have to use the pop up menus described in the previous section If a protocol has been manually assigned by a user the Assign buttons will become active and allow you to make a change in assignment If possible click the appropriate Assign button Removing User Assigned Protocol Assignments As you practice assigning and reassigning protocols you will find that one of the more useful commands is Remove All User Assignments This command allows you to undo all of your assignments To remove some or all user assigned protocol assignments Step 1 Step 2 Step 3 Step 4 Double click any Protocol Message header to open view L2CAP messages Locate a message with a field marked A Left click on the A field to open the Assignment menu Select Remove All User assignments or
19. select Go to Trigger under Search on the Menu bar The Trace Viewer display will reposition the trace to show the triggering event at the top of the screen Go to Packet Message Protocol To display a specific packet Message or Protocol Step1 Select Go to Packet Message Protocol under Search on the Menu Bar 125 CATC Merlin Mobile User s Manual SW Version 2 0 You see the Go to Packet Message Protocol window Go to Packet Message Protocol E Go to Packet lo Cancel Step 2 Enter the number of the packet message or protocol you want to display Step 3 Click OK The Trace View repositions to show the packet at the top of your screen Go to Marker To instruct the analyzer to display a marked packet Step 1 Select Go to Marker under Search on the Menu Bar Y ou see a drop down menu listing the marked packets in that Trace View Search view Window Help o to Trigger Packet 2 Marker 1 Packet 7 Marker 2 All Markers crc Idle l ka Find Next y Ox6F 44 310 553 ms Search Direction Forward Step2 Select the desired packet from the displayed list The Trace View repositions to show the packet at the top of your screen Note The Go to Marker feature functions in conjunction with the Set Marker feature The comments within the parentheses following each marked packet are added or edited with the Set Marker feature 126 CATC Merlin Mobile User s Manu
20. x State Device State BD_ADDR Bluetooth Device Address Alias Whatever alias you entered for the device in the Add New Device dialog Class The device class for each listed device Clock Freq Shows the device s Clock Frequency Security If Encryption is enabled then this field will be marked with a Yes You enter Encryption by clicking the Add Devices button and then clicking Options Last Update Shows when device information was last updated User Notes User comments You add notes by clicking Add Devices and entering text into the dialog box Edit Device Opens a dialog box for editing the device settings in the Device List Add New Device Opens a dialog box for adding new devices to the list You can also enter devices by performing an Inquiry This dialog box lets you enter information that will appear in the device list device names addresses aliases and comments Remove Device Removes the selected device from the Device List 139 CATC Merlin Mobile User s Manual SW Version 2 0 10 3 Edit Comment You can create view or edit the 100 character comment field associated with each Trace file Step1 Select Edit Comment under File on the Menu Bar You see the Edit comment for trace file window Edit Trace File Comment Dialog x This is a recording of a piconet consisting of two laptop Cancel Step2 Create view or edit the comment Step 3 Click OK 10 4 Exportin
21. 3 Step 4 Merlin Mobile User s Manual SW Version 2 0 in the Modes tab in the Recording Options dialog box Run Passive Sync and Record The Master will then page the slave s address and Merlin Mobile will be able to sync When Merlin Mobile synchronizes to the Master turn the slave back on When the Master re pages the address the slave is admitted into the private network Since Merlin Mobile is passive in this mode the slave and Merlin Mobile do not conflict over the shared address Merlin Mobile is then able to record the traffic between the Master and slave Page Sync amp Record Page Sync and Record is the recommended method of recording Page Sync and Record should be implemented before a piconet 1s established This mode causes Merlin Mobile to perform a General Inquiry and collect sync information from the specified slave device when it responds Merlin Mobile then waits for the Master to begin paging the Slave devices When paging begins Merlin Mobile synchronizes to the Master and begins recording Note In order for this mode to work the intended Slave must support inquiry scan The following steps describe the simplest way to use this mode Step 1 Step 2 Step 3 Step 4 Step 5 Note Place both the intended master as well as its first intended slave into inquiry scan mode Have Merlin Mobile perform a General Inquiry You do this by pressing the BT Neighborhood button FA After t
22. Bluetooth Test Generator provide the capability for creating a fully automated testing environment The Merlin Mobile analyzer includes provisions for on the fly detection of and triggering on numerous events Such events include specific packet headers payload headers data patterns and many abnormal error traffic conditions Merlin Mobile continuously records the piconet data in a wrap around fashion until it is manually stopped or until the trigger event 1s detected Upon detection of a triggering event the analyzer continues as necessary to record data until the recording buffer is filled The Merlin Mobile application may be used with or without the analyzer box When used without the analyzer box it functions as a CATC Trace viewer As a Trace viewer it can be used to view analyze and print CATC Trace files CATC Merlin Mobile User s Manual SW Version 2 0 1 1 Bluetooth Specification Please refer to the Bluetooth Specification version 1 1 for details on the Bluetooth wireless technology protocol The Bluetooth Specification is available from the Bluetooth SIG at its web site http www bluetooth org 1 2 Merlin Mobile Analyzer System Compo nents The Merlin Mobile analyzer package includes the following items e One Merlin Mobile analyzer unit e Merlin Mobile software program installation CD e Product documentation including on line Help 1 3 Merlin Mobile Specifications Package Dimensions 5 3 x 2 1 x 0 4
23. CATC Merlin Mobile User s Manual SW Version 2 0 The following screen will display Recording Wizard New piconet Step 3 of 8 x Device Search Type Select group general device search Merlin Mobile can ether search for all Bluetooth devices in range or it can search only for devices within a specific group Search groups are defined by a 24 bit Dedicated Inquiry Access Code DIAC want to search for all Bluetooth devices within range want to search only for devices in the search group comesponding to the following hesadecimal DIAC fseeeoo lt Back Cancel Help Step 3 Y ou will see two options e I want to search for all Bluetooth devices within range This option will cause Merlin Mobile to search for all Bluetooth devices that are in range and ready to transmit and receive data 1 e in Inquiry Sean Mode e I want to search only for devices corresponding to the following hexadecimal DIAC This option will cause Merlin Mobile to search for the class of devices that you specify in the DIAC text box DIAC stands for Device Inquiry Access Code Values are entered in hexadecimal format You can get DIAC values from the Bluetooth Specification Select the first option I want to search for all Bluetooth devices 36 CATC Recording Wizard New piconet Step 4 of 8 Merlin Mobile User s Manual SW Version 2 0 within range then press Next The following screen will display Device Sea
24. Choose External Trigger Form A menu will appear with choices for Pulse Low Pulse High and Toggle TO O C a Co Enable External General Purpose Gutput Enable External General Purpose Output Only External Gutput Form y w Pulse Low Pulse High Toggle Step 3 Choose an option not currently selected The menu closes Step4 Reopen the menu Note that your new selection is now checked Elastic Arrow Elastic arrows allow you to associate Events Counters and Actions To make an association Step 1 Click the left mouse button on an Event button such as Hdr1 or Errors The elastic arrow appears Trigger Step 2 Drag the arrow to the desired Action button Step 3 With the pointer over an Actions button click again the left mouse button again The arrow is replaced with a black line connecting the Event button to the Action button 93 CATC Merlin Mobile User s Manual SW Version 2 0 Event Sequencing If you drag your mouse from one event button to another you will create a compound condition known as an Event Sequence An event sequence is a condition that says Trigger when you see the following sequence of packets The example below may help to clarify 2 Countd 65535 Hort NULL pers ABIL 2 Count 65535 Trigger This example means Trigger when you see a packet with an Null Header followed by a packet with a Poll Header To create an event sequence perform the f
25. HEI Events Actions Implementation Under Test IUT Configurations List Controller Host Host Controller Rate Debug T Enable CATC debug file Save Save As Default Load Cancel HCI Traffic from the IUTs is captured by the analyzer application using an HCI probe provided by CATC that is connected directly to the IUT hardware In a typical setup the HCI commands and data to transmit are passed from the Bluetooth application to the Bluetooth baseband Host to Controller while events and data that was received are passed from the Bluetooth baseband to the Bluetooth application Controller to Host To capture the data the HCI Probe should be connected to the respective Host to Controller and Controller to Host lines When the recording of the IUT s HCI is enabled and the application starts a recording the serial data is captured as incoming serial data For this up to two COM ports should be configured for each IUT 76 CATC Merlin Mobile User s Manual SW Version 2 0 HCI Window Layout The HCI page displays a Debug checkbox a Configurations List that is made up of IUTs that were added via the Add button and buttons labeled Add Edit and Delete Debug Enables the creation of a file that can be used by CATC Support to aid in debugging Configurations List The Configurations List displays the COM settings for the ports used to connect the IUT to the host PC The Config
26. IUTs disable it in the HCI page of the Recording Options dialog 6 2 Opening the Recording Options Dialog Box To open the Recording Options menu click E on the Tool Bar or select Recording Options under Setup on the Menu Bar 64 CATC Merlin Mobile User s Manual SW Version 2 0 You see the Recording Options window By default the Piconet options page displays Recording options x General Piconet Inquiry HCI Events Actions Sync Method Master Address Page Target Page Sync amp Record Y m 0001 02000003 el 000406000006 M5B gt L5B Additional Settings Correlation Value 33 64 57 Force Re Synchronization F Inquiry Timeout 0 50 sec D ie o Sonica atch Clock Rate Loss of sync Timeout 1 16 sec E I Show Paging Traffic Sync Window Initial De whitening State Marrow f Del hitening On C De whitening Off Debug T Enable CATC debug file AR AAA Save Save 4s Default Load cos You will need to set options for each of the Recording Options pages Generally it is best to begin with the General and Piconet pages where you can set the type of recording and then move on to the Events and Actions pages where you can set triggering events 6 3 Recording Options General The General page controls the length of a recording and how it begins and ends Itis shown in the previous illustration The General page display four boxes marked Recording Type Buffer Si
27. Manual SW Version 2 0 9 mi Protocols T Addr Time Data Time EE 00 0100 02 era festes E Data Time MTL gt 03 AA BB 00 09 00 01 00 8 3185 008 01 00 01 00 02 00 data coe Ack d e 000 OF 00 41 00 03 AA BB 00 09 00 01 00 01 00 01 00 0x4858 Yes 314 000 ps 0016 02 00 Time Starnp OO008 318 8476 9 1 Introduction Merlin Mobile can decode HCI LMP and L2CAP protocol messages and RFCOMM SDP TCS HDLC PPP OBEX HCRP BNEP HID IP TCP and UDP protocols The default 1s packet level decoding which means that baseband packets will be displayed when you first view a trace If these packets are carrying LMP L2CAP or higher protocols the protocols will display as undecoded fields such as the L2CAP packet below A Undecoded L2CAP fields A LE FL t Data CRT Idle Time Stamp LAI 17 bytes 0x7E98 243 800 ps 00008 314 4708 By issuing a decode command Merlin Mobile can decode these LMP and other fields and display the data in summary statements called LMP L2CAP Messages Protocols Messages and Protocol Transactions 9 2 LMP and L2CAP Messages LMP and L2CAP Messages are lines in a trace that summarize LMP and L2CAP actions such as an LMP connection request LMP and L2CAP Messages summarize the type of action the number of packets involved in 113 CATC Merlin Mobile User s Manual SW Version 2 0 the action and the device performing the action If the message is carrying higher protocol
28. Manual SW Version 2 0 Show Paging Traffic Show Paging Traffic causes Merlin Mobile to capture paging traffic between the Master and Page Target devices This option is used only with Page Sync and Record Mode Correlation Value 33 64 This value tells Merlin Mobile how many bits in the sync word of each received packet must be matched in order for Merlin Mobile to consider the packet valid and start recording It is recommended that the Correlation Value be set to 57 bits Inquiry Timeout 0 80 secs Default value 1s 20 seconds This value specifies how long Merlin Mobile should perform the Inquiry process for the General unlimited and Dedicated limited recording modes After the specified time has elapsed Merlin Mobile will illuminate the trigger light on the front of the analyzer Loss of Sync Timeout 1 30 secs This value specifies the amount of time that Merlin Mobile will wait for piconet traffic before determining that synchronization has been lost Sync Window The Sync Window slide bar controls the amount Ean Wide of time that Merlin Mobile should wait between receiving an Inquiry Response which will cause the Sync LED to blink and detecting Master Slave piconet traffic which will cause the Sync LED to turn solid A Narrow setting means that the wait time will be minimal a Wide setting means it will be maximal The default is Narrow and this 1s suitable for most recordings However 1
29. Merlin Mobile User s Manual SW Version 2 0 2 4 Displaying Help The Merlin Mobile application has a Help file that is useful as an on screen reference Access the Help file by choosing Help gt Help Topics from the menu bar 2 5 Updating the BusEngine and Firmware The BusEngine core is the heart of the Merlin Mobile analyzer Using state of the art PLD technology it incorporates both the high speed recording engine and the configurable building blocks that implement data state error detections triggering capture filtering external signal monitoring and event counting and sequencing Both the BusEngine program and the firmware that manage the internal microcontroller are fully field upgradeable The most current BusEngine file and firmware file are included with the Merlin Mobile installation software and are automatically installed with the software They are also updated anytime that the driver is updated 2 6 Updating the Driver The driver BusEngine and firmware are all automatically updated when the Merlin Mobile software is installed or upgraded To find out the current driver version number please consult Merlin Mobile s Readme file The driver may also be manually updated The steps below explain how to manually update the driver Note The Merlin Mobile analyzer unit must be attached to the computer via the PC Card slot before updating the driver Updating the Driver on Windows 2000 Step 1 Select Start gt
30. Page Sync amp Record y oooto2000003 fooososooo0065 MSB gt LSB Additional Settings Correlation Value 33 64 57 Force Re Synchronization J lnquiry Timeout 0 80 sec ji a oe ee io atch Clock Rate Loss o sunc Timeout 1 16 sec E Show Paging Traffic Sync Window Initial De whitening State Narrow DeMWhitening On C De whitening Off Debug Enable CATC debug file Save Save 4s Default Load cos Hop Sequence The Hop Sequence menu presents the following three options e 79 Hops Standard This is the option used for most recordings e Reduced Hop Restricts Merlin Mobile to five hop frequencies defined in the test mode specification of the Bluetooth Specification When Reduced Hop or Single Frequency is selected the Sync method is set to Test Mode and cannot be modified by the user e Fixed Frequency Allows the transmit and receive frequency ranges to be specified Selecting this option highlights the DUT Xmit and DUT Recv text boxes When Reduced Hop or Single Frequency is selected the Sync method is set to Test Mode and cannot be modified by the user 68 CATC Merlin Mobile User s Manual SW Version 2 0 Enter values into the two text boxes to the set the transmit and receive frequency ranges e DUT Xmit Freq MHz 2402 Allows the setting of the transmit signal for the Device Under Test e DUT Recv Freq MHz 2402 Allows the setting of the r
31. Save As screen 21 CATC Merlin Mobile User s Manual SW Version 2 0 Step 7 Give the recording a unique name and save it to the appropriate directory 22 CATC Merlin Mobile User s Manual SW Version 2 0 3 Software Overview 3 1 The Main Display Windows While some of the analyzer s Main Display window options are familiar many contain options specific to the analyzer program Table 1 Main Display Pull Down Windows Opens a file Closes the current file Saves all or a specified range of packets from the current file with a specified name Export Packets to Saves all or part of a trace to a text file Text Packet View Format Export Packets to Saves all or part of a trace to a Comma Separated Values CSV file CSV Text suitable for viewing in a spreadsheet application Export gt gt Audio Saves audio data into a file Presents options for setting the Audio Streams Source format Output File format Stream Direction and Output Sampling Lists the last files that were opened Exits the Merlin program Display Options Provides the control of various display options such as color formats and filters Recording Options Opens a dialog box with checkboxes and drop down menus for setting up a recording Recording Wizard Starts a sequence of interactive dialog boxes that configures Merlin for a recording This utility provides an alternative to the Recording Options dialog box Analyzer Allows the operator
32. Settings gt Control Panel from the desktop taskbar then double click on Add Remove Hardware in the Control Panel window The Add Remove Hardware Wizard will open Step 2 Click Next Step 3 Choose Uninstall Unplug a device and click Next Step 4 Choose Unplug Eject a device and click Next Step 5 Select CATC Merlin Mobile Bluetooth Protocol Analyzer from the list of devices and click the Properties button The Properties window will open CATC Step 6 Step 7 Step 8 Step 9 Step 10 Step 11 Step 12 Step 13 Step 14 Step 15 Merlin Mobile User s Manual SW Version 2 0 Select the Driver tab in the Properties window and click Update Driver The Upgrade Device Driver Wizard will open Click Next Choose Display a list of the known drivers for this device so that I can choose a specific driver Then click Next Choose Have disk and click Next The Install from Disk window will open Install from the Merlin Mobile installation CD ROM Make sure that the installation CD 1s in the computer s CD ROM drive then click Browse and navigate to the Software directory on the CD or type the drive letter followed by Software e g D Software in the combo box Click OK Install from a directory on the computer s hard drive Browse or enter the path to the Disk 1 directory of the Merlin Mobile installation then click OK The Install from Disk window will close Select CA
33. TTL in the TTL to RS 232 converter c Step 2 Connect the DB 9 connector marked with RS 232 in the TTL to RS 232 converter c to the connector marked with RS 232 Probe in the HCITrace RS 232 Cable b Step 3 Connect the connector marked with COM A in the HCITrace RS 232 Cable b to Connector A in the 2 port RS232 to USB converter d Step 4 Connect the connector marked with COM B in the HCITrace RS 232 Cable b to Connector B in the 2 port RS232 to USB converter d Step 5 Connect the USB cable to the USB connector of the 2 port RS232 to USB converter e Monitoring RS232 level Signals Legend for photo a HCI Probe Cable b HCI Trace RS 232 Cable CATC Merlin Mobile User s Manual SW Version 2 0 c Connectors A and B on the other end of the HCI Trace RS 232 Cable d Two Port RS 232 to USB Converter For monitoring RS232 level signals do not use the converter To assemble the HCI probe for this configuration perform the following steps Step 1 Connect the DB 9 connector of the HCITrace Probe Cable a to the connector marked with RS 232 Probe in the HCITrace RS 232 Cable b Step 2 Connect the connector marked with COM A in the HCITrace RS 232 Cable c to Connector A in the 2 port RS232 to USB converter d Step 3 Connect the connector marked with COM B in the HCITrace RS 232 Cable c to Connector B in the 2 port RS232 to USB conv
34. The Add button lets you add devices to the Configurations List Clicking Add causes the following dialog box to open x Name pe COM Forts Cancel Controller gt Host Com Hast gt Controller come r Protocal f UART C R5232 BlueCore Baud Rate bps 57600 Parity None r Data Bits kai Stop Bits f Name Symbolic name for easy identification of the device and connector Controller gt Host COM port used for monitoring the HCI traffic from the application to the bluetooth baseband Host gt Controller COM port used for monitoring the HCI traffic from the Bluetooth baseband Controller to the application Host Rate Sets the maximum rate in bits per second bps that you want data to be transmitted through this port Data Bits Changes the number of data bits you want to use for each character that is transmitted and received The computer or device you are communicating with must have the same setting that you choose here Most characters are transmitted in seven or eight data bits Parity Changes the type of error checking you want to use for the selected port The computer or device you are communicating with must have the same setting that you choose here You must choose one of the following e None No parity bit will be added to the data bits sent from this port This will disable error checking e Even Parity bit is set to 1 if it is neede
35. a new piconet This option will cause a sequence of screens to prompt you for information such as the piconet Master address 34 CATC Merlin Mobile User s Manual SW Version 2 0 The following steps shows you how to configure Merlin Mobile to record a new piconet Step 1 From the screen shown in the previous screenshot select the first option I want to establish a new piconet and have Merlin Mobile record traffic on that piconet then press Next o want to establish a new piconet and have Merlin Mobile record traffic on that piconet The following screen displays Recording Wizard New piconet Step 2 of 8 x Inquiry Skip Perform Select to perform or to skip a general device inquiry You can choose to skip a general device inquiry if such was already done Othenwse please select to perform the inquiry The inquiry is needed so the piconet devices can be selected for synchronization and recording Perform Inquiry Mow f Skip Inquiry lt Back Cancel Help Step2 Select Perform Inquiry Now then press Next Selecting Perform Inquiry Now will cause Merlin Mobile to perform a General Inquiry and collect addresses and other details about local Bluetooth devices If you already have address information for your Bluetooth devices you can choose Skip Inquiry Choosing Skip Inquiry will cause the Recording Wizard to advance to Step 6 If you are not sure what option to select choose Perform Inquiry Now 35
36. acknowledgment Instead it is an empty packet This Master interprets this empty packet as an Implicit NAK 1 e implicitly not acknowledged Merlin Mobile summarizes this packet exchange by adding an Ack d field to the Master s data packet and setting the Ack d field to Imp Nak ACK Packet 14580 is the Master s retransmission of the data sent in packet 14577 Packet 14582 is the reply by the Slave device This reply contains an ARQN field with a value of Acknowledge Merlin Mobile summarizes this packet exchange by setting the Ack d field on packet 14580 to Ack 133 CATC Merlin Mobile User s Manual Data Length Contains a list of all data lengths that occur in the trace Packets To Search For Event Groups JAM Address Master Slave Packet Type Acknowledge e oo Data Pattern mode Uncheck All Combining specified Event Groupe Union Packets that match ANY of the specified events f Intersection Packets that match ALL of the specified events Exclusion Packets that DO NOT match opposite to the intersection or union 134 Existing Data Lengths 25 bytes 26 byes O bytes 30 bytes 31 bytes Je bytes 33 bytes 34 bytes 35 bytes 30 bytes 41 bytes 43 bytes 44 bytes 45 bytes 46 bytes 47 bytes 49 bytes A bytes At bytes 55 bytes SW Version 2 0 CATC Merlin Mobile User s Manual Data Pattern Event Groups 18M Address MasterSlayve Pac
37. and exit the Recording Options menu 6 11 Recording Bluetooth Traffic To start recording Bluetooth traffic once the appropriate Recording Options have been set Step1 Select Start under Record on the Menu Bar OR 95 CATC Merlin Mobile User s Manual SW Version 2 0 Click REC Record Piconet on the Tool Bar Your recording session can continue until it has finished naturally or you may need to stop manually by clicking fn on the Tool Bar depending on how you set the Recording Options To manually stop recording Step2 Select Stop under Record on the Menu Bar OR Click fr on the Tool Bar Note The manual Stop Recording feature is primarily of use when recording low volume traffic which can take a long time to fill the recording buffer When the recording session is finished the bus traffic is saved to the hard drive as a file named data tfb or whatever name you assign as the default filename If you have enabled the recording is serial HCI traffic from IUT then a second trace file is created called data_hci tfb To save a current recording for future reference Step3 Select Save As under File on the Menu Bar OR Click on the Tool Bar You see the standard Save As screen Step4 Give the recording a unique name and save it to the appropriate directory 96 CATC Merlin Mobile User s Manual SW Version 2 0 7 Display Options Use the Display Options menu to specify the way CATC Trace informat
38. box closes Within the Device List you should see a Yes in the Security field for the selected device 150 CATC Merlin Mobile User s Manual SW Version 2 0 How to Contact CATC Type of Service of Service Contact are for technical support US a Canada 1 800 909 2282 Worldwide 1 408 727 6600 Write a letter Computer Access Technology Corp Customer Support 2403 Walsh Avenue Santa Clara CA 95051 1302 Visit CATC s web site http www CATC com Warranty and License Computer Access Technology Corporation hereafter CATC warrants this product to be free from defects in material content and workmanship and agrees to repair or replace any part of the enclosed unit that proves defective Ns under these terms and conditions Parts and labor Ww are warranted for one year from the date of first C Y A A 4 TC purchase The CATC software is licensed for use on a single personal computer The software may be copied for backup purposes only This warranty covers all defects in material or workmanship It does not cover accidents misuse neglect unauthorized product modification or acts of nature Except as expressly provided above CATC makes no warranties or conditions express implied or statutory including without limitation the implied warranties of merchantability and fitness for a particular purpose CATC shall not be liable for damage to other property caused by any defects in t
39. following dialog box opens Slave Encryption Setup ay xj Master BD_ADDR Aias PinCode LimkKey do ooo 149 CATC Step 5 Step 6 Note Step 7 Note Step 8 Step 9 Merlin Mobile User s Manual SW Version 2 0 Click the button marked New The following dialog box appears Master BD_ADDR Pin Code Cancel ASCII Hex Upto 16 ASCII characters or 32 Hex digits Link Rey 32 Hex digits Enter the appropriate Personal Identification Number PIN for the selected device to the box marked PIN Code This PIN allows Merlin Mobile to learn the Link Key If you do not have the PIN skip to Step 5 The PIN you provide should be the same used by the Slave For example if your Slave device requires a PIN of 1234 then enter the same PIN in the dialog box shown above If you do not have the PIN or if the Master and Slave have already agreed upon the Link Key manually enter a Link Key as a 128 bit sixteen byte hex value into the box marked Current Link Key If you have the PIN you can skip this step Ifthe Master and Slave were previously connected they may already agree on the Link Key In this case you will need to provide Merlin Mobile with the Link Key and not simply the PIN Click OK The changes you have made are applied and the information is displayed in the Slave Encryption Setup dialog box as shown previously Click OK The Slave Encryption Setup dialog
40. from a trace by pressing the Hide Nulls and Polls button on the Tool Bar From the Tool Bar Click EME to hide all Nulls and Polls 110 CATC Merlin Mobile User s Manual SW Version 2 0 8 9 Hide ID Packets You can hide ID packets from a trace by pressing the Hide ID Packets button on the Tool Bar From the Tool Bar e Click EA to hide all ID Packets 8 10 Hide Voice SCO Packets You can hide SCO packets from a trace by pressing the Hide Voice SCO Packets button on the Tool Bar From the Tool Bar e Click sol to hide all Voice SCO Packets 3 11 Menus in Clicked Fields Y ou can display the following menu when you click in a field in a trace Time Stamp Format d Color b Hide 8 12 Hide Unassociated Traffic You can hide all traffic that is not associated with the current decode level by pressing the Hide Unassociated Traffic button on the Tool Bar From the Tool Bar CAPI This button will cause Merlin Mobile to decode the trace and e Firct click one or more decode buttons such as the View L2CAP Messages Bel selected level of decode e Next click Ex to hide all unassociated traffic 111 CATC Merlin Mobile User s Manual SW Version 2 0 The Hide Unassociated Traffic button will cause Merlin Mobile to hide all traffic except for the selected decode messages or protocols In the example above all packets would be hidden and only L2CAP messages would display 112 CATC Merlin Mobile User s
41. has already been established was canceled as the Merlin Mobile hardware was not detected or was in the process of booting Lip Press Retro to have Merlin Mobile start the operation one more tine Retry Press Finish to exit the Wizard or Back to return to the Previous page Back Cancel Help Step 17 Press Retry or Back to re attempt the process If the hardware failure described above do not occur Merlin Mobile will conduct an inquiry The screen will show that Merlin Mobile is going to attempt a recording in either Passive Sync amp Record mode as shown below or in Sync amp Record mode depending on the options you selected in Step 15 Recording Wizard Existing piconet Step 9 of 9 Mm x Merlin Mobile is attempting to synchronize to the master device of the established piconet and record the traffic AS quiro Stop Recording Press Cancel to terminate the synchronization and record attempt and to close the wizard an Enis Cancel Help Step 18 If you are recording in Passive Sync amp Record mode you will 53 CATC Merlin Mobile User s Manual SW Version 2 0 need to direct your Master device to attempt a connection to Merlin Mobile This will provide Merlin Mobile with the information it needs to record the piconet Once Merlin Mobile has the information it needs it will begin recording The following screen will display Recording Wizard
42. of the piconet where the device with BD_Address XXX 1s the master After the analyzer has synchronized to the Bluetooth piconet under observation the Status Bar will display activity bars and the strength in dBm of the radio signal that Merlin is receiving The activity bars will increase or decrease with activity The signal strength readings will display as five possible values e below 60 dBm e 60dBm e 50dBm e 40 dBm 30 CATC Merlin Mobile User s Manual SW Version 2 0 e above 40 dBm The valid range for a signal is between 60 and 40 dBm Search Status The rightmost segment displays the current search direction Fwd forward or Bwd backward Zoom In Zoom In increases the size of the displayed elements allowing fewer but larger packet fields per screen e Click Bi on the Tool Bar Zoom Out Zoom Out decreases the size of the displayed elements allowing more but smaller packet fields per screen e Click on the Tool Bar 3 4 Tool Tips Throughout the application tool tips provide useful information To display a tool tip position the mouse pointer over an item The tool tip displays in a short moment if present Tool tips can also be found over the Tool Bar and in areas of the packet view screen 3 9 Merlin Analyzer Keyboard Shortcuts Several frequently used operations are bound to keyboard shortcuts Table 2 Keyboard Shortcuts 31 CATC Merlin Mobile User s Manual SW Version
43. produced by an OBEX client or server If the menu items appear grayed out as they do in this BES lent MU GES SEE Left click over the Type field to open the OBEX Client Server Assign menu example it means that Merlin Mobile assigned the client or server status based on data it found in the trace If the menu items appear in black it means that the user assigned the status and 1s therefore free to change the assignment Changing an OBEX Client or Server Status If the beginning sequence of traffic is not recorded in a trace the client server status of the transmitting devices will not be preserved in the trace In this case the OBEX Client Server pop up menu will become active and you will be able to change the assignment Decoding BNEP BNEP Bluetooth Network Encapsulation Protocol is a protocol that allows devices to encapsulate network protocols such as IP Since BNEP can carry different types of network protocols you need to tell Merlin Mobile what protocol the BNEP 1s going to be carrying You do this via a script file called bnep dec that is read during the initialization of the Merlin Mobile software This file tells Merlin Mobile how to decode BNEP fields Once read BNEP can be correctly decoded by pressing the 44 button on the toolbar If the decode file is not read at initialization Merlin Mobile will display the data in an undecoded format For more information on BNEP decoding see a supplemental document on BNEP i
44. right Step3 Select Header AM_Addr from Event Group Step4 Select AM _Addr 7 from the box on the right Step5 Select Union and Exclusion Selecting Union causes the analyzer to search for any of the selected events Step6 Press OK The trace will redisplay so that it excludes DMIs Polls or any packet with AM_Addr 7 Find Next To apply the previous Find parameters to the next search e Select Find Next under Search on the Menu Bar on the Tool Bar 138 CATC Merlin Mobile User s Manual SW Version 2 0 10 2 Device List Device List describes devices discovered in a previous inquiry or was entered by the user The list 1s stored in a file from one session to the next so the information one a device that was collected in previous sessions or was manually entered can always be viewed m amp wm ram e ie State ep appR alias class Clock Freq Security Last update oot In range In Range 000231640084 0x020300 3200 none 02 07 03 13 53 07 E pE Archive v In Range 0050357160454 Ox000000 3199 none 02 07 03 13 53 07 6 Inactive 333300112233 Ox40020C unknown nome 02 07 03 13 53 04 a Inactive 00036E102000 0140680 unknown none 02 07 05 13 53 07 2 a Teoh OATS SS Teco Med al A nooo nose ona ZA By default Device List appears at the bottom of the Merlin Mobile application window If is not open you can open it by selecting View gt Device List Fields in the Device List Buttons B 4
45. ts Ace i eae Mats Wee tis Wat Ge aie ee 127 CATC Merlin Mobile User s Manual SW Version 2 0 PEO aie we ey ere Ne Go tee Ge eek ty wR ace ks ne EE A ee Ee 130 SO I le ERO Meno e a4 ar yee iii wha ead ae eee oe 130 LOSS Or SVC 34 oo rbd SES Bee PAE 130 A OA 130 Event OTOUDS anria aestuarii in o A eh waren eee as 132 Union Intersection and Exclusion 0 0 000 000 0000 136 USDE PING AAPP O aang eee 136 Pind NEE 2 2 223 tt4oe eet eee eee teu ede bbe geese 138 SCS MIG ts ce herman als cd ats td whe a ene eos Mea eee is 139 PGi COminent cat by be ieee tek dekh a eee ae ou ee 140 EPOD Dilbert alate yew ars ag dak iyi ats tera dee a 140 Pile TnitorimaOns rai awe nda Beak ieee ed 141 POPs SUMING rs sti 142 Timmins CalculatioAS popa caca las ida id 142 Bus WU Zan ON sii dedico 143 Tae SUMMA ra T ease ate rs Na ll Be 147 ENCESPUOE Btn aoe aio eats a aie E T aia aA Seahorse Aes BAM T oe 147 Configuring Merlin Mobile for Encryption 148 Chapter 10 How to Contact CATC ooooooo o oooo oo 151 Chapter 11 Warranty and License ooooooooo o 151 Md EEIE TE T E E EE de daa 153 CATC Merlin Mobile User s Manual SW Version 2 0 1 Overview The CATC Merlin Mobile Bluetooth Protocol Analyzer blends powerful piconet traffic recording and analysis abilities with compact easily transportable PC Card technology Merlin Mobile is a development and test tool for products using the Bluet
46. will display the following screen Recording Wizard New piconet Step 8 of 8 xl Merlin Mobile has compleled the recording of the traffic in the piconet using Page Syne 2 amp Record mode Press Repeat to have Merlin Mobile re unitiate the recording process Repeat Fress Cancel to terminate the synchronization and record attempts and to close the wizard You can repeat the recording by pressing the Repeat button Step 11 To close the wizard press the Close button 43 CATC Merlin Mobile User s Manual SW Version 2 0 The wizard will close and your trace will display CATC Merlin Mobile TM Bluetooth Protocol Analyzer C Program Files CATC Merlin Generalinauiry bit l oj x NES File Setup Record Report Search View Window Help 8 x SSC lees AT ye IP TCP UDP Idle Time Stamp 19 000 ps 00000 747 1890 eee Addn ARAS Flow Argn Segn HEC Parity LAP SR SP UAP NAP pOxd ox2 1 o 1 ox2c ox35an6CBE9 oxOCDF9C 1 Po OxEC 0x0001 COD Addr CRC Idle Time Stamp Idle Time Stamp 19 000 ps 00001 058 1265 aoe o Flow Argan Segn HEC Parity LAP SR SP UAP NAP foo ox 1 o 1 ox2c oxasao6cBes oxocorac Rt Po oxec 0x0001 COD Addr CRC Idle Time Stamp Idle Time Stamp 16 000 ps 00001 199 6890 UDR Agen RAS Flow Argn Segn HEC Parity LAP SR SP UAP WAP fox o2 1 o 1 ox2c ox3c0s17686 oxwcorgA R1 Po oxec 0x0001 COD Addr CRC Idle Time Stamp gt Is analyzer connected con
47. 1f the first two options can not be used 69 CATC Merlin Mobile User s Manual SW Version 2 0 Sync amp Record Sync and Record works just like Page Sync and Record except that Merlin Mobile takes its sync data directly from the Master instead of the Slave devices With Sync and Record Merlin Mobile conducts a General Inquiry to get hop frequency and clock information from the Master Merlin Mobile then waits to detect piconet traffic from the Master device s piconet When the piconet is established Merlin Mobile is able to synchronize to the Master and begin recording In contrast to Page Sync and Record Sync and Record can be run with or without an established piconet Note This mode can only be used to find master devices that support Inquiry Scan To perform a Sync and Record follow the steps below Step1 Turn on the Bluetooth devices under observation and set up the master device so it is ready to respond to Inquiry scan For a typical recording ensure that the Master and Slave device s are not yet connected Step 2 In the Modes tab under Recording Options enter the Master Device s address Step3 Start Merlin Mobile recording by pressing a the Record button on the toolbar Step 4 When the analyzer is able to Sync up to the Piconet Master Clock the Green Syne LED in the Merlin Mobile front panel will start blinking Step5 Establish connection between the Bluetooth devices under analysis Step6 Wh
48. 2 0 Shift 7 Goto DH3 packet Shift 6 Goto DMS packet Shift S Search for Soft Error Shift E 32 CATC Merlin Mobile User s Manual SW Version 2 0 5 Recording Wizard Recording Wizard is an interactive utility that presents a series of user friendly dialog boxes for setting up a recording session Recording Wizard serves as an alternative method of configuring the Recording Options dialog box When you are finished using the Wizard you can view your settings in the Recording Options window By providing data to the prompts in the Wizard s dialog boxes you configure Merlin Mobile for a recording session Starting Recording Wizard To start the Recording Wizard e Click a on the Tool Bar or select Recording Wizard under Setup on the Menu Bar You see the Recording Options window Recording Wizard E x Welcome to the Merlin Mobile Recording Wizard This wizard will help pon configure Merlin to detect nearby Bluetooth devices and record Bluetooth piconet traffic The Recording Options window has three buttons marked Next Back and Cancel that allow you to move forward or backward through the wizard or to cancel the wizard To begin advancing through the wizard e Click Next to see the options for the three types of recordings that the Recording Wizard can make 33 CATC Merlin Mobile User s Manual SW Version 2 0 The Wizard advances to the next screen which presents three options Recording Wizard a E x
49. AP Mess aDeSe ote beg daa da da 113 Decoding and Viewing Protocol Data o o ooooooooooooooo ooo 114 Decoding Via the Decoding Toolbar o ooooooooooo 114 Decoding Via the Display Options Dialog Box 115 PA 116 Viewing Packets in LMP and L2CAP Messages 0 0 0 0 o 116 Types of LMP and L2CAP Messages 0 000 116 Viewing L2CAP Channel Connections 0 0 0 ccs 117 Viewing Protocol Messages and Transactions 0 0 0 0 eee eee eee 118 Viewing L2CAP Messages in Protocol Messages 119 Howto DECOdC uta adecua tee eatin ou ley te as 119 Expanding Protocol Messages 0 0 ccc eee eens 119 Changing Protocol Assignments 0 0 0 000000 c cece eee 120 Using the Decoding Assignments Dialog Box 120 Removing User Assigned Protocol Assignments 121 Manually Assigning Protocols o oooooooooo eee 122 Other Assignments OBEX Client Server Status 122 Changing an OBEX Client or Server StatuS o o ooooooooo 123 Decoding BNEP eyso views E A AEN 123 Decode TT it ia e ada a cios 123 Other Decoding OptiSeo iaaea 0000 ccc eee ee 124 Chapter 9 Other Features 0 0 cc cece cece ese ees 125 A aha ote at oe ees 125 GONG ICG oe et NES Bee da bet ese Se een ended rd iaa ad 125 Go to Packet Message Protocol o oooooooooooooooooooooos 125 GO LO MIKO arica aaa na ed 126 A Baise ah
50. B8 arrow will will collapse dd the field Expanded Data expand data Collapsed ata If you click and hold down the left mouse button on one of these arrows you can collapse or expand the field for ALL packets messages or protocols Using the Shortcut Menu If you left click on a Data field a menu will open for expanding or collapsing data fields Step 1 Left click on Data in the Data packet you want to expand or collapse If your Data Trace View is currently expanded you see the Collapse Data menu Data Field view Data Block Collapse Data Expand All Data Fields Collapse All Data Fields Format d Color b Hide 109 CATC Merlin Mobile User s Manual SW Version 2 0 If your Data Trace View is currently collapsed you see the Expand Data menu Data Field View Data Block Expand Data Expand All Data Fields Collapse All Data Fields Format d Color b Hide Note that you can choose to expand or collapse 2 Only the Data in the selected Data packet OR All Data Fields in the Trace View Step2 Select the desired Expand Data or Collapse Data menu item The Trace View is repositioned with the selected packet s adjusted in the format you have specified 8 Hide Frequency Hops You can hide Frequency Hops Hops from a trace by pressing the Hide Hops button on the Tool Bar From the Tool Bar e Click Hap to hide all Hop packets 8 8 Hide Nulls and Polls You can hide Nulls and Polls
51. Bold entries in the list represent items that actually occurred in the trace 131 CATC Merlin Mobile User s Manual SW Version 2 0 In the screenshot shown above for example AM Address is selected On the right you see that only Address 1 1s in bold This indicates that only a single device was transmitting traffic in the displayed trace Event Groups Event Groups are categories of events that can occur in a trace Clicking on an Event Group will display a list of Event types on the right side of the Find window that occur within each Event Group AM Address Contains a list of seven Active Member addresses Bold entries represent devices that occur in the trace Master Slave Contains two options labeled Master and Slave Selecting an option will cause Merlin Mobile to search for traffic based on the selected role Packet Type Contains a list of all Bluetooth packet types If a packet type occurs in the trace 1t will appear in bold Acknowledge Contains a list of three Acknowledge types Explicit NAK Implicit NAK and ACK The three Acknowledge types are responses a device can issue to attempts to transmit packets to it A device can send an Acknowledgment in two ways through setting the ARQN field to 0 explicitly not acknowledged to 1 explicitly acknowledged or by sending an empty packet that does not have an ARQN field implicitly not acknowledged Explicit NAK Explicitly not acknowledged An Explicit
52. Counts Bus Utilization Chatsession blt Packet length m i pm _ lt pz Cc a JJ 40 30 ZO 10 hl o Z o Length bytes ih DO th Bus Utilization Buttons The Bus Utilization window has a row of buttons for changing the format of the displayed data and for exporting data The buttons have the following functions Save As Saves the graphs i as a bitmap file bmp e O Email Creates an email with a bmp file attachment al Weal vacua of the graphs Click and Drag zoom Click diagonally to ar select and zoom in on part of the graph Print S ES En Full Screen Select Range View Settings opens a Sync and Graph areas If two or more sub menu with options for Be graphs are displayed this button will formatting the display See synchronize the graphs to one another Once View Settings Menu synchronized the positioning slider of one below graph will move the other graphs 144 CATC Merlin Mobile User s Manual SW Version 2 0 Graph Areas Presents options for E aa displaying additional graphs of data lengths Horizontal zoom in packet lengths and percentage of bus utilized al Horizontal zoom out View Settings Menu Clicking the View settings button i causes a menu to open with options for formatting the display ial Orient Horizontally changes the Ara nerean orientation of bus usage to horizontal After selecting this opti
53. Custom tab Standard Custom Colors Red fioo 209 209 Sat 255 Green o Lur 55 Blue 110 a Changing Field Formats To change field formats select an item under the Group and Color column This action will enable the formats radio buttons on the right The format types change with respect to the item selected under the Group and Color column For example if L2CAP 1s selected the following displays CAC Data Device HCI HCRF HOLE PPP LELAF 3B Signalling AAA ARTETA LLLLELE TT ATI eee eT Pree eee eres Peeve ree eee reer Ar rr bo LeLer MSB to LSB z CIO ASCII MSB to LSB m8 2CAP color LMP OBE Other Packets v RFCO MM SOF TCS Time 100 CATC Merlin Mobile User s Manual SW Version 2 0 The following formats are available Data Data Format Bit Order Hexadecimal E MSE to LSB Decimal LSE to MSB Binary r Hiding TE Hidden Note Not every format is available for every item Hiding Display Options 7 3 To hide one or more fields in the trace select the Hiding appropriate item from the Group and color column click dal as the checkbox marked Hidden and click the Save button Y ou can also hide Sequences from a trace by selecting the desired options from the checkboxes Level Hiding Options The Level Hiding tab allows you to hide FISs Idle Sequences and other types of traffic To hide traffic select one or more items then
54. Dont CAS E SEGN ERTH AM ADDR i T FLO e Don t care Header H 3 Packet Type Dont care sEGN ARGH T Flin AM ADDR F _ W Don t care Uncheck All Select packet header fields Additional Timezlot Filtering T Filter Empty Timeslots I Filter Timeslots on Packet Filter Save Save As Default Load mea The Event triggering and filtering options allow you to set event conditions for errors and or a variety of packet characteristics Clicking a check box causes further options to display in the right side of the window Additional Timeslot Filtering By default Merlin Mobile records frequency hop and timestamp information for all time slots in the Piconet under analysis regardless of whether the time slot contained a Bluetooth packet This means that in instances where there is little piconet traffic Merlin Mobile will display row after row of empty packets each representing an empty time slot Through the use of timeslot filtering these empty packets can be filtered out Filtering out this information has the benefit of freeing memory so that more traffic can be recorded Filter Empty Slots If Filter Empty Slots is checked Merlin Mobile will exclude all empty time slots from a recording except for those that lie immediately in front of Bluetooth communications packets These remaining empty packets are preserved to give timestamp and frequency hop reference data to the packets that follow 81
55. Manual SW Version 2 0 Step 2 Enter the path and filename for the License Key or use the Browse button to navigate to the directory that contains the License Key Select the lic file and then click Update Device License Information Licensing information for Merlin Mobile may be viewed by selecting Help gt Display License Information from the menu bar The License Information window will open displaying the maintenance expiration and features data for Merlin Mobile 2 8 Installing the HCI Probe If you are planning to record HCI traffic you will need to install an HCI probe The HCI Probe allows you to connect the analyzer software to a single IUT If more IUTs are to be monitored up to three additional HCI Probes should be used The probe is composed of the following components a HCITrace Probe Cable b HCITrace RS232 Cable c TTL to RS232 converter d 2 port RS232 to USB converter e USB cable CATC Merlin Mobile User s Manual SW Version 2 0 HCITrace Probe Cable The HCITrace Probe Cable has three probes e Gnd Should be connected to the reference ground wire e Host Should be connected to the wire that carries the down link traffic from the host to the controller e BTC Should be connected to the wire that carries the up link traffic from the controller to the host HCliTrace RS232 Cable Has three DB 9 connectors e RS 232 Probe Should be connected to the HCI
56. NAK is an explicit response by a device that it did not receive a data packet The Explicit NAK is transmitted in the ARQN field FAcknowledgment Request Negotiation field ARQN 0 means Explicit NAK Implicit NAK Implicitly not acknowledged An Implicit NAK is a NAK that is implied rather than explicitly stated If a device responds to a data packet by sending an empty packet the NAK is implied ACK Acknowledged Ifa data packet is successfully transmitted to a target device the target device acknowledges the received packet by setting the ARQN field to 1 132 CATC Merlin Mobile User s Manual SW Version 2 0 Acknowledgments are easily seen in Merlin Mobile traces because Merlin Mobile adds an Ack d field on data packets of the transmitting device This means that you do not have to hunt through the trace to see if the packet was acknowledged The following screenshot shows two examples of Acknowledgments Packet 14580 T on Addr i Data CRC 0000 08 OO 01 00 02 24 04 00 0xF963 imp Nak 303 600 0008 05 00 40 00 Idle Time Starnp Idle Time Starnp E i Data CRC 2446 5949592 0000 08 OO 01 00 02 24 04 00 0xF963 Yes 303 700 ps 0006 05 00 40 00 Idle Time Starnp 14 800 ps 00004 196 9319 w Argn Seqn HES Idle Time Stamp HA oL Flo ES HOR o oxo 1 1 4 ora Implicit NAK Packet 14577 is a data packet sent by the piconet Master device Packet 14579 should have been a data packet with an
57. Step2 Press Next to advance to the Recording Type screen The following screen will display Recording Wizard i x Recording Type Select the desired wizard recording type Please select the type of recording you wish to make The wizard s recording type combined with other parameters you will be asked to set in the following pages will be used to determine the synchronization method for this session wan to establish a new piconet and have Merlin Mobile record traffic on that piconet want Merlin Mobile to record traffic on a piconet that has already been established Ol am using Bluetooth Test Mode and want Merlin Mobile to record traffic on my test piconet Back Cancel Help Step3 Select the third option I am using Bluetooth Test Mode and want Merlin Mobile to record traffic on my test 55 CATC Merlin Mobile User s Manual SW Version 2 0 piconet Step4 Press Next The following screen will display Recording Wizard Test mode Step 1 of 4 x Frequency Hopping Mode Select hopping mode Most Bluetooth devices use the standard 9 frequency hopping mode however ome legacy devices may use one of the 23 frequency hopping modes specific to certain countries Please select the frequency hopping mode used by Your Bluetooth devices Notice that you can choose the Reduced or Fixed hopping mode for test mode Standard 79 hop mode C Reduced hopping mode C Fised frequency mode
58. TC Merlin Mobile Bluetooth Protocol Analyzer from the list of devices in the Upgrade Device Driver Wizard and click Next Click Next to install the driver Click Finish to close the Wizard Check the driver version on the Driver tab of the Properties window to make sure that the driver was successfully upgraded Close the remaining open windows Updating the Driver on Windows 98 SE Step Step 2 Step 3 Step 4 Select Start gt Settings gt Control Panel from the desktop taskbar then double click on System Properties in the Control Panel window The System Properties window will open Select the Device Manager tab Look in the CATC Analyzers directory and select CATC Merlin Mobile Bluetooth Protocol Analyzer Or Look in the Universal Serial Bus Controllers directory and select CATC Merlin Mobile Bluetooth Protocol Analyzer Click the Properties button The Properties window will open CATC Step 5 Step 6 Step 7 Step 8 Step 9 Step 10 Step 11 Step 12 Merlin Mobile User s Manual SW Version 2 0 Select the Driver tab and click on the Update Driver button The Update Device Driver Wizard will open Click Next Choose Search for a better driver than the one your device is using now and click Next Enter or browse to the location of the driver and click Next Click Next to install the driver Note Ifa message appears saying that Windows cannot locate the driver click OK to close th
59. Trace Probe Cable or to the TTL to RS232 converter depending whether the signal voltage in the IUT is TTL or RS 232 e COM A Should be connected to one of the serial inputs of the 2 port RS232 to USB converter e COM B Should be connected to one of the other serial input of the 2 port R5232 to USB converter TTL to RS232 converter Should be used only when the signal voltage in the IUT is TTL and not RS 232 The DB 9 connector marked with TTL should be connected to the HCITrace Probe Cable The DB 9 connector marked with RS 232 should be connected to the RS 232 Probe connector of the HCITrace RS232 Cable 2 port RS232 to USB converter This converter is used so the serial signals can be delivered to the host machine through a USB input USB cable Connects the 2 port RS232 to USB converter to the Host machine USB port HCI Probe configurations The HCI Probe can be used in two configurations e For monitoring UART level signals e For monitoring RS232 level signals CATC Merlin Mobile User s Manual SW Version 2 0 Monitoring UART Level Signals For monitoring RS232 level signals the TTL to RS 232 converter should be used To assemble the HCI probe for this configuration perform the following steps Refer to the photo and component list shown previously for references to components a through e Step 1 Connect the DB 9 connector of the HCITrace Probe Cable a to the connector marked with
60. Trigger Position in the before Trigger color specified in the Display Options When the Trigger Position is reached the progress indicator wiggles as it waits for the trigger After the trigger occurs the field to the right of the Trigger Position fills in the post Trigger color specified in the Display Options When recording is complete the upper half of the progress indicator fills in white indicating the progress of the data upload to the host computer You should be aware of two exceptional conditions e Ifa Trigger Event occurs during the before Trigger recording the before Trigger color changes to the after Trigger color to indicate that not all the expected data was recorded pre Trigger e When you click Stop before or after a Trigger Event the Progress Bar adjusts accordingly to begin uploading the most recently recorded data The Progress Bar fills with color in proportion to the specified size and actual rate at which the hardware 1s writing and reading the recording memory However the Progress Indicator is normalized to fill the space within the Status Bar Recording Status During recording activity the current Recording Status is temporarily displayed in the next segment When you activate the Record function this segment flashes one of the following messages depending on the selected Recording Options Trigger Triggered Uploading After recording stops 29 CATC Merlin Mob
61. a New Piconet o o oooooooooooooo oo 34 R cordino ai Existine PICOS 0d DA EA Rd 44 Recordine an Vest ModE hearse arias pies 54 Recording in Reduced Hopping Mode 0 000 000 54 Recording in Single Frequency Mode 20 0 c cee 59 Chapter 5 Recording Opti0NS oooooooooo o o o 63 Recordine Modes odias putea as Sate be o 63 PIC OME E TC CORGIING rre dada daa ir eas 63 Inquiry recording ic At A 63 aa aer AAA O A we AOS a 64 Opening the Recording Options Dialog BOX oooooooooooooooooo 64 Recording Options General cctv ds da Sew ao ede 4 65 Gs as gania erana Peat dered ont dese hee Cat ede eke 65 OPON 2 ia bie ot ie E ae Ae Se Ge Cae aoe oan 66 PSS IS ric cts Bose E tur A re Tenn wees nce E ERES 66 o O Sears 67 Recordine Options PICON b sure teeda d E eo ase hale nds ets 67 Hop SEQUENCE vas da da aa 68 Sy me Methods ds ir is eae ee dene 69 Additonal Seine tit di AAA 73 DC BUC a depre rr tds rada adi 75 Recording Options Inquiry oooooooooo eens 75 Recordin Options HOM 5 a4 es Petes aed da Is Pes sas 76 HCI Window Layoutscts cscenme di vem k et Bleeds ooh ads ends T1 Recording ACITTtie rriari ria a A A ip 79 Recording Opt ns Events lt a la e aa 80 Payload Lenat ENON tii A 87 Recording Options Actions 000 cc ccc eens 87 Action Buttons Their Functions 0 0 0000 cece eee eee 88 Blue Do Men s cs aetna dude erate i eee E aE nE aE E 90 S
62. a aches AM Add 5 AT command Data Pattern AM Addr 6 PPPs Mode Ab Addr 7 BNEPs HIDs Direction ie Forward C Backward C Last match Start of the file CO End of the file Uncheck All Combining specified Event Groups C Union Packets that match ANY of the specified events Intersection Packets that match ALL of the specified events Exclusion Packets that OO NOT match opposite to the intersection or union Find all Search In Hidden Cancel The Find window divides into three areas Left area Controls the search level search direction and search origin Find All Extracts the results and place them in a separate trace Search In Hidden Searches all packets including packets that have been hidden Center area Controls the event groups to be searched The selection you make will display further choices on the right side of the Find window At the bottom are three options called Union Intersection and Exclusion that are used with multi criteria searches These options are explained below Right area Controls the specific events to be searched within the trace The box in this right section displays events from the selected Event Group The right area is context sensitive the Event Group selected in the Center area will determine what events will display on the right For example if you Select Packet Type the Right area will show you a list of packet types
63. ably have to hide hops polls and null packets and then scroll through the trace in order to find Protocol messages Expanding Protocol Messages Protocol messages can be expanded to reveal their constituent packets using any of the following methods e Left click the small downward pointing arrow in the message protocol header e Double click a message protocol header e Left click the message protocol header and choose Expand Transaction from the short cut menu 119 CATC Merlin Mobile User s Manual SW Version 2 0 9 9 Changing Protocol Assignments If a sequence of messages is assigned the wrong protocol errors will display To change or remove a protocol assignment you will need to access the Assignment menu and issue an Add Assignment command Step1 Click Erl to display L2CAP messages Note You need to view L2CAP Messages in order to have access to the A field that permits reassigning protocols Step2 Scroll through the trace until you have located an L2CAP message with a field marked A Step3 Left click the field marked A Left click Message Addr Len real A h Data Time 40 2Pkts S 0x7 4 00040 Cym R09 53 01 D9 154 711s An Assignment menu will open for assigning re assigning or un assigning protocols to messages This menu is context sensitive and will vary in content depending on the protocols in the trace The Assignment Menu Current assignment AssinedtoSDP Select an
64. al Piconet Inquiry HCI Event Groups Packet Headers Payload Headers Data Pattern Events Actions Errors CRC Error HEC Error FEC Eror FEC Threshold Exceeded T Invalid Packet Type Header Length Error Payload Length Error Sune Lost fe Uncheck All Additional Timezlot Filtering Filter Empty Timeslots Filter Timeslots on Packet Filter Save Save s Default Load Select errors for triggering Cancel Use any combination of the listed packet signaling protocol errors as a Trigger CRC Error A CRC error in the packet data payload of the previous Bluetooth data packet HEC Error An HEC header error check error in the packet header for the previous Bluetooth data packet FEC Error An uncorrectable FEC Forward Error Correction error in the packet header for the previous Bluetooth data packet Threshold Exceeded Indicates that the number of single bit FEC errors detected since the current recording started has exceeded the specified value Invalid Packet Type An invalid value was detected in the packet type field of the packet header for the previous Bluetooth data packet 86 CATC Merlin Mobile User s Manual SW Version 2 0 Header Length Error Indicates that a received Bluetooth data packet was terminated before all bits of the packet header were received Payload Length Error Indicates that the payload of a received Bluetooth data packet was e
65. al SW Version 2 0 Go to The Go To feature takes you directly to an event in a Trace Step1 Select Go To under Search on the Menu Bar You see the Go To drop down menu Go to Trigger Ezi Go to Packet Message Protocal Go to Marker 0 fo Packet Type Header 4M_ Addr DataLength FS Emp Opcode LeCap Signalling Command d L Lap CID Error Step2 Select the event you want to go to and enter the necessary information Packet Types Go to Trigger e Go to Packet Message Protocaol Go to Marker packet Type o NUL Header OM Addr d 1 POLL ShiFt M ShiFt4P Nv Find Next F3 Datalength d 3 DMI ShiFE M Lmp Opcode 9 AUK ShiFk 4 Search Direction Forward LeCap Signalling Command d Hop Freq ShiFt R 15 500 ps 00037 969 451 or AI Select the type of packet you want to go to L2Cap CID Error AL Flow 127 CATC Merlin Mobile User s Manual SW Version 2 0 Header AM_Addr _ Go to Trigger Go to Packet Message Protacol Go to Marker Pl Find Header 4M Addr Packet Type a DataLength T Find Next F3 S Lmp Opcode L2Cap Signalling Command L2Cap CID Error mber Address from the list DataLength Allows searching based on data length in bytes from the recording Da o to Trigger Go to Packet Message Protocao
66. alculator dialog for calculating various timing and bandwidth parameters in the recording file Traffic Summary Details the number and type of packets were transferred during the recording as well as message level statistics Search Positions the display to show the first packet that follows the trigger event Go to Positions the display to the indicated packet LMP L2CAP message or Packet Message Protocol Message RFCOMM TCS or SDP protocols Protocol Positions the display to a previously marked packet Go to Enables quick searching for specific events using a cascade of pop up windows Allows complex searches Repeats the previous Find operation Can also use F3 to find next Allows you to specify a forward or backward search of a trace file 24 CATC Merlin Mobile User s Manual SW Version 2 0 View Toolbars Presents a sub menu with options for displaying hiding the toolbars and an option called Customize which allows the menus and toolbars to be customized or reset to factory default Status Bar Switches display of the Status Bar on or off Unhide Cells gt Presents a menu of currently hidden cells Allows you to unhides any cells that were hidden through the Display Options dialog box View gt Display Options gt Color Format Hiding Increases the size of the displayed elements Decreases the size of the displayed elements Allows the display to wrap Device List Displays a list of discove
67. an be installed from the installation CD ROM or from installation files downloaded from the CATC website Install from CD ROM Step Insert the Merlin Mobile installation CD ROM into the CD ROM drive of the computer that will be connected to the Merlin Mobile analyzer unit The autorun program should start automatically If it doesn t start use Windows Explorer or My Computer to navigate to the CD ROM drive directory double click the file autorun exe and proceed to Step 2 If it still doesn t start navigate to the Software directory on the CD ROM double click the file Setup exe and proceed to Step 3 Step 2 Choose Install Software to start the setup program Step 3 Follow the on screen instructions to complete the installation Install from installation download Step 1 Select Start gt Run from the Windows taskbar and click the Browse button then navigate to the Disk 1 directory of the Merlin Mobile installation download Select the file Setup exe and click Open Step 2 Follow the on screen instructions to complete the installation 2 2 Hardware Installation Step 1 Insert the Merlin Mobile analyzer unit into the PC Card slot on the desktop or laptop computer that will be running the Merlin Mobile software CATC Merlin Mobile User s Manual SW Version 2 0 Step 2 The New Hardware Wizard will automatically detect Merlin Mobile and will guide you through the rest of the installation 2 3 Starting and Stopping Merli
68. as they negotiate for the Encryption Key Configuring Merlin Mobile for Encryption I gaslag dea ci mi a For Merlin Mobile to successfully decrypt traffic two steps need to be performed 1 Merlin Mobile needs to be given the PIN or Link Key for each Master Slave connection and 2 Recording needs to be begun before the Slave connects to the Master If recording is begun prior to the creating the Master Slave connection Merlin Mobile will be able to obtain the encryption key and decode encrypted traffic The following steps show how to configure Merlin Mobile for encrypted traffic Note Be sure to begin the following process prior to connecting your Slave device to the Master or Merlin Mobile will not be able to capture the Link Key Step1 Select View gt Device List The Device List appears All Devices ool Tn range In Range 000231640084 Ox020300 3700 none 02 07 03 13 53 07 7 LE archive a In Range 008037168464 OxO00000 3199 none 02 07 03 13 53 07 6 Inactive 333300112233 Ox40020C unknown none O2 OF 03 15 55 07 d Inactive OO036E102D00 Ox140680 unknown none 02 07 03 13 53 07 2 O Te ekinn Con Cn To ore ol ma bar are Ta dar ml Dd aoni nA onl ei nor oe ce a ona 148 CATC Merlin Mobile User s Manual SW Version 2 0 Step 2 Click in the row for the device of interest Step3 Click the Edit Devices button The following dialog box opens Add New Device Step4 Click the Setup button The
69. ased on Flow control e 0 e Don t care Flow works in conjunction with the Logical Channel L_CH menu you select an option from the L_CH menu and then select an option under Flow 84 CATC Merlin Mobile User s Manual SW Version 2 0 Select Don t care 1f you do not want to set conditions on Flow control Length in bytes Using both the drop down menu and the text box you can set conditions based on data field length The maximum length for a single slot packet is 29 bytes The maximum length for multi slot packets is 339 bytes The drop down menu gives you options for selecting operators such as greater than and equal to The text box to the right of the drop down menu lets you enter values The Length option works in conjunction with the Logical Channel L_CH menu you first select an option from the L_CH menu and then select an option under Length Data Patterns Clicking Data Patterns causes a text box to ES appear for entering patterns to be matched in the raw payload data Patterns of up to eight hexidecimal bytes can be entered It Errors Clicking Errors causes check boxes to appear for setting conditions for triggering or filtering based on packet signaling protocol errors You can select one or a combination of errors e Select Errors under Event Groups 85 CATC Merlin Mobile User s Manual SW Version 2 0 You see the Errors window Recording Options i l x Gener
70. at vary in appearance and content depending on the type of protocol Some Protocol Messages can be grouped into a higher level entity called a Protocol Transaction A Protocol Transaction is a row in a trace that summarizes the higher level protocol data that is transmitted between a Master and Slave device when one sends a request and the other sends back 118 CATC Merlin Mobile User s Manual SW Version 2 0 a response For example if you press Spel Merlin Mobile will locate SDP requests and responses between a Master and Slave device summarize their data Viewing L2CAP Messages in Protocol Messages If the protocol heading is double clicked the L2CAP data transfer messages that make up the protocol will display below the protocol You can also expand the protocol by left clicking the small downward pointing arrow on the protocol header 4 Data 01 02 00 lode Ident Siglen De stn GIO Flags Con Req 0x19 8s oxo044 0x 0000 2Len Me ddr i Data CRT HOR How to Decode Decoding Protocol messages is the same process as decoding LMP and L2CAP messages Using the Toolbar To decode using the Toolbar press one of the protocol decode buttons such as 1cs Pee Ej Using the Menu To decode using the menu select Setup gt Display Options Then select one of the decode checkboxes Once a decode command has been issued Merlin Mobile will create Protocol Messages in the trace You will prob
71. ate Do De whiten Fallom Master lane Entre es Advanced Press Next to begin recording or Back to return to the previous page lt Back Cancel Help The Advanced button will open the Recording Options dialog box See Chapter 7 for details on the Recording Options dialog box Step 8 Press Next to begin the recording The following screen will display Recording Wizard Test mode Step 4 of 4 i x Merlin Mobile iz now attempting to synchronize and to record traffic an the test piconet using Bluetooth Test Mode Ea quiro Select Cancel to terminate the recording and to close the wizard Peace Enis Cancel Help a7 CATC Merlin Mobile User s Manual SW Version 2 0 Step9 When the recording finishes the following screen will display You can repeat the recording by pressing the Repeat button Recording Wizard Test mode Step 4 of 4 q x Merlin Mobile has completed the recordingof traffic in the piconet in Bluetooth Test Mode Press Retry to have Merlin Mobile retry recording the traffic in the piconet Retry Press Finish to exit the Wizard or Back to return bo the previous page lt Back Cancel Help Step 10 To close the wizard press Finish 58 CATC Merlin Mobile User s Manual SW Version 2 0 5 4 Recording in Single Frequency Mode Step1 In the Recording Type window select the third radio button Recording Wizard E l x
72. ated by a vertical red bar along the left edge of the packet block TAC Taea MULL Flow Argn Seqn HES Pre CAC Time Starnp 00060 128 5315 8 5 Edit or Clear Marker To clear or edit the comments associated with a packet marker Step1 Left click on Packet for the chosen packet 107 CATC Merlin Mobile User s Manual SW Version 2 0 You see the Packet menu Set marker Time From Marker Format d Color p Hide To edit the Marker Comment Step2 Select Edit marker You see the Edit marker comment window Facket 1660 x Reference Packet for Marker Edit Functior Cancel Step 3 Edit the comment as desired Step4 Click OK To clear a Marker Step5 Click Clear marker The vertical red Marker bar disappears 8 6 Expanded and Collapsed Data Formats The data field can be expanded to display greater detail or collapsed to a compact view The Expand Collapse Data feature operates as a toggle There are three ways to toggle between the two views Double Clicking You can expand or collapse a Data field by double clicking anywhere in the Data field of a packet 108 CATC Merlin Mobile User s Manual SW Version 2 0 Left clicking a Field Arrow Many fields have small arrows in the top left corner If you left click this arrow the field will toggle back and forth between collapsed and expanded views Left facin field arrow i Data CRE Right facing 7 09 00 00 09 00 04 00 0x84
73. ave s address you can type it into the box Step9 Press Next The following screen will display Recording Wizard New piconet Step 8 of 8 q x System is Ready Initiate Search Aecord Merlin Mobile is now ready to synchronize to the piconet master when it attempts to page the pre selected Slave device using Merlin Page Sync amp Record mode ou will be prompted to establish the piconet only AFTER Merlin Mobile will enter the Synchronizing state The following options will be used Synchronization Method Page Syne Record Frequency Band Standard 9 hop mode Master address 0007 02000003 Slave address DOD4O6000006 lotial Meis hiena skate Pio De rihikern hd Advanced Press Nest to initiate the recording or Back to return to the previous page Back Cancel Help This screen displays the settings you selected 40 CATC Merlin Mobile User s Manual SW Version 2 0 The Advanced button on the right will open the Recording Options dialog box shown below This screen will show the settings you selected through the Recording Wizard have been applied to the Recording Options dialog Recording Options 3 xj General Piconet Inquiry Extemal Events Actions Sync Method Master Address Page Target Page Sync amp Record m 000102000003 el 000406000006 MSB gt L5B Additional Settings Correlation Value 33 64 57 Force Re Synchronizatio
74. aving Recordin Opuons 2 s sirra trane dd ope Ses 95 Recordinc Bl stooth Trata da eee 95 Chapter 6 Display Options oooooooooooo om 97 General Display Opuons scesero taei ae E dada 98 Setting Color Formatting and Hiding Opti0DS oooooooo 99 Setting Color Display Options nananana anaana 99 Chanomo Field Pormiats4 esses wheat ered Ae ees Ese 100 Hiding Display Options 0 00 ee eens 101 Love Midi Opus gt i cs rodeos 101 CATC Merlin Mobile User s Manual SW Version 2 0 Level Pidime Parameters 25 228 ci ccne eel eden ds idad 102 Saving Display Options 245684 areri terena erea awegies Exgeeueteeed 103 Chapter 7 Reading a CATC Trace ooooooooooooo 105 Trace View HC A acids oe Hd kde esate ine a eto BAe beh eh ass 105 Interpreting the Displayed Information 0 0 0 0 e eee eee 105 JA A Epona gs A O 106 A wees sa at eee Reet EE tena Maia Gi ig onset Bee 106 Editor Clear Marker scsi tapa papis ais 107 Expanded and Collapsed Data FormatS oooooooooooooo o 108 Hide Frequency Hops a2 ri A ia 110 Hide INS aR OMG oe sone co de hic ada EA A 110 AI A tie ae oh ae le teed eee ee dele Beth ees 111 Hide Voice SCO Packets rcis iriri a id A ia ta 111 Menus in ClckcdBlieldsc sta ar Tis ds ds ee 111 bide Unassociated Trate can ivacwacne iras nidad ad 111 Chapter 8 Decoding ProtocolsS oooooooo o o o 113 Mtro GUNG COI er A A E as 113 EMP and EC
75. ce List report Press Repeat to have Merlin Mobile search for devices once again Repeat Back Cancel Help Step6 Press Next The following window will display Recording Wizard New piconet Specify Master Device Step 6 ol 5 E d x Device Address Please select the Bluetooth device address of the master device for the piconet to be recorded The list below includes devices that Merlin Mobile has recently encountered IF pour master device i not already in this list pon may type in its device address la six digit hee value yourself Piconet Master Address Step 7 Select from the drop down menu the hexadecimal address for your Master device If you do not see your device s address you may type it into the text box yourself 39 CATC Merlin Mobile User s Manual SW Version 2 0 The following window will display Recording Wizard New piconet Specify Slave Device Step 7 0 8 i x Device Address Please select the Bluetooth device address of the slave device for the piconet to be recorded The list below includes devices that Merlin Mobile has recently encountered If pour slave device 12 not already in this het pou may type m its device address a si digit hex value yourself Piconet Slave Address lt Back Cancel Help Step8 Select from the drop down menu the hexadecimal address for your slave device into the box labeled Piconet Slave Address If you do not see your sl
76. click Save Display Options E x General Color Format Hiding Level Hiding Devices To Hide Levels To Hide AM Add 0 12345 6 7 Packets Master DOCE Save DETER Boh CCOCCCOCCE Hide HOF Hide POLLANULLs Hide ID Packets Hide SCO Voice l Hide Unagsociated Traffic Restore Factory Presets Save Save As Default Load Cancel Apply 101 CATC Merlin Mobile User s Manual SW Version 2 0 Level Hiding Parameters Use the Hiding window to hide various fields packets messages and protocols from the Trace View screen You can modify these settings at will to display a specific area of a Trace Hiding Fields The Hide Fields checkboxes allow individual fields to be hidden within a trace Click the checkbox es of your choice to hide one or more fields Hiding Packets Messages and Protocols The Hide Packets and Transactions box contains two grids of checkboxes for hiding whole packets messages protocols and traffic from individual devices The grids are labeled Devices to Hide and Levels to Hide Devices to Hide The Devices to Hide grid lets you hide traffic according to device address The grid divides into columns which represent different devices Columns labeled 0 through 7 and All represent the Active Member Address of a device By checking one of the boxes in a column you hide the traffic of the selected device or traffic from all devices if you have selected Al
77. d e Packets are numbered sequentially as recorded time stamped and highlighted to show the device status master or slave e Display formats can be named and saved for later use e Pop up Tool Tips annotate packet fields with detailed information about their contents e Data fields can be collapsed to occupy minimal space in the display which can in turn be zoomed in and out to optimize screen utilization e The display software can operate independent of the hardware and so can function as a stand alone Trace Viewer that may be freely distributed 8 2 Interpreting the Displayed Information Pre ZAC Trail EEN Flow Argn Seqn PEC CA Data C aos e eoll m a 1 ee Idle Time Starnp 1 458 ms 00006 135 9625 The following table describes the abbreviations used in the Merlin display Packet 0 is described from left to right Packet Packet Event Number T M T S M Master Device Transmitting S Slave Device Transmitting Freq Current Hop Frequency in MHz Pre Preamble of the Sync word 105 CATC Merlin Mobile User s Manual SW Version 2 0 Packet Packet Event Number CAC Channel Access Code Trail Access Code Trailer of the Sync word Addr Active Member Address DM1 DMI Packet Type Flow ACL Link Flow Control Arqn Acknowledgment Indication Flag Seqn Sequential Numbering HEC Header Error Correction Code L_CH LMP Message L2FL L2CAP Flow Control Fla
78. d the bus traffic is saved to the hard drive as a file named data tfb or whatever name you assign as the default filename While the file is being saved you should see a brown progress bar at the bottom of the screen When the bar turns white it indicates that the data has been saved to disk CATC Merlin Mobile TM Bluetooth Protocol Analyzer C Program Files CATC Merlin Generalinauiry biet m ioj x E Fie Setup Record Report Search View Window Help 8 x S a R S BS E ig REL Record riconet gt Qh 4 GM Se EL Bee Np AO ox L2 SDP SDP rcg RF OB ay HD HC AV AV BN Pie Hct uw Ep RE rcs BE 9B ar BP ver YG AY BD AY aD iP re uP Idle Time Stamp 19 000 ps 00000 747 1690 peas BG FAS Flow Argn Segn HEC Parity LAP SR SP UAP NAP poxd ox2 1 o 1 0x20 0x35406cBE9 oxocorac Rt PO OxEC 0x0001 COD Addr CRC Idle Time Stamp Idle Time Stamp 19 000 ps 00001 058 1265 Ba AS Flow Argn Segn HEC Parity LAP SR SP UAP NAP 4 foo o2 1 0 1 Jowc oasamscaeo oxocorac R1 Po oxec 0 0001 COD Addr CRC Idle Time Stamp Idle Time Stamp Ere e Flow Argn Segn HEC Parity LAP SR SP UAP NAP ox ox 1 o 1 Joxc 0x3c0517886 Ox0CDF9A R1 PO oxEC 0x0001 COD Addr CRC Idle Time Stamp gt Is analyzer connected configured Search 74 Step 6 To save a current recording for future reference Select Save As under File on the Menu Bar OR Click on the Tool Bar You see the standard
79. d to make the number of ones in the data bits even This will enable error checking e Odd Parity bit is added if it is needed to make the number of ones in the data bits odd This will enable error checking e Mark Parity bit is added but is always set to 1 78 CATC Merlin Mobile User s Manual SW Version 2 0 Stop Bits Changes the time between each character being transmitted where time is measured in bits Edit The Edit button reopens the Add HCI Configurations dialog box so you can edit your settings Be sure to select an entry in the HCI Configurations list before clicking Edit Delete The Delete button allows entries to be deleted from the Configurations List 6 7 Recording HCI Traffic To record HCI traffic from an IUT enter data in the HCI window Step1 In Recording Options go to the HCI page and click Add The Add HCI Trace Configuration dialog appears 4dd HCI Trace Configuration x COM Ports Cancel Controller gt Hast Com Host gt Controller Coma Protocol UART RS232 BlueCore Baud Rate bps 7600 y Parity None Data Bits Bo Stop Bits hr Step 2 Enter the pertinent data in the data fields and click OK The HCI configuration 1s shown in the HCI page of Recording 79 CATC Merlin Mobile User s Manual SW Version 2 0 options General Piconet Inquiry HCI Events Actions Implementation Under Test IOT Configurations List
80. d to select the appropriate standard from the Hop Frequency menu below Recording Options J x General Piconet Inquiry HCI Events Actions Sync Method Page Syne Record Additional Settings Correlation Value 33 64 Inquiry Timeout 0 80 sec Loss of syne Timeout 1 16 sec Master Address Page Target 000102000003 ol 000406000006 MSB gt L5B Force Re Synchronization M Follow Master Slave Switch Match Clock Rate Show Paging Traffic Er i E Initial De whitening State De whitening On C De whitening Off Debug T Enable CATC debug file Saves as Save s Default Load Cancel Ok 19 CATC Merlin Mobile User s Manual SW Version 2 0 Step 4 Click OK to close the Recording Options window and activate the recording options you selected At this point Merlin Mobile will be ready to record Inquiry Recording Merlin Mobile can also record an inquiry process where the Merlin Mobile performs a general inquiry and asks local devices to identify themselves Step 1 Click the down arrow on the right side of the Record Piconet button on the toolbar REL Record Piconet A sub menu appears with options for Piconet Recording Mode and Inquiry Recording Mode Step 2 Select Inquiry Recording Mode The button changes appearance and shows the label Record Inquiry REC Record Inquiry Step 3 From the menu select Setup gt Recording Opti
81. data 118 Explicit NACK 142 External input signals 88 95 trigger form 102 F Features 5 FEC Error 94 FHS packet 90 File information displaying 150 File menu 33 Filename and data 18 Filter In Out button 97 Filter Out In 100 Filtering 89 90 Find feature using 146 Finding 140 Finding devices 46 Flow 116 Fonts 155 Force resynchronization 81 Frequencies DUT 77 Frequency hops hiding 120 G General description 2 General features 5 General inquiry 19 80 83 General options recording 71 General purpose output 102 Go to DataLength 138 error 140 Header AM_ Addr 138 L2Cap CID 140 Lmp Opcode 139 marker 136 packet types 137 packet Message Protocol 135 Graphs 156 SW Version 2 0 CATC Merlin Mobile User s Manual areas menu 155 bus utilization 153 buttons 155 Grid lines 154 on Top 154 Groups events 88 H HDLC 124 Headers AM_Addr 138 length error 95 packets 90 payload 91 HEC 116 HEC Error 94 Help menu 35 Hexadecimal patterns searching 145 HID 124 Hiding 120 121 Higher protocols decoding 123 High pulse output 102 Hops hiding 120 reduced mode 64 sequence 19 Hot keys 41 Humidity 7 HV1 2 3 packet 90 I Idle 116 Implicit NACK 142 Information interpreting 115 Input signals 88 95 Inquiry dedicated 19 general 83 perform skip 45 recording 19 timeout 19 82 Installation basic 9 Interpreting a trace 115 157 SW Version 2 0 CATC Merlin Mobile User s Manual Intersection search 146 Intro
82. data such as RFCOMM TCS OBEX or SDP data the message displays this data in an undecoded format that can be decoded later Data Time 0000 02 AA BB 00 08 35 03 19 Undecoded higher protocol data T Addr MN DJ L2cID A Dyn 0x00441 El ackets L2Le 9 3 Decoding and Viewing Protocol Data Higher protocol data can be decoded two ways by clicking a decode button on the toolbar or by selecting a decode command from a pull down menu L2 SDP SDP yog EF OB HD HC AV AY BN HCI ump 13 22 PE tes BE aD D Bee TC AV 5 EN HD IP IP TCP UDP Decoding Via the Decoding E Toolbar The Decoding Toolbar has ten buttons for decoding packets messages and protocols e Pkt Display Packets e HCI Display HCI Protocol e LMP Display LMP Messages e L2CAP Display L2CAP Messages e SDP Msg Display SDP Protocol Messages e SDP Tra Display SDP Transactions e TGS Display TCS Protocol messages e RECOMM Display RECOMM Protocol e OBEX Display OBEX Protocol e AT Display AT Commands Protocol e HDLC Display HDLC Protocol e PPP Display PPP e HCRP Display HCRP e AVCTP Display AVCTP e AVDTP Display AVDTP e BNEP Display Bluetooth Network Encapsulation Protocol e HID Display HID Protocol 114 CATC Merlin Mobile User s Manual SW Version 2 0 e IP Display IP e TCP Display TCP e UDP Display UDP For example to display LMP messages click up Note Once a decode has be
83. duction 1 Invalid packet type error 94 K Keyboard shortcuts 41 L L_CH Logical Channel 92 116 L2CAP channel connections 127 CID searching 140 described 124 messages 121 123 126 L2FL 116 Len 116 Length of data 93 License 163 Limited inquiry 19 Linking events 98 LMP described 124 messages 123 126 Opcode 139 Logical Channel 92 Long pattern searching 145 Loss of sync searching for 140 timeout 82 Low pulse output 102 M Manual trigger 7 18 74 Markers editing and clearing 117 searching 136 setting 116 Master and slave 142 switch 81 Master address 60 Match clock rate 81 Memory Recording 7 Menus blue dots in events 100 clicked fields 121 158 SW Version 2 0 CATC Merlin Mobile User s Manual pulldown 33 view settings 154 Merlin configure encryption 159 description of 2 Message searching 135 Messages LMP L2CAP 123 126 transfer 126 Modes test recording in 64 N NULL packet 90 Nulls hiding 120 O OBEX 124 Opcode 116 Operating temperature 7 Options general recording 71 name 18 search 62 Orient horizontally 154 Output signals enabling 102 Overview 1 33 P Package dimensions 7 Packets 1100 1101 90 AUX1 90 DM1 2 3 90 DV 90 FHS 90 headers 88 90 headers in 90 hiding 112 HV1 2 3 90 invalid type error 94 NULL 90 POLL 90 searching 135 137 types 90 142 159 SW Version 2 0 CATC Merlin Mobile User s Manual viewing 126 Page sync and record 88 Paging traffic 82 Passiv
84. e 0 0 0 eee 9 Update Me DIV dida E 9 Updating the Driver on Windows 2000 o o ooooooooooooo 9 Updating the Driver on Windows 98 SE o o o ooooooooo ooo 10 Updating the Driver on Windows M8 o ooooooooooooooo o 11 Updating the Driver on Windows XP o ooooooooooooo 12 license KEYS aso 2 540205 Onda cri ii oo cad 12 Update License pareira ete in oe eae wees 12 License TM Onin aiOn ereenn mite pR n WR dw Bed Wee he ee Be eee 13 Installing the HCI Probes ii veto aba es At 4 E eS 13 HCI Probe configurations 00 ai ata 14 2 port RS232 to USB converter 0 0 0 en 16 Your First Bluetooth Recording isidro ee eee di bs 17 Inquiry Recording ido ss Ped tte dient dda dd 20 Chapter 3 Software OvervieW ooooooooooooo 23 The Mam Display WINDOWS slats Gee as 23 JA O An A E T A ae E oe eae ake 26 A O O 28 Recording Prostre blas dork a e e SoG WO ere aaa Ole ea Ras ean eG 28 Status Bar Position Definitions o oooooooooooooooooooo o 28 Recordin MAUI seaside seas 29 ANALY ZC SAWS ss ss eae wes Ga Gas See A ee ee ios 30 SiS ige MNS CALS fan dear A 31 LOMA AA We ele he dod A AAA 31 CATC Merlin Mobile User s Manual SW Version 2 0 ZOOM dad asa AMA ee a Rade 31 SOOM A E ee Geter en eas 31 Merlin Analyzer Keyboard Shortcuts 0 0 0 0 0 000000 31 Chapter 4 Recording Wizard ooooooooooo o o 33 Startino Recording Ward o al AAA AA 33 Recording a Traffic on
85. e information for the analyzer Information About Merlin Displays version information about Merlin 3 2 Toolbar The Tool Bar provides access to the most popular program functions Tool tips describe icon functionality as the mouse arrow is moved over the 1con 1tem gt al R E ER rota DUNE El Bap Np WY 0 ix i apogeu i L SDP SDP pce RE OB ay HD HC AV AV BN a HCT me HB BE PE rcs Be Bat AU pep He oY inp Pop HID IP TCP UP y Li Lar Open file CAP View Hide L2CAP Message Level Save As heg View Hide SDP Message Protocol Level View Hide SDP Transaction Protocol Level Preview Print View Hide TCS Protocol Level 3 e AE 2 la xs Setup Record Options View Hide RECOMM Protocol Level REC Record Piconet rele Start Recording presents options for recording piconet inquiry or IUT HCI traffic View Hide OBEX Protocol Level Stop Recording View AT Commands Protocol Level Execute manual trigger ES Causes analyzer to trigger end of recording 3 a View Hide HDLC Protocol 3 Start Recording Wizard View Hide PPP 26 CATC Kee lt 2 ma ja la a A Merlin Mobile User s Manual Bluetooth Neighborhood Performs an inquiry and then lists the local devices that it discovered Start Merlin s Wand Setup Display Options Zoom In Zoom Out Wrap Hide Frequency Hops Hide Nulls amp Polls Hide ID Packets Hide Voice SCO Packets Hide device
86. e message box and then enter or browse to the location of the driver to continue Click Finish Click the Driver File Details button to check the driver version and make sure that the driver was successfully upgraded Close the remaining open windows Updating the Driver on Windows Me Step Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Select Start gt Settings gt Control Panel from the desktop taskbar then double click on System Properties in the Control Panel window The System Properties window will open Select the Device Manager tab Look in the CATC Analyzers directory and select CATC Merlin Mobile Bluetooth Protocol Analyzer Or Look in the Universal Serial Bus Controllers directory and select CATC Merlin Mobile Bluetooth Protocol Analyzer Click the Properties button The Properties window will open Select the Driver tab and click on the Update Driver button The Update Device Driver Wizard will open Choose Automatically search for a better driver and click Next The Select Other Driver window will open Select the newest driver and click OK The driver will install Click Finish Click the Driver File Details button to check the driver version and make sure that the driver was successfully upgraded CATC Merlin Mobile User s Manual SW Version 2 0 Step 10 Close the remaining open windows Updating the Driver on Windows XP Step 1 Select Start gt Contro
87. e sync and record 78 Patterns data 93 Payload headers 88 91 length error 95 Percentage of triggering 75 Phone numbers Technical Support 163 Physical Components 5 Piconet established devices 79 master address 60 private device 79 recording 19 50 54 recording traffic on 44 sample 3 search options 62 slave address 50 sync and record 79 synchronizing 50 target address 61 Wizard 51 PIN 159 Pkt 124 Polls hiding 120 POLL packet 90 Position of trigger 75 Post triggering percentage 75 Power LED 7 Switch 7 PPP 124 Pre triggering 75 Private Device Piconets 79 Program installation 11 Progress indicator recording 38 Protocol Analyzer 2 160 SW Version 2 0 CATC Merlin Mobile User s Manual Architecture 3 decoding 124 searching 135 Pull down menus 33 Pulse low signal 102 Pulse toggle signal 102 R Reading a trace 115 Record inquiry 83 Record menu 33 Recording Bluetooth traffic 18 105 existing Piconet 54 LED 7 memory 7 mode 19 Piconet 50 progress indicator 38 reduced hop mode 64 session 21 type 73 Recording Options events 88 general 18 71 73 in Wizard 51 saving 104 Recording type 54 Recv DUT freq 77 Reduced hops 64 Reports menu 33 Restart button 98 Resynchronization forced 81 RFCOMM 124 S Sample Piconet 3 recording 21 Saving recording options 104 SDP Msg 124 Search 48 duration of 56 161 SW Version 2 0 CATC Merlin Mobile User s Manual general 58 Search men
88. eceive signal for the Device Under Test Sync Method To record Bluetooth traffic Merlin Mobile needs to synchronize to the piconet under observation Merlin Mobile does not participate in the piconet and behaves as a passive listener It needs however to communicate briefly with the devices in the piconet to learn the Master clock and frequency hopping sequence Sync Method options let you configure how Merlin Mobile synchronizes to the piconet under observation There are three options e Sync and Record e Passive Sync amp Record e Page Sync amp Record Note Ifthe selected Hop Sequence is Reduced Hop or Single Frequency the Sync Method is set to Test Mode and cannot be modified by the user To the right of the Sync Method menu are two menus which let you select or enter address for the devices in the piconet Master Address Presents a drop down list of Master devices found previously You can also enter address values in this box Page Target Presents a drop down list of Page Target devices found previously You can also enter address values in this box Between the two text boxes 1s the following button 2 Swaps the Master and Page Target addresses When to Use the Different Piconet Recording Modes Page Sync amp Record 1s the preferred option and should be used whenever possible If Page Sync amp Record can not be used then Sync amp Record should be used Passive Sync and Record should be used only
89. ecord operation By default Force Re Synchronization is disabled 1 e unchecked Unchecking the Force Re Synchronization checkbox tells Merlin Mobile to use its existing data on Bluetooth devices thereby bypassing the synchronization process and saving a few seconds from the beginning of the trace If you know that Merlin Mobile s data is correct you can uncheck this checkbox and cause Merlin Mobile to use the existing data If the data is incomplete or incorrect however Merlin Mobile will automatically perform a refresh To examine Merlin Mobile s Bluetooth data open Device List View gt Device List Follow Master Slave Switch If enabled this option allows Merlin Mobile to follow a role switch between a Master and Slave This capability allows Merlin Mobile to keep track of changes in a device s role when it changes from one role to another Merlin Mobile is able to follow a role change by listening to the Slave device s Bluetooth clock and hop frequency as soon as it becomes a Master Match Clock Rate Match Clock Rate is a useful option if the Master device s clock is inaccurate Match Clock Rate causes Merlin Mobile to do a General Inquiry to determine the Page Target s clock rate prior to synchronizing to the piconet If unchecked Merlin Mobile will begin piconet synchronization without first doing a General Inquiry This option only works with Page Sync and Record mode 73 CATC Merlin Mobile User s
90. ect the second option I want Merlin Mobile to record traffic on a piconet that has already been established Step4 Press Next 45 CATC Merlin Mobile User s Manual SW Version 2 0 You will see two choices Recording Wizard Existing piconet Step 1 of 9 Inquiry Skip Perform Select to perform or to skip a general device inquiry fou can choose to skip a general device inquiry if such was already done Otherwise please select to perform the inquiry The inquiry i needed so the piconet devices can be selected hor synchronization and recording i Perform Inquiry Mow Skip Inquiry Back Cancel Help Step5 Select Perform Inquiry Now You will see two choices Recording Wizard Existing piconet Step 2 of 9 Device Search Type Select group general device search Merlin Mobile can ether search for all Bluetooth devices in range or it can search only for devices within a specific group Search groups are defined by a 24 bit Dedicated Inquiry Access Code DIAC f want to search for all Bluetooth devices within range a want to search only for devices in the search group corresponding to the following hexadecimal DIAC jseseno Step 6 Select the first option I want Merlin Mobile to search for all Bluetooth devices within range 46 CATC Merlin Mobile User s Manual SW Version 2 0 If you want to limit the inquiry to a class of devices select the second option and enter the
91. eld upgradeable firmware and BusEngine Software operates as a stand alone Trace viewer Connects to the host computer through an available Type II PC Card slot One year warranty and hotline customer support Traffic Generation CATC Merlin Mobile User s Manual SW Version 2 0 Traffic generation capability is provided by Merlin s Wand e Bluetooth BusEngine CATC s BusEngine Technology is at the heart of the new Merlin Mobile Analyzer The revolutionary BusEngine core uses state of the art EPLD technology and incorporates both the real time recording engine and the configurable building blocks that implement data state error detection triggering capture filtering external signal monitoring and event counting amp sequencing And like the flash memory based firmware that controls its operation all BusEngine logic is fully field upgradeable using configuration files that can be downloaded from the CATC Website CATC Merlin Mobile User s Manual SW Version 2 0 CATC Merlin Mobile User s Manual SW Version 2 0 2 Getting Started This chapter describes how to install Merlin Mobile and its software how to start Merlin Mobile and how to set up the analyzer unit 2 1 Installing Merlin Mobile Merlin Mobile can be installed on any PC or laptop computer that uses the Windows 98 SE Windows Me Windows 2000 or Windows XP operating system and has a functioning PC Card slot Software Installation The Merlin Mobile software c
92. en tested and found to comply with EN55022 1994 A1 1995 A2 1997 Class A EN61000 4 2 1995 EN61000 4 3 1995 EN61000 4 4 1995 EN61000 4 5 1995 EN61000 4 6 1995 EN61000 4 11 1994 EN61010 1 1993 and ESTI EN 300 328 1 V1 2 2 2000 07 Manual Version 2 0 Part number 730 0032 00 CATC Merlin Mobile User s Manual SW Version 2 0 CATC Merlin Mobile User s Manual SW Version 2 0 TABLE OF CONTENTS Chapter L OVerVICW sas wise sand Wa os oa ee ae eae Bluetooth Speci Cavion ii a5 SS BAR Le ARERR Ee ERS 2 Merlin Mobile Analyzer System Components 0 00 2 Merlin Mobile Specifications 0 0 0 0 0 ccc eens 2 System REGUIFEMENtSs cotarro PE awe re de dd e rana 3 Using Merlin Mobile with Merlin s Wand 0 0 0 0 ee 3 Merlin Mobile Automaton ss rica ds ies 3 A AA O eee eR Oe Sak eee ITA 4 Features OL Merlin Mobiles sir bh ithe poe dato haa eee oases 4 Chapter 2 Getting Started ooooooooooooom o oo m ooo Installino Merin Mobile o A a Ree ence o ass 7 Sotware Installation orador 7 H rdware Installation So id She in annie ais de a 7 Starting and Stopping Merlin Mobile o ooooooooooooooooooo 8 Startins the Application seal ad ee Mow Rass Se Rela es 8 Exitine the Applhicauion 3 2 oss A Siri AAA 8 Starting the Analyzer Unit 2 2 eee ees 8 Shutting Down the Analyzer Unit 0 0 0 0 000000 eee 8 Displaying Helps avispas das priori dd deeded 9 Updating the BusEngine and Firmwar
93. en Merlin Mobile senses Piconet traffic the Green Sync light goes ON solid recording starts and the status bar in the bottom of the analyzer screen shows activity Recording may be stopped manually or when the recording buffer is filled Note After the Sync light starts blinking a connection between the Bluetooth devices should be established within one 1 minute Passive Sync amp Record Passive Sync and Record is used in situations where the Master device and slave devices do not support Inquiry Scan mode When selected Merlin Mobile enters Inquiry Scan and Page Scan mode and waits for a page from 70 CATC Merlin Mobile User s Manual SW Version 2 0 the Master device When the piconet Master pages Merlin Mobile Merlin Mobile obtains the information necessary for synchronization and then attempts to synchronize to the piconet controlled by that Master Passive Sync and Record is designed to be used with established piconets or private device networks Running Passive Sync and Record with Established Piconets For most situations Passive Sync and Record will be run after a piconet has been established The steps are as follows Step 1 Establish a connection between two or more Bluetooth devices Step 2 Under General Recording Options select Passive Sync amp Record Step 3 Under the Modes tab in Recording Options enter the address for the piconet s master device Step4 Make up an address for Merlin Mobi
94. en performed it will probably be necessary to scroll through the display to find the decoded messages or protocols You can shorten your search by first clicking the Hide Unassociated Traffic button E Decoding Via the Display Options Dialog Box The Display Options dialog box has three options for issuing decode commands To issue a command Step 1 From the menu bar select Setup gt Decoding Options Display Options E x General Color Format Hiding Level Hiding Trace Viewing Level e Packet W Enable Tips T Right click cell context menu FT HCI IY tap LMP Message TT L2CAP Message T SDPmeg ltem SOP Transaction Fields Arial B i T TCS Item TF RFCOMM Item Data Courier New B i OBEX TAT command Display Configuration Mame HDLC frame care default PPP HCRP Transaction avCTP M AVDTP BNEF M HID IF protocol TEP protocol UDP protocol oom Level Restore Factory Presets Save Save s Default Load Step2 Select the option for the desired level of decoding Step3 Click OK or Apply 115 CATC Merlin Mobile User s Manual SW Version 2 0 9 4 Tooltips Additional information about fields can be attained by positioning your mouse pointer over a field of interest A tooltip will appear that will provide details about the field In some cases there can be a considerable amount of information available lode Siglen De stn cit Sre Gl Result c
95. ename 18 reading 115 163 SW Version 2 0 CATC Merlin Mobile User s Manual sample 21 Traffic Bluetooth 105 generation 6 hiding 121 on Piconet 54 paging 82 recording 62 recording on piconet 44 searching 135 summary 156 Trail 116 Transfer message data 126 Trigger event 74 external form 102 LED 7 position 18 75 post triggering 75 recording manual 74 Type of recording 73 U Unassociated traffic hide 121 Union search 146 y Values changing counters 100 View menu 33 options 36 packets 126 settings menu 154 W Warranty 163 Weight 7 Window menu 35 Wizard Piconet 51 X Xmit IUT freq 77 Z Zoom 41 164 SW Version 2 0
96. erter d Step 4 Connect the USB cable not shown to the USB connector of the 2 port RS232 to USB converter d 2 port RS232 to USB converter The 2 port RS232 to USB converter d allows the user to connect two serial connectors to the host machine via a single USB connection When connected to the host machine the converter emulates two separate virtual COM ports that can be used as other real COM ports Prior of using this converter as part of the HCI probe several drivers need to be installed The drivers are provided on the installation CD ROM in the HCI Probe Drivers sub directory Once the converter is connected to a host machine the user is prompted to provide the place where the system can install the drivers from CATC 2 9 Step 1 Step 2 Merlin Mobile User s Manual SW Version 2 0 After installing the drivers two new COM ports are going to be available as seen in the following snapshot of the Device Manager E Device Manager Action view E E MICKEY E CATE Analyzers c Computer E Disk drives a ee ed 2x Hii DYDICD ROM drives H Floppy disk controllers General Fart Settings Driver H E Floppy disk drives Sy IDE ATAJATAPI controllers F USB Serial Port COM3 HES keyboards Bey Mice and other pointing devices ul Monitors Device kupe Ports COM amp LPT a Network adapters E 4 Ports COM amp LPT PA A Communications Port COM1 Location on USB High Speed Serial C
97. event occurs some post trigger recording occurs then the recording ends Note In this mode the recording can be stopped manually in the same way as for manual trigger mode Options The Options box contains two options Beep When Trigger Occurs Options Will cause the PC to beep when a trigger event has occurred Beep When Trigger Occurs Save External Interface Signals Save External Interface Signals Will enable Merlin Mobile to record input signals from a breakout board as fields in a trace Buffer Size Buffer Size The Buffer Size box has a slide bar for adjusting the 1 000 MB recording buffer size from 0 4 megabytes to 512 megabytes 66 CATC Merlin Mobile User s Manual SW Version 2 0 The Recording Type option determines how this buffer 1s used Although there are 512 megabytes of physical memory in the analyzer the efficiency of the recording ranges from 2 1 to 4 1 ratios of physical memory to actual Bluetooth traffic Shorter Bluetooth packets yield a less efficient recording The non traffic portion of physical memory is utilized for control and timing information Note The scale is not linear and affords more granularity in the smaller buffer sizes Trigger Position 6 4 The Trigger Position slide bar sets the amount of post trigger recording that Merlin Mobile will perform It also allows adjustment of the location of a hes eae ae the trigger within the defined buffer You can adjust 1 t
98. f significant drift occurs between Merlin Mobile s clock and that of the Master Merlin Mobile may not be able to sync properly to the piconet Under these conditions you should move the slide bar towards the Wide Setting The slide bar has five discrete settings After sync 1s established Merlin Mobile will remain in sync as long as there is piconet traffic 74 CATC Merlin Mobile User s Manual SW Version 2 0 Debug Enable CATC debug file Checking this box enables the creation of a file that can be used by CATC Support to aid in debugging This option should always be disabled unless you are requested to enable it by CATC personnel 6 5 Recording Options Inquiry The Inquiry page configures how Merlin Mobile records Inquiry traffic Two main options are presented in the Sync Method drop down menu General Unlimited Inquiry and Dedicated Limited Inquiry These options tell Merlin Mobile what kind of Inquiry traffic it should expect to record This page includes settings only for Inquiry recording and BT Neighborhood General Unlimited General means General Inquiry and is used to search for ALL Bluetooth devices that are within range for the amount of time specified in the Inquiry Timeout field Completion of the inquiry process 1s indicated by illumination of the trigger light on the front of the analyzer All responding packets will be displayed when data upload from the analyzer completes Dedicated L
99. fic Summary for more information 10 7 Timing Calculations Starts the modeless calculator dialog for calculating various timing and bandwidth parameters in the recording file To display a File Information report e Select Timing Calculations under Report in the Menu Bar OR Click Dl in the Tool Bar 142 CATC Merlin Mobile User s Manual You see the Timing and Bus Usage Calculator screen Timing Calculator oo zi From beginning of si Packet o or Packet 0 Trigger To beginning of Packet o or Packet 0 Trigger Total Time nanoseconds Y Ar traffic calculations al AM Address Throughput Bit Error Rate ALL Calculate To calculate bus usage and bit rate errors SW Version 2 0 Step1 Enter the range of packets to be examined in the text boxes marked From packet and To packet Step 2 If you wish to limit your calculations to a single device select the device s address from the AM Address drop down menu Step3 Click the Calculate button At this point bus usage will be calculated 10 8 Bus Utilization The Bus Utilization window displays a graph of bandwidth use within a displayed trace 143 CATC Merlin Mobile User s Manual SW Version 2 0 To open the Bus Utilization window select Report gt Bus Utilization or click the button marked tul A window will open with graphs of Link Utilization Data Throughput and Packet
100. figured Search 74 5 2 Recording an Existing Piconet Using Recording Wizard to record an existing piconet 1s similar to recording anew piconet The main difference is that you will be asked if your Master device can support multiple slave devices and whether it can respond to pages once it has created a piconet with another device Step1 To start the Recording Wizard press S or select Setup gt Recording Wizard from the menu 44 CATC Merlin Mobile User s Manual SW Version 2 0 The Recording Wizard introductory page will open x Welcome to the Merlin Mobile Recording Wizard This wizard will help you configure Merlin to detect nearby Bluetooth devices and record Bluetooth piconet traffic Back Cancel Help Step2 Press Next to advance to the next screen You will see three choices Recording Wizard q ig x Recording Type Select the desired wizard recording type Please select the type of recording you wish to make The wizard s recording type combined with other parameters you will be asked to set in the following pages will be used to determine the synchronization method for this session want to establish a new piconet and have Merlin Mobile record traffic on that piconet want Merlin Mobile to record traffic on a piconet that has already been established o am using Bluetooth Test Mode and want Merlin Mobile to record traffic on my test piconet Back Cancel Help Step3 Sel
101. g Len Message Length in Bytes including Opcode TID LMP Transition initiated by Master Opcode LMP host_connection_req CRC Cyclic Redundancy Check Ack d Packet Acknowledgment based on subsequent packet s ARQN with same AM_ADDR Idle Idle Time in nanoseconds Time Stamp Decimal in Seconds Milliseconds Microseconds 10 This is the analyzer internal clock as a reference with resolution of 100 ns 8 3 Tooltips You can get additional information about E each field in a trace by holding your uba 1 o Joxs7aol mouse pointer over a field A tooltip will appear with details about the field 8 4 Set Marker Note Set Marker works in conjunction with the Go to Marker feature You can define a unique Marker for each packet To place a marker on a packet Step1 Left click on Packet for the packet you wish to mark 106 CATC Merlin Mobile User s Manual SW Version 2 0 Step2 Select Set Marker e 0x5 OxBO0010EDDE728F19 0x4 0x1 DA juau 1 62 Data Set marker 00 09 EF 6D 7E FF 7D 23 CO 21 7D 24 7D 22 7D 20 7 eens 96 SF Cl 8A 7D B1 7D 2B 7D 20 20 7D 26 66 C1 El Pvt E Time Stamp Color gt 00022 918 7387 Hide i 5 2 Pe You see the Edit Marker Comment window where you can enter a unique comment about this packet Edit Marker for Packet 1 El Press Ctrl Enter gt to Insert a line break OK Cancel Step3 Enter your comment Step 4 Click OK A marked packet is indic
102. g Data The Export command under the File menu allows you to export trace data for use in a spreadsheet text editor or other utility The Export command supports three formats Export Packets toText Packet View Format Saves all or part of a trace to a text file Selecting this option opens a dialog box that prompts you for a range Enter the range then click OK The data is then exported to a text file Export Packets Messages Protocols to text i x From Packet y o or Markers ifs Packet 26642 or Markers Reset Range to Whole Trace Cancel Export Packets to CSV Text Saves all or part of a trace to a Comma Separated Values CSV file suitable for viewing in a spreadsheet application The steps are the same as those described above 140 CATC Merlin Mobile User s Manual Export gt gt Audio Streams Saves audio data into a file Opens a dialog box with options for setting the Audio Source format Output File format Stream Direction and Output Sampling 10 5 File Information Export Audio Streams Available Streams x Stream 1 AM ADDA 1 Packets 16 19342 Stream Information LMP configuration matching this stream was found SCO Handle 129 Audio Format CYSD Packet Type H43 AM ADOR 1 Facket Range 16 19342 Data Direction M 25 5 gt M M 5 Packets 9343 5 M Packets 9348 Source 4udio Format Stream Direction ESO Pe Combine MMS Ou
103. he General Inquiry completes the addresses will populate the menus marked Master Device and Page Target Select or enter the addresses for both your Master Device and Page Target Click OK at the bottom of the window to close the Recording Options dialog box Press the REL Record Piconet button found on Merlin Mobile s toolbar After approximately 20 seconds the SYNC light on the front of Merlin Mobile will begin to flash meaning that Merlin Mobile has acquired all the information 1t needs to fully synchronize with the piconet about to be established At this point you should establish the piconet using the devices previously defined as master and slave Inquiry Timeout is configurable 0 to 80 seconds in the Recording Options General page 12 CATC Merlin Mobile User s Manual SW Version 2 0 Step6 When the piconet is established the Sync light on the front of Merlin Mobile will change from flashing to solid indicating that Merlin Mobile is fully synchronized to the piconet and 1s currently recording all traffic within that piconet Note If the sync light on the front of Merlin Mobile does not change from flashing to solid it means that Merlin Mobile did not synchronize with the piconet when it was established Additional Settings Force Re synchronization Force Re Synchronization forces Merlin Mobile to re synchronize at the beginning of each Sync amp Record Passive Sync amp Record or Sync amp R
104. he Triggering Position between 1 and 99 post Trigger Trigger Position is available only when Manual Trigger or Event Trigger is selected as Recording type Trigger Position BU 2 post triggering As an example if the buffer size is set to 16MB then for the following Trigger Position settings the amount of pre and post Trigger data is e 95 post triggering 0 8MB pre trigger 15 2MB post trigger e 75 post triggering 4MB pre trigger 12MB post trigger e 50 post triggering 8MB pre trigger 8MB post trigger e 25 post triggering 12MB pre trigger 4MB post trigger e 5 post triggering 15 2MB pre trigger 0 8MB post trigger Note When a Trigger occurs recording continues until the post Trigger amount of the buffer is filled Recording Options Piconet The Recording Options dialog box has two pages for configuring how Merlin Mobile records Bluetooth traffic Piconet which configures piconet recording sessions and Inquiry which configures inquiry recording Sessions 67 CATC Merlin Mobile User s Manual SW Version 2 0 For recording in Piconet mode the Piconet page lets you specify the type of piconet you will be recording and how Merlin Mobile should synchronize and record the piconet This window 1s divided into four boxes marked Hop Sequence Sync Method Additional Settings and Debug Recording Options l 7 x General Piconet Inquiry HCl Events Actions Sune Method Master Address Page Target
105. hexadecimal value for the device class in the text box Step7 Press Next The following screen will appear Recording Wizard Existing piconet Step 3 of 9 x Device Search Duration Specify duration of Search Aecord How long should Merlin Mobile search for nearby Bluetooth devices Any search duration between one and eighty seconds may be specified However a duration of between ten and twenty seconds should be enough time for Merlin Mobile to detect all nearby devices Search for ai seconds for nearby devices Back Cancel Help Step8 If you want to change the search duration type in a new value into the text box Otherwise use the default value 20 seconds then press Next 47 CATC Merlin Mobile User s Manual SW Version 2 0 If Merlin Mobile cannot detect other devices the following message will display x Recording Wizard Existing piconet Step 4 of 9 General Device Search Merlin Mobile has completed the device search operation but has not found any Bluetooth devices in range ln case a nearby piconet i already established are the devices configured to respond to inguines while connected Cannot proceed to next step in wizard session until Merlin Mobile has found some devices in the neighborhood l Press Retry to have Merlin Mobile search for devices once again Retry ext gt Cancel Help If Merlin Mobile passes the hardware test it will then goes o
106. his product damages based upon inconvenience loss of use of the product loss of time or data commercial loss or any other damages whether special incidental consequential or otherwise whether under theory of contract tort including negligence indemnity product liability or otherwise In no event shall CATC s liability exceed the total amount paid to CATC for this product CATC reserves the right to revise these specifications without notice or penalty 151 CATC Merlin Mobile User s Manual SW Version 2 0 152 CATC Merlin Mobile User s Manual INDEX Symbols Numerics 1100 packet 90 1101 packet 90 A Abort upload 40 Acknowledge 142 Action buttons 36 97 Actions tab 96 Addr 116 Addresses AM_ADDR 91 Bluetooth 60 slave device 50 target 61 AM Address 142 Analyzer describing Bluetooth 2 set up 9 status 40 API 4 Application installation 11 Architecture of Piconet 3 Arqn 116 ARQN condition 91 AT 124 Authentication 159 Automation Feature 4 AUX1 packet 90 B Basic installation 9 Bit pattern searching 145 Blue dot menus 100 Bluetooth BusEngine 6 described 1 device address 60 first recording 18 limited search 83 recording traffic 105 search for device 56 153 SW Version 2 0 CATC Merlin Mobile User s Manual searching for devices 46 target address 61 BNEP 124 Bubble help 41 Buffer size 18 74 Bus utilization 152 BusEngine Bluetooth 6 Buttons bus utilization 153 graph area 155 toolbar 36
107. ile User s Manual SW Version 2 0 The flashing message changes to Uploading data x done x indicates the percentage completion of the data uploading process The traffic data is copied to disk overwriting any previous version of this file using the default file name data tfb or a new name specified in the Recording options To abort the upload process Click D mthe ToolBar You are prompted to choose whether to keep the partially uploaded data or to throw it away When the data is saved the Recorded Data file appears in the main display window and the Recording Status window is cleared e Ifthe recording resulted from a Trigger Event the first packet following the Trigger or the packet that caused the Trigger is initially positioned second from the top of the display e Ifthe recording did not result from a Trigger Event the display begins with the first packet in the traffic file Analyzer Status The third segment in the status bar displays analyzer status The status will display one of the following No Sync the system is not synced to any piconet Inquiring The system is performing an Bluetooth Inquiry Syncing to XXX The system is attempting to synchronize to a piconet where the device with BD_Address XXX 1s the master Synced to XXX The system is synchronized to a piconet where the device with BD Address XXX is the master Recording XXX system is recording the Bluetooth traffic
108. imited Dedicated means a specific class or group of Bluetooth devices designated by the DIAC field of the Recording Options dialog Selecting Dedicated causes Merlin Mobile to search for all devices from a specific class or group that are within range for the amount of time specified in the Inquiry Timeout field Completion of the inquiry process is indicated by illumination of the trigger light on the front of the analyzer All responding packets will be displayed when stop is selected BT Neighborhood These options configure how the BT Neighborhood command behaves BT Neighborhood is a utility that performs an Inquiry and then lists the local devices that it discovered e Use Default settings Sets the analyzer to record a General Inquiry with an Inquiry Timeout of 11 seconds e Match Inquiry Recording Settings Sets the analyzer to use the settings you chose above under Hop Sequence Inquiry Type and Additional Settings 75 CATC Merlin Mobile User s Manual SW Version 2 0 Debug Enables the creation of a file that can be used by CATC Support to aid in debugging 6 6 Recording Options HCI The HCI property page lets you include HCI traffic from IUTs into the trace HCI traffic consists of commands and other traffic that are sent by the IUT to generate Bluetooth traffic By default this option is disabled meaning that HCI traffic is not shown in the trace Recording Options S x General Piconet Inquiry
109. inches 135 x 54 x 5 millimeters Weight 2 ounces 57 grams Hardware Interfaces Connectors Standard 16 bit Type II PC Card Antenna 2 4 gigahertz external ISM band Power Consumption Idle 300 milliamps typical Active 350 milliamps typical Environmental Conditions Operating Range 0 to 55 C 32 to 131 F Storage Range 20 to 80 C 4 to 176 F Humidity 10 to 90 non condensing Recording Memory Size 32 MB DRAM for traffic data capture 32 MB DRAM for timing state other data Certification Bluetooth version 1 1 qualified Class 2 designation with 4dBm transmit power and lt 70 receiver sensitivity CATC Merlin Mobile User s Manual SW Version 2 0 FCC and CE compliant 1 4 System Requirements The following is the recommended configuration for the host machine that runs the Merlin Mobile Analyzer application and is connected to the Merlin Mobile Analyzer box e Operating system Microsoft Windows 98 SE Windows 2000 Windows ME or Windows XP operating system e Required setup Microsoft Internet Explorer 4 or later must be installed e See readme html for the latest system requirements 1 5 Using Merlin Mobile with Merlin s Wand Merlin Mobile can be used in conjunction with the CATC Merlin s Wand Bluetooth Test Generator which provides the ability to issue specific protocol commands and test sequences on a piconet Using Merlin Mobile and Merlin s Wand together allows for real time captu
110. ion 45 8105 L2CAP Signalling Message lt Header _p e Payload gt Al Addr Pas Len Peje Code Ident Siglen PSM SreGiD Time kets 1 E E CE L2CAP Data Transfer Message Header p lt q Payload _ gt Data Time 02 AA BB OO 08 35 03 19 11 01 00 06 00 T Addr HEZE Sackets L2Len fh La 0000 0005 LMP and L2CAP Signalling messages have payloads of commands for establishing LMP and L2CAP channels L2CAP Data Transfer messages have a payload that may include RFCOMM SDP or TCS data In order to view higher protocol data you will need to decode the messages shown in the next section The decoded data will appear as new lines in the trace called Protocol Messages 9 7 Viewing L2CAP Channel Connections Once L2CAP messages have been decoded and displayed you can check or change their L2CAP channel connections by opening the L2CAP Decoding Connections dialog box To view or change an L2CAP channel connection Step1 Select from the menu bar View gt Decoding Assignments 117 CATC Merlin Mobile User s Manual SW Version 2 0 The following dialog box will open x L2CAP channel transmissions in the trace found by protocol decoding You can change the protocol assignment for manually assigned channels Manual channel aseignments From message 14 Am amp dd master CID O020041 777 Assign to RFCOMM From message 15
111. ion is displayed From the Setup menu select Display Options Display Options CouerNew H BY Z CATE default E m F E F E E E m F E _ E al i E E F 97 CATC Merlin Mobile User s Manual SW Version 2 0 7 1 General Display Options Use the General Display Options to specify the basic appearance of a Trace view Zoom Level Adjustable in discrete increments from 10 to 200 percent Enable Tips Select to enable Tool Tips with explanation text to pop up when you position your cursor over various fields in the Trace View Wrap Causes packets to wrap within the window if their length exceeds the width of the window Right click cell context menu Activates the right mouse button for opening cell context menus Trace Viewing Level Allows you to select the hierarchical level at which traffic 1s displayed Fields Configures the appearance of field text within the trace Data Configures the appearance of data within the trace Display Configuration Name Comment field associated with the opt file containing the current Display Options values You can also create and store your unique Display Options for future use To create a new Display Options file follow these steps Step 1 Step 2 Step 3 Step 4 Enter a comment for the new file in the Display Configuration Name field Click Save Specify a filename opt Click Save 98 CATC Merlin Mobile User s Manual SW Ver
112. ither longer than expected or that a Bluetooth data packet terminated before the expected end of the payload data Sync Loss When set indicates that a loss of piconet synchronization occurred during the frequency slot prior to this slot 6 9 Recording Options Actions The Actions screen allows you to specify the type of action that Merlin Mobile should perform when it encounters the events specified in the Events window Recording Options x General Piconet Inquiry HCI Everts Actions Hdrij HULL Counti 65535 Count 65535 Trigger Save Save s Default Load cos 87 CATC Merlin Mobile User s Manual SW Version 2 0 Action Buttons Their Functions The Action buttons in the right side of the window provide the means of setting triggers filters and restarts To set an action you simply drag your mouse from an Event to an Action As described further on this movement will link the two via an arrow Trigger The Trigger button enables event triggering Filter In Out The Filter In Out button allows events to be filtered in or out of the recording Filtering provides a useful method of excluding data from the trace so you can conserve recording memory Restart The Restart button causes the two counters Count and Count2 to be reset to zero It also causes the search for event sequences to restart Event sequences are sequences of events that trigger the end of the reco
113. ket Type Acknowledge Data Length Uncheck All Combining specified Event Groups Union Packets that match ANY of the specified events Intersection Packets that match ALL of the specified events Exclusion Packets that OO NOT match opposite to the intersection or unor Searching for Bit Patterns e X Don t care e 0 Matcha 0 e Matcha 1 Searching for Long Patterns Co D mM E to M pg ea es p pi pg ea a pmi pi pde es ri re pea es E p pg ea es my pi pg ea es a p E ri re pe pp a pe pp Wa pe ea a 135 Bitmazk AX AAA AAA EE EEE AAA AAA AAA ees eee es ees gt T 25 Sr EN cr C p T SW Version 2 0 Searches for the next packet that has a specified data pattern Packets To Search For You search for a bit pattern by using the box labeled Bitmask Enter one of the three following values Example xxxxxx01 means Look for a data pattern where the first 6 bits can be any value but the last two bits must be 01 You can search for long pattern sequences by entering patterns into multiple rows within the editor Entering a pattern on one row and skipping several rows before entering the second pattern tells Merlin Mobile to search for the entire pattern between the two specified rows Example Enter xxxxxx01 in row and 11xxxxxx in row 2 This pattern means Look for the pattern xxxxxx0111xxxxxx CATC Mer
114. l Go to Marker d packet Type i Header 4M Addr lataLengt Sy Find Next F3 DataLength a q OA gt gt Lmp Opcode 26 Search Direction Forward l Leap Signalling Command d 25 L2 ap CID b 30 AUTE Error 31 000 24 136 05 40 128 CATC Merlin Mobile User s Manual SW Version 2 0 Lmp Opcode Go to Trigger Go to Packet Message Protocol Go to Marker gt Find Header 41 Addr j Ji 16M T CRC Ack d oa Find Next Datalength ae gt Lmp Opcode 3 accept Search Direction Formard L2Cap Signalling Command d Si clk_req Leap CID j 6 clk_res Error d 7 detach 000 24 156 65 40 AAA AAA 39 Feat_reg j o eb HODR 40 Feat Ox4 OxBOOO1OEDDE 28F19 Ox OA eat_res 49 setup_comp Data on 40 00 OF EF 4B E FD 60 01 OU 21 45 00 Ul 01 00 00 80 01 31 33 CO A8 37 02 EO 00 Oe mn Fo FR AA AA AN AN er F VF df Pre CAC Trail Select the Link Management Protocol Operational Code Lmp Opcode that you want to go to L2Cap Signalling Command Go to Trigger Go to Packet Message Protocal Go to Marker b aoto Facket Type ka Find Header 4M_4ddr pa Find Next ES Datalength Emp Opcode Search Direction Forward as ee L2Cap Signalling Command 2 Conn reg L2 Cap CID 3 Conn resp a 00024 136 8528 zira 4 Config reg eS 5 Config resp Pre LAL Trail aon Diva CAC i HOR
115. l Devices To Hide AM Add O 1 234567 Master FCT CECE Slave EERE Both BERR 6 ATE The row in which you place your checkmark determines whether you are hiding traffic going to or from a device e Master Hide traffic from a Master to selected Slaves e Slave Hide traffic from selected Slaves to the Master e Both Hide all traffic between the Master and selected Slave Example to hide all traffic from a Master to a Slave device with an address of six click the checkbox under column 6 on the row marked Master Levels to Hide Levels To Hide The Levels to Hide grid divides into rows which Packets represent the different packet message and protocol ae levels Clicking a checkbox will cause the analyzer to Clete hide all traffic of a selected level SDP mo Hiding Packets ll At the bottom of the Hiding tab of the Display Options M AT window check boxes are available for hiding HOPs M HDLC POLLs NULLs and other kinds of traffic T PPP 102 CATC Merlin Mobile User s Manual SW Version 2 0 T Hide HOF Hide POLL NULLs Hide ID Packets Hide SCO oice Hide Unassociated Traffic 7 4 Saving Display Options To complete your display options settings use the features at the bottom of the Display Options window These features remain the same no matter which of the four Display Options windows you are working in Click Save to save the currently specified display options for use i
116. l Panel from the desktop taskbar then double click Performance and Maintenance Step 2 Double click on System The System Properties window will open Step 3 Select the Hardware tab and click the Device Manager button The Device Manager window will open Step 4 Look in the CATC Analyzers directory and select CATC Merlin Mobile Bluetooth Protocol Analyzer Or Look in the Universal Serial Bus Controllers directory and select CATC Merlin Mobile Bluetooth Protocol Analyzer Step 5 Select Action gt Update Driver from the Device Manager menu bar The Hardware Update Wizard will open Step 6 Choose Install from a list or specific location Step 7 Choose Don t search then click Have Disk Step 8 Enter or browse to the location of the driver and click OK Step 9 Select CATC Merlin Mobile Bluetooth Protocol Analyzer from the list and click Next The driver will install Step 10 Click Finish Step 11 Select Action gt Properties from the Device Manager menu bar to check the driver version and make sure that the driver was successfully upgraded Step 12 Close the remaining open windows 2 License Keys A License Key is necessary to enable software maintenance in Merlin Mobile License Keys must be obtained from CATC Update License Follow these steps to install a license key Step 1 Select Help gt Update License from the menu bar The Update License dialog will come up CATC Merlin Mobile User s
117. l SW Version 2 0 Step2 Click Change Counter Value You see the Input Counter Value menu Input Counter Yalue E Input Counter Value 1 695 351 f z Cancel Step 3 Enter an input value to tell the Analyzer how many times this event must occur before triggering the end of a recording Step 4 Click OK Filter Out In Blue Dot Menu The Filter Out In button toggles between Filter Out and Filter In Filter In records ONLY those packets related to the specified event Filter Out records all packets EXCEPT those related to the specified event To filter an event in or out of a recording Step 1 Click the blue dot on Filter Out Note the button may say Filter In depending on the last action specified Y ou see the Filter Out In menu i Filter Polarity s Filter Out Filter In Use this menu to toggle the selection between Filter Out and Filter In Step2 Select Filter In The button changes to read Filter In Blue Dot Menus for the Event Buttons The Errors button and the first Headers button marked Hdr1 have the same Blue Dot menus These menus allow Merlin Mobile to trigger external output To enable or disable external trigger output Step1 Click the Blue Dot on an Event button such as Hdr1 or Errors 91 CATC Merlin Mobile User s Manual SW Version 2 0 A menu similar to the one below will open Your menu may say Disable instead of Enable a ene pes Enable Exte
118. l close the message box 37 CATC Merlin Mobile User s Manual SW Version 2 0 If Merlin Mobile passes the hardware test it will search for devices The Recording Wizard will display a progress bar and a message telling you that a search is under way Recording Wizard New piconet Step 5 of 8 X General Device Search Merlin Mobile 13 now searching for devices using General Unlimited Inquiry Recording mode Els Select Cancel to terminate the search and to close the wizard Back Het gt Cancel Help If no device is found the Recording Wizard will display the following screen Recording Wizard New piconet Step 5 of 8 ig x General Device Search Merlin Mobile haz completed the device search operation but has not found any Bluetooth devices in range Are nearby devices operative Cannot proceed to next step in wizard session until Merlin Mobile has found some devices in the neighborhood Fress Retry to have Merlin Mobile search for devices once again Retry Ment gt Cancel Help 38 CATC Merlin Mobile User s Manual SW Version 2 0 If devices found the Recording Wizard will display the following screen Recording Wizard New piconet Step Sof 8 x General Device Search Merlin Mobile has completed the device search operation and has found a total of 3 Bluetooth devices in range Tou can view the devices that were found in the updated Devi
119. ld be to exclude packets with either X or Y e Step 5 Click OK The search will then occur Afterwards the packets meeting the search criteria will display Some Find Examples Search for all DM1 and Poll packets with an Active Member Address of 7 Step 1 From the Event Group select Packet Types Step 2 From the box on the right select DM1 and Poll Step 3 From the Event Group select Header AM_Addr Step 4 From the box on the right select AM_Addr 7 Step 5 From the Center area select Intersection Selecting Intersection tells Merlin Mobile to find packets with ALL ofthe selected traits 137 CATC Step 6 Merlin Mobile User s Manual SW Version 2 0 Press OK The trace should reposition to the first DM1 or Poll packet that has an Active Member address of 7 Exclude all DM1 and Poll Packets with Active Member Addresses of 7 Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Select Packet Types from the From the Event Group Select DM1 and Poll from the box on the right Select Header AM_Addr from the Event Group Select AM_Addr 7 from the box on the right From the Center area select Intersection and Exclusion Press OK The trace will redisplay so that it excludes DM1 packets with AM_Addr 7 and Poll packets with AM_Addr 7 Exclude all packets with ANY of the following attributes DM1 Poll or AM_Addr 7 Step1 Select Packet Types from the Event Groups Step2 Select DM1 and Poll from the box on the
120. le User s Manual SW Version 2 0 your Master Device Recording Wizard Test mode Specify Master Device Step 2 of 4 q x Device Address Please select the Bluetooth device address of the master device for the piconet to be recorded The list below includes devices that Merlin Mobile has recently encountered If pour master device ls not already in this list you may type in its device address la six digit hes value yourself Piconet Master Qddress Back Cancel Help Step4 Press Next Recording Wizard Test mode Step 3 of 4 i x System is Ready Initiate SearchHecord Merlin Mobile is now ready to synchronize to the test piconet using Bluetooth Test mode and start recording IF your piconet is not currently established please establish it now Or you can establish it night after proceeding to the next page while Merlin Mobile ties to synchronize to the piconet The following options will be used Synchronization Method Teztmode Frequency Band Fired frequency mode DUT s Transmit frequency 2402 MHz DUT s Receive frequency 2404 MHz Master address MMAN371ARAR A Advanced Fress Next to begin recording or Back to return to the previous page Back Cancel Help Step5 Press Next Merlin Mobile then synchronizes with the 60 CATC Merlin Mobile User s Manual SW Version 2 0 Master device and begins recording Recording Wizard Test mode Step 4 of 4 i x
121. le and enter it into the Page Target address in the Modes tab in Recording Options Make sure you do not select an address for any other local device Step5 Press the record button on the toolbar in Merlin l REC Record Piconet gt Mobile to start a recording session Step6 Ifnecessary have Master discover Merlin Mobile through a General Inquiry Step 7 From the Master device initiate a page to Merlin Mobile s address This action will enable Merlin Mobile to synchronize to the piconet However the analyzer will not complete the page sequence from the Master This will cause the Master to time out in this request Step8 At the end of this sequence the green Syne light will go on solid recording will begin and activity will be displayed on the status bar in the bottom of the analyzer screen Running Passive Sync and Record with Private Device Piconets Because private device networks do not allow other devices to join the network Merlin Mobile needs to temporarily assume the identity of a slave in the network in order to join that network To do this requires disabling the slave and beginning the operation without an established piconet The following steps show the process Step1 Turn the Master device on and the slave device off You need the slave device turned off so that Merlin Mobile can take its place in the piconet Step 2 Enter the slave s address into Merlin Mobile s Page Target field 71 CATC Step
122. lin Mobile User s Manual SW Version 2 0 Example If you enter xxxxxx01 into row 0 and Bitmask EEE 1 1xxxxxx into row 4 it means Look for the pattern hex hex XXXXXX0Ol XXXXXXXX XXXXXXXX XXXXXXXX 0 1Xxxxxx l oo z 3 4 izxxxxx Searching for Hexadecimal Patterns The columns marked Match and Mask allow you Bitmask Mask Match to specify a pattern in hex You enter the pattern nen nen you want to match in the column marked Match and enter the mask in the column marked Mask The Mask column allows you to specify which bits you are searching for Example A Match of 03 and a Mask of OF tells Merlin Mobile that you are looking for the hex pattern of 03 occurring in the last four bits of the pattern If you enter these values in the Match and Mask columns the Bitmask section will automatically display the equivalent bit values XXXX0011 Union Intersection and Exclusion If you select multiple events you will need to use the options Union or Intersection to conduct the search Union is used to search for any selected event Find x or y Union lets you tell the analyzer to search the trace for any of any of the selected items Intersection is used to search for all selected events Find x and y Intersection lets you tell the analyzer to search the trace for any packet having all of the selected events Exclusion is used to exclude selected traffic from the trace Exclusion 1s used with Union and Intersection
123. ll copies should contain this copyright notice FCC Conference Statement This equipment has been tested and found to comply with the limits for a Class A digital device and an intentional radiator pursuant to Part 15 of the FCC Rules These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment This equipment generates uses and can radiate radio frequency energy and if not installed and used in accordance with the instruction manual may cause harmful interference to radio communications Operation of this equipment in a residential area is likely to cause harmful interference in which case the user will be required to correct the interference at their own expense The end user of this product should be aware that any changes or modifications made to this equipment CATC Merlin Mobile User s Manual SW Version 2 0 without the approval of CATC could result in the product not meeting the Class A limits in which case the FCC could void the user s authority to operate the equipment Important Notice To comply with FCC RF exposure requirements sections 1 1307 and 1 310 of the Rules only the antenna supplied by CATC must be used for this device The antenna must be located at least 20 cm away from all persons FCC Testing applies to FCC ID KH7BT004APA X EU Conference Statement This equipment complies with the R amp TT Directive 1999 5 EC It has be
124. n 7 E AQUI Timeo See m W Follow Master Slave Switch Match Clock Rate Lozs of pnc Timeout 1 30 sec f B e efe Syne Window Initial De whitening State Aia De whitening On De whitening Off Debug Enable CATE debug file Save Save s Default Load Step 10 Press Next to advance the Recording Wizard to the next screen The following screen displays Recording Wizard New piconet Step amp of 8 a x Merlin Mobile is attempting to synchronize to the piconet master device on its paging to the Fage Target device Page Syne amp Record model EEES Quirino Press Cancel to terminate the synchronization and record attempts and to close the wizard PER aie Cancel Help Merlin Mobile pages the Master and 1f specified in Step 8 the Slave devices 41 CATC Merlin Mobile User s Manual SW Version 2 0 If Merlin Mobile is unable to complete its pages the following screen will display Recording Wizard New piconet Step amp of 8 Merlin Mobile was unable to enter the Synchronizing state from which you can establish the new piconet perhaps the master of the piconet is not configured to page a slawe Press Hetry to have Merlin Mobile start the operation one more time Retry Press Finish to exit the Wizard or Back to return to the previous page lt Back Cancel Help If Merlin Mobile is able to complete its pages it will e
125. n future sessions Any file name can be specified but you must use the opt extension If no extension is specified opt is added by default Click Load to load a previously saved opt file thus restoring a previous set of display options The Save as Default function 1s equivalent to the Save function specifying the file name default opt Whenever you start up the Analyzer it automatically loads the default opt file if one exists Click OK to apply any changes you have made to Display Options and close this dialog box Click Cancel to cancel any immediate changes you have made and exit the Display Options menu Click Apply to apply your changes while keeping the Display Options window open 103 CATC Merlin Mobile User s Manual SW Version 2 0 104 CATC Merlin Mobile User s Manual SW Version 2 0 8 Reading a CATC Trace Idle Time Starnp 4 383 sec 00003 193 3643 Idle Time Starnp 28 000 ps 00007 575 8643 E EEE POU POLL Idle Time Stamp 1 518 ms 00007 575 9523 Idle Time Starnp 7 000 ps 00007 577 5961 Idle Time Starnp 492 000 ps 00007 577 6034 Idle Time Starnp 5 000 ps OO007 675 2214 ae Mas L_ EH i Idle Time Starnp 424 000 ps 00007 578 2261 8 1 Trace View Features e The Merlin Mobile packet view display makes extensive use of color and graphics to fully document the captured traffic e Packets are shown on separate rows with their individual fields both labeled and color code
126. n Mobile Starting the Application Use one of the following procedures to start the Merlin Mobile application e Select Start gt Programs gt CATC gt CATC Merlin Mobile from the Win dows taskbar e In Windows Explorer or My Computer navigate to the directory that contains Merlin Mobile then double click on the MerlinMobile exe icon Exiting the Application Any of the following actions will close the Merlin Mobile application e Click on the X in the upper right corner of the application window e Select File gt Exit from the menu bar e Press Alt F4 e Double click the Merlin Mobile control icon in the upper left corner of the application window e Click the Merlin Mobile control icon to access the Control menu and choose Close Starting the Analyzer Unit The Merlin Mobile analyzer unit is powered on whenever it is connected to the host computer via the PC Card slot and the host computer is on The analyzer will initialize itself and perform an exhaustive self diagnostic test that lasts about five seconds Shutting Down the Analyzer Unit On Windows 98 SE and Windows Me e Shut down the Merlin Mobile unit by removing it from the PC Card slot or by shutting down the host computer On Windows 2000 and Windows XP e Shut down the Merlin Mobile unit by shutting down the host computer OR e Use the Add Remove Hardware Wizard to stop Merlin Mobile so that it may safely be removed from the PC Card slot CATC
127. n the Bus Utilization window Step1 Click the W button The Graph Areas menu opens Mer Packet length on Ro amp Packet length on Tx El Link Utilization on Rx amp Link Utilization on Tx El Data Throughput on Rx amp Data Throughput on Tx El Packet Count on Rx amp Packet Count on Tx Packet length on Rx Packet length on Tx Step2 Select the data you want to appear in the Graph Areas window To change the properties in the Bus Utilizations graph follow these steps Step1 In the Graph Areas menu select the type of data to be displayed Step 2 Click OK Or To make a new graph click New 146 CATC Merlin Mobile User s Manual SW Version 2 0 The following dialog box will open It will display options for setting the title data color and line type for the graph Graph area properties E x til Title Appeararce Type Eolor Percent of link used on Ax E Filter out T Hide Link Packets T Hide Training Sequence One Hide Training Sequence Two Set All Clear All Jete te ss e 10 9 Traffic Summary The Traffic Summary dialog box displays a text summary of traffic captured in the current trace Am ddr 7 10991 M H Plt Baseband Packets Baseband Packets 10959 10959 LMF 10 10 C LMP LMP T Errors Packets in Range 0 to 21979 H Pkt Baseband Packets To open the Traffic Summary window press The left pane displays a tree of the different protocol levels Click the
128. n the support directory on the CATC web site http www catc com products support sup_ Merlin Mobilebluetooth html Decoding HID HID Human Interface Device is a profile associated with traffic from devices such as a mouse or a keyboard To decode HID traffic you will need to tell Merlin Mobile what types of HID traffic it will be recording You do this by editing a script file called hid dec Merlin Mobile reads this file during the initialization of the Merlin Mobile software This file tells Merlin Mobile how to decode the HID fields Once read HID can be correctly decoded by pressing the HD button Ifthe decode file is not read at initialization Merlin Mobile will display the data in an undecoded format 123 CATC Merlin Mobile User s Manual Other Decoding Options Other decoding options include the following IP TCP UDP AVCTP AVDTP HCRP 124 SW Version 2 0 CATC Merlin Mobile User s Manual SW Version 2 0 10 Other Features 10 1 Search The Search feature provides several options for searching through recorded traffic allowing you to find specific packets based on triggering status packet number marking or content To view the Search options e Click Search in the Menu bar You see the Search drop down menu Search View Window Help o to Trigger Go to Packet Message Protocaol Go to Marker d o Eo d pa Find West F3 Search Direction Forward Go to Trigger To display a triggering event
129. nter into a synchronizing state and then wait for you to create the piconet During this waiting period Merlin Mobile will display the following screen Recording Wizard New piconet Step 8 of 8 _ x Merlin Mobile has entered Synchronizing state NOW ts the time to establish the piconet and to continue with the recording of the trattic Synchronizing lt AFTER you have established the piconet Merlin Mobile should synchronize and stark recording the traffic Fress Cancel to terminate the synchronization and record attempts and to close the wizard Back Cancel Help 42 CATC Merlin Mobile User s Manual SW Version 2 0 Once you have created the piconet Merlin Mobile will synchronize to the piconet and begin recording During the recording Merlin Mobile will display the following screen Recording Wizard New piconet Step 8 of 8 i x Merlin Mobile has synchronized to the piconet and started recording Merlin Mobile has spnchronized to the piconet and started recording Recording Press Stop Recording to stop the recording Pressing the Close button closes the wizard but Merlin Mobile continues to record traffic To stop the recording in the application You can use the Stop icon in the toolbar stop Recording continues to record traffic To stop the recording in the Press Close to close the wizard At the completion of the recording Merlin Mobile
130. nto conduct a General Inquiry to locate local Bluetooth devices Recording Wizard Existing piconet Step 4 of 9 x General Device Search Merlin Mobile is now searching for devices using General Unlimited Inquiry Recording mode SS Select Cancel to terminate the search and to close the wizard Back ext gt Cancel Help 48 CATC Merlin Mobile User s Manual SW Version 2 0 If Merlin Mobile finds Bluetooth devices it will display the following message Recording Wizard Existing piconet Step 4 of 9 General Device Search Merlin Mobile haz completed the device search operation and has found a total of 2 Bluetooth devices in range Tou can view the devices that were found in the updated Device List report Press Repeat to have Merlin Mobile search for devices once again Repeat Back Cancel Help Check the Device List to see if Merlin Mobile found all of the devices in your piconet If you feel that the list is incomplete you can close this window and press the button marked Repeat This will cause Merlin Mobile to repeat the General Inquiry and recollect information on local Bluetooth devices Step9 Press Next to advance to the next screen The following screen will prompt you for the Master device s address The address can be selected from the menu or typed into the box Recording Wizard Existing piconet Specify Master Device Step 5 of 9 a x
131. ollowing steps Step1 Select two events from the Events window Step 2 Open the Actions window and click on one of the two Event buttons An elastic arrow should appear Hdr4 PULL Trigger Move mouse to new output icon for this event 94 CATC Merlin Mobile User s Manual SW Version 2 0 Step 3 Click on the other event The arrow should connect to the second button and the second button should instantly change locations to the center section of the window Her if HULL 2 Countd E5525 Pena PELE 2 Count 65535 Trigger 6 10 Saving Recording Options To complete your Recording Options settings use the features at the bottom of the Recording Options screen These features remain the same no matter which of the three Recording Options screens you are working in e Click Save to save the currently specified Recording Options for use in future recording sessions Any file name can be specified though use of the rec is recommended if no extension is specified rec is added by default e Click Load to load a previously saved rec file thus restoring a previous set of Recording Options e The Save as Default function is equivalent to the Save function specifying the file name default rec Whenever you start up the Analyzer it automatically loads the default rec file if one exists e Click OK to apply any changes and close this dialog box e Click Cancel to cancel any immediate changes you have made
132. on the menu will B Sean Ero say Orient Vertically Tile vertically Show Plumb Line Tile Vertically tiles the two graphs Sete gt vertically 1 e side by side gt Grid Lines Show Markers Places tick marks along j Grid on Top the x axis of each graph Fonts amp Colors Show Plumb Line Displays a vertical line that connects your cursor to the horizontal axis As the mouse is moved the status bar will show the packet and time frame to which the cursor is pointing Status Opens a sub menu with the following options Bar Displays a status bar at bottom of graph Tooltip Causes a tooltip to appear if you position your mouse pointer over part of the graph and leave it there for a couple of seconds None Turns off tooltips and the status bar Grid Lines Opens a sub menu with the following options Both Displays both X and Y axis gridlines X Axis Displays X axis gridlines Y Axis Display Y axis gridlines None Turns off gridlines Grid on Top Moves the grid lines above the graph 145 CATC Merlin Mobile User s Manual SW Version 2 0 e Fonts and Colors Opens a dialog box for setting the colors and fonts used in the graphs view options x Fonts Tithe Times Hew Roman fi Biz Anda Background a Grid IS Cancel Graph Areas Menu The Graph Areas menu allows you to view different information i
133. ones ox03 e oxo0s1 oxo00s0 ox0000 Connection Request Signalling Command Code Ox3 9 5 Viewing Packets in LMP and L2CAP Mes sages LMP and L2CAP Messages can be opened to reveal gt 5 their constituent packets by double clicking the first cell in of the message or clicking once on the small arrow on that same cell The packets will then display below the message The following screenshot shows an example of a message and its packets 2 L2CAP Addr L2ciID aj Data irne 19 0000 05 AA BB 00 24 00 21 36 00 1E 09 00 04 35 10 35 0016 05 1A 00 00 01 00 35 07 1A 00 00 00 03 08 01 09 0032 01 00 25 04 43 4F 4D 35 00 Data lt a Packets fuavul 1 27 0000 29 00 41 00 05 AA BB OO 24 00 21 36 00 lE O 0016 04 35 10 35 05 1A 00 00 01 00 35 a making up the message lt i Message Packet m ay cac ox ox E HA on ES oa ox 0000 07 1A 00 00 00 03 08 01 09 01 00 25 04 43 0016 35 00 9 6 Types of LMP and L2CAP Messages If you scroll through a trace you will see three kinds of message e LMP Signalling Message e L2CAP Signalling Message e L2CAP Data Transfer Message 116 CATC Merlin Mobile User s Manual SW Version 2 0 Each message has the same basic message header but differs in its payload LMP Signalling Message Header lt Payload _ gt T EMF T Addr TID Opeade reason Tirne F full Ml detach 0x13 user ended connect
134. ons The Recording Options dialog opens with the Inquiry page displaying x General Ficonet Inquiry HCI Events Actions Hop Sequence 79H ops Standard Inquiry Type General Unlimited Dedicated Limited Additional Settings Correlation Value 33 64 lnquiry Timeout 0 80 sec BT Neighborhood f Use default settings The following default settings would be used when a BT Neighborhood ts initiated O Match Inquiry Recording settings Inquiry type General Inquiry Timeout 11 seconds Debug T Enable CATC debug file Save Save s Default Load coca Step 4 If desired make any changes to the options then click OK Step 5 Click the REL Record Inquiry gt button i e the button itself and not the down arrow 20 CATC Merlin Mobile User s Manual SW Version 2 0 Merlin Mobile starts to record the Bluetooth traffic immediately using the settings from the Piconet page in the Recording Options dialog The Bluetooth Inquiry process will proceed for whatever amount of time is set for creating an Inquiry action 0 to 80 seconds After the inquiry time has elapsed the analyzer will uploads the data and displays the packets After a few moments the recording will terminate and the results will display The screen should look like the sample recording below which shows the FHS packets generated during the Inquiry process When the recording session is finishe
135. onverter Manufacturer FT I an F Printer Port LET1 Device status e iy USB Serial Port COM3 i ian A USB Serial Port COM 4 This device iz working properly sae ie Sound video and game controllers j havi bl OE ETT o yoy are having problemes with this device click Troubleshooter to system devices start the troubleshpoter E Universal Serial Bus controllers E Troubleshooter Device usage uss this device enable Your First Bluetooth Recording After installing and launching the software you can test Merlin Mobile by synchronizing to a piconet and then recording the traffic In this inquiry test Merlin Mobile will issue a General Inquiry that asks local devices to identify themselves Merlin Mobile then records the responses Click the down arrow on the Record button l i REL Record Piconet and select Piconet From the menu select Record gt Recording Options The following dialog box will open showing factory default settings Merlin defaults to Page Sync amp Record This setting tells Merlin Mobile to perform a General Inquiry and then collect sync 17 CATC Merlin Mobile User s Manual SW Version 2 0 information from the specified slave device when the slave responds Merlin Mobile then waits for the Master to begin paging the Slave devices When paging begins Merlin Mobile synchronizes to the Master and begins recording x General Piconet Inquiry HCI Events Actions
136. ooth wireless technology Merlin Mobile non intrusively monitors piconet traffic and records and displays captured Bluetooth data Like its predecessor the CATC Merlin Bluetooth Protocol Analyzer Merlin Mobile uses CATC s BusEngine technology which incorporates a real time recording engine with programmable data state and error detection and event triggering filtering counting and sequencing This enables users to optimize recording memory usage to capture the data that is most important The Merlin Mobile system consists of the analyzer hardware unit and the analyzer software The Merlin Mobile analyzer unit monitors and captures baseband packets on a piconet in a non intrusive manner The packets can then be viewed and decoded with the Merlin Mobile software The software displays the piconet data in CATC Trace format and is capable of decoding and organizing the data for these Bluetooth protocol levels Baseband LMP L2CAP SDP TCS RFCOMM OBEX AT HDLC PPP BNEP HID AVCTP AVDTP IP TCP and UDP In addition users can use the CATC Scripting Language CSL to create custom decoders for specific development purposes The Merlin Mobile analyzer unit is configured and controlled by the analyzer software It can be used with portable computers for field service and maintenance as well as with desktop units in a development environment Furthermore Merlin Mobile Automation and compatibility with the CATC Merlin s Wand
137. or the Logical Channel and sub options for Flow Control and Payload length These latter two options allow you to modify searches based on the Logical Channel An example would be Trigger on a start L2CAP message whose flow control bit is 1 and whose data field length is less than 20 e Select Payload Headers under Event Groups 83 CATC Merlin Mobile User s Manual SW Version 2 0 You see the Payload Headers window Recording Options E x General Piconet Inquiry HCI Events Actions Event Groups 1 for single slot packet Packet Headers er SA de MP aoad Headers i L_CH Dont Care Data Pattern FLOW odo Don t care Errors Length E 2 for multi slot packets L_CH Don t care 7 FLOW Oo 1 Dont care Length Uncheck All Select payload header field Additional Timezlot Filtering Filter Empty Timeslots Filter Timeslots on Packet Filter Save Save 4s Default Load cos L_CH Logical Channel The L_CH drop down menu presents five options for iie ing conditions on the Logical Channel 00 undefined setting conditions on the Logical Channe E cae e Don t care 10 L2CAF start 11 LMF message e 00 Undefined e 1 L2CAP continue e 10 L2CAP start e 11 LMP message Select Don t care 1f you do not want to set conditions on Logical Channel Flow Three radio buttons are presented for Flow O O 1 Don tcare setting conditions b
138. other assignment ae Add assignment to RFCOMM to change assignment from Mala esla ae 2 DLP Add assignment to TCS this point downward Add assignment to INEM OWN through the trace Will let one or all protocol al assume Remove All User assignments assignments be removed Step4 From the menu select one of the Add Assignment options not already selected At this point the protocol assignment will change to your selection Using the Decoding Assignments Dialog Box You can get a complete list of all protocol assignments by opening the Decoding Assignments dialog box This dialog box will tell you which protocol assignments were made by Merlin Mobile and which are user assigned User assigned protocols can be reassigned if need be using this dialog box 120 CATC Merlin Mobile User s Manual SW Version 2 0 To open the Decoding Assignments dialog box and reassign a protocol Step1 Select from the menu View gt Decoding assignments The Decoding Assignments dialog box will open A status message in the bottom L2CAP channel Decoding Assignments L2CAP channel transmissions in the trace found by protocol decoding You can change the protocol assignment for manually assigned channels Manual channel assignmente From meszage From message O a slave CID 0000 O O From message From message From message From message From message CID Ox0040 CID Ox0040 SDP A m ddr 7 10 A m ddr 7
139. plus symbol to expand the tree The example above is fully expanded The right pane displays a summary of the traffic for the selected level 10 10 Encryption Bluetooth encryption is a multi staged process that provides devices with secure encrypted communications The pairing process begins with a device prompting the user for a Personal Identification Number PIN 147 CATC Merlin Mobile User s Manual SW Version 2 0 When the right PIN 1s entered the Slave begins an encryption setup dialogue with the Master At the beginning of this dialogue the Slave and the Master agree on a Link Key A Link Key is a 128 bit value that the two devices use for authentication When the Slave and Master agree on a Link Key the Slave then negotiates for the transfer of the Encryption Key from the Master device The Encryption Key is used to encrypt and decrypt messages Once the Encryption Key is transferred both devices use it to encrypt all subsequent communications In order for Merlin Mobile to decode encrypted traffic it needs the Link Key for each Master Slave connection for which encryption will be used If you know the Link Key you can enter the Key into the Encryption Options dialog box If you do not know it you give Merlin Mobile the PIN for a device and allow Merlin Mobile to discover the Link Key on its own Once Merlin Mobile has the Link Key it can capture the rest of what 1t needs by listening to the Master and Slave devices
140. rch Duration Speciy duration of Search Record How long should Merlin Mobile search for nearby Bluetooth devices Any search duration between one and eighty seconds may be spected However a duration of between ten and twenty seconds should be enough time for Merlin Mobile to detect all nearby devices Search for iil seconds for nearby devices Merlin Mobile to detect all nearby devices Back Cancel Help Step 4 Step 5 You will see two options In the text box enter the length of time you want Merlin Mobile to search for nearby devices The default value is 11 If you do not sure what time value to enter use the default value Press Next Before the Inquiry Merlin Mobile tests the hardware connection In the case of failure the following screen will display Merlin Mobile E x A Your Merlin Mobile analyzer was not detected it may not be connected properly to this computer or may not be powered on Please verify that your Merlin Mobile analyzer is connected with a USB cable to this computer that the Merlin Mobile power LED is on and that the trigger LED is not Flashing If the trigger LED is Flashing this indicates a hardware problem please contact your distributor For service TF you have Found the source of the problem press OK to close this message box and then press Retry in the Wizard to retry the operation or press Cancel to exit the Recording Wizard Clicking OK wil
141. rding Restart buttons provide you with a way of saying If you see a sequence of A B C and D then trigger However if you see_X anywhere during the sequence restart your search Count1 Count2 Count and Count2 are counters for specifying how many events must occur before an event can cause a trigger Counters allow conditions to be made such as Trigger after the 21st Poll packet see screenshot below The Actions window showing a condition based on a Poll packet and a counter This condition reads Trigger after the 21st Poll packet 2 Count 21 i Count 65535 Trigger 88 CATC Merlin Mobile User s Manual SW Version 2 0 Connecting Events to Counters To connect an event to a counter click an Event button then click one of the two counter buttons The Counter will reposition itself immediately below the event A line will the connect the counter to the Trigger button This latter connection between the Counter button and the Trigger button occurs because counters always work in association with triggers Counters act as assistants to triggers Setting Multiple Conditions with Counters You can create multiple event conditions by linking a counter to multiple events or by linking two counters to two or more events Linking Multiple Events to One Counter When two or more Events are strung together and then connected to a counter the event button that is touching the counter gets counted The example belo
142. red Bluetooth devices and allows you to add and delete devices and security settings by selecting the device pressing the security button and modifying the settings Menu Function Real time Opens a dialog box with a graphical summary of the traffic currently Statistics being recorded by the Analyzer Real time monitoring allows continuous monitoring and displaying of traffic and related statistical dada in a piconet This processed data is displayed in a set of configurable graphs Decoding Lists current L2CAP decoding assignments Assignments L2CAP Connections Lists current L2CAP connections RFCOMM Channel Lists current RFCOMM assignments Assignments Levels Presents a menu of display levels This menu replicates the Decode Display buttons in the toolbar such as Packets L2CAP TCS etc Window oa Switches display of the Tool Bar on or off Displays all open windows in an overlapping arrangement Tile Arranges multiple trace windows as a series of strips across the main display area or as a series of side by side tiles Arranges minimized windows at the bottom of the display Displays a list of open windows CATC Merlin Mobile User s Manual SW Version 2 0 Help Online Help Displays Help topic associated with current Merlin window Help Topics Displays online help Update License Opens a dialog box for entering license key information for the analyzer Display License Displays current licens
143. requency Band Standard 29 hop mode Master address 00087640064 Page Target address 000406000006 Initial Me hiena shake Cio De mhiker x Advanced Fress Next to initiate the recording or Back to return to the previous page Back Cancel Help The Advanced button will open the Recording Options dialog box shown on page 41 and described in detail in Chapter 7 Step 15 Press Next to begin the recording If the Merlin Mobile hardware is not ready or connected or is in the process of booting up the following information message box will display x Your Merlin Mobile was not detected it may not be connected properly to this computer or may not be powered on Please verify that vour Merlin Mobile is connected with a USB cable to this computer that the Merlin Mobile power LED is on and that the trigger LED is nat flashing If the trigger LED is Flashing this indicates a hardware problem please contact your distributor for service TF you have Found the source of the problem press OK to close this message box and then press Retry in the Wizard to retry the operation or press Cancel to exit the Recording Wizard Step 16 Ifthe above information box opened press OK to close it 52 CATC Merlin Mobile User s Manual SW Version 2 0 The following dialog box will display Recording Wizard Existing piconet Step 9 of 9 x The attempt to record traffic on a piconet that
144. ring of test sequence results as is required by the Bluetooth SIG to provide evidence of product compliance to the specification Merlin s Wand has built in functionality for controlling Merlin Mobile Through Merlin s Wand a Bluetooth recording session can be set up on Merlin Mobile even if the Merlin Mobile application runs on a remote computer For more information about using Merlin Mobile with Merlin s Wand please consult the Merlin s Wand documentation or contact CATC 1 6 Merlin Mobile Automation The Merlin Mobile software includes an Application Program Interface API for developing testing programs and scripts in C and Visual Basic The API reproduces most of the commands embodied in the Merlin Mobile trace viewer software This API allows users to automate procedures that otherwise have to be run manually via the trace viewer software The Automation API can be run locally on the PC attached to Merlin Mobile or remotely over a network connection For further details refer to the Automation API for CATC Bluetooth Analyzers reference manual included in the installation CD ROM You can also download the document from the CATC website CATC Merlin Mobile User s Manual SW Version 2 0 1 7 HCI Trace In addition to the ability to record Bluetooth traffic off the air using the analyzer s hardware and radio module the Merlin can record serial Bluetooth HCI traffic from Bluetooth devices or IUT s Implementations Under Test
145. rnal General Purpose OQutput Enable External General Purpose Gutpuk Only External Gutput Form step2 Select Enable External Trigger Output or Disable External Trigger Output if that is the choice presented If you have chosen Enable External Trigger Output a small arrow will appear on the right side of the button This AE arrow indicates that a condition has been set for creating an external output signal Choosing Disable External Trigger will cause the arrow to disappear Enabling High Pulse Low Pulse or Pulse Toggle Signal Outputs Once External Trigger Output has been enabled you can configure the output signal to one of three formats Pulse High This is the default format The Pulse High setting causes the Analyzer to transmit a 5 volt 16 66 nanosecond signal Pulse Low This format causes the Analyzer to transmit a 5 volt 16 66 nanosecond signal Toggle This format causes the Analyzer to transmit a signal that will toggle with each trigger event between a continuous 5 volt signal and a continuous 5 volt signal To configure the output signal Step 1 Click the blue dot on an Event button that has a small arrow attached to it like the one shown above A Blue Dot Menu will open External Trigger Form should be a choice available If it is not you will need to choose Enable External Trigger and then reopen the menu 92 CATC Merlin Mobile User s Manual SW Version 2 0 Step2
146. s When the recording is eventually initiated the master device should attemot to connect to the device that has the Page Target address Merlin Mobile Once Merlin Mobile receives a page from the specified master device it will extract the appropriate information and synchronize to the piconet Back Cancel Help This screen asks you for the address of the Page Target device which in this case is Merlin Mobile Since the devices in your piconet are not able to respond to inquiries Merlin Mobile will not be able to page the devices and join the piconet Instead you will assign Merlin Mobile an address here in this screen then direct your piconet Master device to connect to Merlin Mobile The Master will attempt to connect to Merlin Mobile and therein give Merlin Mobile the information it needs to record the Master and slave devices Step 13 Type in an address of your choosing for Merlin Mobile Page Target You are making up an address for Merlin Mobile that the Master will use to try to connect to Merlin Mobile 51 CATC Merlin Mobile User s Manual SW Version 2 0 Step 14 Press Next Merlin Mobile will then display your current settings Recording Wizard Existing piconet Step 8 of 9 x System is Ready Initiate SearchrRecord Merlin Mobile 12 synchronized to the piconet master and started recording The following options will be used Synchronization Method Passive Syne amp Record F
147. s that were specified in the Display Options dialog box Hide Unassociated Traffic Complex Find Find Next View Packet Level Baseband View Hide LMP Message Level Hg EP SERRE ee a noo s l E w le le z E 27 SW Version 2 0 View Hide HCRP View Hide AVCTP View Hide AVDTP View Hide BNEP Protocol View HID Protocol Layer View IP Protocol Layer View TCP Protocol Layer View UDP Protocol Layer Display device list File Information Report Error Summary Timing Calculations Traffic Summary Display Bus Utilization graph Display Real Time Statistics View HCI Protocol layer CATC Merlin Mobile User s Manual SW Version 2 0 3 3 Status Bar The Status Bar is located at the bottom of the main display window Depending on the current activity the bar can be divided into as many as four segments The figure below demonstrates the various displays in the status bar Recording Progress When you begin recording the left most segment of the Status Bar displays a Recording Progress Indicator The following figure displays the various indications of the status bar 1 Is analyzerconnected configured Beard fwd 2 Ee AE A AAA AAA AA 3 Trigger Syncing to 008037163787 lt 60dBm Search Fwd z 4 synced to 005097163787 40dBm 5 Ses Trigger Recording 008037163787 40dem Search Fwd 7 6 E Triggered Recording 008037163787 0dsm 7 Trigger Inq
148. sion 2 0 7 2 Setting Color Formatting and Hiding Options Click the Color Format Hiding tab on the Display Options screen General Color Format Hiding Level Hiding Group and Color R Data E Packets F Hesadecimal MSE to LSB fal CRC C Decimal LSB to MSB El Time fs Binary Hiding H ASCII ce Hidden gL 2CAP Signalling L2Len Dec MSE to LSB ASCII MSE to LSB B 20AP color LMF RECOMM TES SDP ORES Ho colors available for selected item HDLC RPP HCI Baseband state HCRP Expand All Collapse All Restore Factory Presets Save Save s Default Load caca vo Use this window to customize the colors and formats associated with each field in the Trace view You can also use this window to hide fields within the trace Setting Color Display Options To change the colors of elements in the trace select an item in the Group and Color column and use the color pallet screen on the right to make the desired changes Note The color of an Invalid Data packet error field cannot be changed 1t 1s permanently set to red 99 CATC Merlin Mobile User s Manual SW Version 2 0 Use this window to customize the colors associated with each field in the trace You can experiment with these options to achieve the color combination best suited to a particular graphic system You can also customize the colors by using the options in the
149. to reset the Analyzer or update the BusEngine and Firmware Record Sae Causes the Analyzer to begin recording Bluetooth activity pse Causes the Analyzer to stop recording 23 CATC Merlin Mobile User s Manual SW Version 2 0 Menu Function Recording Mode Presents a drop down menu with options for setting the analyzer s recording mode Piconet Recording Mode Causes Merlin to monitor and record piconet traffic Merlin records the traffic data as specified in the Recording Options then uploads the data as a Trace file when the recording is complete Inquiry Recording Mode Causes Merlin to perform an inquiry to detects and records Bluetooth devices within range After completing the recording Merlin uploads the trace to the PC and saves it as a Trace file IUT HCI Recording Mode Causes the Merlin software to record HCI traffic from the IUT In this mode the Merlin software on the host PC directly records IUT traffic without first going through the analyzer BT Neighborhood Displays Bluetooth Address and clock frequency for devices in range Inquiry The expected Bluetooth clock frequency is 3200 Hz 250 ppm Report File Information Details such information about the recording as number of packets and triggering setup Error Summary Displays an error summary of the current trace file and allows you to go to a specific packet and save the error file to a uniquely named file Timing Calculation Starts the c
150. tput File Format Output Sampling Wave e khz coe To display a File Information report e Select File Information under Report in the Menu Bar OR Click Ez inthe Tool Bar You see the File Information screen 141 SW Version 2 0 CATC Merlin Mobile User s Manual File Information File name data tth Trace occured Tuesday February 18 2003 17 16 55 Number of packets 79909 Recorded with ElTracer analyzer version 2 00 Build 277 Analyzer Serial Number 02658 Motherboard Ose Version Ox1 Firmware version 1 06 ROM 1 01 BT Firmware version 1 20 BusEngine version 1 07 EusEneme type 0 UPAS Slot 1 Part Number ETOOIMLA Plugin ID 0x02 Version Ox Humber of markers 0 Recording Options Options Name Default Recording Mode Manual trigger Butter Size 16 000 ME Post trigger position 50 Base filename amp path data tt ID 26621 SW Version 2 0 The File Information report provides valuable information about how the recording was made what the buffer settings were what the trigger options were and what version of all the analyzer hardware was used to make the recording 10 6 Error Summary The Error Summary command opens the Traffic Summary dialog box and displays an error summary of the current trace file The dialog box allows you to go to a specific packet and save the error file to a uniquely named file See the discussion below on Traf
151. u 33 Search options 62 Search type 46 56 Searching by data pattern 145 complex 140 data length 138 for bit pattern 145 for bit patterns 145 for errors 140 Header AM_ Addr 138 L2Cap CID 140 Lmp Opcode 139 packet types 137 recorded traffic 135 Security 159 SEQN condition 91 Sequence event 103 Set marker 116 Setup menu 33 Shortcuts keyboard 41 Show markers 154 Show plumb Line 154 Signalling message 126 Signals input 88 95 outputs enabling 102 Size of buffer 74 Slave device address 50 Slave switch 81 Snapshot 18 74 Soft Bit Error searching 140 Software installation 11 overview 33 Special Interest Groups SIGs 1 Specifications 7 Status status bar 154 162 SW Version 2 0 CATC Merlin Mobile User s Manual Status bar 38 Status of Analyzer 40 Storage temperature 7 Summary error 151 traffic 156 Support technical 163 Switches 7 81 Sync and record 78 loss error 95 loss of searching 140 timeout loss of 82 window 82 Synchronization forced 81 Synchronize Piconet 50 Synchronized LED 7 T Tabs recording events 88 recording general 18 72 recording modes 19 recording options 71 Technical Support 163 Temperature tolerances 7 Test debug 83 Test mode recording in 64 Threshold Exceeded error 94 TID 116 Tile vertically 154 Time Stamp 116 Timeout inquiry 82 loss of sync 82 Timeslot filtering 89 Timing calculations 151 Tips tool 41 Toggle signal 102 Toolbar 36 Tooltips 41 116 126 Trace fil
152. u must press the Recording button itself Piconet recording Selecting Piconet configures Merlin Mobile to record piconet traffic using the parameters set in the Piconet page in the Recording Options dialog box When you begin recording in this mode Merlin Mobile will to try to synchronize to a piconet that matches the Piconet parameters set in the Recording Options The recorded traffic is captured off the air Inquiry recording This mode configures Merlin Mobile to record Inquiry traffic When setting the Merlin Mobile to Inquiry recording the system is ready to perform a Bluetooth General or Dedicated inquiry according to the parameters 63 CATC Merlin Mobile User s Manual SW Version 2 0 specified in the inquiry page of the Recording Options The recorded traffic would consist the transmitted packets as well as the responses received from Bluetooth devices in the area IUT HCI mode Configures the system to exclusively record HCI traffic from IUTs This recording mode bypasses the analyzer HCI traffic from the IUT is recorded directly by the analyzer software without going through the analyzer This means that you can record HCI traffic even if the analyzer is not turned on To record HCI traffic first enable the recording of HCI traffic from IUTs You do this in the HCI page of the Recording Options dialog Then set the recording mode to something other than IUT HCI If you want to prevent the recording of HCI traffic from
153. uiring lt 60dBm a a Loloadng 85 done Status Bar Position Definitions The following numbered definitions correspond to the number labels on the above status bars 1 Analyzer is not connected or not configured 2 Idle mode Analyzer is connected to the host machine but is not doing any attempts to synchronize to a piconet nor record Bluetooth traffic 3 Analyzer is trying to synchronize to the piconet with the master device that has BD_Address 00837163787 4 Analyzer is synchronized to the piconet with the master device that has BD_Address 00837163787 5 Analyzer is recording the traffic of the piconet with the master device that has BD_Address 00837163787 However no triggering occurred 28 CATC Merlin Mobile User s Manual SW Version 2 0 6 A trigger event occurred and the analyzer is recording the traffic of the piconet with the master device that has BD_Address 00837163787 However no triggering occurred 7 Analyzer is performing a BT Neighborhood action where it makes inquiries for Bluetooth devices 8 Merlin application uploads recorded data from the analyzer at the end of a recording session As recording progresses the Progress Indicator changes to reflect the recording progress graphically e Inthe Progress Indicator a black vertical line illustrates the location of the Trigger Position you selected in Recording Options Pre Trigger progress is displayed in the field to the left of the
154. urations List allows you to manage as list of up to three IUTs to be recorded and set the parameters for each one It also allows you to enable or disable a specific IUT from being recorded The settings are stored in the recording options file like the rest of the recording options Implementation Under Test IOT Configurations List Controller Host Host Controller Rate Marr Bluetooth Headset COM 5600 bps Edit Delete The Configurations List is made up of the following fields e Name Symbolic name of the IUT given by the user for easy identification e Controller gt Host COM port The port that is used for the capturing of the up link traffic e Host gt Controller COM port The port that is used for the capturing of the down link traffic e Rate the bits per second rate the COM ports are configured for The list displays three possible states for each one of the entries e Enabled The HCI traffic from the IUT is going to be recorded e Disabled The HCI traffic from the IUT is not going to be recorded e Invalid The analyzer failed in opening the COM port for accessing the IUT with the listed parameters In this case you should refer to Windows configuration of the COM ports or check T1 CATC Merlin Mobile User s Manual SW Version 2 0 whether the same COM port s is are used by other applications in the host machine or that the parameters are set correctly Add
155. ve s Default Load ree Packet Type The Packet Type drop down menu lets you select the following packet types for filtering or triggering NULL POLL FHS DM1 DH1 HV1 HV2 HV3 DV AUX1 DM3 DH3 1100 1101 DMS or DHS Select Don t Care if you want Merlin Mobile to ignore this field 82 CATC Merlin Mobile User s Manual SW Version 2 0 AM_ADDR Active Member Address The AM_ADDR is a three bit slave address To select packets from a particular slave device for filtering or triggering enter an address into the AM_ADDR text box You can target up to three devices using the three text boxes SEQN ARQN and Flow Control Bits To set event conditions on SEQN ARQN and Flow control uncheck Don t Care Unchecking Don t Care sets the event condition to SEQN 0 AND ARQN 0 AND Flow 0 This action also puts a checkmark in the box marked Packet Headers A checkmark next to SEQN ARQN or Flow changes the value of this field from zero to one For example if SEQN is checked the event condition becomes SEQN 1 AND ARQN 0 AND Flow 0 To cause Merlin Mobile to ignore this set of check boxes choose don t care Payload Headers Clicking Payload Headers causes a series of options to display on the right for setting conditions on payload headers You will see two sets of options one for single slot packets such as DM1 packets and a second for multi slot packets such as DM3 packets Within each set is a menu f
156. w reads Trigger after you see a sequence of a packet with the specified payload followed by a 21 null packets Payload Hdri Hdri POLL 2 Count 65535 2 Counti 24 Trigger Linking Two Events to Two or More Counters If an Event is linked to Countl and a second event is linked to Count2 it creates an or statement This statement reads Trigger when Count OR Count2 has reached their specified values 89 CATC Merlin Mobile User s Manual SW Version 2 0 This example reads Trigger when Countl has counted 5 Poll packets or Count2 has counted 10 errors Hdr if FOLL J Counti 5 Errors 2 Count 10 Trigger Blue Dot Menus Counti Count2 and a few other buttons in the Actions window have blue dots in their top left hand corners that indicate the presence of context sensitive menus These menus let you set the button s values and or operations Click the left mouse button on a dot to open the menu Counters Blue Dot Menu The Counti and Count2 blue dot menus allow the value of their counters to be changed The value you specify here tells Merlin Mobile how many instances of an event must take place before a trigger occurs The counter can be set between 1 and 65 535 To set a Counter Step1 Click on the blue dot in the upper left corner of the Count button You see the Change Counter Value menu Count 7 A lect tit Change Counter Value 90 CATC Merlin Mobile User s Manua
157. ze Trigger Position and Options Recording type The Recording Type box presents options that control how Merlin Mobile begins and ends a recording The options are Snapshot Manual Trigger and Event Trigger Recording type C Snapshot Event Trigger 65 CATC Merlin Mobile User s Manual SW Version 2 0 Snapshot A Snapshot is a fixed length recording whose size is determined by the Buffer Size box in the Recording Options dialog or by a manual click of the Stop button Recording begins by clicking Y Record Piconet on the Tool Bar and ends when either the selected buffer size 1s filled or you press the Stop button Manual Trigger A Manual Trigger recording 1s a one that is manually begun and ended Recording is begun by pressing 4 Record Piconet on the Tool Bar Recording continues in a circular manner within the limits set by the buffer size Recording ends when Di is clicked on the Tool Bar or the Trigger button is pressed on the analyzer s front panel If you press the Trigger button recording will continue until the post trigger memory has been filled Event Trigger An Event Trigger recording 1s one that uses an event trigger to end the recording Before recording begins you define the event trigger in the Trigger Options dialog box You begin the recording by clicking Record Piconet on the Tool Bar Recording continues in a circular manner within the limits set by the buffer size Once the trigger

CATC Merlin Mobile User`s Manual

Contents

Download Pdf Manuals

Related Search

Related Contents