Home

ComProbe 802.11 User Manual

1. e ee eee eee cece cece eeeeeee 117 4 4 2 23 Coexistence View Timeline Radio Buttons 222 lee eee eee eee eee 117 4 4 2 24 Coexistence View low energy Devices Radio Buttons 22 ee eee eee eee ee 117 4 4 2 25 Coexistence View Legend __ _ 22 a 118 4 4 2 26 Coexistence View Timelines cece cee eee cece eee e eee 118 442 27 Pan mano gee foe ee ee ee ee ee ee ee a 118 4 4 2 28 Relocating the tool tip aa 121 4 4 2 29 The two Timelines ccc ce ee eee ee ee ee ee ee eee ee eee eee 123 4 4 2 30 Bluetooth slot markers cc eee ce ce cece cece cece ee eeeeeeeeeees 125 A SA ZOOM AA 125 WAZ a2 DIECON S AA PAA 126 4 4 2 33 High Speed Bluetooth elec eee eee eee e cee cece e cece cece ceeeeeeees 127 4 4 2 34 Coexistence View No Packets Displayed with Missing Channel Numbers 128 4 4 2 35 High Speed Live View ssenscccscccc coved ccumencvedeniascscceetuc sceeucegecepvuuesdesauunsesses 129 4 5 Data Audio Extraction aoaaa oaaao ccc ccc ccc cee cee cece cece cee cece cece enc eeceeceeeceeeeee 130 OG OUAUISHCS ecco AA E E E E 133 4 6 1 Statistics WINdOW 220c once scene ENE NGA ANINO secs Sen eecedeneteaccesseusassckoaoveheesenestesesex 133 4 6 2 Session Resettable and Capture File Tabs e occ cece eee cece eee eeeeeee 136 4 6 3 Copying Statistics To The Clipboard
2. cece cece eee ccc e cece eeceeceeceeeeees 137 A 6 4 302 11 Error Statistics 0c occ ciucetcavbwasebesacacssiedudetdeescdoseceegeSeseuee voceseescesesSeeeven 137 RG AA 137 4 6 5 1 Statistics Errors Graphs eee ec c ee ceeeeceeecee cece eee eee oaaao oaoa 137 4 6 5 2 Printing Error Graphs 2 220 cece cece cee cee cee cee ccc e cece cece cece eceeceeceeceeeeeees 138 Chapter 5 Navigating and Searching the Data _ 2 22 22 l ele cee cece cece cece cece eeees 139 Sd PINO Ca NAA KNA ATA ANA aNG sass ses GA A 139 5 1 Searching within Decodes Xa am DD T nad h AG NONG Han UNAN LanG ipa rne nG da ideada riean 140 VI ComProbe 802 11 User Manual 5 1 2 Searching by Pattern _ 0 20 2 cc aLaaa LLALLA aLL LaLa eee Laaa aoaaa aaan 142 Bled AMA da HI AA 144 De AA EP 146 5 1 5 Searching for Special Events eee ee ce ec ec ccc cece cece cece cece eceeceeceeceeeeeees 147 5 16 Searching Dy SIGWa AA 148 5 1 7 Searching for Data Errors cece cece ccc aooaa naaa cece eee eeeceeceeceeceeeeeees 152 5 1 8 Find Bookmarks 0 22 eee ce ec cece ee cece eee c cece cece cece eee e eee eeceeeeceeceeeeees 154 5 1 9 Changing Where the Search Lands a 155 5 1 10 Subtleties of Timestamp Searching eee cece cece cece eee e ee eeeceeeeeee 156 D2 BOO MIM ANKS ss edn res cece sucess eeeu eas eae ose neuen be ose e do AA 156 5 2 1 Adding Modi
3. 4 4 1 13 1 1 Creating a Display Filter There are two steps to using a display filter Define the filter conditions and then apply the filter to the data set The system combines both filter definition and application in one dialog 1 Click the Display Filters icon Y on the Frame Display window or select Apply Modify Display Filters from the Filter menu to open the Set Condition dialog box The Set Condition dialog is self configuring which means that when you Select each frame under Conditions the following displayed fields depend on your selection With each subsequent selection the dialog fields will change depending on you selection in that field Set Condition S E Currently Active Condition lt Untitled gt Include Exclude Condition Select each frame where the protocol X AVCTP x field x Command Response x IIs Not Present 7 v All Fields Advanced Cancel Help Figure 4 30 Example Set Conditions Self Configuring Based on Protocol Selection 81 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data Set Condition 5 Eid Currently Active Condition Untitled Include Exclude Condition Select each frame in the range 187 to 234 Enter decimal numbers by typing in the number directly and hexadecimal numbers by starting the number with Ox Advanced Figure 4 31 Example S
4. ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data To manually unframe your data 1 Select Unframe from the File menu on the Control window Unframe is only available if a protocol stack was used to capture the data and there is currently no protocol stack selected In addition to choosing to Unframe you can also be prompted to Unframe by the Protocol Stack Wizard 1 Load your capture file by choosing Open from the File menu on the Control window 2 Select the file to load 3 Choose Protocol Stack from the Options menu on the Control window 4 Select None from the list 5 Click Finish The Protocol Stack Wizard asks you if you want to unframe your data and put it into a new file 6 Choose Yes The system removes the frame markers from your data puts the unframed data into a new file and opens the new file The original capture file is not altered See Reframing on page 49 for instructions on framing unframed data 4 2 5 How the Analyzer Auto traverses the Protocol Stack In the course of doing service discovery devices ask for and receive a Protocol Descriptor List defining which protocol stacks the device supports It also includes information on which PSM to use in L2CAP or the channel number for RFCOMM or the port number for TCP or UDP The description below talks about how the analyzer auto traverses from L2CAP using a dynamically assigned PSM but the principle is the same for RFCOMM channel numbers and
5. Far amat Do Pig OOOO e5 E mh ao AA flo Cakes si Ls ep fe NG pe imaa ra ba sal dak aaa I Be Zoomed Thro ughput and Timeline scrollbars are synchronized aaa Pas pig Pre PT Figure 4 60 Synchronized Zoomed Throughput Graph and View Port The largest value in each technology in the Zoomed Throughput Graph is snapped to the top of the graph This makes the graph easier to read by using all of the available space but because the y axis scales can change it can make it difficult to compare different time ranges or durations Clicking the Freeze Y button freezes the y axis scales and makes it possible to compare all time ranges and durations the name of the button changes to Unfreeze Y anda Y Scales Frozen indicator appears to the right of the title Clicking the Unfreeze Y Unfteeze t button unfreezes the y axis scales Interval l a i j Hide Zoom Freeze Y 16 930 pot Sains ait lak otc ve LIL bits s 100 ms point Ha in WANA LI ne Figure 4 61 Zoomed Throughput Graph Largest Value Snaps to Top 114 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual Hide Zoom Unfreeze Y NG Sree HG WU H Kid AUN AM MJ NG AAW PALMA La Vi HAR LANA lg W Figure 4 62 Zoomed Throughput Graph Freeze Y keeps the y axis constant E o wo ww SE S 1
6. Help SIM Application SIP Figure 6 3 Frame Display Print Preview Dialog 2 From this point the procedure is the same as steps 2 through 5 in How to Print Frame Display Data above 3 Click the OK button and after a brief wait a browser window will appear 165 ComProbe 802 11 User Manual Chapter 6 Saving and Importing Data 6 5 2 Printing from the Event Display The Event Display Print feature provides the user with the option to print either the entire capture buffer or the current selection When Print Preview is selected the output displays in a browser print preview window where the user can select from the standard print options The output file format is in html and uses the Microsoft Web Browser Control print options for background colors and images see below Print Background Colors Using Internet Explorer 1 Open the Tools menu on the browser menu bar 2 Select Internet Options menu entry 3 Click Advanced tab 4 Check Print background colors and images under the Printing section 5 Click the Apply button then click OK The Event Display Print feature uses the current format of the Event Display as specified by the user See About Event Display for an explanation on formatting the Event Display prior to initiating the print feature Configure the Print File Range in the Event Display Print dialog Selecting more than one event in the Event Display window defaults the radio button in
7. Layer4 Abed Abedi m Laeli BETH Laer5 Abcd f8 Layer 13 E a ae Layer 6 Abed BURR Lewen det Other Layer Laper15 Abcd 2 Layer amp Abed ff Laver16 Abed ME Figure 4 29 Frame Display Protocol Layer Color Selector 4 4 1 13 Filtering Filtering allows the user to control the display which capture frames are displayed Filters fall into two general categories 79 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data 1 Display filters allow a user to look at a subset of captured data without affecting the capture content Frames matching the filter criteria appear in the Frame Display frames not matching the criteria will not appear 2 Connection filters Two options are available a A Bluetooth connection Displays only the frames associated with a Classic Bluetooth link or a Bluetooth low energy access address A new Frame Display will open showing only the protocol tabs frames summary and events associated with that particular Bluetooth connection b Aspecific wireless or wired technology Displays all of the frames associated with e Classic Bluetooth e Bluetooth low energy e 802 11 e HCI A new Frame Display will open showing only the protocol tabs frames summary and events associated with the selected technology 4 4 1 13 1 Display Filters A display filter looks at frames that have already been captured It looks at every frame in the capture buffe
8. eee cece cece cece eee e ccc eee e cece eceeceeeeceeeeees 191 A 1 802 11 Conductive Testing Isolating the Environment a 193 Poked Ka AA 193 viii ComProbe 802 11 User Manual A 1 2 Test Setup 802 11 193 Puskas I G 194 A 2 ComProbe Automation Server Why use it eee eee cece ce eee cece eee eeeeeeeeee 195 A 2 1 Automation Server Topology 202 c eee cece cece cece ce cece cece cece cece eceeceeceeeeeees 196 A 2 2 Writing Automation Script 0 20000 cee eee eee ee eee 196 A 2 3 Running Automation Server Script 22 eee eee cece eee eee eee ee ccc eee cccceeeecccceeees 198 A 2 4 Saving Automation Captured Data o eee eee cece cece cece eee eeeeeeees 201 A 2 5 Keeping Track of Events ac cocceweresn ueauennen dete ds anaana nanao annoar nanona annoar ULA URUG NS 203 A 2 6 Automation Can Save Time and Money eee cece cee cece cece ecceeceeeeeeeeees 203 List of Figures Figure 2 1 Front Panel 2 3202 ccecsenertededawacdocce cadusosebucecetcadeanwacbousseedleiehseteneceveundtessoreur 4 Figure 2 2 ComProbe 802 11 with both antennas attached 0 0 2 2 eee eee eee eee eee 5 Figure 2 3 Back Panel Power __ 2 22 22 aa 5 Figure 2 4 Back Panel USB ec a000 oaoa ee cece cece ccc eee eee eeceeeeceeceeeees 6 Figure 2 5 Back Panel ProbeSync with BPA 600 2 2 Ha 7 Figure 2 6 Desktop Folder LINK 2ccccc
9. 0 e cece eee e cece eeeceeceeees 180 7 1 4 5 Displaying Fractions of a Second ee eee ec e cece cece eee ceeceeeeees 181 7 2 Technical Information 252 2cec2ececsdccacveceeestdccecbedetetescsausttdeasedaseided dane vestnideceacnse 181 Jak Perio mMmanCe NOTOS Aa ee tees aceasta ad Sees Gaan aa a nd Ga sees 181 7 2 2 la dla elle AA 182 F23 OP DOS nG a na aaa aT maha NAGA NG DA AALAGA DA NIBALEN ALTA Dad BRA SGaA TSE 182 1 24 Event NUMBERING snoicoeeeoecndn th derdeeced de nandudcade cekexsdeceyac oneudensewwedneaeddeusiselecsewds 182 7 2 5 Useful Character Tables cee ce ee ee ee ce ee cece ERASAN A SEn aA 182 TIS PPC COGES ccc east hoes ses eeceeeu ann bao nueseeeoesu eel DNA P INA ee sas alone TON NGANGA DP 183 PS WA le cook a oi ee E stn oe eee AA 183 Tea CBC DIC COUS oc naman EBM ene RE sees eanauedenwasacen NANA 184 7 2 5 4 Communication Control Characters 00 2 eee eee eee eee eee 184 7 2 6 The Frontline Serial Driven 2k ania haaha bA dactnegeecudeosaseciebieteesadeaxtatecdeetedenten 185 7 2 7 DecoderScript Overview cece eee cece cece eee e cece cece cece cece ee eeeeeceeceeeeees 185 7 2 8 Bluetooth low energy ATT Decoder Handle Mapping 0 0 eee cece cee ceeceeceeees 186 7 3 Contacting Technical Support oie eee cece ce ce cece cece eee eee eeeeeeeeeeeeeees 187 Appendicies a 189 Appendix A Application Notes
10. 4 4 1 11 7 Binary Pane The Binary pane displays the logical bytes in the frame in binary Because the Binary pane displays the logical bytes rather than the physical bytes the data in the Binary pane may be different from that in the Event pane See Physical vs Logical Byte Display for more information Colors are used to show which protocol layer each byte belongs to The colors correspond to the layers listed in the Decode pane The Event Radix Binary Character and Decode panes are all synchronized with one another Clicking on an element in any one of the panes highlights the corresponding element in all the other panes 4 4 1 11 8 Event Pane The Event pane shows the physical bytes in the frame You can choose between i displaying only the data events or displaying all events by clicking the All Events icon Ft Ta 78 Ge 1f Nh a5 h4 0 This ts the Event Pane Copy Selection to Clipboard Mee oOo ASM I Select Entire Frame Displaying all events means that special Change Text Highlight Color events such as Start of Frame End of Frame and any signal change events are displayed as special symbols within the data Display All Events The status lines at the bottom of the pane give the same information as the status lines in the Event Display window This includes physical data errors control signal changes if appropriate and timestamps Because the Event pane displays the physical bytes rather
11. Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual Statistics Window Menus Table 4 16 802 11 Statistics Window Menus Description Copies all statistics to the Windows clipboard Opes the notes dialog for recording comments on a capture file Only available when view a capture file Copies the character rate statistics to the Windows clipboard Copies data statistics to the Windows clipboard Copies only the FSC error statistics to the Windows clipboard Copies only the data currently in the buffer to the Windows Clipboard Copies the frame rate statistics to the Windows clipboard When checked will open the window or Statistics Window bar When not checked the window or bar is closed When checked the displayed statistics will stop updating although data is still being captured Unchecking will resume statistics updating Available during live capture Resets all displayed statistics and restarts the calculations Opens the Errors 802 11 window Performs the same function as the control Window Options Menu I O Settings Opens the Timestamping Options window that allows for changing the resolution of the timestamps Opens a pop up with font size selections Closes the Statistics Window Clicking on these selections will change the focus from the Statistics Window to the selected window Opens the ComProbe Help window 135 ComProbe 802 11 Us
12. comprobe 0211 fas reel he i n comprobe S021 apo reng f APP Image 41 3 0 1 3 comprobe 00211 Af rei fau FLF image 02 comprobe BILL perdis nevi Feu PRS image O eomprobe 81211 ah reb fu ATH maga fi comprobe S0211 athak revo rey ATHIK mage 0 2 comprobe 80211 athak kw reb feu ATH HW mage D2 comprobe B0211 athak common nee fens ATHE COMMON image Da i a Jag In comprobe 8021 aga nevi fau Fie Venson 2 1 is same as outeni instaled H N werpon 2 1 Informational comprobe S02ii_app eiu Fie Version 0 4 1 3 is samo as currently installed HAY version 0 4 1 3 Start Update ox Cancel Figure 3 9 802 11 I O Settings Firmware Update Version List 3 1 2 5 Security Wi Fi security settings are discussed in detail in the Decoder Parameters section 3 1 2 6 Wi Fi Device Scanner 1 On the I O Settings dialog click on the Settings tab and then click on the Scanner button The Wi Fi Device Scanner dialog will open 9 Wi Fi Device Scanner File Configure Control Help Start scop _Selectchannel__ Cancd hep Status Inactive Devices Found 0 Sniffer ComProbe 802 11 SN 0102120052 Figure 3 10 802 11 Device Scanner with no Devices Detected 2 On the Wi Fi Device Scanner dialog Select the Start button or select Start Scanning from the Control menu to begin populating the list The Wi Fi Device Scanner dialog displays a list of discoverable Wi Fi devices in a ta
13. Figure 3 17 Set Subsequent Decoder Parameters from Control window moa Ei GOQ T C RARALR Unfiltered Info Configured BT low energy devices Errors l Baseband LHF PreConnection FH5 Bluetooth FHS L2CAP SDP UELLE B Frame Role Addr OLCI Channel Frame Type PYF Bit Cmd CmdType K0 Masher 1 Ox00 0 SABEM 1 o Al Slave 1 0x00 LA 1 ae Master 1 0x00 o UIH o Com Param Nag K3 Slave 1 0x00 a UIH O Fes Param Neg Set Subsequent Decoder Parameters 52 RFCOMM Rules in effect from frame 57 onward until redefined here for a later frame On the Slave side with Server Channel 13 RFCOMM is carying Hands Free Ovemdden by user Change the Selected Item to Cary Hands Free bd Fenovi Figure 3 18 Example Set Subsequent Decode for Frame 52 RFCOMM e Each entry in the Set Subsequent Decoder Parameters dialog takes effect from the specified frame onward or until redefined in this dialog on a later frame e The Remove Override button will remove the selected decode parameter override e The Remove All button will remove all decoder overrides If you do not have decoders loaded that require parameters the menu item does not appear and you don t need to worry about this feature 3 2 1 Decoder Parameter Templates 3 2 1 1 Select and Apply a Decoder Template 1 Select Set Initial Decoder Parameters from the Options menu on the Control window or the Frame Display o Chapt
14. Show Both When checked the Throughput Graph will graph both the data based on packets Packet And throughput in darker colors and payloay throughput in lighter colors The Throughput Payload Indicator will show calculations based on packet throughput Performs the same Throughput function as the Throughput Both radio button The following four selections are mutually exclusive Show 5 GHz When checked the 5 GHz Timeline is visible and the 2 4 GHz Timeline is not visible Timeline Only 802 11 5 GHz packets are shown Performs the same function as the Timeline 5 GHz radio button Show 2 4 GHz When checked the 2 4 GHz Timeline is visible and the 5 GHz Timeline is not visible Timeline The timeline will show Classic Bluetooth Bluetooth Low Energy and 802 11 2 4 GHz packets Performs the same function as the Timeline 2 4 GHz radio button Show Both 2 4 When checked the 2 4 GHz Timeline and the 5GHZ Timeline is visible Performs the GHz and 5 same function as the Timeline Both radio button GHZ Timelines Show When check shows only timelines which have had packets at some point during this Timelines session If no packets are present the 2 4 GHz Timeline is visible Performs the same Which Have or function as the Timeline Auto radio button Had Packets Auto Mode The following two selections are mutually exclusive Show Low When checked shows in the 2 4 GHz Timeline only packets from Bluetooth low enegry Energy devices con
15. warmy Be catebul when changing Ihese paameler Please read the onde help Met or contact Technical Support Selechons do not take effect unti FTS and ary datasources are Hated Diver Recent Buie Size in Ebates Dine Schon Queue See m Operating Suslem Pages Fiame Complebon Timea m Seconds Figure 7 2 Advanced System Options dialog e Driver Receive Buffer Size in Kbytes This is the size of the buffer used by the driver to store incoming data This value is expressed in Kbytes e Driver Action Queue Size In Operating System Pages This is the size of the buffer used by the driver to store data to be transmitted This value is expressed in operating system pages e Frame Completion Timeout in Seconds This is the number of seconds that the analyzer waits to receive data on a side while in the midst of receiving a frame on that side If no data comesin on that side for longer than the specified number of seconds an aborted frame event is added to the Event Display and the analyzer resumes decoding incoming data This can occur when capturing interwoven data DTE and DCE and one side stops transmitting in the middle of a frame The range for this value is from O to 999 999 seconds Setting it to zero disables the timeout feature P Note This option is currently disabled 7 1 1 3 Selecting Start Up Options To open this window 1 Choose System Settings from the Options menu on the Control A window 2 On the System S
16. 1 434 984 4505 Instructional Videos Frontline provides a series of videos to assist the user and may answer your questions These videos can be accessed at fte com support videos aspx On this web page use the Video Filters sidebar to select instructional videos for your product 187 ComProbe 802 11 User Manual Chapter 7 General Information 188 Appendicies Appendix A Application Notes 189 ComProbe 802 11 User Manual Appendicies 190 Appendix A Application Notes A 1 802 11 Conductive Testing Isolating the Environment 22 cece cece eee e ee eee cece 193 A 2 ComProbe Automation Server Why use it _ 2 22 eee ee cece ee eee eee ee eee eeeeeeee 195 191 ComProbe 802 11 User Manual Appendicies 192 A 1 802 11 Conductive Testing Isolating the Environment Conductive testing could be used for many reasons but the most common use is to isolate the 802 11 Wi Fi test setup from the surrounding environment Interference from radio frequency RF sources is the most common reason for isolating the test from the environment This is especially important when the environment contains RF sources using the industrial scientific and medical ISM radio bands used for Wi Fi Conductive in this context means that you are not air sniffing that is capturing 802 11 transmissions on the ComProbe 802 11 analyzer antenna The conductive test set
17. 5 Then click the Move Forward or Move Back button To go to a particular event 1 Select the Data Event Number or All Events Number radio button 2 Type the number of the event in the box 3 Click the Go To button 4 To move forward or backwards through the data type in the number of events that you want to move each time 5 Then click on the Move Forward or Move Backward button 6 For example to move forward 10 events type the number 10 in the box and then click on Move Forward Each time you click on Move Forward Frontline moves forward 10 events See Event Numbering for why the Data Event Number and All Events Number may be different As a general rule if you have the Show All Events icon depressed on the Event Display window or Frame Display Event pane choose All Events Number If the Show All Events button is up choose Data Event Number 5 1 5 Searching for Special Events Frontline inserts or marks events other than data bytes in the data stream For example the analyzer inserts start of frame and end of frame markers into framed data marking where each frame begins and ends If a hardware error occurs the analyzer shows this using a special event marker You can use Find to locate single or multiple special events To access the search for special events function 1 Opena capture file to search 2 Open the Event Display PP or Frame Display 6 window 3 Click on the Find icon Ah or choose Find from t
18. Choose Provide lt context name gt Alternatively you can choose Set Subsequent Decoder Parameter from the Options menu 3 This option brings up a dialog showing all the places where context data was overridden 4 Ifyou know that information is missing you can t provide it and you don t want to see dialogs asking for it un check Automatically Request Missing Decoding Information 5 When unchecked the analyzer doesn t bother you with dialogs asking for frame information that you don t have In this situation the analyzer decodes each frame until it cannot go further and then simply stop decoding 4 3 Analyzing Byte Level Data 4 3 1 Event Display To open this window click the Event Display icon PB on the Control window toolbar The Event Display window provides detailed information about every captured event Events include data bytes data related information such as start of frame and end of frame flags and the analyzer information such as when the data capture was paused Data bytes are displayed in hex on the left side of the window with the corresponding ASCII character on the right seis ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data 9 Event Display Homer cfa File Edit View Format Bookmarks Options Window Help B 283 D lv AAT Event Number U 3 4 o 3 10 11 12 13 14 15 432 Slave 00 01 5a 03 FP da 04 a5 23 6b be 00 i 01 amp Master 4337 e 46 z0 23 Sl
19. Click OK The Set Condition dialog box closes and the analyzer applies the filter When a display filter is applied a description of the filter appears to the right of the toolbar in the Frame Display windows P Note The OK button is unavailable grayed out until the condition selections are complete 4 4 1 13 1 6 The Difference Between Deleting and Hiding Display Filters If you wish to remove a filter from the system permanently then use the Delete procedure However if all you want to do is remove a filter as a means to un clutter the display then use the Hide procedure Deleting a saved filter removes the filter from the current session and all subsequent sessions In order to retrieve a deleted filter the user must recreate it using the Set Conditions dialog Hiding a filter merely removes the filter from the display A hidden filter can be reapplied using the Show Hide procedure 85 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data Deleting Saved Display Filters 1 Select Delete Display Filters from the Filter menu in the Frame Display window to Delete Named Conditions User Defined Conditions open the Delete Named Condition dialog ASO The system displays the Delete Named iter Condition dialog with a list of all user defined Filter 5 Filters filters Filter Filter Role Slave 2 Select the filter to be deleted from the list SCO link Supported 3 Click the Delete button 4 Cli
20. Click on the CRC icon 4f o l Choose CRC Method 4 Inthe CRC dialog box click on the down arrow to show the list of choices for CRC algorithms Choose an algorithm to use Choose CRC 32 Ethernet Choose CRC 32 Ethernet for Ethernet data or TE j j Sum Z s comp the appropriate CRC type for serial data PAC KORI AQF 1 s comp 5 Enter a Seed value in hexadecimal if desired OR 2 s com 6 Click OK to generate the CRC It appears in the byte information Si ad lines at the bottom of the Event Display window Whenever you a select a range of data a CRC using the algorithm you selected is calculated automatically Calculating CRC for interwoven data Frontline calculates the CRC for either side of the interwoven data Which side it calculates is determined by the first byte selected If the first byte is from one side then Frontline calculates the CRC for just the bytes on that side If the first byte is from the other side then Frontline calculates the CRC for just the bytes on that side Incorrect results with CRC16 for serial data If you are calculating CRCs using the CRC16 algorithm and the CRCs do not match what you know they should be try CRC16rev What hardware often calls CRC16 is what software calls CRC16rev 54 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual 4 3 5 Calculating Delta Times and Data Rates 1 Click on the Event Display icon pe on the Control window to open the Event Displ
21. Click the Display All Bookmarks icon Ll Select the bookmark you want to move to and click the Go To button or simply double click on the bookmark Click the Move Forward and Move Back buttons to cycle through the bookmarks 157 ComProbe 802 11 User Manual Chapter 5 Navigating and Searching the Data Find dual mode capture 01 cfa Figure 5 14 Find Window Bookmark tab Used to Move Around With Bookmarks To delete a bookmark select it and click the Delete button To modify a bookmark select it and click the Modify button Click Remove All to delete all the bookmarks 158 Chapter 6 Saving and Importing Data 6 1 Saving Your Data You can save all or part of the data that you have captured You can also load a previously saved capture file and save a portion of that file to another file This feature is useful if someone else needs to see only a portion of the data in your capture file On the Control window toolbar you can set up to capture a single file Click here to see those settings There are two ways to save portions or all of the data collected during a data capture Click here to see how to capture data to disk 6 1 1 Saving the Entire Capture File This option is only available when you select Single File from the Capture Mode on System Settings Click here to learn more about selecting Save options from System Settings 1 If you are capturing data click on the Stop Capture icon to st
22. Destination Address RITA DA Nal if a o i Ci a 2 3 BAGA AG AG NAGA PE PE PE PE PE a Figure 4 74 Coexistence View Timeline Tool Tip Shown Anchored to Computer Screen 4 4 2 29 The two Timelines There are two Timelines available for viewing one for the 5 GHz range and one for the 2 4 GHz range Classic Bluetooth and Bluetooth low energy occur only in the 2 4 GHz range 802 11 can occur in both 123 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data View Packet Range E8 Pack eta mmm Selected Packet Hon a 5 GAZ Channels AM SONG 32205 5007S Pe aS 22211 455160 PM Figure 4 75 5 GHz and 2 4 GHz 802 11 packets The y axis labels show the channels for each technology and are color coded Blue Classic Bluetooth Green Bluetooth low energy Orange 802 11 The 5 GHz timeline has only 802 11 channel labels and the rows alternate orange and white one row per channel The 2 4 GHz timeline has labels for all three technologies The rows alternate blue and white one row per Classic Bluetooth channel The labels going left to right are 802 11 channels Bluetooth low energy advertising channels Bluetooth low energy regular channels and Classic Bluetooth channels The Viewport Packet Range above the timelines shows the packet range and packet count of packets that would be visible if both timelines were shown i e hiding one of the timelines doesn t cha
23. General Procedure l eee cece cece cece ccc cece eee eeceeees 39 4 1 2 1 ComProbe 802 11 with Wireshark 2 00 2 cece cee ce eee eee eee eeees 41 4 1 3 Capturing Using Frontline Wi Fi Datasource with Wireshark 41 4 1 4 Combining BPA 600 802 11 and HSU with ProbeSync 22 c eee eee eee eee cece ee eeeees 44 4 1 5 Extended Inquiry Response _ 2 22 eee cece cece cece cece cece ooo oaao nannan 46 AZ PIOLO SACKS 4 53515 Sa ucaneet sce namads beenowneeeetedanegudebatacaaavescaeeceswantotessuspeyedeudaumeteace 46 4 2 1 Protocol Stack Wizard ject ets ee eg cen eerie eae te eee ees cease cess 47 4 2 2 Creating and Removing a Custom Stack eee eee cece cece eee c ee ceececeeeeeceeeee 48 4 2 3 Reframing da nakak kak nA aho awa NG naa phh hima nik abaca rho Bhd Eka bab h o mh NG LAAN dhEN dm orrn 49 A 2A WANA ad ata kaaa aah e aa nama ka Lun na Naba aa AT La Damag hdd basa a abad lacasi 49 4 2 5 How the Analyzer Auto traverses the Protocol Stack e cece eee eee cece eeeee 50 4 2 6 Providing Context For Decoding When Frame Information Is Missing 50 4 3 Analyzing Byte Level Data _ 22 2 lei 0000000020220222 eee eee eee eeeeeeeeeeees 51 4 3 1 Event Display 2 22 oe cece ce cc cc ccc cece cece cece cece eee e eee ceeceeceeceeeceeceeees 51 4 3 2 The Event Display Toolbar 2 ieee cece cee ec eee eee eee eee eee eeeeeee
24. Pd 3 8 T aod SOS am Sea Baa kapa es ee al a Ef a a ae iam E ae KEN NA b Let fig h Lk info p pw w x m Jo pl a uf v EFA E IG SS a Ga a GA ALet tote et eta d ps KT PMN oO ett ste eee HA Fx O 1 2 3 4 5 6 7 819 EEH ae E Ea LT a tt es Ka kaa Ea pat bie ki Ea Pit ky f es aa Ea ae ae 4 Sees lee i E E E ee O ze o i T 7 2 5 4 Communication Control Characters Chapter 7 General Information Listed below in alphabetical order are the expanded text meanings for common ANSI communication control characters and two character system abbreviation for each one Some abbreviations have forward slash characters between the two letters This is to differentiate the abbreviations for a control character from a hex number For example the abbreviation for Form Feed is listed as F F to differentiate it from the hex number FF Table 7 2 Communications Control Characters o ee je 184 Chapter 7 General Information Table 7 2 Communications Control Characters continued rs fs mesm OO 7 2 6 The Frontline Serial Driver ComProbe 802 11 User Manual ComProbe software uses custom versions of the standard Windows serial drivers in order to capture data These drivers are usually installed during the routine product installation However if you need to install the serial driver after ComProbe software has alre
25. USA Europe Japan USA Europe Japan USA Europe Japan 5 2421 2443 MHz centered at 2432 MHz USA Europe Japan 12 2456 2478 MHz centered at 2467 MHz Europe Japan 6 2426 2448 MHz centered at 2437 MHz USA Europe Japan 13 2461 2483 MHz centered at 2472 MHz Europe Japan 7 2431 2453 MHz centered at 2442 MHz USA Europe Japan 14 2473 2495 MHz centered at 2484 MHz Japan The row labels for 802 11 channels 1 13 are placed at the center frequency of each channel The row label for 802 11 channel 14 is in parentheses because that channel s center frequency is above the top of the graph Figure 4 77 2 4 GHz information windows 4 4 2 30 Bluetooth slot markers When zoomed in far enough Bluetooth slot markers appear in the 2 4 GHz timeline A Bluetooth slot is 625 us wide TAG a 16410 Cata oe 1h eta NAAT ae Figure 4 78 Vertical blue lines are Bluetooth slot markers 4 4 2 31 Zooming There are various ways to zoom 2125 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data 1 Drag one of the sides of the Throughput Graph viewport 2 Select a zoom preset from the Zoom or right click menus 3 Select the Zoom In or Zoom Out button or menu item 4 Turn the mouse wheel in the Timelines or the Zoomed Throughput Graph while the zoom cursor is selected The action is the same as selecting the Zoom In and Zoom Out buttons and menu items except that the time point a
26. b WEP Passkey the shared passkey phrase used in communications Note When capturing both B uetooth and 802 11 data using the 802 11 AMP capture selection Frontline uses the link from the BR EDR connection To automatically decode 802 11 AMP frames in this case select the Bluetooth AMP encryption type but leave the link key blank 4 Select OK to save the settings and close the dialog 34 ComProbe 802 11 User Manual Chapter 3 Configuration Settings 3 2 3 Adding or Changing TCP UDP Port Assignments TCP and UDP are Transport layer protocols in the IP protocol suite These transport layer protocols use ports to establish communication between application layer protocols For example all Web traffic uses the HTTP protocol HTTP is an application layer protocol that uses the standard TCP UDP port 80 The Internet Assigned Numbers Authority IANA is responsible for maintaining the list of standard port numbers and their assignments For an up to date listing of all standard TCP UDP port assignments visit www iana org When the analyzer reads a TCP UDP or IPX packet it infers the upper layer protocols by using pre defined rules of traversal For example if the packet has a TCP source or destination port number 80 then the upper layer protocol is HTTP These rules which are built in to the software determine the upper layers of the protocol stack based on the source or destination port numbers in the packet The built in rules are ba
27. contain your search parameters 1 Enter the search pattern 2 Check Ignore Case to do a case insensitive search 143 ComProbe 802 11 User Manual Chapter 5 Navigating and Searching the Data 3 When you have specified the pattern you want to use click on the Find Next or Find Previous buttons to start the search from the current event The result of the search is displayed in the in Frame Display and Event Display Refer to Searching by Decode on page 140 for information on Side Restrictions 5 1 3 Searching by Time Searching with Time allows you search on timestamps on the data in Frame Display and Event Display window To access the search by time function 1 Opena capture file to search 2 Open the Event Display PB or Frame Display 5 window 3 Click on the Find icon Ah or choose Find from the Edit menu 4 Click on the Time tab of the Find dialog Note The tabs displayed on the Find dialog depend on the product you are running and the content V4 of the capture file you are viewing Decode Pattem Time GoTo Special Event Bookmark Relative kamal sarap ataizi Bapu EET How Second 1 1 000000 Second a dh dl da Bilis e Go bo the bmestamp CG On o baoe the specified lima O Onor after the specihed lime Figure 5 6 Find by Time tab The analyzer can search by time in several different ways Search for Absolute Relative timestamp 144 Chapter 5 Navigating and Searc
28. of along header line so that the field is visible regardless of where the header is scrolled to An added field can be removed from the Summary pane by selecting Remove New Column from the right click menu The default column layout both membership and order can be restored by selecting Restore Default Columns from the Format or right click menus Changing Column Widths To change the width of a column 1 Place the cursor over the right column divider until the cursor changes to a solid double arrow 2 Click and drag the divider to the desired width 3 To auto size the columns double click on the column dividers Hiding Columns To hide a column 1 Drag the right divider of the column all the way to the left 2 The cursor changes to a split double arrow when a hidden column is present 3 To show the hidden column place the cursor over the divider until it changes to a split double arrow then click and drag the cursor to the right 4 The Frame Size Timestamp and Delta columns can be hidden by right clicking on the header and selecting Show Frame Size Column Show Timestamp Column or Show Delta Column Follow the same procedure to display the columns again Moving Columns Changing Column Order To move acolumn NG ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data 1 Click and hold on the column header 2 Drag the mouse over the header row 3 A small white triangle indicates where the column is m
29. selection Continue to enter the requested parameters in the fields provided until the conditions statement is complete 83 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data NOT Condition where the protocol 7777 exists x le gt lie Figure 4 32 Two Filter Conditions Added with an AND Operator 6 Click the plus icon on the left side of the dialog box and repeat steps 4 and 5 for the next condition Use the up t and down 4 arrow icons on the left side of the dialog box to order your conditions and the delete button e to delete conditions from your filter 7 Continue adding conditions until your filter is complete 8 Include parentheses as needed and set the boolean operators 9 Click OK 10 The system displays the Save Named Condition dialog Provide a name for the filter condition or accept the default name provided by the system and click OK Save Named Condition e e pc FF Ce User Defined Conditions FilterU Figure 4 33 Save Named Filter Condition Dialog The Set Condition dialog box closes creates a tab on the Frame Display with the filter name and applies the filter When a display filter is applied a description of the filter Filter Include each frame where the protocol Data exists appears to the right of the toolbar in the Frame Display windows Note The OK button on the Set Condition dialog box is unavailable grayed out until the condition sel
30. session of Frame Display Antenna True e The search is cancelled when you select a different protocol tab during a search e You can cancel the search at any time by selecting the Cancel Current Search button 4 4 1 7 Synchronizing the Event and Frame Displays The Frame Display is synchronized with the Event Display Click on a frame in the Frame Display and the corresponding bytes is highlighted in the Event Display Each Frame Display has its own Event Display As an example here s what happens if the following sequence of events occurs 1 Click on the Frame Display icon in Control window toolbar to open the Frame Display 2 Click on the Duplicate View icon dg to create Frame Display 2 3 Click on Event Display icon Po in Frame Display 2 Event Display 2 opens This Event Display is labeled 2 even though there is no original Event Display to indicate that it is synchronized with Frame Display 2 4 Click on a frame in Frame Display 2 The corresponding bytes are highlighted in Event Display 2 5 Click on a frame in the original Frame Display Event Display 2 does not change 69 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data 4 4 1 8 Working with Multiple Frame Displays Multiple Frame Displays are useful for comparing two frames side by side They are also useful for comparing all frames against a filtered subset or two filtered subsets against each other e To crea
31. 11 packets by channel and time 4 4 2 27 Packet information Packet information is provided in various ways as described below 118 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual Packets are color coded to indicate attribute Retransmit Bad Packet Can t Decrypt or Invalid IFS master Tx technology Classic Bluetooth Bluetooth low energy or 802 11 and category type Selection Box Attribute Bad Packet MasternTx Master Technology Classic Bluetooth Packet Category or Type ACL Figure 4 67 Each packet is color coded The innermost box which indicates packet category type is the packet proper in that its vertical position indicates the channel its length indicates the packet s duration in the air its left edge indicates the start time and its right edge indicates the end time The height of Classic Bluetooth and Bluetooth low energy packets indicates their frequency range 1 MHz and 2 MHz respectively Since 802 11 channels are so wide 22 MHz 802 11 packets are drawn with an arbitrary 1 MHz height and centered within a separate frequency range box which indicates the actual frequency range Selecting a packet by clicking on it draws a selection box around it as shown above and highlights the applicable entries in the legend mit Bad Packet Cant Decrypt Inwalid IFS fe Discontinuity a DANO Click on any bold entry above to enable navigation Figure 4 68
32. 18 2442 MHz 19 2444 MHz 20 2446 MHz 21 2448 MHz 22 2450 MHz 50 2452 MHz 51 2453 MHz 52 2454 MHz 53 2455 MHz 54 2456 MHz 55 2457 MHz 56 2458 MHz 57 2459 MHz 58 2460 MHz 59 2461 MHz 23 2452 MHz 24 2454 MHz 25 2456 MHz 26 2458 MHz 27 2460 MHz 60 2462 MHz 61 2463 MHz 62 2464 MHz 63 2465 MHz 64 2466 MHz 65 2467 MHz 66 2468 MHz 67 2469 MHz 68 2470 MHz 69 2471 MHz 28 2462 MHz 29 2464 MHz 30 2466 MHz 31 2468 MHz 32 2470 MHz 70 2472 MHz 1 2473 MHz 2 2474 MHz 73 2475 MHz 4 2476 MHz 75 2477 MHz 6 2478 MHz 77 2479 MHz 8 2480 MHz 33 2472 MHz 34 2474 MHz 35 2476 MHz 36 2478 MHz 39 2480 MHz 802 11 2 4 GHz In the 802 11 2 4 GHz frequency range there are 11 channels in the USA 13 in Europe and 14 in Japan Each channel is 22 MHz wide Channels overlap There is a 5 MHz shift between each of the first 13 channels There is a 12 MHz shift between channels 13 and 14 1 2401 2423 MHz 2 2406 2428 MHz 3 2411 2433 MHz 4 2416 2438 MHz centered at 2412 MHz centered at 2417 MHz centered at 2422 MHz centered at 2427 MHz USA Europe Japan USA Europe Japan USA Europe Japan USA Europe Japan 8 2436 2458 MHz 9 2441 2463 MHz 10 2446 2468 MHz 11 2451 2473 MHz centered at 2447 MHz centered at 2452 MHz centered at 2457 MHz centered at 2462 MHz USA Europe Japan
33. 2 Go to the CVEventDisplay section 3 Change the value for SelectionOffset 4 If you want the selection to land on the top line of the display change the SelectionOffset to O zero 155 ComProbe 802 11 User Manual Chapter 5 Navigating and Searching the Data 5 1 10 Subtleties of Timestamp Searching Timestamping can be turned on and off while data is being captured As a result the capture buffer may have some data with a timestamp and some data without When doing a search by timestamp the analyzer ignores all data without a timestamp Note The raw timestamp value is the number of 100 nanosecond intervals since the beginning of H January 1 1601 This is standard Windows time 5 2 Bookmarks Bookmarks are electronic sticky notes that you attach to frames of interest so they can be easily found later In Frame Display bookmarked frames appear with a magenta triangle icon next to them 5 Frame Command Eno Code FID MIC AiD Source TID LID Fra Deka Timestane A 1 Ed 12 6 2010 11 25 2 168 DOO 12 67200 11 25 b E3 124 0000 00 3 LAND 17250 a Ed 00 00 00 1 12 6 2010 11 25 Figure 5 13 Bookmarked Frame 3 in the Frame Display 00 ag 00 o0 g Inthe Event Display bookmarks appear as a dashed line around the start of frame 1 M 0G 15 marker D0 4500 00 47 lt Bookmarks are easy to create and maintain and are a very valuable tool for data analysis When you create or modify a bookmark
34. 25 ms Increase Auto Hide Packet Count From 4 000 to 20 000 May Be Slow Use All Packets for Throughput Indicators Use Selected Packets for Throughput Indicators Use Viewport Packets for Throughput Indicators Set 802 11 Tx Address Show Packet Throughput Show Payload Throughput Show Both Packet and Payload Throughput Show 5 GHz Timeline show 2 4 GHz Timeline how Both 5 GHz and 2 4 GHz Timelines how Timelines Which Have or Had Packets Auto Mode hann ky how Low Energy Packets From Configured Devices Only Show All Low Energy Packets 2 4 GHz Large Throughput Graph Show Dots in Throughput Graph Dots Reveal Overlapped Data Points Show Zoomed Throughput Graph Show Tooltips in Upper Left Corner of Screen Figure 4 73 Coexistence View Format Menu Show Tooltips on Computer Screen 122 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual Packet 15 455 802 11 Management Beacon 6 17 2011 10 41 19 835783 AM Beginning Timestamp 6 17 2011 10 41 19 636799 AM Ending Timestamp tence View bpa Radio Timestamp n a mat Zoom Navigate Spectrum Help Duration 1 016 ms Type Management OD gt Subtype Beacon Channel 10 2457 MHz OAL Selected O Viewport Width 20 MHz Data Rate 1 0 Mb s wg throughput 1 sec throughput Channel Type 802 11b Bua Packet Len 128 bytes Payload Len 0 bytes Source Address Cisco Linksys LLC 72 b3 a6 SA
35. 4 64 802 11 Source Address Drop Down Selector _ 2 2 2 22 e cece eee eee eee e cece eeeeeeee 117 Figure 4 65 Coexistence View Legend _ 2 22 a 118 Figure 4 66 Coexistence View Timelines eee cece cee cece cece eee cece ee ceeeeeeeeeeees 118 Figure 4 67 Each packet is color coded cece eee ce eee ccc c cece ccc ecececceececeeceeceeceees 119 Figure 4 68 Highlighted entries in the legend for a selected packet 119 Figure 4 69 Timeline header for a single selected packet eee eee cee cece cece eceeees 119 Figure 4 70 Timeline header for multiple selected packets l elec eee eee eee ee ee eeeee 120 Figure 4 71 Descriptive text on timeline packets 20 2 le a 120 Figure 4 72 A tool tip for a Classic Bluetooth packet _ 2 222 lien cece cece eeeeeees 121 Figure 4 73 Coexistence View Format Menu Show Tooltips on Computer Screen 122 Figure 4 74 Coexistence View Timeline Tool Tip Shown Anchored to Computer Screen 123 Figure 4 75 5 GHz and 2 4 GHz 802 11 packets ec c cece cee ce eecceeceeeeeees 124 Figure 4 76 5 GHz information window 2 22 eee eee eee ce eee cece cece cece aooaa nannan 125 Figure 4 77 2 4 GHz information windows a 125 Figure 4 78 Vertical blue lines are Bluetooth slot markers __ 22 22 22 eee eee eee eee eee ee eeee
36. 6 6 2 Exporting a File with Event Display Export a 167 6 6 2 1 Export Filter Out 2 222 lee cece cee cee cee cece eee cence eee eeeeeeeeeeeees 170 6 6 2 2 Exporting Baudot _ 2 2 22 eee cee ccc cee cee eee e cece cece cece eee eceeceeceeeeeceeeees 170 Chapter 7 General Information 22 22 ee cece eee cece cee eee eee eee eee aoaaa annn 171 vil ComProbe 802 11 User Manual 7 1 System Settings and Progam Options 22 22 eee ee cece cee eee eee eee cess 171 Fa System Se CNS capes aoe ass ee tne ee eee AA 171 7 1 1 1 System Settings Disabled Enabled Options _ 2 2 2 22 eee eee eee eee cece eee eeeeeee 173 7 1 1 2 Advanced System Options ee cece cece cece ccc cece cece ccececceeceecececceeeeees 173 71123 Selecting Start Up ODUONS susccecstcsteudch dusitecteoberucussedennsanweedescoseausacnscneeaeauce 174 7 1 2 Changing Default File Locations _ 2 222 l occ cece ccc cece cee cece cece eee eeceeceeceeeeeees 175 7 1 3 Side Names 2 222 eee ee ee eee eee eee eee eee eee eee eee eee eee 177 PA We SUN AA AA 178 7 1 4 1 Timestamping Options ec ce cee cc ee ee cee e cee e eee eeeeeees 178 7 1 4 2 Enabling Disabling Timestamp 20 2 occ e cece cece cece eeeeeeceeeecececees 179 7 1 4 3 Changing the Timestamp Resolution 0 22 22 eee eee cece eee eee e cece ceeeeeee 179 7 1 4 4 Switching Between Relative and Absolute Time
37. Bluetooth low energy packets from non configured devices are excluded if the Configured radio button in the LE Devices group is selected LE Devices Configured e Frame Display filtering has no effect here in that packets that are filtered out in O All Frame Display are still used here as long as they otherwise meet the criteria for each radio button as described below 4 4 2 6 All radio button All packets are used for average throughput and packets Packets All Selected Viewpott occurring in the last 1 second of the session are used for 1 second throughput except that Bluetooth low energy packets from non configured devices can be excluded as noted above 4 4 2 7 Selected radio button Selected packets the selected packet range is shown in the timeline header are used for average throughput and packets in the 1 second duration ending at the end of the last selected packet are used for 1 second except that Bluetooth low energy packets from non configured devices can be excluded as noted above Packets JA Selected Viewport Selected Packets 15454 15437 Gan 1477 ms Timestamp Delta 45 922 me Span 46 192 ms Figure 4 11 Timeline Header Showing Selected Packets 4 4 2 8 Viewport radio button The viewport is the purple rectangle in the Throughput Graph and indicates a specific starting time ending time and resulting duration Packets that occur within that range of time are used for average throughput an
38. Discards the temporary file and 2 clears the display a Event Display Brings the Event Display window to the front a ee Show Statistics Opens Statistics dialog Duplicate View Creates a second Frame Display window identical to the first Apply Modify Display Filters Opens the Display Filter dialog Quick Protocol Filter brings up a dialog box where you can filter or hide one or more protocol layers Protocol Stack brings up the Protocol Stack Wizard where you can change the stack used to decode framed data 63 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data Table 4 4 Frame Display Toolbar Icons continued Reload Decoders When Reload Decoders is clicked the plug ins are reset and received frames are re decoded For example If the first frame occurs more than 10 minutes in the past the 10 minute utilization graph stays blank until a frame from 10 minutes ago or less is decoded Find Search for errors string patterns special events and more Display Capture Notes Brings up the Capture Notes window where you can view or add notes to the capture file modify an existing bookmark led Display All Bookmarks Shows all bookmarks and lets you move between bookmarks Coexistence View Opens the Coexistence View Extract Data Opens the Extract Data dialog Audio Extraction Opens the Audio Extraction dialog Pie Chart This icon displays a chart that
39. Filter Name The filter you just created appears in the Named Filters section ASCII 3 of the Quick Filtering dialog ok Cancel 441 413 1 4 Using Compound Display Filters Compound filters use boolean logic to create complex and precise filters There are three primary Boolean logic operators AND OR and NOT The AND operator narrows the filter the OR operator broadens the filter and the NOT operator excludes conditions from the filtered results Include parentheses in a compound filter to nest condition sets within larger condition sets and force the filter processing order There are two steps to using a compound filter Define the filter conditions and then apply the filter to the data set The analyzer combines both filter definition and application in one dialog 1 Click the Display Filters icon Y on the Frame Display window or select Apply Modify Display Filters from the filter menu to open the Set Condition dialog box 2 Click the Advanced button on the Set Condition dialog box 3 Select Include or Exclude radio button Now you can set the conditions for the filter 4 Select the initial condition for the filter from the combo box at the bottom of the dialog for Select each frame Condition Select each frame where the protocol 5 Set the parameters for the selected condition in with the conversation the fields provided The fields that appear in the Vee dialog box are dependent upon the previous
40. Highlighted entries in the legend for a selected packet Summary information for a selected packet is displayed in the timeline header Selected Packet 15 457 Timestamp 6 9 7 2011 10 47 19 835783 AM Technology Classic Type DMI Bluetooth Clock 0201158610 Payload Len 3 bytes Figure 4 69 Timeline header for a single selected packet 119 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data When multiple packets are selected by dragging the mouse with the left button held down clicking one packet and shift clicking another or clicking one packet and pressing shift arrow the header shows Gap duration between the first and last selected packets Timestamp Delta difference between the timestamps which are at the beginning of each packet and Span duration from the beginning of the first selected packet to the end of the last selected packet Selected Packets 15434 15437 Gapi 9477 ms Timestamp Delta 45 922 ms Span 46 192 ms Figure 4 70 Timeline header for multiple selected packets Text can be displayed at each packet by selecting Show Packet Show Packet Number Number Show Packet Type and Show Packet Subtype Show Packet Type from the Format menu Show Packet Subtype Hide Packet Text x Auto Hide Packet Text When Duration 31 25 ms SS 15 455 Marmt 15 458 Data 15 459 Data 15 460 Data 15 456 DN 15 457 Dhi Figure 4 71 Descriptive text on timeline packets Placin
41. Info PreConnection FHS RFCOMM SDP LMP Non Captured Info PreConnection FHS RFCOMM SDP Filtering shows only frames that contain the protocol desired but it shows the entire frame Hiding removes any protocol layers from displaying in any frame Figure 4 44 Frame Display Quick Filtering and Hiding Protocols Dialog The box on the left is Protocols To Filter In When you select the checkbox for a protocol in the Protocols to Filter In the Summary pane will only display those frames that contain data from that protocol If you filter on more than one protocol the result are all frames that contain at least one of those protocols For example if you filter on IP and IPX NetBIOS you receive all frames that contain either IP or IPX NetBIOS or both A Quick Filter tab then appears on the Frame Display Changing the filter definition on the Quick Filter dialog changes the filter applied on the Quick Filter tab Quick filters are persistent during the session but are discarded when the session is closed Quick Filter The box in the center is the Protocols To Hide When you select the checkbox for a protocol in the Protocols To Hide data for that protocol will not appear in the Decode Binary Radix and Character panes The frames containing that type data will still appear in the Summary pane but not in the Decode Binary Radix and Character panes The box on the right is the Named Filters It contains fil
42. PC would not be a slave of more than one device Let us say that a link exists between a PC and a keyboard with the PC a master If the mouse wants to become a member of the link it initiates the connection Since the mouse initiated the connection it is the master of a new link and the PC is the slave The PC is still the master of the link between the PC and keyboard A role switch now occurs between the PC and the mouse and the PC is now the master of a link with two slaves the mouse and keyboard 2 3 Control Window The analyzer displays information in multiple windows with each window presenting a different type of information The Control window opens when the Run button is clicked in the Select Data Capture Method window The Control window provides access to each ComProbe analyzer functions and settings as well as a brief overview of the data in the capture file Each icon on the toolbar represents a different data analysis function A sample Control Window is shown below 3 ComProbe Protocol Analysis System 802 11 a e Hs Fle View Live Options Window Help CEE REEERE Configuraton lt No Device Capture file C Wsers Public Documents Frontine Test Equipment y Capture Files Capture 20 13 05 23 075126 cfa Capture Status Paused Capture to Single File lt 1 used Packets on h w 0 For Help Press Fl Packet Decoder 0 pps Figure 2 7 ComProbe Analyzer Control Window Because the Control window can get lost behind oth
43. Refer to Coexistence View Legend on page 118 Performs the same functions as the mp Last Legend Packet button Toggle This selection is active during Live capture mode only Checking this selection will lock Display Lock the Throughput Graph and the Timeline in its current position however the capture will continue Not checking this selection will cause the Throughput Graph and the Timeline to scroll as data is collected Note Navigate menu selections are context sensitive For example If the first packet is Si selected the Next Packet and the Last Packet selections are active but the Previous Packet selection is inactive 4 4 2 2 Coexistence View Toolbar BBEOD 4949 9 gt A AAL P A Figure 4 46 Coexistence View Toolbar The toolbar contains the following selections Table 4 10 Coexistence View Toolbar icons Ca ia Move to the first packet Move to the previous packet 103 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data Table 4 10 Coexistence View Toolbar icons continued Pp escription ption C Opee openee apan a Na YU a aa nagan aaa Wee ooo When selected the cursor changes from Scroll pp to a context aware zooming cursor Click on normal cursor to remove the zooming cursor Zooming cursor 104 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual Table 4 10 Coexistence View Toolbar icons continued O e
44. Session tab The timestamp appearing in Session tab fields is the timestamp of when the analysis drear 2015 70452 AM began The timestamp appearing in the Resettable tab fields is the timestamp either when the analysis began or when the last Reset was initialted The Capture File tab shows information on the data that is currently in the capture If the capture file had become full the analyzer began to overwrite the oldest data and put new data in its place This is called wrapping If the file wrapped the numbers on the Capture File tab is smaller than those on the Session tab Occasionally some of the statistics read n a for Not Available This happens for various reasons For example many of the items on the Capture File tab become not available if the buffer becomes full and wraps When this happens the analyzer can no longer provide accurate statistics for the data in the file because some of the data that the statistics are based on has been lost 136 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual 4 6 3 Copying Statistics To The Clipboard Any table in the Statistics window can be copied to the clipboard where it can be pasted into any application 1 Choose the name of the table from the Edit menu 2 To copy the contents of all the tables choose Copy All to Clipboard kh Statistics 802 11 View Graph Options Window Help Copy All To Clipboard Notes Copy Chars Sec To Clipboard Copy Dat
45. System Settings from the Options menu on the Control Pm window and click the Timestamping Options button or click the click the Timestamping Options icon f from the Event Display O window 2 Go to the Display Options section at the bottom of the window and find the Number of Digits to Display box 3 Click on the arrows to change the number You can display between O and 6 digits to the right of the decimal point 7 2 Technical Information 7 2 1 Performance Notes As a software based product the speed of your computer s processor affects the analyzer s performance Buffer overflow errors are an indicator that the analyzer is unable to keep up with the data The information below describes what happens to the data as it arrives what the error means and how various aspects of the analyzer affect performance Also included are suggestions on how to improve performance The analyzer s driver takes data from the driver and counts each byte as they are put into the driver s buffer The analyzer s driver tells the user interface that data is ready to be processed The analyzer takes the data from the driver s buffer and puts the data into the capture buffer Driver Buffer Overflows occur when the user interface does not retrieve frames from the driver quickly enough Buffer overflows are indicated in the Event Display window by a plus sign within a circle Clicking on the buffer overflow symbol displays how many frames hav
46. TCP UDP port numbers The analyzer looks for SDP Service Attribute Responses or Service Search Attribute Responses carrying protocol descriptor lists If the analyzer sees L2CAP listed with a PSM it stores the PSM and the UUID for the next protocol in the list After the SDP session is over the analyzer looks at the PSM in the L2CAP Connect frames that follow If the PSM matches one the analyzer has stored the analyzer stores the source channel ID and destination channel ID and associates those channel IDs with the PSM and UUID for the next protocol Thereafter when the analyzer sees L2CAP frames using those channel IDs it can look them up in its table and know what the next protocol is In order for the analyzer to be able to auto traverse using a dynamically assigned PSM it has to have seen the SDP session giving the Protocol Descriptor Lists and the subsequent L2CAP connection using the PSM and identifying the source and channel IDs If the analyzer misses any of this process it is not able to auto traverse It stops decoding at the L2CAP layer For L2CAP frames carrying a known PSM 0x0001 for SDP for example or 0x0003 for RFCOMM the analyzer looks for Connect frames and stores the PSM along with the associated source and destination channel IDs In this case the analyzer does not need to see the SDP process but does need to see the L2CAP connection process giving the source and destination channel IDs 4 2 6 Providing Context Fo
47. Type and Show Packet Subtype menu selections When checked automatically hides any text shown below the packet in the Viewport when the Viewport duration exceeds 31 25 ms Applies the text shown by the Show Packet Number Show Packet Type and Show Packet Subtype menu selections The Viewport duration is shown at the bottom of the Viewport This selection reduces display clutter when viewing a larger timeline section When not checked the default the packets in the viewport are hidden if the number of visible packets exceeds 4 000 When checked the default count increased from 4 000 to 20 000 packets before the packets are hidden Choosing this selection may slow down the displaying of the packets The following three selections are mutually exclusive Use All Packets for Throughput Indicators Use Selected Packets for Throughput Indicators Use Viewport Packets for Throughput Indicators Set 802 11 Tx Address When checked all captured packets are used for average throughput calculations and all packets in the last one second of the capture session are used for the 1 sec throughput See Coexistence View Throughput Indicators on page 105 for more information Performs the same function as the throughput indicator All radio button When checked the packets selected in the Viewport are used for average throughput calculations and selected packets in the one second before the last selected packet are used for the 1
48. User Manual 1 Right click on the data display header labels and choose a different radix D r d l r m r r l m i i n l m Display numbers in Binary SE Display numbers in Octal Oda Display numbers in Decimal b 3 Display numbers in Hexadecimal Figure 4 16 Header labels right click 2 Or right click anywhere in the data display and select a different radix Oa 9a amp 30 Copy the selection and put it on the i 2a Save As Go to an Event Number l 5e OE Find 197 Oc Display Only Numbers 44 Display Only Characters Display Sides Together meee v Display all Event Information Yy numbers in Binary Display numbers in Octal Display numbers in Decimal V Display numbers in Hexadecimal Figure 4 17 Data display right click menu If you want to see only the numerical values click on the Numbers Only icon 41 on the Event Display toolbar 4 3 7 3 Switching Between ASCII EBCDIC and Baudot On the Event Display window the analyzer displays data in ASCII by default when you click on the Characters Only icon A There are several ways to change the character set used to display data 1 Gotothe Format menu and select the character set you want A check mark next to the character set indicates which set is currently being used 2 With the data displayed in characters right click on the data panel header label to choose a different character set If you want to see o
49. are searching forward in the buffer you usually want to choose the On or After option If you choose the On or Before option it may be that the analyzer finishes the search and not move from the current byte if that byte happens to be the closest match When you select Absolute as Search for the radio buttons are On or before the specified time or On or after the specified time When you select Relative as Search for the radio buttons are On or before the specified time relative to the first selected item or On or after the specified time relative to the last selected item 1 Select On or before the specified time or On or after the specified time 2 When you have specified the time interval you want to use click on the Go To Move Forward or Move Backward buttons to start the search from the current event When you select Absolute as Search for Go To is available When you select Relative as Search for Move Forward or Move Backwardis available There are a couple of other concepts to understand in respect to searching with timestamps e The analyzer skips some special events that do not have timestamps such as frame markers Data events that do not have timestamps because timestamping was turned off either before or during capture are also skipped 145 ComProbe 802 11 User Manual Chapter 5 Navigating and Searching the Data e Timestamping can be turned on and off while data is being captured As a result the capture buff
50. cable less than 1 5 meters 4 9 feet insert one end to the master ComProbe device OUT jack 2 Insert the other end of the cable into the slave ComProbe device IN jack A Note The ComProbe BPA 600 device must always be the master node in ProbeSync mode ComProbe 802 11 User Manual Chapter 2 Getting Started MASTER DIGITAL 1 0 USB POWER Probek SLAVE Figure 2 5 Back Panel ProbeSync with BPA 600 2 2 Data Capture Methods This section describes how to load Frontline Test Equipment Inc ComProbe Protocol Analysis System software and how to select the data capture method for your specific application 2 2 1 Opening ComProbe Data Capture Method On product installation the installer creates a folder on the windows desktop labeled Frontline ComProbe Protocol Analysis System lt version gt 1 Double click the Frontline ComProbe Protocol Analysis System desktop folder This opens a standard Windows file folder window Chapter 2 Getting Started ComProbe 802 11 User Manual di bk Frontline ComProbe Protocol Analysis System 12 11 662 0 w Include in library Share with Burn New folder pa Name j sktop di Development Tools wnloads 4 Documentation cent Places JE Maintenance Tools ogle Drive fa Capture File Viewer 68 ComProbe 802 11 with Wireshark Iles cuments why Dacumets Select to open Capture Methods Figure 2 6 Desktop Folder Link 2 Double click on Frontline ComPr
51. come wholly from one side or the other If you choose to search for the pattern ABC and you restrict the 4 Event Display f all search to just the DTE side the analyzer finds the following pattern Fie Ect Yew Format Options Window aga maisama In this example the analyzer finds only the second pattern highlighted above because we restricted the search to just the DTE side The first pattern doesn t qualify because it is split between the DTE and DCE sides and the third pattern though whole comes from just the DCE side Evert 16 to 42 of 6 425 27 events Rate Deka CREDTE CRC DCE NG Timestamp No Timestamp 9 35 Por Help Press FI If we choose both the DTE and the DCE sides in the above example then the analyzer finds the second pattern followed by the third pattern but not the first pattern This is because each side has one instance in which the whole pattern can be found The analyzer completely searches the DTE side first followed by the DCE side A Note Side Restriction is available for pattern and error searching 1 Select one of the two options 2 Select DTE DCE or both 3 When you made your selections click on the Find Next or Find Previous buttons to start the search from the current event The result of the search is displayed in the Decode pane in Frame Display 5 1 2 Searching by Pattern Search by Pattern lets you perform a traditional string search You can combine any of
52. configuration TCP connection and capture hardware At this point you shouild save the sample script as your own template As long as you maintain this test setup you will not need to change these settings making your unique template reusable However you may want to build a library of templates to cover a variety of automation configurations Once your unique template is coded you will find that development time for variations to the template is insignificant In the next section we will step through the remainder of the sample script program to show how the Automation Server converts the sniffing process to a largely self acting process A 2 3 Running Automation Server Script In this section we will make a comparison between the main program code and the manual operation at the GUI in a sniffing and capture session This approach will show that the Automation Server will duplicate the manual processes but automation offers reliable repetition of those manual process and will save time in development and regression testing program to suit your specific sniffing and capture needs The command set is outlined in the Note Note that this is sample script and that you will have to change the code in the main Programmers Guide in Chapter 3 On or about line 824 of the sample script you will see the following code StaertFTS tells the Automation Server to launch the ComProbe software by opening your version of Frontline j T ComProbe Proto
53. created in one Frame Display in different Frame Display window 4 4 1 13 1 2 Including and Excluding Radio Buttons All filter dialog boxes contain an Include and an Exclude radio button These buttons are mutually exclusive The Include Exclude selection becomes part of the filter definition and appears as part of the filter description displayed to the right of the Toolbar Include A filter constructed with the Include button selected returns a data set that includes frames that meet the conditions defined by the filter and omits frames that do not Exclude A filter constructed with the Exclude button selected returns a data set that excludes frames that meet the conditions defined by the filter and consists of frames that do not 82 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual 4 4 1 13 1 3 Named Display Filters You can create a unique display filter by selecting a data type on the Frame Display and using a right click menu When you create a Name Filter it appears in the Quick Filtering dialog where you can use it do customize the data you see in the Frame Display panes 1 Select a frame in the Frame Display Summary Pane 2 Right click in the one of the data columns in the Summary Pane CRC NESN DS Packet Success Ethertype Source Address etc 3 Select Filter in data type The Filtering Results Filtering Results dialog appears 4 Enter a name for the filter 5 Select OK
54. displays the number of frames with and without errors Reload Decoders When Reload Decoders is clicked the plug ins are reset and received frames are re decoded For example If the first frame occurs more than 10 minutes in the past the 10 minute utilization graph stays blank until a frame from 10 minutes ago or less is decoded Filter Text giving the filter currently in use If no filter is being used the text reads All Frames which means that Filter nothing is filtered out To see the text of the entire filter place the cursor over the text and a ToolTip pops up with the full text of the filter 64 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual Table 4 4 Frame Display Toolbar Icons continued The following icons all change how the panes are arranged on the Frame Display Additional layouts are listed in the View menu Show Default Panes Returns the panes to their default settings Show Only Summary Pane Displays only the Summary pane Shall All Panes Except Event Pane Makes the Decode pane taller and the Summary pane narrower Toggle Display Lock Prevents the display from updating First Frame Moves to the first frame in the buffer Previous Frame Moves to the previous frame in the buffer Next Frame Moves to the next frame in the buffer Last Frame Moves to the last frame in the buffer Find on Frame Display only searches the Decode Pane for a value you ent
55. ee 020a DDL ee eee ee eee eee cece ee eeeeeeeeeeeeees 7 2 2 1 Opening ComProbe Data Capture Method 2 22 22 ee cece eee cece cece cece eceeeees 7 2 2 2 ComProbe 802 11 Air Sniffing Data Capture Methods _ _ 2 22 eee eee eee cece eee 9 2 2 3 Bluetooth 802 11 Air Sniffing Multiple Technologies Aggregated _ _ 2 0 10 2 2 4 Virtual Sniffing 22 ec cee cee cece ee ee eee cence eee annaa 10 2 2 5 Determining Master and Slave 2 0 22 cle ce eee cece cece cece eee cece cece eeeeeeceeceees 11 23 CONTON WINGOW Ao NG cise aetna ee sere esses se ame ANAND ANGKAN Adam sA 11 2 3 1 Control Window Toolbar 22222 0 c eee eee ee ee ee eee eee eee eee 12 2 3 2 Configuration Information on the Control Window 2 22 e eee eee ee eee eee cece eeees 13 2 3 3 Status Information on the Control Window 2 0 0 2 2 eee eee ee eee ee eee eee ee eee 13 2 3 4 Frame Information on the Control Window 2 20 2 o cece eee cece ee cece ee cece ee ee ee eee 13 2 3 5 Control Window Menus 2 2 222 cece eee eee eee ee cee ee ee ee eee ee ee eee cece eee eens 14 2 3 6 Minimizing Windows 22 eee cee eee ce cee cece ee eee cece eee eee e cence eee aana a 17 Chapter 3 Configuration Settings 18 3 1 802 11 Configuration _ 22 2 eee cece eee eee cence Laana aaau 18 3 1 1 ComProbe 802 11 Hardware Settings 2 22 ee eee eee cece ee eee
56. eee eee ee eeeeeeees 18 3 1 2 802 11 I O Settings cecccosncidccsasanaseodi cease seduces csv aessadagusdsewetedos aan bciedsuwe Aaahh Cas ULI 18 FL Bk AA AA 19 Bl a aa GA 21 Bee Cane AA eee est 21 ComProbe 802 11 User Manual 3 1 2 4 Firmware Update aoaaa anaana aaa daaah aaa aa aaa LaaLa DL LaLa LaLa LLALL LaaLa aa aaan 23 PELT CI eea eee ae ee AA 25 3 1 2 06 Wi Fi Device Scannel 2220 cence cease nsaan a AS NAG LADAE SAN ALEDL LASING LONG DA dha lat AG LL Sha E 25 3 1 3 Wi Fi Device MAC Address Editor cece eee cece ee cece cece eee ee eens 29 3 2 Decoder Parameters aa Gn AL a ANA BA a a 29 3 2 1 Decoder Parameter Templates occ ccc cee cece eee ee cece eee ceeceeceeceeceeeees 31 3 2 1 1 Select and Apply a Decoder Template le ee cece cece cece ee eeeeees 31 3 2 1 2 Adding a New or Saving an Existing Template 20 c cece eee eee ec cee cece eeeeeee 32 3 2 1 3 Deleting a Template eee ce ee cece cece ee eee eee eeeeeeeeeeee 32 3 2 2 Wi Fi Security Decoder Parameters eee eee eee cee eee cece cece eee e andanan nnnnnnnnnnn 33 3 2 3 Adding or Changing TCP UDP Port Assignments 2 2 e eee eee c ee ee eee ceecececeeeeeeeee 35 Chapter 4 Capturing and Analyzing Data aa 37 41 Capture Dala cr se tet ee ne ee ee Se es Ce se ee eee 37 4 1 1 Air Sniffing Positioning Devices a 37 4 1 2 Capturing Data to Disk
57. error condition e Select the appropriate state for each type of error Example If you need to find an event where just an overrun error occurred but not any other type of error you would choose overrun error to be On and set all other errors to Off This causes the analyzer to look for an event where only an overrun error occurred If you want to look for events where overrun errors occurred and other errors may have also occurred but it really doesn t matter if they did or not choose overrun to be On and set the others to Don t Care The analyzer ignores any other type of error and find events where overrun errors occurred To find the next error click the Find Next button To find an error that occurred earlier in the buffer to where you are click the Find Previous button 5 1 8 Find Bookmarks Searching with Bookmarks allows you search on specific bookmarks on the data in Frame Display and Event Display window Bookmarks are notes reminders of interest that you attach to the data so they can be accessed later To access the search for bookmarks 1 Opena capture file to search 2 Open the Event Display or Frame Display 5 window 3 Click on the Find icon AA or choose Find from the Edit menu 4 Click on the Bookmarks tab of the Find dialog Note The tabs displayed on the Find dialog depend on the product you are running and the content of the capture file you are viewing 154 Chapter 5 Navigating an
58. listed here Also listed is Ehe last source MAC address that was set here in the previous session IF that address has nok wet been seen in this session it is shown in parentheses Figure 4 63 802 11 Source Address Dialog 116 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual 802 11 Ix Address 802 11 Tx Address 00 00 79 85 F3 31 ay lt none 00 00 F4 cS ed 28 00 0c 29 71 c8 99 ce address is considered a Tx packet and is shown with a Wwe been seen during this session are listed here Also listed at was set here in the previous session IF that address has ik is shown in parentheses F 1 E df d5 bb 193 Figure 4 64 802 11 Source Address Drop Down Selector 4 4 2 22 Coexistence View Throughput Radio Buttons Throughput The radio buttons in the Throughput group specify whether to show packet and or payload lines Packet in the Throughput Graph and also whether to show packet or payload throughput in the O Payload throughput indicators if the Both radio button is selected packet throughput is shown in the O Both throughput indicators 4 4 2 23 Coexistence View Timeline Radio Buttons Timeline The radio buttons in the Timeline group specify timeline visibility The first three buttons specify 5 GHz whether to show one or both timelines while the Auto button shows only timelines which have 2 4GHz had packets at some point during this session If no packets have be
59. number format Click once to show only numeric values and again to show both character and numeric values All Events Controls whether the analyzer shows all events in the window or only data bytes Events include control signal changes and framing information 63 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data Timestamping Options Brings up the timestamping options window which has options for customizing the display and capture of timestamps 4 3 3 Opening Multiple Event Display Windows Click the Duplicate View icon dg from the Event Display toolbar to open a second Event Display window You can open as many Event Display windows as you like Each Event Display is independent of the others and can show different data use a different radix or character set or be frozen or live The Event Display windows are numbered in the title bar If you have multiple Event Displays open click on the Event Display icon po on the Control window toolbar to show a list of all the Event Displays currently open Select a window from the list to bring it to the front 4 3 4 Calculating CRCs or FCSs The cyclic redundancy check CRC is a function on the Event Display window used to produce a checksum The frame check sequence FCS are the extra checksum characters added to a frame to detect errors 1 Open the Event Display P window 2 Click and drag to select the data for which you want to generate a CRC 3
60. of a personality entry may be detected which causes a failure when trying to launch Frontline For example if an Frontline product is installed at C Users Public Public Documents Frontline Test Equipment My Decoders then My Decoders cannot be set to any of the following e C My Decoders e C Users My Decoders e C Users Public My Decoders e C Users Public Public Documents My Decoders e or to any directory that already exists in the path C Users Public Public Documents Frontline Test Equipment My Decoders Default Capture File Folder Checkbox If the Use Last Opened Folder for Capture Files checkbox is checked then the system automatically changes the default location for saving capture files each time you open a file from or save a file to a new location For example let s say the default location for saving capture files is Drive A gt Folder A Now you select the Use Last Opened Folder for Capture Files checkbox The next time however you open a capture file from a different location Folder B gt Removable Flash Drive for example Now when you save the capture file it will be saved to Folder B gt Removable Flash Drive Also all subsequent files will be saved to that location This remains true until you open a file from or save a file to a different location There is one caveat to this scenario however Let s say you have selected Use Last Opened Folder for Capture Files and opened a file from a location other tha
61. on advice of technical support 7 1 1 1 System Settings Disabled Enabled Options Some of the System Settings options are disabled depending upon the status of the data capture session e As the default all the options on the System Settings dialog are enabled e Once the user begins to capture data by selecting the Start Capture button some of the options on the System Settings dialog are disabled until the user stops data capture and either saves or erases the captured data e The user can go into the Startup options and Advanced system options on the System Settings dialog and make changes to the settings at any time 7 1 1 2 Advanced System Options These parameters affect fundamental aspects of the software and it is unlikely that you ever have to change them If you do change them and need to return them to their original values the default value is listed in parentheses to the right of the value box Most technical support problems are not related to these parameters and as changing them could have serious consequences for the performance of the analyzer we strongly recommend contacting technical support before changing any of these parameters To access the Advanced System Options 1 Go to the Control A window 2 Choose System Settings from the Options menu 3 On the System Settings window click the Advanced button 173 ComProbe 802 11 User Manual Chapter 7 General Information Advanced System Options
62. sec throughput See Coexistence View Throughput Indicators on page 105 for more information Performs the same function as the throughput indicator Selected radio button When checked all packets appearing in the Viewport are used for average throughput calculations and all packets in the one second before the last packet in the Viewport are used for the 1 sec throughput See Coexistence View Throughput Indicators on page 105 for more information Performs the same function as the throughput indicator Viewport radio button When checked this selection is used to specify the 802 11 source address where any packet with that source address is considered a Tx packet and is shown with a purple border in the timelines Performs the same function as the SET button Refer to Coexistence View Set Button on page 116 The following three selections are mutually exclusive 97 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data Table 4 7 Coexistence View Format Menu Selections continued N aj lai Vata 5 NG my Ko LRrEe tk i Ka L 1 Ao KA Show Packet When checked the Throughput Graph and Throughput Indicator shows data based on Throughput packet throughput Performs the same function as the Throughput Packet radio button Show Payload When checked the Throughput Graph and Throughput Indicator shows data based on Throughput payload throughput Performs the same function as the Throughput Payload radio button
63. state more than once per millisecond UARTs in the 8250 family include 8250s 16450s 16550s and 16550 variants If you have any questions about the behavior of your UART and Ring Indicator please contact technical support 7 2 3 Progress Bars The analyzer uses progress bars to indicate the progress of anumber of different processes Some progress bars such as the filtering progress bar remain visible while others are hidden The title on the progress bar indicates the process underway 7 2 4 Event Numbering This section provides information about how events are numbered when they are first captured and how this affects the display windows in the analyzer The information in this section applies to frame numbering as well When the analyzer captures an event it gives the event a number If the event is a data byte event it receives a byte number in addition to an event number There are usually more events than bytes with the result is that a byte might be listed as Event 10 of 16 when viewing all events and Byte 8 of 11 when viewing only the data bytes The numbers assigned to events that are wrapped out of the buffer are not reassigned In other words when event number 1 is wrapped out of the buffer event number 2 is not renumbered to event 1 This means that the first event in the buffer may be listed as event 11520 of 16334 because events 1 11519 have been wrapped out of the buffer Since row numbers refer to the event numbers
64. than the logical bytes the data in the Event pane may be different from that in the Radix Binary and Character panes See Physical vs Logical Byte Display for more information Colors are used to show which protocol layer each byte belongs to The colors correspond to the layers listed in the Decode pane The Event Radix Binary Character and Decode panes are all synchronized with one another Clicking on an element in any one of the panes highlights the corresponding element in all the other panes 4 4 1 11 9 Change Text Highlight Color Whenever you select text in the Binary Radix or Character panes in Frame Display the text is displayed with a highlight color You can change the color of the highlight Select Color Text Highlight Color Selector 1 Select Change Text Highlight Color from the Cancel Options menu You can also access the option by right clicking in any of the panes Defaults 2 Selecta color from the drop down menu Other 3 Click OK The highlight color for the text is changed 78 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual Select Cancel to discard any selection Select Defaults to return the highlight color to blue 4 4 1 12 Protocol Layer Colors 4 4 1 12 1 Data Byte Color Notation The color of the data in the panes specifies which layer of the protocol stack the data is from All data from the first layer is bright blue the data from the s
65. the Add or Modify Bookmark Ly icon on one of the toolbars or c Right click on the frame event and choosing Modify Bookmark on the selection 3 Change the comment in the dialog box 4 Click OK The edited bookmark will be saved as a part of the cfa file 5 You can also select Display All Bookmarks LO from the Frame Display and Event Display toolbar or the Bookmarks menu the Find window will open on the Bookmark tab Select the bookmark you want to modify and click the Modify button Change the comment in the dialog box and click OK Delete 1 Select the frame or event with the bookmark to be deleted 2 There are three ways to access the Add Modfy Bookmark dialog a Select Add or Modify Bookmark from the Bookmarks menu on the Frame Display and Event Display b Select the Add or Modify Bookmark Lil icon on one of the toolbars or c Right click on the frame event and choosing Modify Bookmark on the selection 3 Click on the Delete button The bookmark will be deleted 4 You can also select Display All Bookmarks O from the Frame Display and Event Display toolbar or the Bookmarks menu the Find window will open on the Bookmark tab Select the bookmark you want to delete and click the Delete button 5 2 2 Displaying All and Moving Between Bookmarks There are three ways to move between bookmarks 1 Press the F2 key to move to the next frame or event with a bookmark 2 Select Go to Next Bookmark from the Bookmarks menu 3
66. the computer such that the dongle is positioned towards the DUTs e The preferred placement is positioning the DUTs and the ComProbe hardware at the points of an equilateral triangle in the same horizontal plane i e placed on the same table or work surface The sides of the triangle should be between 1 and 2 meters for Bluetooth transmitter classes 1 and 2 The distance for transmitter class 3 should be 1 2 meter Figure 4 1 Devices Equally Spaced in the Same Horizontal Plane Finally eliminate other RF sources e Wi Fi interference should be minimized or eliminated Bluetooth shares the same 2 4 GHz frequency bands as Wi Fi technology Wi Fi interference can cause loss of packets and poor captures In a laboratory or testing 38 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual environment do not place the DUTs and ComProbe hardware in close proximity with Wi Fi transmitting sources such as laptops or routers Turning off Wi Fi on the computer running the ComProbe software is recommended Poor Placement A poor test configuration for the analyzer is placing the DUTs very close to each other and the analyzer far away The DUTs being in close proximity to each other reduce their transmission power and thus make it hard for the analyzer to hear the conversation If the analyzer is far away from DUTs there are chances that the analyzer may miss those frames which could lead to failure in decryption of the d
67. the formats when entering your string and your search can include wildcards To access the search by pattern function 1 Opena capture file to search 2 Open the Event Display PD or Frame Display window 142 Chapter 5 Navigating and Searching the Data ComProbe 802 11 User Manual 3 Click on the Find icon AA or choose Find from the Edit menu 4 Click on the Pattern tab of the Find dialog Note The tabs displayed on the Find dialog depend on the product you are running and the content V4 of the capture file you are viewing Decode Patten Time Go To Special Events Bookmark Enter Hex values as xx Ignore case Find Previous Binary values as kbbbbbbbb Control characters as e matches any byte or hex or binary digit To enter 48 77 or prefix with character Figure 5 4 Find Pattern Tab Patten Erie Hew values at fo Binary value 53 Lbbbbbbbb Control characlers at ec 2 matches any bets or hex of bry dg To enter 3k77 or preii wath chasacter Side Fetih O Search only there sides IDTE DCE Figure 5 5 Find Pattern Tab Side Restrictions Pattern allows you to enter a string in the text box You can use characters hex or binary digits control characters wildcards or a combination of any of the formats when entering your string Every time you type in a search string the ComProbe analyzer saves the search The next time you open Find the drop down list will
68. they work the same way In the above example the first row would be listed as 2d00 which is hex for 11520 The advantage of not renumbering events is that you can save a portion of a capture file send it to a colleague and tell your colleague to look at a particular event Since the events are not renumbered your colleague s file use the same event numbers that your file does 7 2 5 Useful Character Tables 182 Chapter 7 General Information ComProbe 802 11 User Manual 7 2 5 1 ASCII Codes chew xO x1 x2 x3 xd a5 6 x B eA xB xC a Dx NUL 50H 5TX ETX EOTJENO AC BEL BS HI LF WT FF Casa 1x DLE 001 002 003 DC4 NAK SYN ETB CAN EM sugjesc FS 6s Rs us xj els el lol l4 l A 3 0 1 2 3 4 5 6 7 6 9 lila EEA IG AIBICIDIE F S H I MINJO 7 2 5 2 Baudot Codes ETERS FIGURES 0 00 BLANK NUL BLANK NUL a gt FIGURES FIGURES Ei a eee LETTERS 2 02 a ga 15 D5 6 06 8 09 10 OA 12 OC 13 0D 14 DE 15 OF 16 10 18 12 19 13 20 a ali 15 AL 18 2 1D L30 IF nm 183 ComProbe 802 11 User Manual 7 2 5 3 EBCDIC Codes best x0 Ee eee Ox NULISOH ST4 ETX PF HT LC DEL SMM VT FF CR SO si lx JOLELOC1 DC2 TM RES NE LES IL CAN EM CC cut ES JIGS IRS 10S SYN EOT maki Es o ats Lod
69. using the ComProbe 802 11 in conjunction with other ComProbe devices or in a stand alone configuration a smaller version of the standard Coexistence View is available This High Speed Live View is essentially the Viewport from the standard Coexistence View When viewing High Speed Live only 802 11 traffic is visible Because Bluetooth packets are slow they are not visible in High Soeed mode 1 Click on the Control window File menu and select Close t el J ComProbe Protocol Analysis System 802 11 Sa 2 View Live Options Window Help Open Capture File Ctrl O E Close D wr Save Ny trl S apture Files Capture 2012 12 21_135337 cfa Close the active file ape 1 Capture 2012 1 oe Packet Decoder 23 pps BES y ik Exit ComProbe Protocol Analysis System 2 The Control window will open again Click on the Control Window File menu and select Go Live High Speed Mode File Options Methods Help Sad For Help Press F1 J ComProbe Protocol Analysis System HSView cfa arm Edit View Options Window Help Go Live kili E Go Live High Speed Mode Open Capture File NY Ctrl O Close NA _ Select High Speed Live Mode to see the Reframe Coexistence High Speed View Unframe Recreate Companion File 1 C Users HSView cfa Exit ComProbe Protocol Analysis System 3 Click on the Control window Start Capture button to begin capturing data Click on the Coexistence View bu
70. wide and has the indicated center frequency Channels do not overlap 0 2402 MHz 1 2403 MHz 2 2404 MHz 3 2405 MHz 4 2406 MHz 5 2407 MHz 6 2408 MHz 7 2409 MHz 8 2410 MHz 9 2411 MHz 10 2412 MHz 11 2413 MHz 12 2414 MHz 13 2415 MHz 14 2416 MHz 15 241 MHz 16 2418 MHz 17 2419 MHz 18 2420 MHz 19 2421 MHz 20 2422 MHz 21 2423 MHz 22 2424 MHz 23 2425 MHz 24 2426 MHz 25 2427 MHz 26 2428 MHz 27 2429 MHz 28 2430 MHz 29 2431 MHz 30 2432 MHz 31 2433 MHz 32 2434 MHz 33 2435 MHz 34 2436 MHz 35 2437 MHz 36 2438 MHz 37 2439 MHz 38 2440 MHz 39 2441 MHz The row labels are placed at the center frequency of each channel Bluetooth low energy LE There are 40 LE channels Each channel is 2 MHz wide and has the indicated center frequency Channels do not overlap Channels 0 through 36 are Data channels Channels 37 through 39 are Advertising channels 37 2402 MHz D 2404 MHz 1 2406 MHz 2 2408 MHz 3 2410 MHz 4 2412 MHz 5 2414 MHz 6 2416 MHz 7 2418 MHz 8 2420 MHz 9 2422 MHz 10 2424 MHz 38 2426 MHz 11 2428 MHz 12 2430 MHz 13 2432 MHz 14 2434 MHz 15 2436 MHz 16 2438 MHz 17 2440 MHz The row labels are placed at the center frequency of each channel 40 2442 MHz 41 2443 MHz 42 2444 MHz 43 2445 MHz 44 2446 MHz 45 2447 MHz 46 2448 MHz 47 2449 MHz 48 2450 MHz 49 2451 MHz
71. window File menu Save selection The Save selection opens a Save as dialog where you would enter the location and file name for your capture data a cfa file The Save Capture command contains parameters that perform the same operation only automatically Save Capture c Users Public Public documents Frontline Test Equipment My Capture Files mycap cfa 9 ComProbe Protocol Analysis System BPA 600 oy A5 View Live Options Window Help Open Capture File cs rt mt Close Save fCapture 201404 28_080138 cfa Utilization 0 Slave O Master Events 1 Packet Decoder 0 pps 100 1 Capture 2014 04 28 080138 cfa 2 Lumia 5amsunqWeEP469 5C0 details 7 cfa Figure 8 ComProbe Software File Save Save Capture command will save the entire capture file which can be reloaded into the ComProbe software for later analysis To reload the capture file you use the Automation Server Open Capture File command that has similar parameters to the Save Capture command Open Capture File c Users Public Public documents Frontline Test Equipment My Capture Files mycap cfa While the Save Capture automatically archives everything that happened during the capture session your may want to write a script that focuses on specific protocols To do that you use the Automation Server Export command that tells ComProbe software to invoke the Frame Display and then automatically selects the File Export menu option In the example code below the dat
72. you have up to 84 characters to explain a problem leave yourself a reminder leave someone else a reminder etc Once you create a bookmark it will be saved with the rest of the data in the cfa file When you open a cfa file the bookmarks are available to you Once you have created a bookmark you can use the Find function or other navigation methods to locate and move among them 5 2 1 Adding Modifying or Deleting a Bookmark You can add modify or delete a bookmarks from Frame Display and Event Display Add 1 Select the frame or event you want to bookmark 2 There are three ways to access the Add Bookmark dialog a Select Add or Modify Bookmark from the Bookmarks menu on the Frame Display and Event Display b Select the Add or Modify Bookmark Li icon on one of the toolbars or c Right click on the frame event and choosing Add Bookmark 3 In the dialog box add a comment up to 84 characters in the text box to identify the bookmark 4 Click OK Once you create a bookmark it will be saved with the rest of the data in the cfa file When you open a cfa file the bookmarks are available to you 156 Chapter 5 Navigating and Searching the Data ComProbe 802 11 User Manual Modify 1 Select the frame or event with the bookmark to be edited 2 There are three ways to access the Add Modfy Bookmark dialog a Select Add or Modify Bookmark from the Bookmarks menu on the Frame Display and Event Display b Select
73. 05 4A 225 Radio BUTONG ay 2s greens cue nearness LG Gama ANG Ana OROEN ES SEERNES d 106 44 2 6 All radio DUTTON oc ee jose tee sce anee ea cteoeeecdoseesiacdeeedoisneeeceaveucedidesedieseeedsuiees 106 4 4 2 7 Selected radio button 12 cece ce ee cee eee ee ee ce eee cece enone 106 4 4 2 8 Viewport radio button 2 22 cece cece cece eee e cece cece cece eceeeeeeees 106 a BB AS Mdicator WON AA KAPPA 107 4 4 2 10 Coexistence View Throughput Graph 22 oe ee ee ee eee eee eee eee e ee eeeeees 108 4 4 2 11 Throughput Graph Y axis labels e eee eee eee c ccc cece eee eecceecceeceeeeees 108 AAD A Excluded packets AA 109 4 4 2 13 Tooltips 2 2 2 2 ccc ccc cee cee cece eee e cence eee ec ee cee eeeeceeceeceeceseeeees 109 4 4 2 14 Discontinuities 222 eee eee eee ee 109 A Zo NIEWDO a caneeceucecusee ONAE 6 net damn NANANG GE NAN CA 110 AA 2G SWAP DUON AA 111 ComProbe 802 11 User Manual 4 4 2 17 Dots button 2 0222 ee ee eee cece cece cece eee eeeeeeeeees 112 4 4 2 18 Zoomed Throughput Graph 20 2 ee eee eee ce cee cece cece eee eceeeeeceeeeeees 113 A A2 ZOOMWCUNSOF fcicdecwuteccecciclstecduiee asks teeta cogbbecacdssousenbuueudssrcegceeusteceedion 115 4 4 2 20 Comparison with the Bluetooth Timeline s Throughput Graph _ 115 4 4 2 21 Coexistence View Set Button eee eee 116 4 4 2 22 Coexistence View Throughput Radio Buttons
74. 1 follow these steps to capture B uetooth data 1 Establish data transmission between DUT 1 and DUT 2 2 Begin capture of the data with the ComProbe 802 11 Refer to the ComProbe 802 11 User Manual at fte com 3 Conduct protocol analysis with the ComProbe software on the personal computer or save the capture file for future analysis For any questions concerning conductive testing contact Frontline technical support at 434 984 4500 or email tech_support fte com Copyright 2015 Frontline Test Equipment Inc Author John Trinkle with Sean Clinchy Publish Date 19 October 2015 194 A 2 ComProbe Automation Server Why use it Frontline provides a full line of wireless sniffing devices for T SSS developers that include ComProbe BPA 600 for Pees Pk ULAT Bluetooth Classic low energy and coexistence ai man ComProbe 802 11 for Wi Fi and Bluetooth coexistence aman Normal ComProbe protocol analyzer use is through a GUI on a personal computer In this operation mode the user t sony has direct control of the setup and data capture through r the keyboard and mouse User specific ComProbe gan R If analyzer configuration and capture decisions may come from user prescribed test documents or applied ad hoc or on the fly The ComProbe software GUI is sufficient for many development projects But situations may arise where a more automated process is desirable For example if a company want
75. 1010011 00010011 Hote ingay Ram g t DONOOOOO maro OOOOH 00000700 ie Liban Ira sal LID L1001000 00000110 00001001 O1010000 i aang E rit z 01101000 01101111 A 01100101 00000111 Evert HO Enbande ingur Re 00000011 00010101 OQO1OOD1 00011111 00010001 00001001 DODILOOO1 DOODODOD 0000000 OODODO0O kum Repr DODOHOOO DONOODOD DOOLODIO DOO0N000 0000000 S Biuakooth Dapaca Adae ii deie nababaon oooo0000 poaoaona 00000000 00090000 Paga San HrpHion Mide H 00000000 TORIO00G DIODIGIO ORIGDORO DOGODDOD a POSTS AN NA PAMPA IN NAGA pata Rte FRAAS PRONE ENARA u a li i 5 headed x aak ow eae KA ar wee bee Ye ee Ws y h s ete u NG we a au PG canna ILAAN AA ie a eee EE LI as Paa AK eu a ME Pu yn a ey Mew wet ue NANANA NANANA NAKAR KAANAK O A 2 Motai ma Baa na EH Frag E ei go gl ris TE Erama fy m pm ad EFI total 7576 Cad es Figure 4 14 Frame Display Extended Inquire Response EIR displays extensive information about the Bluetooth devices that are discovered as data is being captured EIR provides more information during the inquiry procedure to allow better filtering of devices before connection and sniff subrating which reduces the power consumption in low power mode Before the EIR tab was created this type of information was not available until a connection was made to a device Therefore EIR can be used to determine whether a connection can should be made to a device prior to making the connection Note If a Bluet
76. 11 9 Change Text Highlight Color ccc ee cee cece cee eeeeeeeeee 78 iV ComProbe 802 11 User Manual 4 4 1 12 Protocol Layer Colors licence cee eee eee aLaaa anana 79 4 4 1 12 1 Data Byte Color Notation elec eee cee cece cece ccc ceeceececeececceeeee 79 4 4 1 12 2 Changing Protocol Layer Colors l eee cece cece cece cece eee eeeeeeee 79 4 4 1 13 Filtering 2 2 22 0 a 79 OA Med DIS piy MNCS serseri bons ceetetoeecaeeoaansssecsrec AA 80 4 4 1 13 1 5 Defining Node and Conversation Filters 4 4 1 13 1 6 The Difference Between Deleting and Hiding Display Filters 4 4 1 13 1 7 Editing Filters 4 4 1 13 2 Connection Filtering lee ee ee cece cee cee eee cece cee eeeeeeeeeee 89 4 4 1 13 2 1 Creating a Connection Filter 4 4 1 13 2 2 Connection Filter Display 4 4 1 13 3 Protocol Filtering from the Frame Display 220 e cece eee eee eee cece eee 94 4 4 1 13 3 1 Quick Filtering on a Protocol Layer 4 4 1 13 3 2 Easy Protocol Filtering WAZ COCK EM E VIEW sa AA NANA NANG GG DA NANO GAN AD END UNAN YAAN UNAN aeaereeetee see 95 AAD A Coexistence View Menus naaa ABA BDRDLDU DUH OERI ERE OERS KENDI NEN GD D DUDE TA ANS EEREN 96 4 4 2 2 Coexistence View Toolbar ee cee eee e eee eens 103 4 4 2 3 Coexistence View Throughput Indicators _ 2 22 a 105 4 4 2 4 Throughput Aa AGNO DN NE eotede owes ncestekscseeereatodcealewaseecunemnteececceres 1
77. 110000 p 637 11 30 2012 12 20 02 895166 PM 0 00 00 00 636 631 3 Data 94 148 224 10010100 638 11 30 201212 20 02 895166PM 0 00 00 00 637 632 3 Data 221 34 42 100010 639 11 30 2012 12 20 02 895166 PM 0 00 00 00 638 633 3 Data 21 33 41 100001 640 11 30 2012 12 20 02 895166 PM 0 00 00 00 639 634 3 Data ic 28 34 11100 641 11 30 2012 12 20 02 895166PM 0 00 00 00 640 635 3 Data 80 128 200 10000000 642 11 30 2012 12 20 02 895166 PM 0 00 00 00 641 636 3 Data 80 128 200 10000000 643 11 30 2012 12 20 02 895166 PM 0 00 00 00 642 637 3 Data 80 128 200 10000000 644 11 30 2012 12 20 02 895166 PM 0 00 00 00 643 638 3 Data 80 128 200 10000000 Figure 6 6 Example csv Event Display Export Excel spreadsheet 6 6 2 1 Export Filter Out You can filter out data you don t want or need in your text file This option is available only for serial data In the Filter Out box choose which side to filter out the DTE data the DCE data or neither side don t filter any data For example if you choose the radio button for DTE data the DTE data would be filtered out of your export file and the file would contain only the DCE data You can also filter out Special Events which is everything that is not a data byte such as control signal changes and Set I O events Non printable characters or both If you choose to filter out Special Events your export file would contain only the data bytes Filtering out the non printable characters means that you
78. 4 6479 1 27 2015 10 02 04 6529 1 27 2015 10 02 04 6534 1 27 2015 10 02 04 6537 1 27 2015 10 02 04 6579 1 27 2015 10 02 04 6584 1 27 2015 10 02 04 6587 1 27 2015 10 02 04 6773 1 27 2015 10 02 04 6823 1 27 2015 10 02 04 6873 1 27 2015 10 02 04 6878 1 27 2015 10 02 04 6881 1 27 2015 10 02 04 7060 1 27 2015 10 02 04 7065 1 27 2015 10 02 04 7063 1 27 2015 10 02 04 7110 1 27 2015 10 02 04 7160 1 27 2015 10 02 04 7335 1 27 2015 10 02 04 7340 1 27 2015 10 02 04 7344 1 27 2015 10 02 04 7385 1 27 2015 10 02 04 7435 1 27 2015 10 02 04 7585 1 27 2015 10 02 04 7635 1 27 2015 10 02 04 7685 1 27 2015 10 02 04 7792 1 27 2015 10 02 04 7842 Delta Timestamp 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 4 w Total Frames 6 767 Frames Filtered In 6 017 Frame s Selected 1 1 total Figure 4 41 Front Display Filtered on Access Address Ox8e89bed6 In the figure above is an example Bluetooth low energy data set connection filtered on Access Address Ox8e8
79. 4 Bluetooth slots 3 125 msec 5 Bluetooth slots 6 25 msec 10 Bluetooth slots 15 625 msec 25 Bluetooth slots 31 25 msec 30 Bluetooth slots 62 5 msec 100 Bluetooth slots 156 255 msec 250 Bluetooth slots 31 25 msec 500 Bluetooth slots 625 msec 1 000 Bluetooth slots 1 sec 1 600 Bluetooth slots 2 sec 3 200 Bluetooth slots 3 sec 4 800 Bluetooth slots 4 sec 6 400 Bluetooth slots 5 sec 8 000 Bluetooth slots 10 sec 16 000 Bluetooth slots 20 sec 32 000 Bluetooth slots A Note Right clicking anywhere in the Coexistence View window will open the Zoom menu ina pop up Table 4 9 Coexistence View Navigate Menu Selections When clicked the first packet in the session is Home selected and displayed in the Timeline Performs the same function as the First Packet button 101 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data Last Packet Previous Packet Next Packet Previous Retransmitted Packet Next Retransmitted Packet Previous Invalid IFS Packet Next Invalid IFS Packet Previous Error Packet Next Error Packet Table 4 9 Coexistence View Navigate Menu Selections continued Description When clicked the last packet in the session is End selected and displayed in the Timeline Performs the same function as the D Last Packet button When clicked the first packet occurring in time Left Arrow prior to the current
80. 500000 Options Window Help Se i PO LA LA LA GS lak kl a DoE 8 Q 909 Find Errors LE BB bi LE PKT LE LE DATA LE LL L2CAP SMP ATT v RA Q Summary Data L File Edit View Format Filter Bookmarks Options Window Help a PEG YESZT apan LA LA LA Ss Lk kl ci E8 66009 m HEJ Ino Erors Header Length 13 Bachan LE BB LE PKT LE ADV Data io CP H 1 i Channel Index 37 2402 MHz B Meets Predefined Filter Criteria for BT low energy devi Receive Status Received without errors Decryption Initiated No Signal Strength 7 medium he PDU Length 37 LE PKT 3 be Preamble Oxaa i Access Address Ox8e89bed6 i CRC Oxfe96e6 B LE ADY H PDU Type ADY_IND Advertiser Address Type random Payload Length 35 Advertiser Address Dx712500000002 B AD Data AD Element Length 2 i AD Type Flags B AD Data BR EDR Not Supported Yes i LE General Discoverable Mode Yes AD Element H Length 11 i AD Type Complete list of 16 bit UUIDs CAD Data UUID Health Thermometer UUID Heart Rate Monitor UUID Blood Pressure Monitor UUID Weight Scale UUID Body Composition AD Element i Length 13 Framet ASCII Hex on nom amp O NS RB O Summary Data note protocol tabs Filtered Data Set protocol tabs 1 27 2015 10 02 04 6235 E 1 27 2015 10 02 04 6285 1 27 2015 10 02 04 6335 1 27 2015 10 02 0
81. 7 and 8 e USB Port USB 2 0 High Speed or USB 3 0 Super Speed The ComProbe software must operate on a computer with the following minimum characteristics e Processor Core i5 processor at 2 7 GHz e RAM 4 GB e Free Hard Disk Space 20 GB 1 3 Software Installation 1 3 1 From CD Insert the ComProbe installer disc into your DVD drive Click on the Install CPAS shortcut and follow the directions Chapter 1 ComProbe Hardware amp Software ComProbe 802 11 User Manual 1 3 2 From Download Download the latest CPAS installer from FTE com Once downloaded double click the installer and follow the directions Chapter 2 Getting Started In this chapter we introduce you to the ComProbe hardware and show how to start the ComProbe analyzer software and explain the basic software controls and features for conducting the protocol analysis 2 1 802 11 Hardware Attaching Antennas When you remove the ComProbe 802 11 from the box the first step is to attach the antennas Figure 2 1 oo BOZ 11 Figure 2 1 Front Panel 1 Attach an antenna to each front panel connector ComProbe 802 11 User Manual Chapter 2 Getting Started Figure 2 2 ComProbe 802 11 with both antennas attached 2 1 1 Connecting Powering the ComProbe 802 11 Once you have attached the antennas the next step is to power up and connect the ComProbe 802 11 to the computer 1 Insert the power cable DC connector from the 12 volt AC adapter into the
82. 8 180 Timestamping Disabled 59 210 Appendicies Timestamping Enabled 59 Timestamping Options 171 178 Timestamping Resolution 179 Timestamps 178 180 Transferring Packets 39 Truncated Frame 59 U Underrun Error 59 Unframe 49 Unframe Function 49 Unframing 49 Unknown Event 60 V vendor specific decoder 185 Viewing Data Events 56 WwW WEP 802 11 I O Settings 18 Wi Fi Timeline Wi Fi Error Statistics 137 WPA Key 33 802 11 I O Settings 18 WPA Key 33 Wrap Buffer File 171 Zooming 125 zooming cursor 115
83. 802 11 AMP 802 1X L2CAP OBEX FTP Data pd Frame Display Connection Filter 802 11 All BTAmp80211FTPwLE cfa o em File Edit View Format Filter Bookmarks Options Window Help IP YE SS 8 DI O MAS kho i i No frame selected Do E 3 O Q ag pi R B O Summary GT ino Erors H B Frame ASCII Hex Fram Delta Timestamp Al 1 660 109 00 00 41 1 4210 2012 3 55 10 85203 E Figure 4 43 Connection Filter selecting All 802 11 frames front 4 4 1 13 3 Protocol Filtering from the Frame Display 4 4 1 13 3 1 Quick Filtering on a Protocol Layer On the Frame Display click the Quick Filtering icon NG or select Quick Filtering from the Filter menu This opens a dialog that lists all the protocols discovered so far The protocols displayed change depending on the data received 94 Chapter 4 Capturing and Analyzing Data Quick Filtering and Hiding Protocols Protocols To Filter In Protocols To Hide Named Filters ComProbe 802 11 User Manual All Frames With Errors All Frames With Information AYDTP AVDTP Signaling Baseband Bluetooth FHS Headset L2CAP All But the Last Layer All Frames With Information AVDTP AVDTP Signaling Baseband Bluetooth FHS Headset L2CAP Filter0 Filter Filter2 SCO link Supported Filter3 Role Slave Configured BT low energy devid Exclude NULLs and POLLs Cancel Help LMP Non Captured
84. 9bed6 The Frame Display in the front is the filtered data set One way to note the difference between the original and the filtered display is to observe the Protocol Tabs In the filtered display there are four low energy protocol tabs as compared to nine in the original display This access address connection is not using five of the protocols From any open Frame display the user can set another Connection Filter based on the original data set Display Example 2 All 802 11 data filtered in In this example there is a capture file with Classic Bluetooth Bluetooth low energy and 802 11 To view just the 802 11 data set 802 11 All is selected from the right click pop up menu 93 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data O Frame Display BTAmp80211FTPwLE cfa File Edit View Format Filter Bookmarks Options Window Help CF PH VE SAN FH AAAS he see i OE eCooo TAB p erres iw LE AD Awl ata Field Tumceated or Not Present Unfiltered Info Errors o This is the Decode Pane Baseband LMP PreConnection FHS Bluetooth FHS L2CAP AMP Manager SDP OBEX FTP Non Captured Info LE BB LE PKT LE ADY ao ae 802 li Riadind B02 Ad MACY 1E8022 SMAPS BDZ A AMPJ 802 16 L2CAB OBEX EIR Raad Expand Decode Pane Copy Selection to Clipboard B Frame ASCII Hex Fram Delta Timestamp E Collapse All Nodes 1 63 4 10 2012 3 54 29 68448 Expand All Nod
85. A airs NAT AA at AA TG AAO Ad Figure 4 79 A negative discontinuity 126 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual View pe Peke Banga i Paes CO 4544 ma h P25 naba Pr H SAT PW Figure 4 80 A positive discontinuity When there are one or more discontinuities the actual time encompassed by the visible timeline differs from the zoom level duration that would apply in the absence of any discontinuities The actual time referred to as absolute time is shown followed by abs The zoom level duration referred to as relative time is shown followed by rel When there are no discontinuities relative and absolute time are the same and a single value is shown Selected Packets 477 475 Gap 7199545 Timestamp Delta 7 20011 Spam 7 20038 Figure 4 81 Timeline header with discontinuity 15 625 ms rel 7 21484 s abs Figure 4 82 Timeline duration footer with discontinuity For example the timeline above has a zoom level duration of 15 625 ms the relative time shown in the footer But the discontinuity graphic consumes the width of a Bluetooth slot 625 us and that area is 7 19984 s of absolute time as shown by the Gap value in the header So the absolute time is 7 21484 s Zoom level duration Bluetooth slot duration Gap duration 15 625 ms 625 us 7 19984 s 0 015625 s 0 000625 s 7 199840 s 0 015000 s 7 199840 s 7 214840 s 7 21484 s 4 4 2 33 Hig
86. Bluetooth Devices Once synchronization is acheived the arrow between the Classic devices will turn green with the arrow head point to the master device StartSniffing 200 Appendicies ComProbe 802 11 User Manual Note StartSniffing is unique to Bluetooth ComProbe devices and it will automatically execute the Automation Server StartCapture command once synchronized For non Bluetooth devices use the StartCapture command that is equivalent to the Start Capture button in the Control window At line 874 the following code will halt the capture after 10 seconds This bit of code illustrates the control that you can have over the capture process after 10000 At line 879 we have another Bluetooth unique command that stops the sniffing and is equivalent to clicking the Stop Sniffing button _ on the BPA 600 datasource StopSniffing Here is one of those Bluetooth unique situations At line 889 the Stop Capture command is issued Unlike the Start Sniffing command the Stop Sniffing command does not automatically execute the Stop Capture command so it must be in the program if using ComProbe Bluetooth hardware Stop Capture will stop the capture of data This command is equivalent to clicking on the Stop Capture button Jj on the Contrtol window StopCapture K ComProbe Protocol Analysis System BPA 600 File View Live Options Window Help Feith PEIE S AAASL wa BB Configuration Bluetooth low energy Capture Stat
87. Capture File to start the software and used only for viewing capture files To reframe your data load your capture file select a protocol stack and then select Reframe from the File menu on the Control window Reframe is only available if the frame recognizer used to capture the data is different from the current frame recognizer In addition to choosing to Reframe you can also be prompted to Reframe by the Protocol Stack Wizard 1 Load your capture file by choosing Open from the File menu on the Control window and select the file to load 2 Select the protocol stack by choosing Protocol Stack from the Options menu on the Control window select the desired stack and click Finish 3 If you selected a protocol stack that includes a frame recognizer different from the one used to capture your data the Protocol Stack Wizard asks you if you want to reframe your data Choose Yes 4 The analyzer adds frame markers to your data puts the framed data into a new file and opens the new file The original capture file is not altered See Unframing on page 49 for instructions on removing framing from data 4 2 4 Unframing This function removes start of frame and end of frame markers from your data The original capture file is not altered during this process You cannot unframe from the Capture File Viewer accessed by selecting Capture File Viewer or Load Capture File to start the software and used only for viewing capture files 49
88. Decoders and My Methods We will be updating our web site with new and updated utilities etc on a regular basis and we urge decoder writers to check there occasionally 7 2 8 Bluetooth low energy ATT Decoder Handle Mapping Low energy device attributes contain a 16 bit address called the attribute handle Each handle is associated with an attribute Universally Unique Identifier UUID that is 128 bits long In the attribute database the handle is unique while the UUID is not unique The ComProbe software detects and stores the relationships mappings between handle and UUID during the GATT discovery process But sometimes there is no GATT discovery process because e The discovery has previously taken place and both devices stored the mappings and the discovery will not repeat at every subsequent connection e The developer owns both devices in the conversation and chose to ignore discovery because the mappings are known e The devices are in development and the code to perform the mappings has not been written yet The solution to this problem is to 1 define the mappings in a file and 2 then pre loading the mapping using the ComProbe software Creating handle UUID mapping file Create a file named ATT Handle UUID Preload ini in the root directory of C Users Public Public Documents Frontline Test Equipment My Decoders but the file can be located anywhere Assume that you want to create a GATT service starting at handle 1 Crea
89. Directories Opens the File Locations dialog where the user can change the default file locations Check for New When this selection is enabled the program automatically Releases at Startup checks for the latest Frontline protocol analyzer software releases Side Names Opens the Side Names dialog used to customize the names of the slave and master wireless devices Protocol Stack Opens the Select a Stack dialog where the user defines the protocol stack they want the analyzer to use when decoding frames Set Initial Decoder Parameters Opens the Set Initial Decoder Parameters window Each entry in the window takes effect from the beginning of the capture onward or until redefined in the Set Subsequent Decoder Parameters dialog This selection is not present if no decoder is loaded that supports this feature Set Subsequent E Opens the Set Subsequent Decoder Parameters dialog Decoder where the user can override an existing parameter at any Parameters frame in the capture Each entry takes effect from the specified frame onward or until redefined in this dialog on a later frame This selection is not present if no decoder is loaded that supports this feature Automatically Request Missing Decoder Information When checked this selection opens a dialog that asking for missing frame information When unchecked the analyzer decodes each frame until it cannot go further and it stops decoding This selection is no
90. Power port on the ComProbe 802 11 back panel Figure 2 3 Oo 802 11 Probe Figure 2 3 Back Panel Power 2 Plug the 12 volt AC adapter into the AC power source The front panel Power light illuminate Figure 2 1 3 Insert the USB cable into the USB port on the ComProbe 802 11 back panel Figure 2 4 Chapter 2 Getting Started ComProbe 802 11 User Manual 802 11 Figure 2 4 Back Panel USB 4 Insert the other end of the USB cable into the PC 5 It may take as long as thirty seconds for Windows to recognize that the ComProbe 802 11 hardware is connected to the PC The Activity light on the ComProbe 802 11 front panel Figure 2 1 will blink during this period when the light is steady the ComProbe 802 11 hardware is ready to communicate with the ComProbe software 2 1 2 Setting Up for ProbeSync The ComProbe 802 11 hardware has ProbeSync which allows for synchronization of ComProbe hardware clocks and timestamping One ComProbe device will act as the master device by providing the clock to the slave device receiving the clock Do not confuse master and slave with Bluetooth device master and slave relationships When using the ComProbe 802 11 with a ComProbe BPA 600 the BPA 600 must always be the master ProbeSync device Refer to the following table Table 2 1 802 11 ProbeSync Relationships No 1 ComProbe 802 11 No 2 ComProbe 802 11 ComProbe BPA 600 ComProbe 802 11 1 Using a CAT 5 Ethernet
91. Rules Set Subsequent Decoder Parameters Hide This Pane Show Hidden Panes Bookmarks Options Window Help PE 6 Y FSS hh DO DOE amp amp OCGOd MEA Data Errors Baseband PreConnection FHS SCO eSCO Ba Frame Fr Access Add CAC EDADDA 6 463 5 464 5 465 5 466 6 467 6 466 5 469 6 470 6 47 Ca Ka Pa Classic J Bluetooth low energy F aaa ya Jm b4 LA LA Sak hah JAAA Delta 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 00 00 00 0 Figure 4 39 Connection Filter from the Frame Display Pane right click From the Frame Display frame selection Sum Timestamp 41342015 10 55 32 661 4 13 2015 10 55 32 660 4 13 2015 10 55 32 671 4713 2015 10 55 32 6901 4713 2015 10 55 32 692 4773 2015 10 56 32 6941 421372015 10 55 32 701 41342015 10 55 32 7051 4713 2015 10 55 32 711 4713 2015 10 55 32 711 4713 2015 10 55 32 14 4 13 2015 10 55 32 7201 Select a frame in the summary pane Right click and select Connection Filter in the pop up menu The procedure for creating a connection filter are identical as described in From the Frame Display Filter menu above If the frame you have selected is associated with a Classic Bluetooth link or a Bluetooth low energy access address an additional pop up menu item will app
92. Sample Script Do not change any script in Procedures and Command Wrappers FTE_Base namespace vars Modifications In the FTE_Base namespace vars section you will need to identify the connections for the host and the port Near the top of this section locate the following code at or near line number 747 748 set Connections Host 0 0 0 0 set Connections Port 22901 For the Host change 0 0 0 0 to the IP address of the computer running Automation Server For example 192 168 10 94 For the Port number the default is set to 22901 which is not acommon TCP port It is unlikely that another application is using this port so you can leave the Port set to default 22901 Note Before launching the Automation Server the IP address and IP port the same as the script Host and Port values must be modified in the XML configuration file FTSAutoServer exe config H This file is located in C Program Files Frontline Test System II Frontline ComProbe Protocol Analysis System your version Executable Core directory The code to modify is lt add key IPAddr value 0 0 0 0 gt and lt add key Port value 22901 gt Start of Sample Script Modifications This section is the main part of the program and several lines in the template need to be changed to support your unique data capture environment First at or around line 792 we need to input the Host IP address again Locate the following code and enter your Host IP address FTEBaselnit is
93. Selected Item From List button becomes active 2 Click the Remove Selected Item From Listbutton to remove the stack from the list You cannot remove stacks provided with the analyzer If you remove a custom stack you need to define it again in order to get it back If you are changing the protocol stack for a capture file you may need to reframe See Reframing on page 49 for more information You cannot select a stack or change an existing one for a capture file loaded into the Capture File Viewer the Capture File Viewer is used only for viewing capture files and cannot capture data Protocol Stack changes can only be made from alive session 47 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data 4 2 2 Creating and Removing a Custom Stack To create a custom stack arang a 1 Choose Protocol Stack from the Options menu on the Control window or click the Protocol Stack icon on the Frame Display toolbar 2 Select Build Your Own from the list and click Next 3 The system displays an information screen that may help you decide if you need to define your own custom stack Defining a custom stack means that the analyzer uses the stack for every frame Frames that do not conform to the stack are decoded incorrectly Click Next to continue Select Protocols 1 Select a protocol from the list on the left 2 Click the right arrow button to move it to the Protocol Decode Stack box on the rig
94. The first step to ensuring reliable air sniffing data capture is to understand the RF characteristics of the Devices Under Test DUTs The Bluetooth Class antenna types and radiation patterns are all important factors that can affect the placement of the DUTs and the ComProbe analyzer Radiation patterns are rarely spherical so understanding your device s radiation patterns can greatly enhance successful data capture Position devices to avoid radiation attenuation by the surroundings This step is optional Consider conductive testing to establish a baseline capture Conductive testing isolates the DUTs and analyzer from environmental effects The next step is to ensure that the testing environment is as clutter free as possible e Line of sight obstructions should be eliminated between the ComProbe hardware and the DUTs because they cause a reduction in signal strength Obstructions include but are not limited to water bottles coffee cups computers computer screens computer speakers and books A clear unobstructed line of sight is preferred for DUT and ComProbe hardware positioning e If using an analyzer connected to a computer position the computer on an adjacent table or surface away from the analyzer and DUTs taking advantage of the cables length If this is not possible position the computer behind the analyzer as far away as possible If using the ComProbe FTS4BT which is a dongle either use an extension USB cable or position
95. _Coex BPA600 and 802 11 in Coexistence Moving to line 831 in the sample script we see a configuration setting command for the ComProbe BPA 600 The only parameters shown in this code are the address of the Master and Slave devices If other parameters are omitted from the code the default values are selected This line of code is equivalent to setting the BPA 600 datasource for Classic Bluetooth ConfigSettings format OParameters BPA600 Master 0x00025b01cb8b Slave 0x00025b01cbe1 199 ComProbe 802 11 User Manual Appendicies K3 BPA 600 datasource File View BPA6GOO Help Devices Under Test LE Only Classic Only Single Connection Dual Mode Classic Only Multiple Connections Device Oe 0Seac1 ladbec John Trinkle s if Waiting for the master to connect to the slave LE Device Sync wali First Master LE Address Type Advertiser Initiator Dee 000025b00a220 UGO Classic Encryption LE E ption Enter New Long Tem Key Enter New PINADOB data 6 3 2015 12 00 39 PM Oxdifdtidtdttdtat a MA ee Figure 6 ConfigSettings equivalent ComProbe BPA 600 Configuration Settings Dialog Similar ConfigSettings code will appear in the sample script for the ComProbe 802 11 At line 853 the StartSniffing command appears This is equivalent to clicking the Start Sniffing button je on the BPA 600 datasource toolbar Start Sniffing will start synchronization of the BPA 600 with the
96. a To Clipboard l Copy Errors To Clipboard Copy Buffer Information To Clipboard Copy Frames Sec To Clipboard j Figure 4 86 802 11 Edit Menu for Copying 4 6 4 802 11 Error Statistics The Wi Fi Error Statistics window appears when you select the window from the a icon No Errors 30083 9434 in the Control window toolbar or the Frame J ut WeErors 1991 6 Display toolbar The dialog is view only there is no user interaction possible The window displays the percentage of packets with and without errors in a pie chart and ina table Dor llep Pree IT Parse Eee 4 6 5 Graphs 4 6 5 1 Statistics Errors Graphs Open the Statistics window and click on the picture of a graph Lal on the Errors table header or choose the graph name from the Graph menu on the Statistics window 137 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data The Frame Sizes Graph window has Session Resettable and Capture File tabs that correspond to the tabs on the Statistics window Each tab shows the data that corresponds to the appropriate tab on the Statistics window The window displays the errors in either a pie chart or bar graph format Click the Pie icon PB to display a pie chart and click the Bar icon to display a bar graph 4 6 5 2 Printing Error Graphs Click the Print icon Ca to print the graph The analyzer prints exactly what is shown in the window 138 Chapter 5 Navigating and Searchi
97. a is exported to the identified path file is waiting for the frame to complete and is selecting the 802 11 MAC protocol tab Export c Users Public Public documents Frontline Test Equipment My Capture Files mycap csv Mode 0 Tab 802 11 802 11 MAC KI Frame Display NFC Wifi cfa File Edit View Format Filter Bookmarks Options Window Help a2 Y Yegna coer Rada DOs CCOO Header Size 48 io Data length 255 H Channel Frequency MHz 2422 Find Ja a 7 Channel Number 3 fe 55l Type Subtype Seq Addr Receive Addr Trar e agila aling Mm 33 Nal fe tb BSS FRFRERFEIFEE DA Cisc H Data Rate 1 ee ee ee ce ee Oe eee Hardware Clock 0x0000000000390545 a ny Ha Na di Ha AH Hg QC Radio Clock 0422915094 _ oe mika Ka a A 4 36 Mgmt Beacon 748 IESS FHIERIEIEF DA Cisc z Zo Data Qos Nu 778 To AP lsco Linkays Ll Intel H Antenna 1 Control Channel R551 26 Figure 9 Export Command equivalent Frame Display 802 11 MAC tab selected Refer to the ComProbe Automation Server Protocol Programmers Guide for detail of the Export command Mode and Tab parameters 202 Appendicies ComProbe 802 11 User Manual Export provides you with the ability to automatically save specific protocol data that may be the focus of your analysis The exported file is saved as a comma separate value csv file type This file may be opened for later analysis in any application that supports csv format such
98. a procedure that sets up the TCP connection FTEBaselnit 192 168 0 90 At or around line 803 change 13 1 830 1052 in the following code to the version of your ComProbe software The version number can be found listed with your Frontline installation directory at C Program Files x86 Frontline Test System CPASVersion is a varible used in the program to locate your installed version of the ComProbe software set CPASVersion C Program Files Frontline Test System II Frontline ComProbe Protocol Analysis System 13 1 830 1052 Executables Core Lastly you need to identify the personality of the ComProbe hardware On or about line 823 you will change the following code to replace the text within the quotes with the personality key that matches your sniffing hardware configuration Within the sample script are a few examples of commonly used personalities or profiles The Programmers Guide provides a complete list of personalities set Profile BPA600 Coex 197 ComProbe 802 11 User Manual Appendicies This code is the personality for using a ComProbe BPA 600 for Classic Bluetooth and a ComProbe 802 11 for Wi Fi with the software operating in Coexistence View If you wanted to use just the ComProbe BPA 600 for captureing Classic Bluetooth and Bluetooth low energy then you would change the value in quotes to BPA600 Having made these changes to the sample script template you are ready to capture data using your client server
99. ad by the ComProbe analyzer The dialog shows the name of each ComProbe hardware device its process id in square brackets and the number of packets remaining These stored packets are read until they re exhausted or the user clicks the Discard button on the dialog Unlike 802 11 Bluetooth packets never come in faster than the datasource can process them However Bluetooth packets must still be stored so that they can be read in chronological order with the 802 11 packets 40 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual Transferring Packets Current Packet Transfer Statistics Hardware Packets on hardware ComProbe 802 11 6120 21 084 BPA 500 2720 3 Total 21 087 Live capture has stopped but there are packets buffered on the ComProbe Hardware that have not been decoded These packets will continue bo be transferred and decoded until complete Press the Discard button to stop packet transfer and discard all untransferred packets R is 26 complete O seconds remaining Figure 4 3 Packet Transfer Dialog 4 1 2 1 ComProbe 802 11 with Wireshark 4 1 3 Capturing Using Frontline Wi Fi Datasource with Wireshark Note This topic is provided as a courtesy to our customers who want to use Wireshark in conjunction with the ComProbe 802 11 although the ComProbe software is fully capable of J performing the same functions as Wireshark Frontline does not support or maintain third party prod
100. ady been installed please refer to the instructions available in the Setup folder installed under Start Programs Product Name and version Setup How to Install the FTS Serial Driver 7 2 7 DecoderScript Overview The DecoderScript Reference Manual and User Guide is delivered with each Frontline ComProbe Protocol Analysis System installation package under Developer Tools The manual is also available on line at FTE com The main purpose of this manual is to describe DecoderScript the language used in writing decoders DecoderScript allows you to create new decoders or modify existing decoders to expand the functionality of your ComProbe protocol analyzer DecoderScript displays protocol data checks the values of fields validates checksums converts and combines field values for convenient presentation Decoders can also be augmented with custom C coded functions called methods to extend data formatting validation transformations and so on A decoder defines field by field how a protocol message can be taken apart and displayed The core of each decoder is a program that defines how the protocol data is broken up into fields and displayed in the Frame Display window of the analyzer software 185 ComProbe 802 11 User Manual Chapter 7 General Information This manual provides instruction on how to create and use custom decoders When reading the manual for the first time we encourage you to read the chapte
101. ail pane displays a transaction To keep the distinction between layers and messages clear each header of each message in the detail pane ends with the word Message or Messages The latter is used because data and handshake messages are shown as a single color coded entry Each protocol layer is represented by a color which is used to highlight the bytes that belong to that protocol layer in the Event Radix Binary and Character panes The colors are not assigned to a protocol but are assigned to the layer The Event Radix Binary Character and Decode panes are all synchronized with one another Clicking on an element in any one of the panes highlights the corresponding element in all the other panes Click the Toggle Expand Decode Pane icon im to make the Decode pane taller This allows for more of a lengthy decode to be viewed without needing to scroll 4 4 1 11 5 Radix or Hexadecimal Pane The Radix pane displays the logical bytes in the frame in either Ria cs 21 TE Ah ca hexadecimal decimal or octal The radix can be changed from as od This ic the Radir Pane the Format menu or by right clicking on the pane and choosing Hexadecimal Decimal or Octal s Copy Selection to Clipboard Because the Radix pane displays the logical bytes rather than N Select Entire Frame the physical bytes the data in the Radix pane may be different Change Text Highlight Color from that in the Event pane See Physical vs Logical Byte Dis
102. al Frame Display will remain open and can be minimized Note The system currently limits the number of frame displays to 5 This limit includes any Frame Displays opened using Duplicate View dg from the Toolbar see Working with Multiple Frame Displays on page 70 The new Frame Display with the filtered connection frames will only contain the data defined by the filter criteria That is the criteria could be a single link or data for a particular technology 92 Chapter 4 Capturing and Analyzing Data Display Example 1 Bluetooth low energy Access Address selected ComProbe 802 11 User Manual QI P H 8 p Frame 1 Len 53 LE BB he Header Length 13 i Header Version 3 H CP H 1 iw Channel Index 37 2402 MHz Meets Predefined Filter Criteria fo H Receive Status Received witho H Decryption Initiated No iw Signal Strength 7 medium 3 La PDU Length 37 B LE PKT i Preamble Oxaa Access Address Ox8e89bed6 ke CRC Oxfe96e6 LE ADV i PDU Type ADV IND i Advertiser Address Type random iw Payload Length 35 AD Data B AD Element H Length 2 i i AD Type Flags O AD Data BR EDR Not Suppotf B AD Element eee 11 UUID Blood Pressurg UUID Weight Scale i i JUD Body Composilf B 4D Element Length 13 m Total Frames 6 767 Frames Filtered In For Help Press F1 File Edit View Format Filter Bookmarks YY Advertiser Address Ox712
103. alog 02 2 2 cece eee eee eee cece eee e ee eee 28 Figure 3 14 Wi Fi Direct MAC Address Editor _ 2 22 eee eee cece cece cece ccc e cc ceececcececceeceee 29 Figure 3 15 Select Set Initial Decoder Parameters from Control window 2 30 Figure 3 16 Tabs for each decoder requiring parameters _ 2 22 e eee ee cee eee eee e cee ceeeeeeees 30 Figure 3 17 Set Subsequent Decoder Parameters from Control window 2 2 2 31 Figure 3 18 Example Set Subsequent Decode for Frame 52 RFCOMM 22 22 e eee eee ee 31 Figure 3 19 Security WPA2 WEP Decoder Tab 2 22 222 e cece cee cece eee eee aoaaa ranoo 2222222 33 Figure 4 1 Devices Equally Spaced in the Same Horizontal Plane c eee e eee eee eee eeee 38 Figure 4 2 Example Poor Capture Environment 22 0 e eee cece cece cece cece eee eeceeeees 39 Figure 4 3 Packet Transfer Dialog _ 2 22 2 lec ee cece cece cece cece cece ec eeeccecceeceeeececceeees 41 Figure 4 4 Datasource Stopped Sniffing ee cece cece cece cece cece eee nonn 41 Figure 4 5 Datasource Sniffing occ cc cee cece ee cece eee ATEEN EE ERSEN et 42 Figure 4 6 Wireshark Capture Dialog o eo eee ccc cece cece cece cece eee eeeeeeeeee 42 Figure 4 7 Wi Fi Datasource Toolbar coe cece ec cece ccc ccc c cece cc eececcececce
104. alue if it is found will be highlighted in the Decode Pane 4 Select Find Previous Occurrence or Find Next Occurrence to continue the search There are several important concepts to remember with Find 68 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual e When you enter a search string and select Enter the search moves forward e If you select Find Previous Occurrence when the search reaches the first frame it will then cycle to the last frame and continue until it reaches the frame where the search began e Shift F3 is a shortcut for Find Previous Occurrence e If you select Find Next Occurrence when the search reaches the last frame it will then cycle to the first frame and continue until it reaches the frame where the search began e F3 is a shortcut for Find Next Occurrence e You cannot search while data is being captured e After acapture is completed you cannot search until Frame Display has finished decoding the frames e Find is not case sensitive e The status of the search is displayed at the bottom of the dialog Total Frames 259 Frames Filtered In 259 Frame s Selected 201 1 e The search occurs only on the Search for Antenna True results Found protocol layer selected e Tosearch across all the protocols on the Frame Display select the Unfiltered tab e A drop down list displays the search values entered during the current
105. and Analyzing Data 4 4 2 10 Coexistence View Throughput Graph a aa HID Wiwponsynchronied with Zoomed Throughput Graph BB and Timelines 802 11 Packet Classic Packet Se Throughput Throughput LE Packet Throughput Classic Payload 802 11 Payload Ee Throughput Figure 4 51 Coexistence View Throughput Graph The Throughput Graph is a line graph that shows packet and or payload throughput over time as specified by the radio buttons in the Throughput group If the Both radio button is selected packet and payload throughput are shown as two separate lines for each technology The payload throughput line is always below the packet throughput line unless both are 0 The data lines and y axis labels are color coded Blue Classic Bluetooth Green Bluetooth low energy Orange 802 11 Each data point represents a duration which is initially 0 1 s Each time the number of data points per line reaches 300 the number of data points per line is halved to 150 and the duration per data point is doubled The duration per data point thus progresses from 0 1 s to 0 2 s to 0 4 s to 0 8 s and so on 4 4 2 11 Throughput Graph Y axis labels The y axis labels show the throughput in bits per second From left to right the labels are for 802 11 Bluetooth low energy and Classic Bluetooth The duration of each data point must be taken into account for the y axis label s value to be meaningful For exampl
106. ange you want to save is too large to select note the numbers of the first and last item in the range Right click in the data Select Save Selection or Save As from the right click menu Click on the radio button labeled Selection If you selected Sare a range make sure the starting and ending numbers are CJ Entire File correct To specify a range type the numbers of the first 2 Selection and last items in the range in the boxes Events Frames Select either Events or Frames to indicate whether the cod numbers are event or frame numbers Type fle name herd Type a file name in the As box at the bottom of the screen Hote Na capturing wal be done whi the Click the Browse icon to browse to a specific directory file is being saved Otherwise your file is saved in the default capture file directory Click OK when you are finished 6 2 Adding Comments to a Capture File The Notes feature allows you to add comments to a CFA file These comments can be used for many purposes For example you can list the setup used to create the capture file record why the file is useful to keep or include notes to another person detailing which frames to look at and why Bookmarks are another useful way to record information about individual frames To open the Notes window 1 Click the Show Notes icon E This icon is present on the toolbars of the Frame Display as well as the Event Display po Notes can be selected fr
107. ar On a two channel circuit the background color of the one line summary indicates whether the frame came from the DTE or the DCE device Frames with a white background come from the DTE device frames with a gray background come from the DCE device The ComProbe USB Summary pane in displays a one line summary of every transaction in a capture buffer or mi Isa Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual file Whenever there is a transaction it is shown on a single line instead of showing the separate messages that comprise the transaction The Msg column in that case says Transaction Each message in a transaction contains a packet identifier PID All of the PIDs in a transaction are shown in the transaction line All IN transactions i e transactions that contain an IN token message are shown with a purple background All other transactions and all non transactions are shown with a white background IN transactions have special coloring because that is the only place where the primary data flow is from a device to the Host The protocol information included for each frame depends on the protocol selected in the summary layer box located directly below the main toolbar Frame numbers in red indicate errors either physical byte level or frame errors If the error is a frame error in the displayed protocol layer the bytes where the error occurred is displayed in red The Decode Pane gives preci
108. as Micosoft Excel or Access A 2 5 Keeping Track of Events Automation Server Add Bookmark command will automatically add a book mark to the last frame currently in the capture buffer Consider this scenario You have set up your automation script but you want to keep track of the specific events for example when you start streaming music from your smart phone to a Bluetooth speaker The Add Bookmark String StartMusicStream In this scenario the Add Bookmark command may be used with TCL conditional statements to detect and guide the event actions The string parameter will be the name on the bookmark for your saved or exported data capture When analyzing the automated capture session at a later date you can use the bookmark to localize your analysis to the event A 2 6 Automation Can Save Time and Money In a carefully considered design development or testing environment automation of wireless sniffing and data Capture can save time and money The Frontline Automation Server gives you the means to save time by ensuring process are reliably reproduced This is especially true for situations when you want to run the identical tests on several products or versions of a product Being able to compare captured data across design versions is enhanced when you can run exactly the same process Up front automation script development time is a consideration when setting up an automated sniffing process The ComProbe Automation Server Protocol Program
109. at protocol on that technology e A protocol filter tab appears in the General group only if the protocol occurs in more than one of the technology specific tab groups For example if L2CAP occurs in both Classic Bluetooth and Bluetooth low energy there will be L2CAP tabs in the General group the Classic Bluetooth group and the Bluetooth low energy group Select the Unfiltered tab to display all packets There are several special tabs that appear in the Summary pane when certain conditions are met These tabs appear only in the General group and apply to all technologies The tabs are 73 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data e Bookmarks appear when a bookmark is first seen e Errors appear when an error is first seen An error is a physical error in a data byte or an error in the protocol decode e Info appears when a frame containing an Information field is first seen The tabs disappear when the capture buffer is cleared during live capture or when decoders are reloaded even if one of the tabs is currently selected They subsequently reappear as the corresponding events are detected The tabs disappear when the capture buffer is cleared during live capture or when decoders are reloaded even if one of the tabs is currently selected They subsequently reappear as the corresponding events are detected Use the navigation icons keyboard or mouse to move through the frames The icons and o mo
110. at radio frequencies attenuate over distance The free space rule of thumb dictates that radio energy decreases in strength by 20 dB by each 10 to 1 increase in range In the real world the effects of objects in an outdoor environment cause reflection diffraction and scattering resulting in greater signal losses Indoors the situation can be worse Reflections occur from walls and other large flat surfaces Diffraction occurs from objects with sharp edges Scattering is produced from objects with rough surfaces and from small objects Also any object directly in the path of the radiation can present a hard or soft partition depending on the partition s material properties Path losses from partitions are difficult to estimate Estimating indoor propagation loss 1 One estimate of indoor path loss based on path loss data from a typical building provides a range power rule At 2 4 GHz the following relationship provides an approximate estimate of indoor path loss Indoor Path Loss in dB 40 35Log iolrange in meters This approximation is expected to have a variance of 13 dB Mitigating path loss and interference Bluetooth device design contributes to mitigating environmental effects on propagation through spread spectrum radio design for example However careful planning of the testing environment can also contribute to reliable data capture process 37 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data
111. ata Obstacles in close proximity to or in between the analyzer and the DUTs can interfere and cause reduction in signal strength or interference Even small objects can cause signal scattering Figure 4 2 Example Poor Capture Environment 4 1 2 Capturing Data to Disk General Procedure A Note Capture is not available in Viewer mode 1 Click the Start Capture button to begin capturing to a file This icon is located on the Control Event Display and Frame Display windows 2 Files are placed in My Capture Files by default and have a cfa extension Choose Directories from the Options menu on the Control window to change the default file location Note For the Dashboard when you capture to series of files the window displays the data from the beginning of the first capture even when a new file in the series is created This is VA because the Dashboard is a Session Monitor which means that even if you capture to a series of files the data from the first file is always displayed The display does not refresh when a new capture file in a series is created 3 Watch the status bar on the Control window to monitor how full the file is When the file is full it begins to wrap which means the oldest data will be overwritten by new data 39 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data 4 Click the Stop Capture icon to temporarily stop data capture Click the Start Capture icon again to
112. available o 0 Standard 1 14 Wi Fi channels o 1 Expanded channels below the standard range o 1 Expanded channels above the standard range e FCS Filter The Frame Check Sequence filter indicates if the device should capture frames with an invalid FCS Select All Frames or Valid Frames Clicking on the Scanner button will open the Wi Fi Scanner dialog This action is useful if you do not know the channel to sniff Once you have selected a channel in the Wi Fi Scanner dialog and confirmed your selection the selected channel will appear in Channel 20 ComProbe 802 11 User Manual Chapter 3 Configuration Settings 3 1 2 2 Status Settings Status Capture Filters Firmware Update ComProbe 807 11 Serial Number 0107120052 Hardware Information Software Version Clock Source Source FPGA Capture Media Indicator OK Application Interface Data Capture Information Total Packets Captured Total Bytes Captured Packets Bytes Packets Not Yet Read by PC Bytes Not Yet Read by PC Count Figure 3 4 802 11 I O Settings Status Tab The Status dialog provides current information about the ComProbe device There are no settings for this dialog 3 1 2 3 Capture Filters The Capture Filters dialog allows you create modify and delete capture filters The dialog initially displays the existing MAC address Capture Filters e To activate the capture filters and to be able to create modify additional filters you first must s
113. ave PMNS a6 23 6b be 00 00 01 Master C z j2 00 08 amp Slave 4565 Slave RP 1b bd c0 23 0b Bd 5e 00 010717 amp H 50 Master 4385 Slave do 23 Ob Sd 5c 00 01 5a 01 amp FP 34 50 3 Co Master 4401 FR 37 6a f0 23 Ob 9d Slave Event 4 338 of 4 831 Frame 188 5 3 2011 1 48 58 604388 PM Source ASCIT Hex Dec Oct Binary Errors Master 27 33 47 00100111 For Help Press F1 4953 0b Captured Byte Information Figure 4 1 Event Display Click on an event to find out more about it The three status lines at the bottom of the window are updated with information such as the time the event occurred for data bytes the time the byte was captured the value of the byte in hex decimal octal and binary any errors associated with the byte and more Events with errors are shown in red to make them easy to spot When capturing data live the analyzer continually updates the Event Display as data is captured Make sure the Lock icon a is displayed on the toolbar to prevent the display from updating Clicking on the icon again will unlock the display While locked you can review your data run searches determine delta time intervals between bytes and check CRCs To resume updating the display click the Lock icon again You can have more than one Event Display open at a time Click the Duplicate View icon g to create a second independent Event Display window You can lock one copy of the Event Display and analyze your data while th
114. ave the appropriate bit s or byte s selected in the Radix Binary Character and Event panes e Radix Pane The Radix Pane displays the logical data bytes in the selected frame in either hexadecimal decimal or octal e Binary Pane The Binary Pane displays a binary representation of the logical data bytes e Character Pane The Character Pane displays the character representation of the logical data bytes in either ASCII EBCDIC or Baudot e Event Pane The Event Pane displays the physical data bytes in the frame as received on the network By default all panes except the Event Pane are displayed when the Frame Display is first opened Protocol Tabs Protocol filter tabs are displayed in the Frame Display above the Summary pane 61 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data e These tabs are arranged in separate color p coded groups These groups and their Noes og Classic Bluetooth blue UERS friant ino le colors are General white Classic Bluetooth Se aS blue Bluetooth low energy green a821 Bada AO ILMAC ae man Bluetooth low energy green 802 11 orange USB purple NFC brown and SD teal The General group applies to a Lee oo all technologies The other groups are magan Tu 802 11 orange technology specific sie Fegi CLE e Clicking on a protocol filter tab in the General group filters in all packe
115. ay HTML Export The Frame Display Print dialog and the Frame Display HTML Export are very similar This topic discusses both dialogs Frame Display Print The Frame Display Print feature provides the user with the option to print the capture buffer or the current selection The maximum file size however that can be exported is 1000 frames When Print Preview is selected the output displays in a browser print preview window where the user can select from the standard print options The output file format is in html and uses the Microsoft Web Browser Control print options for background colors and images 163 ComProbe 802 11 User Manual Chapter 6 Saving and Importing Data Print Background Colors Using Internet Explorer 1 Open the Tools menu on the browser menu bar 2 Select Internet Options menu entry 3 Click Advanced tab 4 Check Print background colors and images under the Printing section 5 Click the Apply button then click OK Configure the Print File Range in the Frame Display Print Dialog Selecting more than one frame in the Frame Display window defaults the radio button in the Frame Display Print dialog to Selection and allows the user to choose the All radio button When only one frame is selected the All radio button in the Frame Display Print dialog is selected How to Print Frame Display Data 1 Select Print or Print Preview from the File menu on the Frame Display window to display the Frame Di
116. ay window 2 Use the mouse to select the data you want to calculate a delta time and rate for 3 The Event Display window displays the delta time and the data rate in the status lines at the bottom of the window Event Display Homer cfa File Edit View maman Bookmarks pions Window Help 00 41 00 Ob ef ld 0d 0a 7b 43 49 45 56 3 i 28 57 00 74 Ob i Zc 30 Od Da 5a amp a E 30 58 00 24 Ob Sd SE 00 01 07 F j 1 F ra m 24 6c 00 24 Ob Sd 5c 00 01 5a 05 AA ee Ue PANIG 01 48 70 M Scie tes O Figure 4 2 Delta fields 4 3 6 Switching Between Live Update and Review Mode The Event Display and Frame Display windows can update to display new data during live capture or be frozen to allow data analysis By default the Event Display continually updates with new data and the Frame Display is locked 1 Make sure the Lock icon is active so the display is locked and unable to scroll 2 Click the Unlock iG icon again to resume live update The analyzer continues to capture data in the background while the display is locked Upon resuming live update the display updates with the latest data You can have more than one Event Display or Frame Display window open at a time Click the Duplicate View icon g to open additional Event or Frame Display windows The lock resume function is independent on each window This means that you can have two Event Display windows open simultaneously and one window can be lock
117. be 802 11 IN connector 2 Connect the ComProbe HSU Cat 5 cable to the ComProbe 802 11 OUT connector Each device datasource is setup individually to sniff their respective link Should the hardware be connected incorrectly that is IN to IN or OUT to OUT an error message will appear Follow the instructions in error message To continue click on the OK button The ComProbe device datasource Status window will also display a warning message suggesting information sources 44 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual BPA 600 datasource A Probe Syne setup error has been detected The Probe Sync cable should be connected to the OUT port of one BPA and the IN port on the other BPA IMPORTANT Please follow these steps in the exact order listed 1 Corectly connect the Probe Sync cable between the two BFAS 2 Close CPAS YOU MUST DO THIS STEP 3 Restart CPAS f necessary please refer to the Quick Start Guide for further information Figure 4 10 Incorrect ProbeSync Hardware Connection Error 4 Reconnect the USB cable for both BPAs 2 5 Restart CPAS f necessary please refer to the Quick Start Guide for further information Figure 4 11 Incorrect ProbeSync Hardware Connection Message In Datasource Status The BPA 600 datasource dialog Start Sniffing E button initiates the capture for all connected ComProbe 802 11 and HSU devices On the 802 11 and HSU receiving the clock cable
118. ble The devices are identified by se Chapter 3 Configuration Settings ComProbe 802 11 User Manual e MAC Address e SSID e Type e Channel e Frequency e RSSI e First Seen e Last Seen Note You can select the Stop or Stop Scanning from the Configure menu anytime to V4 stop the device search Q Wi Fi Device Scanner File Configure Control Help MAC Address SSID Type Channel Frequency RSSI First Seen Last Seen 58 6D 8F F6 B9 0E FTE Olympus AP 3 2422 16 13 00 19 13 00 19 10 0D 7F 7C FE E7 FTE BTLE TEAM AP 2437 5 13 00 21 13 00 22 00 0F B5 35 38 92 TGBLaw Public AP 2437 2 13 00 21 13 00 21 98 FC 11 CE B9 30 Nimbus20 144 AP 2457 29 13 00 22 13 00 27 E8 39 35 0D 0B D4 HPODOBD4 AP 2457 25 13 00 24 13 00 27 1 2 3 4 5 10 AG E TESE Systems n AP 222 13 00 25 13 00 28 7 11 2462 8 44 32 C8 C3 9C 40 HOME 9C40 AP 13 00 26 13 00 27 8 00 1E E5 42 06 68 TGBLaw Private AP 11 2462 8 13 00 26 13 00 27 FTE Test_Systems sa Cases om Devices Found 8 Sniffer ComProbe 802 11 SN 0102120052 Figure 3 11 802 11 Device Scanner with Devices Detected 3 Select the device 4 Click on Select channel lt no gt where lt no gt is the channel number selected Confirm sniffing channel The Confirm Sniffing Channel confirmation will appear Click on Yes m Do you want to sniff on Channel 10 Access Point FTE Test Systems will close the Wi Fi Device Scanner kasa and the ComProbe analyzer will u
119. button The system displays the changes in port assignment s965 Chapter 3 Configuration Settings ComProbe 802 11 User Manual Delete a Port Assignment 1 Choose Set Initial Decoder Parameters from the Options menu on the Control window 2 Click the TCP tab or UDP or IPX for those protocols 3 Select click on and highlight the port assignment to delete 4 Select Delete The system deletes the port assignment Move a Port Assignment If you need to move an entry to ensure it is processed before or after another entry select the entry in the list and then click the Move Up or Move Down buttons Port Assignment Considerations e The analyzer traverses an entry if either the source or destination port match e The analyzer processes port number entries in order from top to bottom 36 Chapter 4 Capturing and Analyzing Data The following sections describe the various ComProbe software functions that capture and display data packets 4 1 Capture Data 4 1 1 Air Sniffing Positioning Devices When capturing over the air packets proper positioning of the ComProbe hardware and the Devices Under Test DUTs will result in the best possible captures and will mitigate sources of path loss and interference The following procedures will help optimize the capture process especially if you are have problems obtaining reliable captures Problems with indoor radio propagation Even in free space it is well understood th
120. can examine the specific files information individually 1 You access this dialog by selecting Extract Data Audio from the View menu or by clicking on the icon from the toolbar 130 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual Data Audio Extraction Settings Select liz A2DP v Open Files After Extraction L oe SCO eSCO Options BPP Write Streams as FTP Two Mono Files id HCRP One Stereo File HF 7 Ho Convert A Law and p law to Linear PEM F7 IF OPP hala always converted V PBAP Add Silence packets IV SCO es5CO V SPP MEG V WBS Extract Figure 4 13 Data Audio Extraction Settings dialog 2 Choose a checkbox es on the left side of the dialog to identify from which profile s you want to extract data It s important to note that if there is no data for the profile s you select no extracted file is created 3 If you want the file s to open automatically after they are extracted select the Open File s After Extraction checkbox A Note This does not work for SCO eSCO 4 Click on aradio button to write the streams as Two Mono Files or as One Stereo File J Note This option is for SCO eSCO only 5 Select the checkbox if you want to convert A Law and p law to Linear PCM CVSD are always converted to Linear PCM It s probably a good idea to convert to Linear PCM since more media players accept this format Pd Not
121. ccctvccceseccedcr codeescuecdedadecceirduebcecondeseeteccuncnsoetecdere 8 Figure 2 7 ComProbe Analyzer Control Window 2 ee cee cece ec cece eccceccceccecececceeeees 11 Figure 3 1 802 11 Hardware Settings Dialog lee eee eee eee cece eee eeeeeeeee 18 Figure 3 2 802 11 I O Settings Dialog ccc ec eee cece cece cece ceceeeececeeececs 19 Figure 3 3 802 11 I O Settings Settings Tab 2 2 2 2 eee eee ec eee cece e cece cee eeeeeeeeeeee 20 Figure 3 4 802 11 I O Settings Status Tab l cece eee eee ee cee ee eee eee cece eeeeeeeeeeeceeeeees 21 Figure 3 5 802 11 I O Settings Capture Filters Tab U ee eee eee eee eee e ee eeeeeees 22 Figure 3 6 802 11 I O Settings Capture Filters Add New Address Dialog 2 eeeeeeeeee 22 Figure 3 7 802 11 I O Settings Capture Filters Edit MAC Address Dialog eee eee 23 Figure 3 8 802 11 I O Settings Firmware Update Tab 2 cece eee cece c cece eee eeeeecs 24 Figure 3 9 802 11 I O Settings Firmware Update Version List 2 2 cece e ee ee eee cece eee 25 Figure 3 10 802 11 Device Scanner with no Devices Detected 0 e cece 25 Figure 3 11 802 11 Device Scanner with Devices Detected 2002 26 Figure 3 12 802 11 Hardware Settings Dialog 2 2 2 2 a 27 IX ComProbe 802 11 User Manual Figure 3 13 Wi Fi Device Scanner I O Settings Di
122. cceceeceeeees 42 Figure 4 8 Wi Fi Datasource Sniffing Menu e ee ce eee ce eee cece eee eee ee ceeeeeeeee 43 Figure 4 9 Wireshark Capture Options _ 22 2 a 43 Figure 4 10 Incorrect ProbeSync Hardware Connection Error 2 22222 e eee ee eee eee eee 45 Figure 4 11 Incorrect ProbeSync Hardware Connection Message In Datasource Status 45 Figure 4 12 ProbeSync Synchronizing Device Status Message 20 2 e eee eee ee ee eee eee eee 45 Figure 4 13 ProbeSync Synchronized Device Status Message cece cece eee ecececcecceeeees 45 Figure 4 14 Frame Display Extended Inquire Response 2 22 22 e eee e cece e cece eee ce eeeeeees 46 Figure 4 15 Format MENU 22 lt ceccceesechcosevent dees cadadudeakwadeecdauscodctemaduessabacsveceoadeagasese 56 Figure 4 16 Header labels right click c ccc eee eeceeceeeeeees 57 Figure 4 17 Data display right click menu a 57 Figure 4 18 Event Display Options menu 2 22 2 cece eee cece eee e cece eceeeeeees 60 Figure 4 19 Event Display Font Size Selection ce ee eee cece cece eee e cece ee ceecceeeeecee 60 Figure 4 20 Frame Display with all panes active lee cece eee cece cece cece eceeeees 61 Figure 4 21 Frame Display Find text entry field 2 a 67 Figure 4 22 Search Find Dialog occ e ec eee cece
123. cece cece ee eeeeeeeerereeees 68 Figure 4 23 Frame Display File menu Byte Export cece cece cece cece eee eeceeeeeeees 71 Figure 424 Byte Export GIGIO a wana nka a Kadayawan ed iyasusteecsee ss eudeduchscedwausetedeuasdeecwsssuacs 71 ComProbe 802 11 User Manual Figure 4 25 Save As dialog eee cece en eee ee eee eee cence eee ee anaana 72 Figure 4 26 Sample Exported Frames Text File _ 2 20 2 lec ec eecee cece ccc c cece cceeecceeceecees 72 Figure 4 27 Example Protocol Tags cceosc ccccccek stu bconsedenekseccucsdbbus ccuneuw she tcecdadoeseecauesecs 73 Figure 4 28 Summary pane right with Tooltip on Column 5 Tran ID u cece e ee ee eee 74 Figure 4 29 Frame Display Protocol Layer Color Selector 0 22 22 cece eee eee cee cece eeeee 79 Figure 4 30 Example Set Conditions Self Configuring Based on Protocol Selection 81 Figure 4 31 Example Set Conditions Self Configuring Based on Frame Range 82 Figure 4 32 Two Filter Conditions Added with an AND Operator eee e eee eee eee ences 84 Figure 4 33 Save Named Filter Condition Dialog 0 00 84 Figure 4 34 Using Named Filters Section of Quick Filters to Show Hide Filters 87 Figure 4 35 Set Condition Dialog in Advanced View 22 22 e eee eee eee eee eee eee eee eee 88 Figure 4 36 Rename Filt
124. check the box next to the hidden filter to show or hide a display filter 86 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual Hamed Filters Filter JASON LL 7 Filter Filterz Filter Role Slave SCO link Supported Filters Figure 4 34 Using Named Filters Section of Quick Filters to Show Hide Filters not automatically appear in other Frame Display windows You must use the Hide Show dialog to display a filter created in one Frame Display in different Frame Display window 4 4 1 13 1 7 Editing Filters A Note When you have multiple Frame Display windows with a display filter or filters those filter do Modifying a Condition in a Filter 1 Click the Display Filters icon VW on the Frame Display window or select Apply Modify Display set Condition Ko Curentu Ache Condition Filler Filter ASCIE 3 Filters from the Filter menu to open the Set Condition dialog box The Set Condition dialog box displays the current filter definition at the top of the dialog To display another filter click the Open 2 icon and select the filter from the pop up list of all the saved filters 2 Editthe desired parameter of the condition Because the required fields for a condition statement depend upon previously selected parameters the Set Condition dialog box may display additional fields that were not present in the original filter In the event this occurs continue
125. ching 146 byte export 70 C Calculating Data Rates and Delta Times 55 Capture Buffer 160 171 173 Capture Buffer Size 171 Capture File 39 160 163 171 173 auto save imported files 171 capture to a series of files 171 capture to one file 171 changing default location of 175 changing max size of 171 173 framing captured data 49 importing 163 loading 162 reframing 49 removing framing markers 49 saving 160 161 starting capture to file 39 ComProbe 802 11 User Manual Capturing 39 Data to Disk 39 CFA file 161 162 Changing Default File Locations 175 Character 143 184 Character Pane 77 Character Set 57 182 183 Characters Per Second Table 137 Choosing a Data Capture Method 7 Clear Capture Buffer 171 CN 184 Coexistence View 95 le Devices Radio Buttons 117 Legend 118 Set Button 116 Throughput Graph 108 Discontinuities 109 Dots 112 Swap Button 111 Viewport 110 Zoom Cursor 115 Zoomed 113 Freeze Y 114 Unfreeze Y 114 Y Scales Frozen 114 Throughput Indicators 105 Throughput Radio Buttons 117 Timeline Radio Buttons 117 Timelines 118 discontinuities 126 high speed 127 206 Appendicies packet 118 two timelines 123 Toolbar 103 Tooltip 109 relocate 109 121 Color of Data Bytes 79 Colors 79 Comma Separated File 167 Compound Display Filters 83 Confirm CFA Changes 162 Context For Decoding 50 Control Characters 184 Control Signals 58 177 Control Window 17 171 Configuration Information 13 Conversation Filter
126. ck OK The Delete Named Condition dialog box closes and the system deletes the filter Hiding and Revealing Display Filters If a display filter is showing the following steps will hide that filter but will not delete it 1 Select Hide Show Display Filters from the Filter menu on the Hide Show Filters Frame Display window to open Filters the Hide Show Filters dialog The system displays the Hide Show Filters dialog with a list of all user dude each frame where the protocol Data field ASCII Contains the Substring defined filters 2 i 2 Select the filter to be hidden from the Cancel Hep combo box 3 Click the Hide button The Hide button is only showing if the selected filter is currently showing in the Frame Display 4 Click OK The Hide Show Filters dialog box closes and the system hides the filter and removes the filter tab from the Frame Display If a display filter is hidden the following steps will reveal that filter in the Frame Display 1 Select Hide Show Display Filters from the Filter menu in the Frame Display window to open the Hide Show Filters dialog The system displays the Hide Show Filters dialog with a list of all user defined filters 2 Select the filter to be revealed from the combo box 3 Click the Show button 4 Click OK The Hide Show Filters dialog box closes and the system reveals the filter in the Frame Display You can also open the Quick Filter dialog and
127. ck on the name given in the Current Names column and then click again to modify the name a slow double click 3 Select OK to initiate the changes The changes that have been made will not fully take effect for any views already open Closing and reopening the views will cause the name change to take effect 4 Torestore the default values click the Set Defaults button 7 1 4 Timestamping Timestamping is the process of precise recording in time of packet arrival Timestamps is an optional parameter in the Frame Display and Event Display that can assist in troubleshooting a network link 7 1 4 1 Timestamping Options The Timestamping Options window allows you to enable or disable timestamping and change the resolution of the timestamps for both capture and display purposes To open this window Choose Set Timestamp Format from the Options menu on the Frame Display and Event Display window or click on the Timestamping Option ga icon in the Event Display toolbar The Timestamping Options window will open 178 Chapter 7 General Information ComProbe 802 11 User Manual Timestamping Options Store Timestamps This item takes effect immediately Capture Options storage Resolution 0 50 Microseconds high resolution 7 Cancel Note 1 To apply resolution changes you must restart the program Help Note 2 Finer resolutions increase the capture file size Click Help for more information on how timestam
128. col Analysis System and to use a specific personality StartFTS format s s SCPASVersion Profile Gamliel In the code above from the sample script SCPASVersion was defined at line 803 and the SProfile Sisi was set at line 823 to use ComProbe BPA 600 and ComProbe 802 11 in coexistence This is naa a equivalent to 1 double clicking on the Frontline desktop folder and starting the software and 2 selecting a capture method 198 Appendicies ComProbe 802 11 User Manual Select Data Capture Method Requires one ComProbe BPA 600 hardware and one ComProbe 802 11 hardware For Classic low energy 802 11 coexistence analysis Captures Bluetooth Classic low energy and 802 11 data and displays in the Frame Display and Coexistence View a Multiple Technologies Aggregated 3 502 11 AMP 49 202 11 AMP Interlaced Page Scan 902 11 and NFC 902 11 and 5D 902 11 and USB a 602 11 Interlaced Page Scan 3 4 502 11 5D and USB 802 11 Bluetooth Coexistence Bluetooth Classic LE BPA 500 amp 802 11 4 Bluetooth Classic LE BPA 500 amp NFC Gears OMS Bluetooth Classic LE BPA 500 amp USB 802 1 mt Bluetooth Classic LE BPA 600 amp 802 11 LE Bluetooth Classic LE BPA 600 amp NFC dll Bluetooth Classic LE BPA 600 amp USE OUT A Two 802 11 and One BPA 500 Te WG Ma Prob 4 saman j Figure 5 SProfile BPA600
129. connected to IN the Start Sniffing button is disabled when using ProbeSync In each ComProbe device s Control window status window will announce the synchronizing function Querying for firmware ids yr Finished querying for firmware ids Probe Sync cable connected to OUT l Figure 4 12 ProbeSync Synchronizing Device Status Message Figure 4 13 ProbeSync Synchronized Device Status Message Data captured in the synchronized device will appear in the Frame Display Event Display Bluetooth Timeline Bluetooth low energy Timeline and Coexistence View Data saved as a capture file will include data captured on each devices Within these dialogs the packets identified as link 1 2 and 3 were captured on the synchronizing device that provides the clock Those packets captured on the synchronized device carry link 4 5 and 6 identifiers 45 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data 4 1 5 Extended Inquiry Response Extended Inquiry Response EIR is a tab that appears automatically on the Frame Display window when you capture data E france Display F15461 Ak a KO Nag fenu Peet Opare maa 1p BOO a 8BOOOO ia 7 tended ingary Ampon ts Unlitored Baseband ipp d iredi ba 00202111 112111111 00900001 10111006 11100119 OOO CHOC e Hassband 01011101 1
130. cted Displays the frame number or numbers of selected highlighted frames and the total number of selected frames in parentheses e Total Frames The total number of frames in the capture buffer or capture file in real time e Frames Filtered In The total number of frames displayed in the filtered results from user applied filters in real time 4 4 1 3 Hiding and Revealing Protocol Layers in the Frame Display Hiding protocol layers refers to the ability to prevent a layer from being displayed on the Decode pane Hidden layers remain hidden for every frame where the layer is present and can be revealed again at any time You can hide as many layers as you wish Note Hiding from the Frame Display affects only the data shown in the Frame Display and not any information in any other window There are two ways to hide a layer 66 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual 1 Right click on the layer in the Decode pane and choose Hide protocol name Layer In All Frames 2 Click the Set Protocol Filtering button on the Summary pane toolbar In the Protocols to Hide box on the right check the protocol layer s you want hidden Click OK when finished To reveal a hidden protocol layer 1 Right click anywhere in the Decode pane 2 Choose Show protocol name Layer from the right click menu or click the Set Protocol Filtering button and un check the layer or layers you want revealed 4 4 1 4 Physical
131. d Searching the Data ComProbe 802 11 User Manual Find Ethernet Sniffer Decode Patten Time GoTo Special Everts Bookmark Franek d Book 44 First emor 12 6 2010 11 2548 18062 Forward Frames 106 Souta kinconect 12 6 2010 11 25 56 7c Frame 108 The tenestamnp seems ko be off on thee frome 12 GoTo Figure 5 12 Find Bookmark tab There are several ways to locate bookmarks e Select the bookmark you want to move to and click the Go To button e Simply double click on the bookmark e Click the Move Forward and Move Back buttons to move through the frames to the bookmarks shown in the window When the bookmark is found it is highlighted in the window There are three ways to modify bookmarks 1 Click on Delete to remove the selected bookmark 2 Click on Modify to change the selected Bookmark name 3 Remove All will delete all bookmarks in the window The Find window Bookmark tab will also appear when using functions other than Find such as when clicking on ro the Display All Bookmarks icon 5 1 9 Changing Where the Search Lands When doing a search in the analyzer the byte or bytes matching the search criteria are highlighted in the Event Display The first selected byte appears on the third line of the display CVEventDisplay To change the line on which the first selected byte appears Selectlion0Offset 2 1 Open fts ini located in the C User Public Public Documents Frontline Test Equipment
132. d filter tab and the number of frames The body shows the frame number the timestamp in the same format shown in the Frame Display Summary pane and the frame contents as raw bytes ByteLevelExport 1 txt Notepad o e 23 File Edit Format View Help Byte export of all filtered in frames Capture file le modified channel maps HID kbd cant decrypt GAIT cfa Filter tab Unfiltered 1 299 frames exported Frame Number Timestamp Frame Contents 1 7 5 2012 6 05 23 966944 PM 00 ff b2 00 15 aa d be 89 Be 00 13 2 7 5 2012 6 05 23 967570 PM 18 ff ae 00 15 aa d6 be 89 8e 00 13 3 7 5 2012 6 05 23 968195 PM 4e ff b3 00 15 aa dei be 89 Be 00 13 4 7 5 2012 6 05 23 994441 PM 00 ff b2 00 15 aa d6 be 89 8e 00 13 6 6 J 96 b1 eb d7 90 96 b1 eb d7 90 96 b1 eb d7 90 eb d7 90 96 b1 eb d7 90 96 b1 eb d7 90 J 5 7 5 2012 6 05 23 995066 PM 18 ff ae 00 15 aa d6 be 89 8e 00 13 6 7 5 2012 6 05 23 995691 PM 4e ff b7 00 15 aa d6 be 89 8e 00 13 JI voooy os to ey ty H oo oo O XO J 4 mm b Figure 4 26 Sample Exported Frames Text File 4 4 1 11 Panes in the Frame Display 4 4 1 11 1 Summary Pane The Summary pane displays a one line summary of every frame in a capture buffer or file including frame number timestamp length and basic protocol information The protocol information included for each frame depends on the protocol selected in the summary layer box located directly below the main toolb
133. d packets in the 1 second duration ending at the end of the last packet in the viewport time range are used for 1 second throughput except that Bluetooth low energy packets from non configured devices can be excluded as noted above Packets All Selected G Viewport 106 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual Figure 4 48 Throughput Graph viewport 4 4 2 9 Indicator width The width of each indicator is the largest 1 second throughput seen up to that point for that technology Classic Bluetooth Bluetooth low energy or 802 11 where the 1 second throughput is calculated anew each time another packet is received The 1 second throughput indicator will never exceed this width but the average throughput indicator can For example the image below has a large average throughput because the Selected radio button was selected and a single packet was selected and the duration in that case is the duration of the single packet which makes for a very small denominator in the throughput calculation When the average throughput exceeds the indicator width a plus sign is drawn at the right end of the indicator Packets CO All Selected O Viewport Awg throughput bits Figure 4 49 Average throughput indicators show a plus sign when the indicator width is exceeded E Cti Figure 4 50 A single selected packet 107 ComProbe 802 11 User Manual Chapter 4 Capturing
134. d pay attention to when doing the search The analyzer pays attention to any control signal with a check mark Click on a box to place a check mark next to a control signal Click again to uncheck the box By default the analyzer searches all control signals which means all boxes start out checked For example if you are only interested in finding changes in RTS and CTS you would check those two boxes and uncheck all the other boxes This tells the analyzer to look only at the RTS and CTS lines when running the search The other signals are ignored The control signals types include USB Pin 1 USB Pin 2 USB Pin 3 USB Pin 4 RS232 Request to Send RTS RS232 Clear to Send CTS RS232 Data Set Ready DSR RS232 Data Terminal Ready DTR RS232 Carrier Detect CD RS232 Ring Indicator RI Click here to learn more about the Breakout Box and Pins 1 4 Searching for event where The first three options are all fairly similar and are described together These options are searching for an event where o One or more control signals changed o One or more control signals changed from off to on o One or more control signals changed from on to off Searching for an event where one or more signals changed means that the analyzer looks at every control signal that you checked and see if any one of those signals changed state at any time 150 Chapter 5 Navigating and Searching the Data ComProbe 802 11 Us
135. der Parameters 2 Select the Security tab There are three types of types of encrypted data on the security tab each one selectable via a radio button e WPA2 Wi Fi Protected Access and WEP Wired Equivalent Privacy data that is transmitted over a 802 11 communications link There are two values you have to enter for the WPA2 and WEP to be decrypted properly Click here to see additional WEP settings in the I O Settings dialog e The Bluetooth alternative MAC PHY AMP enables Bluetooth to support data rates up to 24Mbps by using additional wireless radio technologies e The third method is to specify the pre shared key in its raw hex forum a 32 byte hex number Depending on which Encrypted Data type you select the options for entering data on the rest of the dialog varies AVDTP Security L2CAP RFCOMM A2DP USB IPX TCP UDP Encrypted Data WPA2 WPA2 SSID Bluetooth AMP Passkey Pre Shared Key papag Bluetooth AMP BR EDR Link Key Pre Shared Key Raw Hex Key WEP SSID Passkey Figure 3 19 Security WPA2 WEP Decoder Tab 33 Chapter 3 Configuration Settings ComProbe 802 11 User Manual Set the WPA2 or WEP parameters 1 Select the WPA2 radio button This activates the WPA2 and WEP text boxes 2 There are two values to set for the WPA2 and WEP keys a WEP SSID Service Set Identifiers the station ID of the 802 11 communications link b WEP Passkey the shared passkey phrase used in communicati
136. dn t be visible A tooltip can be displayed for each dot Dots can be removed for greater visibility of the plots when data points are crowded together Show Zoom Figure 4 58 Dots Toggled On and Off 112 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual Overlapping Dots F Classic Bluetooth top _4 Bluetooth low enegy middle Fi 802 11 bottom Overlapping Dots F Cursor placed on visilble A bottom dot to display 802 11 1S L packetinformation pa E F t 380 859 bits s 802 11 Packet Throughput 3 120 bits 8 192 ms 802 11 Packets in Overall Packet Range 16 785 16 787 Data Point 85 Right click to zoom to data point TOUTS 2 Mm Figure 4 59 Overlapping Dots Information Display 4 4 2 18 Zoomed Throughput Graph Clicking the Show Zoom button Show Zoom displays the Zoomed Throughput Graph above the Throughput Graph The Zoomed Throughput Graph shows the details of the throughput in the time range covered by the viewport in the Throughput Graph Both the Zoomed Throughput Graph and the Timelines are synchronized with the Throughput Graph s viewport The viewport is sized by dragging one of its sides or by using one of the other zooming techniques listed in the Zooming subsection in the Timelines section 113 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data ka Tamasa War ee aba ba a ef Bes a pas anda
137. e This option is for SCO eSCO only 6 Select the Add Silence packets to insert the silence packets dummy packets for the reserved empty slots into the extracted file If this option is not selected the audio packets are extracted without inserting the silence packets for the reserved empty slots Pi Note This option is for SCO eSCO only 131 ComProbe 802 11 User Manual 7 Select Extract A Save As dialog appears The application will assign a file name and file type for each profile you select in Step 1 above The file type varies depending on the original profile A separate file for each profile will be created but only for those profiles with available data 8 Select a location for the file 9 Click Save The Data Extraction Status and Audio Extraction Status dialogs appear When the process is complete the dialogs display what files have been created and where they are located Data Extractio Bip dala extraction stated Fie C Document and Settings ab Deskbop date extachorn Bip dala extraction brashed Bpo dala extraction stared Fide C Documents ond Settings Yab Deskbop data extiachon Epp dala edrachon brushed Fip data extraction started Fie Wocumernt and Seftegs bab O shop dels extraction Ae Fip dala edracbon Grushed Fip data edraction started File Documents and Settings tab Deskiog data extractontl Fip dala edracton frihed Fip dala esdraction started File Documents and Sethngs
138. e if a data point has a duration of 0 1 s and a bit count of 100 it will have a throughput of 1 000 bits s and the y axis labels will be consistent with this 108 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual Figure 4 52 Throughput Graph y axis labels 4 4 2 12 Excluded packets Retransmitted packets and bad packets packets with CRC or Header errors are excluded from throughput calculations 4 4 2 13 Tooltips Placing the mouse pointer on a data point shows a tooltip for that data point The tooltip first line shows the throughput the throughput type packet or payload and the technology Subsequent lines show the bit count the duration of the data point the packet range of that duration only packets of the applicable technology from that packet range are used for the throughput calculation and the number of the data point which is O for the first data point in each line a 1 F i i 2 880 bits s Packet T Bit Count 286 Pal Duration 100 ms Classic Packets in Packet Range 15 455 15 437 f Data Point 12 Figure 4 53 Data point tooltip The Throughput graph tool tips can be shown in the upper left corner of your computer screen to provide an unobstructed view Refer to Relocating Tool Tips 4 4 2 14 Discontinuities A discontinuity is when the timestamp going from one packet to the next either goes backward by any amount or forward by more than 4 01 s This value is u
139. e 125 Figure 4 79 A negative discontinuity AA 126 Figure 4 80 A positive discontinuity _ 22 22 2 eee eee cece cee cece eee eee eeeeeeeeeees 127 Figure 4 81 Timeline header with discontinuity eee cece ec cece eee eee ceeceeceeeeeees 127 Figure 4 82 Timeline duration footer with discontinuity 22 ee eee eee cee cece ee eeeeee 127 Figure 4 83 High speed Bluetooth packets have a blue frequency box and a two tone tool tip 128 Figure 4 84 Missing Channel Numbers Message in Timelines eee cece ee eceeeeeeee 128 Figure 4 85 802 11 Statistics Window _ 2 ieee cece cece cece ccc e cee ceeecceccecceceeceeceees 134 Figure 4 86 802 11 Edit Menu for Copying _ 2 a 137 X ComProbe 802 11 User Manual Figure 5 1 Find Dialog __ _ 0 222 2 ee aaa aaa LaaLa LLL LaL LaL LLL LaaLa aaa L aana 139 Figure 5 2 Find Decode Tab Search for String a 140 Figure 5 3 Find Decode Tab Side Restriction _ 2 22 2 eee cece ce eee cee ccc cece eeeeeeeeees 141 Figure 5 4 Find Pattern Tab _ 0 22 2 a 143 Figure 5 5 Find Pattern Tab Side Restrictions e eee eee cece cece cece ee ceeeeeees 143 Figure 5 6 Find by Time tab a 144 Figure 5 7 Find Go To tab _ 2 222 2 eee ccc cece eee cece eee eee e eee aooo annann 146 Figure 5 8 Find Special Events tab c ccccceiuy ecu wsace
140. e been lost There are several things that you can do to try and solve this problem e Use capture filters to filter out data you don t need to see Capture filters reduce the amount of data processed by the analyzer Ethernet Only e Close all other programs that are doing work while the analyzer is running Refrain from doing searches in the Event Display window or other processor intensive activities while the analyzer is capturing data e Timestamping takes up processor time primarily not in timestamping the data but in writing the timestamp to the file Try turning off timestamping from the Timestamping Options window e For Driver Buffer Overflows change the size of the driver buffer This value is changed from the Advanced System Settings Go to the Control window and choose System Settings from the Options menu Click on the Advanced button Find the value Driver Receive Buffer Size in Operating System Pages Take the number listed there and double it e The analyzer s number one priority is capturing data updating windows is secondary However updating windows still takes a certain amount of processor time and may cause the analyzer to lose data while the window is being updated Some windows require more processing time than others because the information being displayed in them is constantly changing Refrain from displaying data live in the Event Display and Frame Display windows The analyzer can capture data with no windows o
141. e eee eceeceeceeeceeceees 107 Figure 4 51 Coexistence View Throughput Graph eee ee cece ce cee eee e eee eeeeeeeee 108 Figure 4 52 Throughput Graph y axis labels 2 2 2 2 o eee cece cee cece ccc ccc e cee eceeeeeceeceeees 109 Figure 4 53 Data point tooltip 22 lec cece ee ce eee cece ence e eee eeeeeeeeeeees 109 Figure 4 54 A negative discontinuity 22 20 o eee cee cee ce cece cece cece cece ececeeceeceececeeceeees 110 Figure 4 55 Three positive discontinuities 2 22 22 c eee cece cece cece cece eee eeeeeeeees 110 X ComProbe 802 11 User Manual Figure 4 56 Throughput Graph Viewport 222 2 cece eee cece cee eee eee cece eee eeeeeeeee 111 Figure 4 57 Small Timeline and large Throughput Graph after pressing the Swap button 112 Figure 4 58 Dots Toggled On and Off 22 ieee cee cee cece cece eee cece eee eeeeeeeeeeees 112 Figure 4 59 Overlapping Dots Information Display a 113 Figure 4 60 Synchronized Zoomed Throughput Graph and View Port eee eee 114 Figure 4 61 Zoomed Throughput Graph Largest Value Snaps to Top 22 2 2 eee eee eee eee 114 Figure 4 62 Zoomed Throughput Graph Freeze Y keeps the y axis constant _ 115 Figure 4 63 802 11 Source Address Dialog 2 22 eee ccc ee eee e cece cece e cece eeeceeeeeeceeees 116 Figure
142. e future simply double click the shortcut to start the analyzer in the associated protocol Supporting Documentation The Frontline ComProbe Protocol Analysis System directory contains supporting documentation for development Automation DecoderScript application notes user documentation Quick Start Guides and User Manual and maintenance tools 2 2 2 ComProbe 802 11 Air Sniffing Data Capture Methods Select Data Capture Method 3 59 802 11 As Sniffing 802 11 Ar Sriffing QO an 3E Virtual Sniffing KJ FTS Side KO IEEE11073c Connected Devices e 802 11 o Requires one ComProbe 802 11 hardware o Captures 802 11 data on the selected channel e 802 11 Double o Requires two ComProbe 802 11 hardware m m Ig Oem SOZ 11 usa POWER mara ct 37 9 oe 802 11 Bi our DIGITAL VO use POWER Proves Chapter 2 Getting Started ComProbe 802 11 User Manual e 802 11 Triple o Requires three ComProbe 802 11 hardware e 802 11 with USB o Requires one ComProbe 802 11 and one ComProbe USB hardware e 802 11 with USB and SD o Requires one ComProbe 802 11 one ComProbe USB and one ComProbe SD hardware 2 2 3 Bluetooth 802 11 Air Sniffing Multiple Technologies Aggregated ComProbe Protocol Analysis System can capture Bluetooth and 802 11 simultaneously and display results in the Coexistence View Select Data Capture Method 23 los Multiple Technologies Aggregated a Requires one ComProbe BPA 600 ha
143. e instance of the Automation Server Figure 3 Automation Server ona Single PC Figure 4 Automation Server Using Two PCs A 2 2 Writing Automation Script Automation scripting is done by persons with knowledge of TCP socket communications The process automation is achieved by writing a client application which talks over a TCP network socket connection with the ComProbe Automation Server Delivered in your ComProbe installation package is a sample script SampleClient tcl This script is located in your installation directory This is typically located at C Program Files x86 Frontline Test System II Frontline ComProbe Protocol Analysis System your version Development Tools On 32 bit Windows or Windows XP the root installation folder is C Program Files 196 Appendicies ComProbe 802 11 User Manual The sample script is written in TCL Tool Command Language TCL is an open source cross platform programming language More information is available at www tcl tk The script can be translated to any general purpose programming language such as C as long as you retain the program structure The sample script is divided into the following sections identified by FEEEEEEEEE EEE EEE EEE EEE EEE EEE EEE EEE EEE EE ETE EEE EEE EE EEE EE EEE Procedures comments FESESSSESSSR RRS EESESER ES ESES ETERS EASA EER RESTATE AREA TEE TF 1 Procedures 2 Command Wrappers 3 FTE Base namespace vars 4 Start of
144. e second Event Display updates as new data is captured Event Display is synchronized with the Frame Display and Mesage Sequence Chart dialogs Selecting a byte in Event Display will also select the related frame in the Frame Display and the related message in the Message Sequence Chart 4 3 2 The Event Display Toolbar A Home Brings the Control window to the front a Home Brings the Control window to the front Start Capture Begins data capture to disk Stop Capture Closes a capture file and stops data capture to disk ay NG Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual ll lt BEB BBEU SSP pe HO Save Prompts user for a file name If the user supplies a name a cfa file is saved Clear Discards the temporary file and clears the display Lock In the Lock state the window is locked so you can review a portion of data Data capture continues in the background Clicking on the Lock icon unlocks the window Unlock In the Unlock state the screen fills in the data captured since the screen lock and moves down to display incoming data again Clicking on the Unlock icon locks the window Duplicate View Creates a second Event Display window identical to the first Frame Display framed data only Brings up a Frame Display with the frame of the currently selected bytes highlighted Display Capture Notes Brings up the Capture Notes window where you can view or add notes to the capture f
145. e the dialogs 4 6 Statistics 4 6 1 Statistics Window The Statistics window supplies basic information about the data on the network When reviewing a capture file the Statistics window shows a summary of the data in the file 133 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data J Statistics 802 11 Edit View Graph Options Window Help Os HR session Resettable Capture File Statistics for the session Frames 7 Sec Chars 7 Sec Curent fF Curent 9 523 Average fz Average 14 592 Peak 248 Peak oo 72 292015 9 36 40 AM 22972015 9 35 59 AM Data Frames 76 423 Chars 15 428 951 Events 15 641 827 Buffer Information Errors nal Driver Butter Overflow 0 FCS Errors 46 463 Frames dropped by device 0 For Help Press F1 Figure 4 85 802 11 Statistics Window To open the Statistics window click the Statistics icon nt on the Control window toolbar or choose Statistics from the View menu on the Control window The analyzer monitors the network and collects statistics all the time even when data is not actively being captured Activate the Lock icon to stop the window from updating Click the Unlock icon IS again to resume updating The analyzer continues to monitor network traffic while the Statistics window is locked so you may see the numbers jump right after updating has resumed reflecting all the statistics that were gathered while the window was locked 134
146. ear as shown in the example image below This selection is a predetermined filter based on your selection In the example frame 6471 is associated with Link 4 so the predetermined filter assumes that you may want create a connection filter for that link Clicking on Connection Filter Link 4 will filter in Link 4 frames without opening all the drop down menus 91 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data B Frame ASCII Hex Fram Delta Timestamp a EEE 289 4 13 2015 10 55 This is the Summary Pane Copy Selection to Clipboard Save Selection Go To Show Frame Size Column Show Timestamp Column Show Delta Column Add New Column Help Remove New Column Change Column Order Help Restore Default Columns TU Add Bookmark Export Connection Filter gt Classic Al 1 Connection Filter Link 4 Bluetooth low energy k Link Provide L CAP Rules Set Subsequent Decoder Parameters Show Hidden Panes b Figure 4 40 Connection Filter from frame selection right click Creating from any Frame Display window A Connection Filter can be created from any open Frame Display window and the filtering will always be applied to the original captured data set 4 4 1 13 2 2 Connection Filter Display Once you have selected which connections to filter in another Frame Display will open The origin
147. econd layer is green the third layer is pink etc The protocol name for each layer in the Decode pane is in the same color Note that the colors refer to the layer not to a specific protocol In some situations a protocol may be in two different colors in two different frames depending on where it is in the stack You can change the default colors for each layer Red is reserved for bytes or frames with errors In the Summary pane frame numbers in red mean there is an error in the frame Also the Errors tab is displayed in red This could be a physical error in a data byte or an error in the protocol decode Bytes in red in the Radix Character Binary and Event panes mean there is a physical error associated with the byte 4 4 1 12 2 Changing Protocol Layer Colors You can differentiate different protocol layers in the Decode Event Radix Binary and Character panes 1 Choose Select Protocol Layer Colors from the Options menu to change the colors used The colors for the different layers is displayed 2 Tochange acolor click on the arrow next to each layer and select a new color 3 Select OK to accept the color change and return to Frame Display Select Cancel to discard any selection Select Defaults to return the highlight colors to the default settings Protocol Layer Color Selector Layer 1 bc LayerS Abed ff OK Layer Abed Abedi Laver 10 EEE Cancel HEHE Layer 3 Abed BURR Layer 11 E H Defaults
148. ection between a slave and a master or an advertising packet Connection filtering displays only the frames protocols summary details and events for the selected connections S Note Connection Filters are not persistent across sessions 4 4 1 13 2 1 Creating a Connection Filter In the Frame Display there are four ways to create a connection filter From the Frame Display Filter menu Click on the Frame Display Filter menu Connection Filter selection From the drop down menu select Classic or Bluetooth low energy The options are 89 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data e Classic Bluetooth o All will filter in all Classic Bluetooth frames You are in effect filtering out any Bluetooth low energy frames and are selecting to filter in all the Classic Bluetooth links o Links displays all the master slave links You can select only one link to filter in The selected link will filter in only the frames associated with that link e Bluetooth low energy o All will filter in all Bluetooth low energy frames You are in effect filtering out any Classic Bluetooth frames and are selecting to filter in all Bluetooth low energy access addresses o Access Addresses displays all the low energy slave device s access address You can select only one access address to filter The selected link will filter in only the frames associated with that access address e 802 11 o All will filter in all 802 11 f
149. ections are complete 84 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual 4 4 1 13 1 5 Defining Node and Conversation Filters There are two steps to using Node and Conversation display filter Define the filter conditions and then apply the filter to the data set The analyzer combines both filter definition and application in one dialog 1 8 Click the Display Filters icon Y on the Frame Display window or select Apply Modify Display Filters from the filter menu to open the Set Condition dialog box From the Select each frame combo box choose frames with the conversation as the initial condition Select an address type IP MAC TCP UDB from the Typecombo box The address type selection populates both Address combo boxes with node address in the data set that match the type selection Select a node address from the first Address combo box Choose a direction arrow from the direction box The left arrow filters on all frames where the top node address is the destination the right arrow filters on all frames where the top node address is the source and the double arrow filters on all frames ae where the top node address is either the source or the destination If you want to filter on just one node address skip step 7 and continue with step 8 If you want to filter on traffic going between two address nodes i e a conversation select a node address from the second Address combo box
150. ed while the other continues to update 55 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data 4 3 7 Data Formats and Symbols 4 3 7 1 Switching Between Viewing All Events and Viewing Data Events By default the analyzer on the Event Display dialog shows all events that include e Data bytes e Start of frame e End of frame characters e Data Captured Was Paused Click on the Display All Events icon to remove the non data events Click again to display all events See List of all Event Symbols on page 58 for a list of all the special events shown in the analyzer and what they mean 4 3 7 2 Switching Between Hex Decimal Octal or Binary On the Event Display window the analyzer displays data in Hex by default There are several ways to change the radix used to display data Go to the Format menu and select the radix you want A check mark next to the radix indicates which set is currently being used Bookmarks Hexadecimal Decimal Octal Binary v ASCI 7 bit ASCI EBCDIC Baudot Figure 4 15 Format Menu lAn event is anything that happens on the circuit or which affects data capture Data bytes control signal changes and long and short breaks are all events as are I O Settings changes and Data Capture Paused and Resumed The base of a number system Binary is base 2 octal is base 8 decimal is base 10 and hexadecimal is base 16 56 Chapter 4 Capturing and Analyzing Data ComProbe 802 11
151. eeee 66 4 4 1 4 Physical vs Logical Byte Display _ 2 022 c eee ce ec eee eee cece ccc eee eeeeeeeeees 67 AA La Sorne RAMOS oreroraa E EEEIEE 67 4 4 1 6 Frame Display Find 2 2 20 cece cece cece cece cece eee eececeeeeeeeeees 67 4 4 1 7 Synchronizing the Event and Frame Displays 22 eee ee cece cece ccc ceccecceeeeees 69 4 4 1 8 Working with Multiple Frame Displays 222 ce eee cece cee cece eee cee eeeeee 70 4 4 1 9 Working with Panes on Frame Display 2 22 22 e eee eee eee c ee eee ccc cceeceeeceeeeeees 70 4 4 1 10 Frame Display Byte Export cece ccc ee ce cece cece cece eeeeeeeees 70 4 4 1 11 Panes in the Frame Display 22 occ ec ce eee eee c eee e eee eceeceeeeeeeeeees 72 4 4 1 11 1 Summary Pane ec ee ee eee cee eee eee 72 4 4 1 11 2 Customizing Fields in the Summary Pane a 75 4 4 1 11 3 Frame Symbols in the Summary Pane 2 22 eee eee cece eee cece ee eeeee 76 4 4 1 11 4 Decode Pane occcceccncceccuchusdvedeescesecekedaccudecdcdes ctuceseecceloesnedecueskeencader 76 4 4 1 11 5 Radix or Hexadecimal Pane cee ce ee ee ee ee ee ee eee eee 77 4 4 1 11 6 Character Pane eae aes ec centa bcancesen came snes sen ecee meee res oeaencoreredees 11 4 4 1 11 7 Binary Pane cee cee cee cece eee e eee c ee neeeeeeee 78 aa EVN M PANG 2onn AA ees aceensoanceaeouesaedaere aenaboveacwe 78 4 4 1
152. eeeeees 52 4 3 3 Opening Multiple Event Display Windows 2 0 0 a 54 4 34 Calculating CRES Or FESS ga aka 3t a ma O GU an AGA NA a ag TA a aa NG RT Aa EEE 54 ComProbe 802 11 User Manual 4 3 5 Calculating Delta Times and Data Rates 55 4 3 6 Switching Between Live Update and Review Mode 2 cece cece cece cccccececeeeceeees 55 4 3 7 Data Formats and Symbols _ 2 222 2 ee eee cece cee cee eee eee eee eee cece eee eeeeeeeeeeees 56 4 3 7 1 Switching Between Viewing All Events and Viewing Data Events _ 0 56 4 3 7 2 Switching Between Hex Decimal Octal or Binary 2 22 22 eee eee eee eee eee eeee 56 4 3 7 3 Switching Between ASCII EBCDIC and Baudot 22 ee cece cece cece eee eee 57 4 3 7 4 Selecting Mixed Channel Sides _ _ 2 2 e cece eee cece eee c eee cece eee eee ee eeeeeeeeeeeee 57 4 3 7 5 Listof all Event Symbols ad aaa en cediode aa ucuuude we eve AA AG Naa 58 LS GLO SILO ia aoe ee ee re eee ane ANG ANAN TE a NG Ah AT nA 60 4 4 Analyzing Protocol Decodes cece cece cece cece cece cece ee eceececeeceeceeceeeeceeeees 60 4 4 1 Frame Display WindOW aaa aNG done AG eect sete GAGA NLNG GRASYA 60 4 4 1 1 Frame Display Toolbar a 63 4 4 1 2 Frame Display Status Bar cece cece ec ooa ooo ooann onnon 66 4 4 1 3 Hiding and Revealing Protocol Layers in the Frame Display 2 0 eeee
153. een filled For example if you are capturing to disk and have specified a 200 Kb capture file the bar graph tells you how much of the capture file has been used When the graph reaches 100 capture either stops or the file begins to overwrite the oldest data depending on the choices you made in the System Settings e Utilization Events The second half of the status bar gives the current utilization and total number of events seen on the network This is the total number of events monitored not the total number of events captured The analyzer is always monitoring the circuit even when data is not actively being captured These graphs allow you to keep an eye on what is happening on the circuit without requiring you to capture data 2 3 4 Frame Information on the Control Window Frame Decoder information is located just below the Status bar on the Control window It displays two pieces of information For Help Press F1 e Frame Decoder 233 fps displays the number of frames per second being decoded You can toggle this display on off with Ctrl D but it is available only during a live capture e 132911 displays the total frames decoded e 100 displays the percentage of buffer space used 13 Chapter 2 Getting Started ComProbe 802 11 User Manual 2 3 5 Control Window Menus The menus appearing on the Control window vary depending on whether the data is being captured live or whether you are looking at a cfa file The follow
154. elect the Enable MAC Address Capture Filters check box e You can select deselect which filters are active by checking unchecking the Enable checkbox in the first column in the table e You can also select to ignore Management Control Data and Reserved frame types by selecting one or more the checkboxes 21 Chapter 3 Configuration Settings ComProbe 802 11 User Manual Settings Status Capture Filters Firmware Update I Enable MAC Address Capture Filters Move Address Up Move Address Down Frame types to ignore Management Control Data Reserved Figure 3 5 802 11 I O Settings Capture Filters Tab To create a key select one of the following options e Add New Address displays a text box where you can enter the address Add MAC Address e g 0014bf72b3a6 m Field In MAC Frame M Address 1 Receive Address 2 Transmit Indude Exdude jv Address 3 MW Address 4 Iv Implicit Transmit e g Transmitting an ACK OK Cancel Figure 3 6 802 11 I O Settings Capture Filters Add New Address Dialog 1 Enter a MAC Address in the text field 2 Select the Include radio button to only capture packets with this MAC address wi Is ComProbe 802 11 User Manual Chapter 3 Configuration Settings 3 Select the Exclude radio button to capture packets with other filters but not ones with this MAC address 4 Select one or more check boxes to identify which fields in the MAC Frame
155. en received at all and the Bath Auto button is selected the 2 4 GHz timeline is shown Auto 4 4 2 24 Coexistence View low energy Devices Radio Buttons LE Devices The radio buttons in the LE Devices group where LE means Bluetooth low energy Configured specify both visibility and inclusion in throughput calculations of Bluetooth low energy packets CD All The All radio button shows and uses all Bluetooth low energy packets The Configured radio button shows and uses only Bluetooth low energy packets which come from a configured device 11 7 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data 4 4 2 25 Coexistence View Legend Selected Retrans mit Bad Packet Can t Decrypt Invalid IFS fe Discontinuity E Unknown cnown Click on any bold entry above to enable navigation Figure 4 65 Coexistence View Legend The legend describes the color coding used by packets in the timelines Selecting a packet in a timeline highlights the applicable entries in the legend An entry is bold if any such packets currently exist Clicking on a bold entry enables the black legend navigation arrows in the toolbar for that entry 4 4 2 26 Coexistence View Timelines Ta F 1 ria TA Ba TE EGF pop ki AG Pa A ID BA Faa Figure 4 66 Coexistence View Timelines The Timelines show Classic Bluetooth Bluetooth low energy and 802
156. er 3 Configuration Settings ComProbe 802 11 User Manual ie window 2 Click the Open Template a icon in the toolbar and select the 4 Template F desired template from the pop up list The system displays the content Ea of the selected template in the Initial Connections list at the top of the P Frontlinel dialog Frontline 3 Click the OK button to apply the selected template and decoders e Frontline 1 settings and exit the Set Initial Decoder Parameters dialog Fronthne the 3 2 1 2 Adding a New or Saving an Existing Template ne Frontlines Add a Template A template is a collection of parameters required to completely decode communications between multiple devices This procedure adds a template to the system and saves it for later use 1 Click the Save Er button at the top of the Set Initial ig Decoder Parameters dialog to display the Template Manager dialog Name To Save Template As Cancel Frontline4 2 Enter aname for the new template and click OK Cunartip Saved Tamelates For Ths Object Tyee Frontline The system saves the template and closes the Template Prorat i Frontined CM Manager dialog Hontined 3 Click the OK button on the Set Initial Decoder Parameters window to apply the template and close the dialog Save Changes to a Template This procedure saves changes to parameters in an existing template 1 After making changes to parameter settings in a user defined template c
157. er Manual o If you want to look at just one control signal m Check the box for the signal m Uncheck all the other boxes m Choose to search for an event where one or more signals changed m The analyzer notes the state of the selected signal at the point in the buffer where the cursor is search the buffer and stop when it finds an event where RTS changed state m Ifthe end of the buffer is reached before an event is found the analyzer tells you that no matches were found e Searching for events where control signals changed state from off to on or vice versa is most useful if the signals are usually in one state and you want to search for occasions where they changed state For example O O O O If DTR is supposed to be on all the time but you suspect that DTR is being dropped Tell the analyzer to look only at DTR by checking the DTR box and unchecking the others Do a search for where one or more control signals changed from on to off The analyzer would search the DTR signal and stop at the first event where DTR dropped from on to off e Searching for an Exact State To search for an exact state means that the analyzer finds events that match exactly the state of the control signals that you specify O First choose to search for an event where your choices exactly describe the state This changes the normal check boxes to a series of radio buttons labeled On Off and Don t Care for each control signal Cho
158. er Manual Chapter 4 Capturing and Analyzing Data Table 4 16 802 11 Statistics Window Menus continued About ComProbe Provides a pop up showing the version and release information Protocol Analysis Frontline contact information and copyright information System Support on the Web Opens a browser to fte com technical support page Statistics Window Toolbar Statistics Window Toolbar Icons eon pesenan D Changes the focus to the Control Window Reset the statistics tables amp Display Lock Unlock Timestamp Format 4 6 2 Session Resettable and Capture File Tabs The Session Resettable and Capture File tabs are parts of the Statistics and Errors windows Session Resettable Capture Fie Information about all data collected since the analyzer was started is shown in the Session tab The Session tab cannot be reset in this sense it is like the odometer on a car The odometer on a car shows you all the miles driven since the car was built and the Session tab shows you all the data collected since the analyzer was started If you think of the Session tab as the odometer then the Resettable tab is the trip odometer It can be reset and allows you to record statistics for a new trip In this way you can effectively start a new session without having to restart the analyzer If the Reset button E was pressed during the capture then the numbers on this tab differs from the numbers on the
159. er in the text box Find Previous Occurrence Moves to the previous occurrence of the value in the Frame Display Find Find Next Occurrence Moves to the next occurrence of the value in the Frame Display Find Cancel Current Search Stops the current Frame Display Find 65 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data Table 4 4 Frame Display Toolbar Icons continued i a ee ae Summary Drop Down Box Lists all the protocols found in the data in the file This box does not list all the protocol decoders available to the analyzer merely the protocols found in the data Selecting a protocol from the list changes the Summary Summary pane to display summary information for that protocol When a low energy predefined Named Filter like Nulls and Polls is selected the Summary drop down is disabled Summary Non Captured Info z Text with Protocol Stack To the right of the Summary Layer box is some text giving the protocol stack currently in use Summary Non Captured Info Baseband with Auto traverse in the buffer is the sorted order Therefore the last frame in the buffer may not have the last frame Note If the frames are sorted in other than ascending frame number order the order of the frames number 4 4 1 2 Frame Display Status Bar The Frame Display Status bar appears at the bottom of the Frame Display It contains the following information e Frame s Sele
160. er may have some data with a timestamp and some data without When doing a search by timestamp the analyzer ignores all data without a timestamp e The raw timestamp value is the number of 100 nanosecond intervals since the beginning of January 1 1601 This is standard Windows time 5 1 4 Using Go To Searching with Go To allows you to go to a particular frame or event or to move through the data X number of events or frames at a time You can move either forward or backwards through the data To access the Go To function 1 Opena capture file to search 2 Open the Event Display PD or Frame Display window 3 Click on the Find icon AA or choose Find from the Edit menu 4 Click on the Go To tab of the Find dialog 5 The system displays the Find dialog with the Go To tab selected Note The tabs displayed on the Find dialog depend on the product you are running and the H content of the capture file you are viewing Ska Decode Patten Tine GoTo Special Ewerdt Bookmark a Frame Humbe Merve Eorratd Ci Daa Event Humber Move Back Al Everts Numba gis Figure 5 7 Find Go To tab To go to a particular frame 1 Select the Frame Number radio button 2 Type the frame number in the box 3 Click the Go To button 146 Chapter 5 Navigating and Searching the Data ComProbe 802 11 User Manual 4 To move forward or backward a set number of frames type in the number of frames you want to move
161. er windows every window has a Home icon a that brings the Control window back to the front Just click on the Home icon to restore the Control window 11 Chapter 2 Getting Started ComProbe 802 11 User Manual When running the Capture File Viewer the Control window toolbar and menus contain only those selections needed to open a capture file and display the About box Once a capture file is opened the analyzer limits Control window functions to those that are useful for analyzing data contained in the current file Because you cannot capture data while using Capture File Viewer data capture functions are unavailable For example when viewing Ethernet data the Signal Display is not available The title bar of the Control window displays the name of the currently open file The status line below the toolbar shows the configuration settings that were in use when the capture file was created 2 3 1 Control Window Toolbar Toolbar icon displays vary according to operating mode and or data displayed Available icons appear in color while unavailable icons are not visible Grayed out icons are available for the ComProbe hardware and software configuration in use but are not active until certain operating conditions occur All toolbar icons have corresponding menu bar items or options Table 2 2 Control Window Toolbar Icon List eee ee Open File Opens a capture file ernment DOT be reviewed and saved but no new data can be cap
162. ers Dialog aa 89 Figure 4 37 Connection Filter from the Frame Display Menu 00 eee eee eee eee eeeeeee 90 Figure 4 38 Connection Filter from the Frame Display Toolbar right click 2 2 00 90 Figure 4 39 Connection Filter from the Frame Display Pane right click _ 22 22 2 22 2 2 91 Figure 4 40 Connection Filter from frame selection right click 00 0 020 e eee eens 92 Figure 4 41 Front Display Filtered on Access Address Ox8e89bed6 _ 2 22 eee eee eee eee 93 Figure 4 42 Unfiltered Capture File with Classic low energy and 802 11 Uu AA 94 Figure 4 43 Connection Filter selecting All 802 11 frames front 2 22 eee e eee eee eee 94 Figure 4 44 Frame Display Quick Filtering and Hiding Protocols Dialog 2 2222 2 eee eee ee 95 Figure 4 45 Coexistence View Window 2 2 22 c eee eee ee cece ec eee cece cece cece ee ceeeeceeceeeeee 96 Figure 4 46 Coexistence View Toolbar a 103 Figure 4 47 Coexistence View Throughput Indicators 02 2 l eee eee eee eee ee eee 105 Figure 4 48 Throughput Graph viewport 20 22 eee eee cee cece ce cece cece cece ee ceeceeceeceeeeeees 107 Figure 4 49 Average throughput indicators show a plus sign when the indicator width is exceeded 107 Figure 4 50 A single selected packet _ 2 22 2 cece cece cee ccc ccc cece cece
163. es Protocol Stack Set Initial Decoder Parameters Set Subsequent Decoder Parameters Automatically Request Missing Decoding Information Figure 3 15 Select Set Initial Decoder Parameters from Control window The Set Initial Decoder Parameters window opens with a tab for each decoder that requires parameters Set Initial Decoder Parameters Template Io LAVDTP Securty Figure 3 16 Tabs for each decoder requiring parameters e Each entry in the Set Initial Decoder Parameters window takes effect from the beginning of the capture onward or until redefined in the Set Subsequent Decoder Parameters dialog Override Existing Parameters The Set Subsequent Decoder Parameters dialog allows the user to override an existing parameter at any frame in the capture where the parameter is used If you have a parameter in effect and wish to change that parameter e Select the frame where the change should take effect e Select Set Subsequent Decoder Parameters from the Options menu and make the needed changes You can also right click on the frame to select the same option 30 ComProbe 802 11 User Manual Chapter 3 Configuration Settings Options Window Help Directories ww Check for New Releases at Startup Side Names Protocol Stack Set Initial Decoder Parameters Set Subsequent Decoder Parameters Automatically Request Missing Decoding Information
164. es 2 23 00 00 29 8 42072012 3 54 59 50800 a 23 00 00 00 0 4072012 3 54 59 50800 Connection Filter k Classic i 23 00 00 00 0 4 10 2012 3 54 59 50800 Bluetooth low energy g 23 00 00 00 0 4 10 2012 3 54 59 50800 Set Subsequent Decoder Parameters 802 11 gt 33 00 00 00 7 4 10 2012 3 54 58 50621 33 00 00 00 0 4 10 2012 3 54 58 90690 Hide This Pane 8 33 00 00 00 0 4 10 2012 3 54 58 80758 g 33 00 00 00 1 42072012 3 54 58 93496 40 33 00 00 00 0 4 10 2012 3 54 59 93565 11 33 nnnan nan ma 4 19 9019 D RA RO QCA Figure 4 42 Unfiltered Capture File with Classic low energy and 802 11 When the Frame Display with the filtered 802 11 data set appears only the Protocol Tabs for 802 11 are present and the tabs for Classic Bluetooth and Bluetooth low energy have been filtered out Frame Display BTAmp80211FTPwLE cfa o 8 X File Edit View Format Filter Bookmarks Options Window Help 22u YIS DI UUASL NE fe ra MoeERBCeCe s Find z A A Summary Data 3 be LE ADV AdvData Field Truncated or Not Present Unfiltered Info Errors LE BB Baseband LMP PreConnection FHS Bluetooth FHS L2CAP AMP Manager SDP OBEX FTP PAG Gan ig Non Captured Info pe Channel Index 38 2426 MHz LE BB LE PKT LE ADY Meets Predefined Filter Criteria for BT low energy devices z Receive Status Received without errors 802 11 Radio 802 11 MAC LLC 802 2 SNAP
165. et Conditions Self Configuring Based on Frame Range 2 Select Include or Exclude to add filtered data or keep out filtered data respectively 3 Select the initial condition for the filter from the drop down list 4 Set the parameters for the selected condition in the fields provided The fields that appear in the dialog box are dependent upon the previous selection Continue to enter the requested parameters in the fields provided until the condition statement is complete 5 Click OK The system displays the Save Named Condition dialog Provide a name for the filter condition or accept the default name provided by the system and click OK Prohibited characters are left bracket right bracket and equal sign The Set Condition dialog box closes creates a tab on the Frame Display with the filter name and applies the filter The filter also appears in the Quick Filtering and Hiding Protocols dialog When a display filter is applied a description of the filter appears to the right of the toolbar in the Frame Display windows Notes e The system requires naming and saving of all filters created by the user e The OK button on the Set Condition dialog box is unavailable grayed out until the condition selections are complete e When you have multiple Frame Display windows with a display filter or filters those filter do not automatically appear in other Frame Display windows You must use the Hide Reveal feature to display a filter
166. ettings window click the Start Up button 3 Choose one of the options to determine if the analyzer starts data capture immediately on starting up or not 174 Chapter 7 General Information ComProbe 802 11 User Manual Program Start Up Options On piogram start wap Ce Don t start caphunng immediately O Silai capturing bo a file immeckateky O Start capturing immediately bo the folowing ile Figure 7 3 Start Up Options dialog e Don t start capturing immediately This is the default setting The analyzer begins monitoring data but does not begin capturing data until clicking the Start Capture icon on the Control Event Display or Frame Display windows e Start capturing to a file immediately When the analyzer starts up it immediately opens a capture file and begins data capture to it This is the equivalent of clicking the Start Capture icon The file is given a name based on the settings for capturing to a file or series of files in the System Settings window e Start capturing immediately to the following file Enter a file name in the box below this option When the analyzer starts up it immediately begins data capture to that file If the file already exists the data in it is overwritten 7 1 2 Changing Default File Locations The analyzer saves user files in specific locations by default Capture files are placed in the My Capture Files directory and configurations are put in My Configurations The
167. figured for this session and uses these packets for throughput calculations Packets From Performs the same function as the LE Devices Configured radio button Configurated Devices Only Show All Low When checked shows in the 2 4 GHz Timeline all Bluetooth low energy packets Energy captured in this session and uses these packets for throughput calculations Performs Packets the same function as the LE Devices All radio button 98 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual Table 4 7 Coexistence View Format Menu Selections continued Large When checked the Throughput Graph appears in the bottom half of the window Throughput swapping position with the timeline Graph j When not checked the Throughput Graph appears in its default position at the top of the window Performs the same function as clicking the Swap button See Coexistence View Throughput Graph on page 108 Show Dots in When checked displays dots on the Throughput Graph Dots are different sizes for each Throughput technology so that they reveal overlapping data points which otherwise wouldn t be Graph Dots visible A tooltip can be displayed for each dot Performs the same function as the Dots Reveal button See Coexistence View Throughput Graph on page 108 Overlapped Data Points Show Zoomed When checked dispalys a Zoomed Throughput Graph above the Throughput Graph The Throughput Zoomed Throughput Graph sho
168. first frame with the complete header it cannot decode subsequent frames with partial header information A magenta triangle indicates that a bookmark is associated with this frame Any comments associated with the bookmark appear in the column next to the bookmark symbol 4 4 1 11 4 Decode Pane The Decode pane aka detail pane is a post process display that provides a detailed decode of each frame im transaction sometimes referred to as a frame The decode is presented in a layered format that can be expanded and collapsed depending on which layer or layers you are most interested in Click on the plus sign to expand a layer The plus sign changes to a minus sign Click on the minus sign to collapse a layer Select Show All or Show Layers from the Format menu to expand or collapse all the layers Layers retain their expanded or collapsed state between frames Protocol layers can be hidden preventing them from being l displayed on the Decode pane Right click on any protocol layer Hide L2CAP Layer In All Frames and choose Hide protocol name from the right click menu Expand All Nodes Provide AVDTP Rules In a USB transaction all messages that comprise the transaction are shown together in the detail pane The color coding that is 76 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual applied to layers when the detail pane displays a single message is applied to both layers and messages when the det
169. forms the same function as the gt Next Error Packet button 102 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual Table 4 9 Coexistence View Navigate Menu Selections continued Hot kev selection Descriptio First Legend When clicked selects the first legend packet in the session and displays it in the Packet Timeline This control is enabled when a bold packet type is selected in the Coexistence View Legend Refer to Coexistence View Legend on page 118 Performs the same functions as the la First Legend Packet button Previous When clicked selects the first prior legend packet in time from the current selection and Legend displays it in the Timeline This control is enabled when a bold packet type is selected in Packet the Coexistence View Legend Refer to Coexistence View Legend on page 118 Performs the same functions as the da Previous Legend Packet button Next Legend When clicked selects the next legend packet in time from the current selection and Packet displays it in the Timeline This control is enabled when a bold packet type is selected in the Coexistence View Legend Refer to Coexistence View Legend on page 118 Performs the same functions as the Next Legend Packet button Last Legend When clicked selects the last legend packet in the session and displays it in the Packet Timeline This control is enabled when a bold packet type is selected in the Coexistence View Legend
170. frontline gt ommunicationg Faster 802 11 a b g n PROTOCOL ANALYZER ComProbe User Manual Revision Date 12 15 2015 ComProbe 802 11 User Manual Copyright 2000 2015 Frontline Test Equipment Inc FTS Frontline Frontline Test System ComProbe Protocol Analysis System and ComProbe are registered trademarks of Frontline Test Equipment Inc The following are trademarks of Frontline Test Equipment Inc The Bluetooth SIG Inc owns the Bluetooth word mark and logos and any use of such marks by Frontline is under license All other trademarks and registered trademarks are property of their respective owners ComProbe 802 11 User Manual Contents Chapter 1 ComProbe Hardware amp Software 222 22 ieee cee eee eee eee eens 1 1 1 WV ele IS manual ose eee tee scene eee oa eee nase ee neneeu sees EEEE ENNE EE rAr eiS r TENER 2 1 2 Computer Minimum System Requirements 22 eee eee eee eee cee cece eee oanrin 2 1 3 SOLUWare instalat ad a saa AA aaa A AE SE 2 a LEAD a ee ee ee 2 1 3 2 From Download La a adan mana kas aata aa saad HG GG NAN ANT NING ONE SUIT eoe saae Eeen bini 3 Chapter 2 Getting Started 4 2 1 802 11 HardWare sees ae ate ree ee NAKADALI nA ese DA ees Se re ate NATA hd 4 2 1 1 Connecting Powering the ComProbe 802 11 _ 2 0 2 2 lee eee eee eee eee eeeeeee 5 DAs setine Up TOF PROD SWING taco tacccset cea eee at se aden eee Aa ese esas 6 2 2 Data Capture Methods __ 2 22 22 lei e
171. fying or Deleting a Bookmark o eee eee eee eee eee cece eeeeee 156 5 2 2 Displaying All and Moving Between Bookmarks cece eee e ccc cececceceececceceeeee 157 Chapter 6 Saving and Importing Data u 2 22 oe eee cc eee eee e cece ec eeeeeeees 159 6 1 Saving YOUN AA 159 6 1 1 Savi g the Entire Capture Plea na saa NAGANA DA mka ndn NOEL Nan bd Nena anG sudededuxediuaes seseestawe 159 6 1 2 Saving the Entire Capture File with Save Selection 0H cece cece ccc ceeceeceeeeeee 160 6 1 3 Saving a Portion of a Capture File e cece cece cece ee eceeeeeees 161 6 2 Adding Comments to a Capture File eee ee cece cee eee ce eee cece cence eeeeeceeeeeees 161 6 3 Confirm Capture File CFA Changes eee eee eee cee ce eee cece eee e eee cece eeeeeeeeeeeeees 162 6 4 Loading and Importing a Capture File 22 22 ole a 162 6 4 1 Loading a Capture File ee cee ces eee een a a se 162 6 4 2 Importing Capture Files 20 22 occ cc cc ec eee dkr Ssn cece eee eeeeeceeceeceeeeeees 163 Ba IN oe wis cet ed Be wees eee ie eb ee dns aa twat ees ete sie NAA bot eseee Hah aminan 163 6 5 1 Printing from the Frame Display HTML Export 2 2 c cece cece cece cece cece cece ececececeees 163 6 5 2 Printing from the Event Display 22 22 eee eee ccc eee eee cece cece eeeeeeeeees 166 Sasha AA 167 6 6 1 Frame Display Export a 167
172. g the mouse pointer on a packet displays a tooltip color coded by technology that gives detailed information 120 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual Et Diii Packet 15 457 Classic DM1 8172011 10 41 15 835783 AM Beginning Timestamp 671772011 10 41 15 836053 AM Ending Timestamp Duration 270 us Hole Master Channel 36 438 MHz Clock 0s0113e610 Packet Status CAC Error L2CAP Flow Go Logical Link ID L CAP start or no fragmentation SEUN 1 ARON 0 Payload Length 9 534 of 17 bytes max Decrpted by Bluetooth ComProbe No Bad packet data 0x 45 02 02 00 Figure 4 72 A tool tip for a Classic Bluetooth packet 4 42 28 Relocating the tool tip You can relocate the tool tip for convenience or to see the timeline or throughput graph unobstructed while displaying packet information In the Format menu select Show Tooltips in Upper Left Corner of Screen and any time you mouse over a packet the tool tip will appear anchored in the upper left corner of the computer screen To return to viewing the tool tip adjacent to the packets deselect the tool tip format option in the menu 121 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data l Coexistence View le Sniffer_Capture_ GEB6900AA 2 cfa File Zoom Navigate Help l w Show Packet Number w Show Packet Type Show Packet Subtype Hide Packet Text Auto Hide Packet Text When Duration gt 31
173. g throughput Ni Throughput Over Tings Thi bits s ee O Packet Payload Both Timeline 5GHz 2 4GHz Both selected Auto Retransmit Bad Packet Can t Decrypt LE Devices Configured Click on any bold entry above to enable navigation 2 4 GHz Channels For Help Press F1 Figure 4 45 Coexistence View Window 4 4 2 1 Coexistence View Menus The following tables describe each of the Coexistence View Menus Coexistence View Capture 2015 12 02_104121 cfa 3 File Format Zoom Navigate Spectrum Help F Table 4 6 Coexistence View File Menu Selections Reset Exit Table 4 7 Coexistence View Format Menu Selections Show Packet When checked the packet number shows below the packet in the Viewport Number 6 758 209 96 Chapter 4 Capturing and Analyzing Data Selecti Show Packet Type ComProbe 802 11 User Manual Table 4 7 Coexistence View Fomai venu SELERA continued c r rip Ji O When checked the packet type shows below the packet in the Viewport oa Show Packet When checked the packet subtype shows below the packet in the Viewport if applicable Subtype Hide Packet Text Auto Hide Packet Text When Duration gt 31 25 ms Increase Auto Hide Packet Count from 4 000 to 20 000 May Be Slow When checked hides any text shown below the packet in the Viewport Applies the text shown by the Show Packet Number Show Packet
174. h Speed Bluetooth High speed Bluetooth packets where Bluetooth content hitches a ride on 802 11 packets have a blue frequency range box instead of orange as with regular 802 11 packets both are shown below and the tool tip has two colors orange for 802 11 layers and blue for Bluetooth layers 127 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data Custer Tue Epcos Dais Sata Got Dana Carmel 3 ST Ar ah 20 bir an Pasar BAG kay Dharma Tepe AG Ng Fopke Lrt NET baket Ta Adder DEE Ni bado GA Casiinakon Adhar ORS la i THAP Figure 4 83 High speed Bluetooth packets have a blue frequency box and a two tone tool tip 4 4 2 34 Coexistence View No Packets Displayed with Missing Channel Numbers S Note This topic applies only to Classic Bluetooth Captured packets that don t contain a channel number such as HCI and BTSnoop will not be displayed When no packets have a channel number the Coexistence View Throughput Graph and Timelines will display a message Packets without a channel number such as HCI won t be shown Sheezeoe FG oes Kha Pees tie a Chie Gur buih 3d HET al kak PAN Paka wi a Channa number such as HET wai ba shown Pagka ah p chang number mh a HOT Nal be haan Figure 4 84 Missing Channel Numbers Message in Timelines 128 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual 4 4 2 35 High Speed Live View When
175. hark If it is displaying V4 a different message then you can use the Reset button on the Wi Fi Datasource window or select Reset E or in the Sniffing menu to get back to this message f File Sniffing View Help l N M Reset i O _ Shown inactive Stat Y Stop Shown inactive Figure 4 7 Wi Fi Datasource Toolbar 42 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual We Dataoure File View Help Start o Stop Hardware Settings 10 Settings Reset Figure 4 8 Wi Fi Datasource Sniffing Menu Once the Wi Fi Datasource starts capturing packets and sending them to Wireshark you can pause and resume capturing using the Stop and Start toolbar buttons on the Wi Fi Datasource toolbar or the Sniffing menu Note that the Restart command on the Wireshark window does not function The workaround is to click Reset E on the Wi Fi Datasource then click Start on the Wireshark Capture menu Also the Wireshark Capture Filters menu does not function but you can use IO Settings menu on the Wi Fi Datasource window or Sniffing menu for setting filters Known Issues with Wireshark e In Real Time capture mode when you select Update list of packets in real time check box in the Capture Options dialog if you move the Wireshark window around on the desktop or click on anything on the Wireshark window it freezes the desktop You can unfreeze it by bringing up Windows Task Manager by pressing C
176. he Edit menu 4 Click on the Special Events tab of the Find dialog Note The tabs displayed on the Find dialog depend on the product you are running and the Si content of the capture file you are viewing 147 ComProbe 802 11 User Manual Chapter 5 Navigating and Searching the Data Decode Paten Time GoTo Speca Even Bookmark Abod Begin Char Sinp C Broken Frame T Butter O vesiiow C Capture Paused C Capture Resumed Cl Dropped Franss C Dropping Sync C End Char Stnp C End of Frame C Flow Control Active C Flow Control Inactree Frame Recognize Changed 110 Settings Changed Figure 5 8 Find Special Events tab 5 Check the event or events you want to look for in the list of special events Use Check All or Uncheck All buttons to make your selections more efficient 6 Click Find Next and Find Previous to move to the next instance of the event Not all special events are relevant to all types of data For example control signal changes are relevant only to serial data and not to Ethernet data For a list of all special events and their meanings see List of all Event Symbols on page 58 5 1 6 Searching by Signal Searching with Signal allows you to search for changes in control signal states for one or more control signals You can also search for a specific state involving one or more control signals with the option to ignore those control signals whose states you don t care about The ana
177. he Summary pane Filtered out frames are not exported e Selected Frames export is the same as All Frames export except that only frames selected in the Summary pane will be exported Byte Export Z8 Export raw bytes from the currently selected filter tab All Frames O Selected Frames Figure 4 24 Byte Export dialog Click the OK button to save the export Clicking the Cancel button will exit Byte Export 3 The Save As dialog will open Select a directory location and enter a file name for the exported frames file 71 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data J Save As 28 Goj E Desktop gt Search Desktop p Organize v New folder J v Se Fani Name 5 Size Item type BO Desktop F G9 Libraries Mm Downloads B John W Trinkle Recent Places Computer Gu Network G9 Libraries Ji Frontline ComProb File folder Documents Ji Frontline ComProb File folder at Music di Frontline ComProb File folder t Pictures d Frontline ComProb File folder a Subversion YI a Filename ByteLevelExport 1 bt pi Save as type Text Files txt X amp Hide Folders Save Cancel Figure 4 25 Save As dialog Click on the Save button The exported frames are in a text file that can be opened in any standard text editing application The header shows the export type the capture file name the selecte
178. hing the Data ComProbe 802 11 User Manual e Absolute An absolute timestamp search means that the analyzer searches for an event at the exact date and time specified If no event is found at that time the analyzer goes to the nearest event either before or after the selected time based on the Go to the timestamp selection e Relative A relative search means that the analyzer begins searching from whatever event you are currently on and search for the next event a specific amount of time away 1 Select Absolute or Relative 2 Select the date and time using the drop down lists for Month Year Day Hour Minute Second 1 10000000 I Note Month and Year are not available if you select Relative 3 When you have specified the time interval you want to use click on the Go To Move Forward or Move Backward buttons to start the search from the current event Note When you select Absolute as Search for Go To is available When you select H Relative as Search for Move Forward or Move Backwardis available Go to the timestamp On or before On or after The analyzer searches for an event that matches the time specified If no event is found at the time specified the analyzer goes to the nearest event either before or after the specified time Choose whether to have the analyzer go to the nearest event before the specified time or after the specified time by clicking the appropriate radio button in the Go to the timestamp box If you
179. hoose Find from the Edit menu 4 Click on the Decode tab of the Find dialog Note The tabs displayed on the Find dialog depend on the product you are running and the content H of the capture file you are viewing Decode Patten Time Search For Sting In Decode C Search Foe All Errore O Search Foe Fiame ST O Search Foe Indoemation Frames Figure 5 2 Find Decode Tab Search for String 140 Chapter 5 Navigating and Searching the Data ComProbe 802 11 User Manual Oecede Patter Time GoTo 5pecid Event Signal Emor Bor O Search For Sting In Decode C lgnere cate C3 Seach For All Emors Hele O Search For Frame Enos Oink O Search Far Information Frames Sade Revinchon Search vahou regad bo data ongin C Search onb these sides w OTE m OE Figure 5 3 Find Decode Tab Side Restriction There are several options for error searching on the Decoder tab e Search For String in Decoder allows you to enter a string in the text box You can use characters hex or binary digits wildcards or a combination of any of the formats when entering your string Every time you type in asearch string the analyzer saves the search The next time you open Find the drop down list will contain your search parameters e Search for All Errors finds frame errors as well as frames with byte level errors such as parity or CRC errors e Search for Frame Errors Only finds frame specific errors
180. ht or double click the protocol to move it to the right 3 To remove a protocol from the stack double click it or select it and click the left arrow button 4 Ifyou need to change the order of the protocols in the stack select the protocol you want to move and click Select a protocol stack 802 11 MAC 802 11 Radio Air Sniffer BlueCore Serial Protocol BCSP from Cambridge Silicon Radio with autotraverse Bluetooth HC UART H4 with autotraverse Bluetooth HEI USB with autotraverse Bluetooth virtual transport with autotraverse Fictitious Protocol with autotraverse H4D5 with autotraverse jwt_Protocol LE BB MWS Wireless Coexistence Interface 2 HE SS LA LR Ee Remove Selected Item From List Curent Protocol Stack Select a Protocol Stack Protocol Decode Stack All additional stack layers Baseband can be determined AVDTP automatically paa There are no additional stack layers Choose one at a time by double clicking or by using the select button AMP Manager ARP AVRCP Browsing Baseband BCCMD BIP BlueCore Serial Protocol 7 4 JIM t on the Move Up and Move Down buttons until the protocol is in the correct position 5 The lowest layer protocol is at the top of the list with higher layer protocols listed underneath Auto traversal Have the analyzer Determine Higher Layers If you need to define just a few layers of the protocol stack and the remaining layers can be deter
181. i O ma a N D m th o N gt Interval Menu The Interval drop down menu is used to set the duration of each data point in the Zoomed Throughput graph The default setting is Auto that sets the data point interval automatically depending on the zoom level The other menu selections provide the ability to select a fixed data point interval Selecting from a larger to a smaller interval will display more data points Should the number of data points exceed 30 000 no data is displayed and a warning will appear in the graph area 4 4 2 19 Zoom Cursor Selecting the Zoom Cursor button changes the cursor to the zoom cursor TX The zoom cursor is controlled by the mouse wheel and zooms the viewport and thus the Timelines and the Zoomed Throughput Graph The zoom cursor appears everywhere except the Throughput Graph which is not zoomable in which case the scroll cursor is shown When the zoom cursor is in the Timelines or Zoomed Throughput Graph zooming occurs around the point in time where the zoom cursor is positioned When the zoom cursor is outside the Timelines and the Zoomed Throughput Graph the left edge of those displays is the zoom point 4 4 2 20 Comparison with the Bluetooth Timeline s Throughput Graph The Throughput Graphs for Classic Bluetooth in the Coexistence View and the BluetoothTimeline can look quite different even though they are plotting the same data The reason is that the Coexistence View uses times
182. ial condition when running searches that rely on finding events where error conditions changed The analyzer searches until it finds an event where error conditions changed or it reaches the end of the buffer at which point the analyzer tells you that there are no more events found in the buffer If you are searching for an exact match the analyzer asks you if you want to continue searching from the beginning of the buffer Searching for Exact Error Conditions 153 ComProbe 802 11 User Manual Chapter 5 Navigating and Searching the Data To search for an exact state means that the analyzer finds events that exactly match the error conditions that you specify kb Find BPA500 cfa Select the This exactly describes the search for event where aaa state radio button y One or more of these changed ma i nc Nex One or more of these occurred gq N18 Ex9cy Pas Find Previous One or more of these was off zarile HIS atalia Find Previous e This changes the normal check boxes to a Hep i elp series of radio buttons labeled On Off On Off Don t Care AA and Don t Care for each error Reserved OC Side Restriction Search without regard to data origin o On means that the error occurred Search only these sides o Off means that the error did not E Slave occur Master o Don t Care means that the analyzer ignores that
183. ile Add Modify Bookmark Add a new or modify an existing bookmark Display All Bookmarks Shows all bookmarks and lets you move between bookmarks Find Search for errors string patterns special events and more Go To Opens the Go To dialog where you can specify which event number to go to CRC Change the algorithm and seed value used to calculate CRCs To calculate a CRC select a byte range and the CRC appears in the status lines at the bottom of the Event Display Mixed Sides Serial data only By default the analyzer shows data with the DTE side above the DCE side This is called DTE over DCE format DTE data has a white background and DCE data has a gray background The analyzer can also display data in mixed side format In this format the analyzer does not separate DTE data from DCE data but shows all data on the same line as it comes in DTE data is still shown with a white background and DCE data with a gray background so that you can distinguish between the two The benefit of using this format is that more data fits onto one screen Character Only The analyzer shows both the number hex binary etc data and the character ASCII EBCDIC or BAUDOT data on the same screen If you do not wish to see the hex characters click on the Character Only button Click again to go back to both number and character mode Number Only Controls whether the analyzer displays data in both character and number format or just
184. in use 14 ComProbe 802 11 User Manual Chapter 2 Getting Started Table 2 4 Control Window View Menu Selections Live amp Event Display Ctri Opens the Event Display window for analyzing byte level Capture Shift E data File Frame Display Ctrl Opens the Frame Display window for analyzing protocol level Shift M data Ctrl Opens the Statistics Window that shows information about Shift S packet throughput Coexistence View Opens the Coexistence View window that can simultaneously display Classic Bluetooth Bluetooth low energy and 802 11 packets and thourghput Wi Fi Error Opens the Wi Fi Error Statistics window that displays the Statistics number of packet errors Table 2 5 Control Window Edit Menu Selections Capture Ctrl Opens the Notes window that allows the user to add File Shift O comments to a capture file Control Window Live Menu Selections Live Start Capture Shift F5 Begins data capture from the configured wireless devices Stop Capture Stops data capture from the configured wireless devices Shift Clears or saves the capture file F10 AG Chapter 2 Getting Started ComProbe 802 11 User Manual Table 2 6 Control Window Options Menu Selections Live amp Hardware Settings 0 Classic Capture File 1 Bluetooth low energy I O Settings 0 Classic 1 Bluetooth low energy System Settings Alt Opens the System Settings dialog for configuring capture Enter files
185. ince it is the first device we heard in the connection event Because there is potential clock drift since the last connection event 74 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual we cannot use the absolute timing to correct this error there would still be cases where we get it wrong Therefore we always assign 1 to the first packet in a connection event So even though it is rare there are connection events where packets sent by the slave device are labeled 1 and packets sent by the master are labeled 2 Finally in a noisy environment it is also possible that the sniffer does not capture packets in the middle of a connection event If this occurs and the sniffer cannot determine the side for the remaining packets in that connection event the side is labeled U for unknown 4 4 1 11 2 Customizing Fields in the Summary Pane You can modify the Summary Pane in Frame Display Summary pane columns can be reordered by dragging any column to a different position Fields from the Decode pane can be added to the summary pane by dragging any Decodepane field to the desired location in the Summary pane header If the new field is from a different layer than the summary pane a plus sign is prepended to the field name and the layer name is added in parentheses The same field can be added more than once if desired thus making it possible to put the same field at the front and back for example
186. ing All prints up to 1000 frames from the buffer Choosing Selection prints only the frames you select in the Frame Display window 6 Selecting the Delete File deletes the temporary html file that was used during printing 7 Click the OK button Frame Display Print Preview The Frame Display Print Preview feature provides the user with the option to export the capture buffer to an html file The maximum file size however that can be exported is 1000 frames If you chose Print Preview the system displays your data in a browser print preview display with options for printing such as page orientation and paper size You can also use your Printer Preferences dialog to make some of these selections When printing your data the analyzer creates an html file and prints the path to the file at the bottom of the page This file can be opened in your browser however it may appear different than the printed version 1 Select Print Preview from the File menu on the Frame Display window to display the Frame Display Print Preview Frame Display Print Preview Provide information to export data trom the currently selected filter tab Include Detail Section Summary No decode section Data Bytes 5 All layers Selected layers only Frame Range All Selection 2MB SMTP CHAD 7 Delete File Reset The Selected Layer Note Browser print options may affect whether any gray background i printed See Help for info OK Cancel
187. ing Options button or click the click the Timestamping Options icon f3 from the Event Display O window 2 Go to the Display Options section at the bottom of the window and find the Display Relative Timestamps checkbox 3 Check the box to switch the display to relative timestamps Remove the check to return to absolute timestamps Note The options in this section affect only how the timestamps are displayed on the screen not Si how the timestamps are recorded in the capture file e Display Raw Timestamp Value shows the timestamp as the total time in hundred nanoseconds from a specific point in time e Display Relative Timestamps shows the timestamp as the amount of time that has passed since the first byte was captured It works just like a stop watch in that the timestamp for the first byte is 0 00 00 0000 and all subsequent timestamps increment from there The timestamp is recorded as the actual time so you can flip back and forth between relative and actual time as needed e Selecting both values displays the total time in nanoseconds from the start of the capture as opposed to a specific point in time e Selecting neither value displays the actual chronological time When you select Display Relative Timestamp you can set the number of digits to display using the up or down arrows on the numeric list 180 Chapter 7 General Information ComProbe 802 11 User Manual 7 1 4 5 Displaying Fractions of a Second 1 Choose
188. ing tables describe each menu Table 2 3 Control Window File Menu Selections Closes Live mode capture file and the framing is different in the new stack you need to reframe in order for the protocol decode to be correct See Reframing on page 49 Removes start of frame and end of frame markers from your data SeeUnframing on page 49 Recreate This option is available when you are working with decoders If Companion File you change a decoder while working with data you can recreate the frm file the companion file to the cfa file Recreating the frm file helps ensure that the decoders will work properly Reload Decoders The plug ins are reset and received frames are decoded again Live amp Open Capture File Opens a Windows Open file dialog at the default location Capture Public Documents Frontline Test Equipment My Capture File Files Capture files have a cfa extension Capture Go Live Returns to Live mode File Reframe If you need to change the protocol stack used to interpret a Saves the current capture or capture file Opens a Windows Save As dialog at the default location Public Documents Frontline Test Equipment My Capture Files Exit ComProbe Shuts down the ComProbe Protocol Analysis System and all Protocol Analysis open system windows System Recent capture files A list of recently opened capture files will appear The View menu selections will vary depending on the ComProbe analyzer
189. ingle shared view The ComProbe BPA 600 ComProbe 802 11 and ComProbe HSU analyzers have ProbeSync capability allowing timestamp synchronization of captured data Synchronizing the clock for these ComProbe devices used in combination requires attention to the sequence of hardware connection It is important to remember the following key points e ComProbe devices are connected serially in a daisy chain fashion The combined length of all cables in the chain cannot exceed 1 5 meters 4 5 ft e The master ComProbe device provides the clock to the other devices All other ComProbe devices are slaves and received the clock from the master device e On ComProbe devices with an OUT and IN connector the function of these connectors is dependent on if they area master or a slave o master device OUT connector provides the clock to all slave devices IN connector is not used o slave device IN connector receives the clock from the OUT connector of the prior device in the chain The OUT connector is just a pass through connector on a slave device e BPA 600 is always the master device and the first device in the chain if being used e HSU is always the last slave device in the chain if being used e HSU maximum capture data rate is 6 Mbit sec Connecting ComProbe BPA 600 ComProbe 802 11 and ComProbe HSU devices in ProbeSync takes place in the following steps 1 Connect the ComProbe BPA 600 OUT connector to the ComPro
190. l 1 Select I O Settings from the Configure menu on the Wi Fi Device Scanner window AWi Fi Scanner VO SenM Scan channels from 2417 MHz 2 vi upto 5190 MHz 33 Channel listen time 1000 ms Send probe requests to discover SSID if necessary No Cancel Help Figure 3 13 Wi Fi Device Scanner I O Settings Dialog 2 Scan Channels from Pick a lower and upper limit to scan a specific subset of frequencies By default all channels are selected Choosing a subset of frequencies to scan saves time and can be used when the user is interested in scanning only a certain range of frequencies 3 Enter an amount in msecs for Channel listen time Channel listen time is how long ComProbe 802 11 will listen on a channel to discover devices before moving on to the next channel 4 Select Yes or No to choose whether to send a probe sync request Sometimes an Access Point will intentionally not send it s SSID in a beacon to conceal it s identity Selecting Yes for this option will send the MAC address the SSID will be part of the Probe Response it sends back 5 Select OK to save the options and close the dialog or Cancel to close the dialog without saving your choices 3 1 2 6 5 Device Scanner RSSI Values The 802 11 specification does not provide a relationship between the RSSI value and the actual power value Here are the definitions from the specification 1 RSSI in FHSS PHY The RSSI is an optional paramete
191. l Lee iy a f Baan i DOEN E200 a i RR Deccds Pang Pait Tire H ade ee lala Coie ee manga dance Lisa ae ai magand Barbari Li PreConnection FH Bbh FHS LICAP S0 ADOdb ADT er Sar AVDTP Sagrang Headset Hon Cagetes esd Bede PUTA sga E Few Fra pg Pat Ba TE LL Fil LAGER Pi SGN ARGH lm T maf ba i Mos oF D Del Lt Ge Ge i summary Fang T miii E B i noe oe G bai Lt fe a i Leo W ar DOOD LF o Fy Lz Gn Ga L g LDAP fka Ga HT a Dims i WHI Li 1 Loga Link i LILAR din a ro bhagair Da Pin mooo pi WHT Lz g la Pagitan Levey H Ba a DTO a DHI LZ Ge Di 0 Deeceppded bp Mason Co nka Ta Later L i TTT Radix Pane foc L Ba a Fa if i bd is HA 3 aaa pa i Character Pane TFLURAL LA a ia a ta 8 3E Ob Jd j I 73 Event Pane if a1 Mm Talia FHP aaa 2 Pre a ic lL by Figure 4 20 Frame Display with all panes active Frame Display Panes The Frame Display window is used to view all frame related information It is composed of a number of different sections or panes where each pane shows a different type of information about a frame e Summary Pane The Summary Pane displays a one line summary of each frame for every protocol found in the data and can be sorted by field for every protocol Click here for an explanation of the symbols next to the frame numbers e Decode Pane The Decode Pane displays a detailed decode of the highlighted frame Fields selected in the Decode Pane h
192. lay Filter menu above Frame Display TestFile5limmer cfa File Edit View Format Live Filter Bookmarks Options Window Help Q B flee Se 48 dl VES sa O A AA Sle ki Al All ii Frame 6 471 Ma Connection Filter j Classic eband RR P E Errors Bluetooth low energy Link 0 nad 3 Baseband Show Hidden Panes gt eet Vara penus E Baseband PreConnection FHS SCO eSCO z Header Length 11 4 Header Version 3 B Framet Pr Access Add CAC BDADOR Fram Delta Timestamp ae as 17 4 13 2015 10 55 32 661 mot Ld 1 mam Aaa oa A aF on CAL AY Figure 4 38 Connection Filter from the Frame Display Toolbar right click 90 Chapter 4 Capturing and Analyzing Data From the Frame Display panes Right click anywhere in a Frame Display pane and select Connection Filter in the pop up menu The procedure ComProbe 802 11 User Manual for creating a connection filter are identical as described in From the Frame Display Filter menu above Frame Display TestFileSlimmer cta File Edit View Format Liwe Filter Q G oo nH sa Frame 6 471 Master Len 259 Errors i Baseband Packet Status CRC Error 20 5 Baseband Header Length 11 Header Version 3 faa Linde d This is the Decode Pane Copy Selection to Clipboard Select Entire Frarne Expand Decode Pane Collapse All Nodes Expand All Nodes Connection Filter Provide L2CAP
193. lick the Save button at the top of the Set Initial Decoder Parameters window to display the Template Manager dialog 2 Ensure that the name of the template is listed in the Name to Save Template As text box and click OK 3 The system displays a dialog asking for confirmation of the change to the existing template Click the Yes button The system saves the parameter changes to the template and closes the Save As dialog 4 Click the OK button on the Set Initial Decoder Parameters window to apply the template and close the window 3 2 1 3 Deleting a Template 1 After opening the Set Initial Decoder Parameters window click the Delete button in the toolbar The system displays the Template Manager dialog with a list of saved templates 33 ComProbe 802 11 User Manual Chapter 3 Configuration Settings 2 Select click on and highlight the template marked for deletion and click the Delete button The system removes the selected template from the list of saved templates 3 Click the OK button to complete the deletion process and close the Delete dialog 4 Click the OK button on the Set Initial Decoder Parameters window to apply the deletion and close the dialog 3 2 2 Wi Fi Security Decoder Parameters On the Set Initial Decoder Parameters dialog the security tab allows specifying a key for software decryption of 802 11 frames To access this dialog 1 Inthe Options menu on the Control window and choose Set Initial Deco
194. list of all the saved filters Set Condition 5 ES Currently Active Condition Filters Include Exclude Condition ADOR where the protocol Baseband field LT ADDR Is Egu AND In the range 178 to 43 Delete selected condtion Figure 4 35 Set Condition Dialog in Advanced View 2 Select the desired condition from the filter definition 3 Click the Delete Selected Line fye icon 4 Edit the Boolean operators and parentheses as needed 5 Click OK The system displays the Save Named Condition dialog Ensure that the filter name is displayed in the text box at the top of the dialog and click OK If you choose to create an additional filter then provide a new name for the filter condition or accept the default name provided by the system and click OK The Set Condition dialog box closes and the system applies the modified filter Note When a display filter is applied a description of the filter appears to the right of the toolbar in the Frame Display windows Note The OK button on the Set Condition dialog box is unavailable grayed out until the condition selections are complete Renaming a Display Filter 1 Select Rename Display Filters from the Filter menu in the Frame Display D window to open the Rename Filter dialog The system displays the Rename Filter dialog with a list of all user defined filters in the Filters combo box 88 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 U
195. ly selected packet is selected and displayed in the Timeline Performs the same function as the O Previous Packet button When clicked the first packet occurring next in Right Arrow time from the currently selected packet is selected and displayed in the Timeline Performs the same function as the Next Packet button When clicked selects the first prior retransmitted packet from the current selection and displays it in the Timeline Performs the same function as the a Previous Retransmitted Packet button When clicked selects the next retransmitted packet from the current selection and displays it in the Timeline Performs the same function as the Next Retransmitted Packet When clicked selects the first prior invalid B uetooth low energy IFS packet from the current selection and displays it in the Timeline Performs the same function as the a Previous Invalid IFS Packet button When clicked selects the next invalid B uetooth low energy IFS packet from the current selection and displays it in the Timeline Performs the same function as the Dp Next Invalid IFS Packet button When clicked selects the first prior packet Ctrl Left Arrow with an error from the current selection and displays it in the Timeline Performs the same function as the a Previous Error Packet button When clicked selects the next packet with an Ctr Right Arrow error from the current selection and displays it in the Timeline Per
196. lyzer takes the current selected byte as its initial condition when running searches that rely on finding events where control signals changed To access the search by time function 1 Opena capture file to search 2 Open the Event Display NG or Frame Display P window 3 Click on the Find icon Ah or choose Find from the Edit menu 4 Click on the Signal tab of the Find dialog 148 Chapter 5 Navigating and Searching the Data ComProbe 802 11 User Manual Note The tabs displayed on the Find dialog depend on the product you are running and the content H of the capture file you are viewing Search for eveni where re ai mode of these Cy One oF more of these changed from off bo on DES apn Pns if Pan 4 Figure 5 9 Find Signal tab Find 51A 161 cla Decode Pattem Time GoTo Special Events Signal Emo Bor 4 Search for avert where GG One of more of these Cj One cr move of ihare changed changed bom on bo off Find Freviou cy One ce more of these Cy This exactly lana changed trom off bo on describes the Hae mor ARTS cts F D5A FOTA Fco FR 149 ComProbe 802 11 User Manual Chapter 5 Navigating and Searching the Data Figure 5 10 Find Signal Tab You will choose one qualifier Searching for event where then choose one or more control signals Control Signals The section with the check boxes allows you to specify which control signals the analyzer shoul
197. m the Options menu on the Control window 18 ComProbe 802 11 User Manual Chapter 3 Configuration Settings Settings Status Capture Filters Fimware Update ComProbe 202 11 Serial Number 0102120052 Channel 2412 MHz 1 Scanner Extension Channel lo FCS Fiter AI Fames ts Figure 3 2 802 11 I O Settings Dialog There are several things to remember about I O Settings e The I O Settings are specific to the device selected in the Hardware Settings e Two 802 11 devices attached to a computer have different settings e Changing the settings changes the devices default settings e fa parameter is changed e g Channel 1 is changed to 6 the new setting appears the next time the I O Settings dialog is opened for the device e The settings are saved when the OK button is pressed 3 1 2 1 Settings 19 Chapter 3 Configuration Settings ComProbe 802 11 User Manual Settings Status Capture Filters Fimware Update ComProbe 202 11 Serial Number 0102120052 Channel 2412 MHz 1 Scanner Extension Channel lo FCS Filter Al Frames Figure 3 3 802 11 I O Settings Settings Tab The Settings dialog allows you to change and observe basic configuration values These include the Channel Extension Channel FCS Filter and Capture Type e Channel Select the channel from the drop down list Channels have been extended to the 5Ghz range e Extension allows you to extend the range of channels
198. mers Guide is delivered with your installation package and the latest version is always available for download on FTE com support documents in ComProbe Automation Should you need additional assistance with the Automation Server contact Frontline s technical support team Copyright 2015 Frontline Test Equipment Inc Author John Trinkle Publish Date 8 May 2014 The Bluetooth SIG Inc owns the Bluetooth word mark and logos and use of such marks is under license 203 Appendicies Index 802 11 I O Settings 18 A Aborted Frame 174 About Display Filters 80 Absolute Time 180 Add a New or Save an Existing Template 32 Adding a New Predefined Stack 48 Adding Comments To A Capture File 161 Advanced System Options 173 Apply Capture Filters 82 Apply Display Filters 80 83 85 ASCII 57 character set 182 viewing data in 57 ASCII Codes 182 ASCII Pane 77 Auto Sizing Column Widths 75 Automatically Request Missing Decoding Information 50 Automatically Restart 171 Automatically Restart Capturing After Clear Capture Buffer 171 Automatically Save Imported Capture Files 171 Autotraversal 48 50 Bar Charts 137 Baudot 57 170 Baudot Codes 183 Begin Sync Character Strip 59 Binary 56 143 205 ComProbe 802 11 User Manual Binary Pane 78 BL 184 Bookmarks 156 157 Boolean 83 88 Broken Frame 58 BS 184 Buffer 160 171 Buffer Overflow 171 Buffer Tabs 136 Buffer File Options 171 Byte 54 56 78 182 Sear
199. mined based on the lower layers 1 Clickthe All additional stack layers can be determined automatically button 2 If your protocol stack is complete and there are no additional layers click the There are no additional stack layers button 48 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual 3 If you select this option the analyzer uses the stack you defined for every frame Frames that do use this stack are decoded incorrectly Save the Stack 1 Click the Add To Predefined List button 2 Give the stack a name and click Add In the future the stack appears in the Protocol Stack List on the first screen of the Protocol Stack wizard Remove a Stack 1 Select it in the first screen and click Remove Selected Item From List 2 If you remove the stack you must to recreate it if you need to use it again Note If you do not save your custom stack it does appear in the predefined list but applies to the H frames in the current session However it is discarded at the end of the session 4 2 3 Reframing If you need to change the protocol stack used to interpret a capture file and the framing is different in the new stack you need to reframe in order for the protocol decode to be correct You can also use Reframe to frame unframed data The original capture file is not altered during this process Note You cannot reframe from the Capture File Viewer accessed by selecting Capture File Viewer or Load
200. n Closes the file and returns you back to the display No changes are saved e Discard Changes Closes the file without saving any of the changes made to the notes bookmarks or protocol stack 6 4 Loading and Importing a Capture File 6 4 1 Loading a Capture File From the Control Window 1 Go to the File menu 2 Choose a file from the recently used file list 3 If the file is not in the File menu list select Open Capture File from the File menu or simply click on the Open icon on the toolbar 4 Capture files have a cfa extension Browse if necessary to find your capture file 5 Click on your file and then click Open 162 Chapter 6 Saving and Importing Data ComProbe 802 11 User Manual 6 4 2 Importing Capture Files 1 From the Control window PD go to the File menu and select Open Capture File or click on the Open icon on the toolbar 2 Left of the File name text box select from the drop down list Supported File Types box to All Importable File Types or All Supported File Types cfa log txt csv cap Select the file and click Open The analyzer automatically converts the file to the analyzer s format while keeping the original file in its original format You can save the file in the analyzer s format close the file without saving it in the analyzer s format or have the analyzer automatically save the file in the analyzer s format see the System Settings to set this option All of these options keep
201. n the default directory All subsequent capture files will be saved to that location Suppose however the next time you want to save a capture file the new file location is not available because the directory structure has changed a folder has been moved a drive has been reassigned a flash drive has been disconnected etc In the case of a lost directory structure subsequent capture files will be saved to the default location ComProbe software will always try to save a file to the folder where the last file was opened from or saved to if Use Last Opened Folder for Capture Files is checked If however the location is not accessible files are saved to the default directory that is set at installation If the checkbox is unchecked then the system always defaults to the directory listed in the File Locations dialog 7 1 3 Side Names The Side Names dialog is used to change the names of objects and events that appear in various displays The Side Names dialog will change depending on the sniffing technology in use at the time the software was loaded Changes to the Names are used throughout the program 177 ComProbe 802 11 User Manual Chapter 7 General Information Side Names Default Namez Current Hames Slave Master Figure 7 6 Example Side Names Where Slave and Master are current 1 To open the Side Names dialog choose Side Names from the Options menu on the Control window 2 Tochange aname cli
202. nality is in addition to the more robust Search Find dialog Frame Display Find is located below the toolbar on the Frame Display dialog Frame Display bpa bt le cfa e36 YY SZ MA PAN AAAS hi Om 3 OO Find RB C Sum Figure 4 21 Frame Display Find text entry field Where the more powerful Search Find functionality searches the Decode Binary Radix and Character panes on Frame Display using Timestamps Special Events Bookmarks Patterns etc 67 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data Seles Decode Patten Tim GoTo Specia Event Bookmark Search for C Absolute Ci Relive Rare Month Hep Daw Hou Second 1 1 000000 Seconds a alm isa st oo a Ga ho tree imesamp CG Onor baoe the gpeciied tine O Onor after the specihed lime Figure 4 22 Search Find Dialog Find on Frame Display only searches the Decode Pane for a value you enter in the text box To use Find 1 Select the frame where you want to begin the search 2 Enter a value in the Find text box Find Antenna True A Note Note The text box is disabled during a live capture Select Find Previous Occurren e de to begin the search on frames prior to the frame you selected or Find Next Occurrence po to begin the search on frames following the frame you selected Antenna True dim Tiara Qtheruation Fake db Trancnet Alteration Fake db Arterna Signal True _ The next occurrence of the v
203. ng the Data The following sections describe how to navigate through the data and how to find specific data or packet conditions of interest to the user 5 1 Find Capturing and decoding data within the ComProbe analyzer produces a wealth of information for analysis This mass of information by itself however is just that a mass of information There has to be ways to manage the information ComProbe software provides a number of different methods for making the data more accessible One of these methods is Find Decode Pattem Time GoTo Special Events Bookmark Seach fee imestan You Day Hou Go to the bmesismp On or before the penhad ime On ot alter the pecihed time Figure 5 1 Find Dialog 139 ComProbe 802 11 User Manual Chapter 5 Navigating and Searching the Data Find as the name suggests is a comprehensive search function that allows users to search for strings or patterns in the data or in the frame decode You can search for errors control signal changes bookmarks special events time and more Once the information is located you can easily move to every instance of the Find results 5 1 1 Searching within Decodes Searching within decodes lets you to do a string search on the data in the Decode Pane of the Frame Display window To access the search within decodes function 1 Opena capture file to search bag Open the Event Display PD or Frame Display window 3 Click on the Find icon or c
204. nge the packet range or count This packet range matches the packet range shown above the viewport in the Throughput Graph as it must since the viewport defines the time range used by the timelines When no packets are in the time range each of the two packet numbers is drawn with an arrow to indicate the next packet in each direction and can be clicked on to navigate to that packet the packet number changes color when the mouse pointer is placed on it in this case LELE An arrow points to the next packet when no packets are in the time range 15 214 arrowed packet number changes color when the mouse pointer is on it Clicking navigates to that packet The header shows information for packets that are selected The footer shows the beginning ending timestamps and visible duration of the timelines The i buttons bring up channel information windows which describe channel details for each technology They make for interesting reading 124 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual 802 11 5 GHz Only channels with a base value of 5 GHz and spacings of either 20 or 40 MHz are shown here Due to space limitations each channel is drawn with fied spacing Instead of being spaced relative to its distance from other channels as is done with 2 4 GHz channels with the exception of 802 11 channel 14 Figure 4 76 5 GHz information window Bluetooth Classic There are 79 Classic channels Each channel is 1 MHz
205. nical support page 2 3 6 Minimizing Windows Windows can be minimized individually or as a group when the Control window is minimized To minimize windows as a group 1 Go to the Window menu on the Control window 2 Select Minimize Control Minimizes All The analyzer puts a check next to the menu item indicating that when the Control window is minimized all windows are minimized 3 Select the menu item again to deactivate this feature 4 The windows minimize to the top of the operating system Task Bar 17 Chapter 3 Configuration Settings In this section the ComProbe software is used to configure an analyzer for capturing data 3 1 802 11 Configuration 3 1 1 ComProbe 802 11 Hardware Settings The Hardware Settings dialog provides the ability to select a device to sniff scan The dialog only lists devices with a MAC address that match the Frontline devices To access the Hardware Settings dialog 1 Select Hardware Settings from the Options menu on the 802 11 Control window Wi Fi Scanner Hardware Settings Gritter ComProbe 002 11 SH 0102120057 Refresh List OF Cancel Help Figure 3 1 802 11 Hardware Settings Dialog 2 Select a device from the drop down list 3 Select OK If no devices are found the list is blank A Note Upon launching the Air Sniffer the first device in the drop down is the default device 3 1 2 802 11 I O Settings 1 Select I O Settings fro
206. nly characters click on the Characters Only icon A on the Event Display toolbar 4 3 7 4 Selecting Mixed Channel Sides If you want to get more data on the Event Display window you can switch to mixed sides mode This mode puts all the data together on the same line Data from one side Slave is shown on a white background and data from the other side Master is shown on a gray background 57 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data 1 Click once on the Mixed Sides icon Ea to put the display in mixed sides mode 2 Click again to return to side over side mode 3 You can right click in the center of the data display window to change between mixed and side over side modes by selecting Display Sides Together A check mark is displayed Click on Display Sides Together to remove the check mark and return to side by side display 4 Right click in the sides panel on the right of the data display and select Display Sides Together A check mark is displayed Click on Display Sides Together to remove the check mark and return to side by side display 4 3 7 5 List of all Event Symbols By default the Event Display shows all eventsevents which includes control signal changes start and end of frame characters and flow control changes If you want to see only the data bytes click on the All Events button Click again to display all events Click on a symbol and the analyzer displays the symbol name and
207. obe Protocol Analysis System and the system displays the Select Data Capture Method dialog ComProbe Protocol Analysis System Version gt Frontline ComProbe Protocol Analysis J Note You can also access this dialog by selecting Start gt All Programs gt Frontline System Three buttons appear at the bottom of the dialog Run Cancel and Help When the dialog first opens Cancel and Help are active and the Run button is inactive grayed out Bur starts the selected protocol stack closes the dialog and exits the user back to the desktop takes the user to this help file as does pressing the F1 key 3 Expand the folder and select the data capture method that matches your configuration 4 Click on the Run button and the ComProbe Control Window will open configured to the selected capture method P Note If you don t need to identify a capture method then click the Run button to start the analyzer Creating a Shortcut A checkbox labeled Create Shortcut When Run is located near the bottom of the dialog This box is un checked by default Select this checkbox and the system creates a shortcut for the selected method and places it in the Frontline ComProbe Protocol Analysis System lt version gt desktop folder and in the start menu when you click ComProbe 802 11 User Manual Chapter 2 Getting Started the Run button This function allows you the option to create a shortcut icon that can be placed on the desktop In th
208. obe software e Chapter 3 Configuration Settings The software and hardware is configured to capture data Configuration settings may vary for a particular ComProbe analyzer depending on the technology and network being sniffed There are topics on configuring protocol decoders used to disassemble packets into frames and events e Chapter 4 Capturing and Analyzing Data This Chapter describes how to start a capture session and how to observe the captured packets frames layers and events e Chapter 5 Navigating and Searching the Data Here you will find how to move through the data and how to isolate the data to specific events often used for troubleshooting device design problems e Chapter 6 Saving and Importing Data When a live capture is completed you may want to save the captured data for future analysis or you may want to import a captured data set from another developer or for use in interoperability testing This chapter will explain how to do this for various data file formats e Chapter 7 General Information This chapter provides advanced system set up and configuration information timestamping information and general reference information such as ASCII baudot and EBCDIC codes This chapter also provides information on how to contact Frontline s Technical Support team should you need assistance 1 2 Computer Minimum System Requirements Frontline supports the following computer systems configurations e Operating System Windows
209. om the Edit menu on one of these windows 161 ComProbe 802 11 User Manual Chapter 6 Saving and Importing Data 2 Type your comments in the large edit box on the Notes window The Cut Copy Paste features are K Fs B are all supported from Edit menu and the toolbar 2C at the current cursor location supported from Edit menu and the toolbar when text is selected Undo and Redo features 3 Click the thumbtack icon to keep the Notes window on top of any other windows 4 When you re done adding comments close the window 5 When you close the capture file you are asked to confirm the changes to the capture file See Confirming Capture File CFA Changes for more information 6 3 Confirm Capture File CFA Changes This dialog appears when you close a capture file after changing the Notes the protocol stack or bookmarks The dialog lists information that was added or changed and allows you to select which information to save and whether to save it to the current file or to a new one Changes made to the file appear in a list in the left pane You can click on each item to see details in the right pane about what was changed for each item You simply check the boxes next to the changes you want to keep Once you decide what changes to keep select one of the following e Save To This File Saves the changes you have made to the current capture file e Save As Saves the changes to a new file e Cancel the Close Operatio
210. on on the Virtual Sniffer Datasource window in ComProbe software More information is available in the Live Import Developer s Kit located in the Development Tools folder in Frontline ComProbe Protocol Analysis System desktop folder and a white paper is available at Bluetooth Virtual Sniffing e FTSSide o Nohardware required o ComProbe software acquires data via user developed software 10 ComProbe 802 11 User Manual Chapter 2 Getting Started e IEEE 11073 o No hardware required o for sniffing data virtually from the continua Enabling Software Library CESL IEEE 11073 tester 2 2 5 Determining Master and Slave In Bluetooth the device that initiates the connection is always the master at connection time You only need to know the master and slave at connection time when setting up the I O Settings Afterward a role switch may occur but the analyzer automatically follows the role switch P Note You do not have to identify a Master address if you are using Firmware Version 62 or newer Role Switches After the connection has been made a role switch can take place A good example of why this happens would be when a mouse connects to the PC The mouse initiates the connection so it is the master After the connection is made a role switch occurs so that the PC becomes the master and the mouse becomes a slave The role switch takes place because the PC may be working with multiple devices at the same time and as such the
211. ons 3 Select OK to save the settings and close the dialog Set the Bluetooth AMP parameters Bluetooth AMP parameters are used when capturing 802 11 alternative MAC PHY AMP frames for Bluetooth High Speed 1 Select the Bluetooth AMP radio button to activate Bluetooth AMP and WEP text boxes 2 Enter a hexadecimal value for the BR EDR Link Key Basic Rate or Extended Data Rate 3 There are two values to set for the WEP key a WEP SSID Service Set Identifiers the station ID of the 802 11 communications link b WEP Passkey the shared passkey phrase used in communications Note When capturing both B uetooth and 802 11 data using the 802 11 AMP capture H selection Frontline uses the link from the BR EDR connection To automatically decode 802 11 AMP frames in this case select the Bluetooth AMP encryption type but leave the link key blank 4 Select OK to save the settings and close the dialog Set the Pre Shared Key parameters The third way to set encrypted data is to specify the pre shared key in its raw hex forumas a 32 byte hex number P Note The other ways of specifying the WPA2 key automatically generate this value 1 Select the Pre Shared Key radio button activates the Pre Shared Key and WEP text boxes 2 Enter a 32 byte hex number inthe Pre Shared Key Raw Hex Key text box 3 There are two values to set for the WEP key a WEP SSID Service Set Identifiers the station ID of the 802 11 communications link
212. ons dialog _ 2 220 a 174 Figure 7 3 Start Up Options dialog _ 2 222 2 ieee eee cece cee eee cece cece eeeeeeeeeeees 175 Figure 7 4 File Locations dialog _ 2 220 22 a 176 Figure 7 5 File Locations Browse dialog _ 22 22 c cece cece cece eee cece cece ccc eee ceeceeeeees 176 Figure 7 6 Example Side Names Where Slave and Master are current e e eee 178 Figure A 1 ComProbe 802 11 Conductive Test Setup for 3X3 MIMO 2 eee eee 194 xiii Chapter 1 ComProbe Hardware amp Software Frontline Test Equipment ComProbe family of protocol analyzers work with the following technologies e Classic Bluetooth e Bluetooth low energy e Dual Mode Bluetooth simultaneous Classic and low energy e Bluetooth Coexistence with 802 11 e Bluetooth HCI USB SD High Speed UART e NFC e 802 11 Wi Fi e SD e USB e HSU High Speed UART The ComProbe hardware interfaces with your computer that is running our robust software engine called the ComProbe Protocol Analysis System or ComProbe software Whether you are sniffing the air or connecting directly to the chip Frontline analyzers use the same powerful ComProbe software to help you test troubleshoot and debug communications faster ComProbe software is an easy to use and powerful protocol analysis platform Simply use the appropriate ComProbe hardware or write your own proprietary code to pump communication st
213. ooltip on Column 5 Tran ID Sides in Bluetooth low energy A Bluetooth low energy data connection consists of connection events which are a series of transmissions on the same channel In each connection event the master transmits first then the slave and then the devices take turns until the connection event is finished When the data connection is encrypted and the packets are successfully decrypted the sniffer can determine exactly who sent which packet only non empty encrypted packets empty packets are never encrypted These packets are labeled either M for master or S for slave When the data connection is unencrypted or when encrypted packets are not successfully decrypted by the sniffer the sniffer cannot distinguish the two devices master and slave packets by their content just by the packet timing In those cases we label each device as side 1 or 2 not as master or slave In each connection event packets sent by the device which transmitted first in the connection event are labeled 1 and packets sent by the device which transmitted second are labeled 2 If no packets in the connection event are missed by the sniffer the device labeled 1 is the master and the device labeled 2 is the slave However if we do not capture the very first packet in a connection event i e the packet sent by the master but do capture the packet sent by the slave we label the slave as side 1 s
214. ooth device does not support Extended Inquiry Response the tab displays H Received Signal Strength Indication RSSI data which is less extensive than EIR data 4 2 Protocol Stacks 46 Chapter 4 Capturing and Analyzing Data 4 2 1 Protocol Stack Wizard The Protocol Stack wizard is where you define the protocol stack you want the analyzer to use when decoding frames To start the wizard 1 Choose Protocol Stack from the Options menu on the Control window or click the Protocol Stack icon 3 on the Frame Display 2 Selecta protocol stack from the list and click Finish Most stacks are pre defined here If you have special requirements and need to set up a custom stack see Creating and Removing a Custom Stack on page 48 Select a Protocol Stack ComProbe 802 11 User Manual Select a protocol stack __ Build Your Own __ 802 11 MAC 802 11 Radio Air Sniffer BlueCore Serial Protocol BCSP from Cambridge Silicon Radio with autotraverse Bluetooth HC UART H4 with autotraverse Bluetooth HC USB with autotraverse Bluetooth virtual transport with autotraverse Fictitious Protocol with autotraverse H4DS with autotraverse jwt_Protocol LE BB MWS Wireless Coexistence Interface 2 Current Protocol Stack Bluetooth Virtual Transport with Auto traverse 1 If you select a custom stack i e one that was defined by a user and not included with the analyzer the Remove
215. op data capture You cannot save data to file while it is being captured 2 Open the Event Display por Frame Display p window 3 Click the Save Fa icon or select Save from the File menu 159 ComProbe 802 11 User Manual Chapter 6 Saving and Importing Data Saveas OO O ajz My Documents CODFT54BT Tomas Dawid 1 W My Computer 9PTS4Cortrol DH Plus Wideo am i 4 My Network Places CIFT54Cortrol DH Video eit Frontbne Ethertest 7 COIFT54Corarol No Capture bo Buffer ex Frontline ETS48T 7 11 5 0 E2FT54Contrd Intro M 1 FI Frontline FTS4Control Demo 7 10 13 0 C3FT54Contral Intro Video 1 Ef Frontline FTS4Cortrol Demo 7 10 16 0 J JFTS54Cortrol Modbus Video ff Frontline FTS4U56 7 6 11 0 FTS Help System he Adobe C53 C3 yph Lab Stock Icons Er Backgrounds Graphics Ef Basic Air Sniffing How To CO Network Vie 5 15 07 fe bmp kong odd FTS4Control camtasia videso cr Camtasia Blue with Filmstrip CjPrint User Guides Camba Blue no fiknstrip C3 ReboHelp graphics ase Save at pe Capture Files cia r Cancel Figure 6 1 Windows Save dialog 4 Type a file name in the File name box at the bottom of the screen 5 Browse to select a specific directory Otherwise your file is saved in the default capture file directory 6 When you are finished click OK 6 1 2 Saving the Entire Capture File with Save Selection 1 If you are capturing data click on the Stop icon j to stop data capture Y
216. ort Example csv file How to Export Event Display Data to a File 1 Select Export Events from the File menu on the Event Display window to display the Event Display Export dialog 2 Enter a file path and name or click the browser button to display the Windows Save As dialog and navigate to the desired storage location 3 Selecta file type from the Save as type drop down List Menu on the Event Display Export dialog Select from among the following file formats Text File txt CSV File csv HTML File html Binary File bin 4 Select the range of events to include in the file from either All or Selection in the Event Range section of the Event Display Export dialog e Selecting more than one event in the Event Display window defaults the radio button in the Event Display Export dialog to Selection and allows the user to choose the All radio button e When only one event is selected something must be selected the All radio button in the Event Display Export dialog is selected by default 5 Next you need to select the Side variable for serial communications e is used to determine whether you want to export data from or both e Choose Host Function Control or Both to determine how you want to export the data 5 Choose Host Function Control or Both to determine how you want to export the data 6 Choose whether you want to display multiple events or single events per row 168 Chapter 6 Saving and Impo
217. oscecdedededaeevdecedcuuwedewatudwesdosenteewacuadee 148 Figure 5 9 Find Signal tab 2 lee eee cc cee cece cee cece eee cece ee eeeeeeeeeeees 149 Figure 5 10 Find Signal Tab o cece ce cece ec ccc cece cece cece cece eceeceeceeceeceeeeeees 150 Figure 5 11 Find Error tab aawat akan m chess Stier daa tucedseebieedoreousesent decdesudeudedewleeesers 152 Figure 5 12 Find Bookmark tab cc io cs5c cceccadosencadeesnadcuesiuntddevedddaedotedes ecendateweesendeaee 155 Figure 5 13 Bookmarked Frame 3 in the Frame Display 22 eee eee cece eee eee eeee 156 Figure 5 14 Find Window Bookmark tab Used to Move Around With Bookmarks 158 Figure 6 1 Windows Save dialog eee cece cece ce ec eee eee eee eee eee eeeeeeeeeeeeeees 160 Figure 6 2 Frame Display Print Dialog _ 222 eee cece cece cee eee e cece cece eeceeceeceeeeeees 164 Figure 6 3 Frame Display Print Preview Dialog _ 2 22 22 ee cece eee eee cece cece eeeeeeeees 165 Figure 6 4 Event Display Print Dialog _ 2 22 22 lee eee ce cece cee eee cece cece eeeeeeeeeeeees 167 Figure 6 5 Event Display Export Example csv file 168 Figure 6 6 Example csv Event Display Export Excel spreadsheet 2 2 c cece e eee eeeeee 170 Figure 7 1 System Settings Single File Mode o lec c eee e cece e ce eeeeeeeees 172 Figure 7 2 Advanced System Opti
218. ose which state you want each control signal to be in Choose Don t Care to have the analyzer ignore the state of a control signal When you click Find Next the analyzer searches for an event that exactly matches the conditions selected beginning from the currently selected event If the end of the buffer is reached before a match is found the analyzer asks you if you want to continue searching from the beginning If you want to be sure to search the entire buffer place your cursor on the first event in the buffer Select one of the four radio buttons to choose the condition that must be met in the search Select one or more of the checkboxes for Pin 1 2 3 or 4 Or Select one or more of the checkboxes for Request to Send RTS Clear to Send CTS Data Set Ready DSR Data Terminal Ready DTR Carrier Detect CD and Ring Indicator Rl Click Find Next to locate the next occurrence of the search criteria or Find Previous to locate an earlier occurrence of the search criteria 151 ComProbe 802 11 User Manual Chapter 5 Navigating and Searching the Data 5 1 7 Searching for Data Errors The analyzer can search for several types of data errors Searching for data error sallows you to choose which errors you want to search for and whether to search the DTE or DCE data or both Bytes with errors are shown in red in the Event Display window making it easy to find errors visually when looking through the data To access the sea
219. ou cannot save data to file while it is being captured 2 Open the Event Display por Frame Display J window 3 Right click in the data 4 Select Save Selection or Save As from the right click menu 5 Click on the radio button labeled Entire File Save Entire File 6 Choose to save Events or Frames Choosing to save T Selection Events saves the entire contents of the capture file Choosing to save Frames does not save all events in the capture file Events Frames 1 tl 7 Type a file name in the As box at the bottom of the screen As Type fie name hen Click the Browse icon to browse to a specific directory E aoe es penton ie Otherwise your file is saved in the default capture file file is being saved directory 8 When you are finished click OK 160 Chapter 6 Saving and Importing Data ComProbe 802 11 User Manual 6 1 3 Saving a Portion of a Capture File 1 If you are capturing data click on the Stop icon to pause data capture You cannot save data to a file while it is being captured Open the Event Display or Frame Display window depending on whether you want to specify a range in bytes or in frames Select the portion of the data that you want to save Click and drag to select data or click on the first item move to the last item and Shift Click to select the entire range or use the Shift key with the keyboard arrows or the navigation icons in the Frame Display toolbar If the r
220. oved to 4 When the triangle is in the desired location release the mouse Restoring Default Column Settings To restore columns to their default locations their default widths and show any hidden columns 1 Right click on any column header and choose Restore Default Column Widths or select Restore Default Column Widths from the Format menu 4 4 1 11 3 Frame Symbols in the Summary Pane Table 4 5 Frame Symbols A green dot means the frame was decoded successfully and the protocol listed in the Summary Layer drop down box exists in the frame No dot means the frame was decoded successfully but the protocol listed in the Summary Layer drop down box does not exist in the frame A green circle means the frame was not fully decoded There are several reasons why this might happen e One reason is that the frame compiler hasn t caught up to that frame yet It takes some time for the analyzer to compile and decode frames Frame compilation also has a lower priority than other tasks such as capturing data If the analyzer is busy capturing data frame compilation may fall behind When the analyzer catches up the green circle changes to either a green dot or no dot Another reason is if some data in the frame is context dependent and we don t have the context An example is a compressed header where the first frame gives the complete header and subsequent frames just give information on what has changed If the analyzer does not capture the
221. paper size You can also use your Printer Preferences dialog to make some of these selections When printing your data the analyzer creates an html file and prints the path to the file at the bottom of the page This file can be opened in your browser however it may appear different than the printed version 6 6 Exporting 6 6 1 Frame Display Export You can dump the contents of the Summary pane on the Frame Display into a Comma Separated File csv To access this feature 1 Right click on the Summary pane or open the Frame Display File menu 2 Select the Export menu item 3 Select a storage location and enter a File name 4 Select Save 6 6 2 Exporting a File with Event Display Export With the Event Display Export dialog you can export the contents of the Event Display dialog as a test txt CSV csv HTML htm or Binary File bin You also have the option of exporting the entire capture buffer or just the current selection of the Event Display dialog 167 ComProbe 802 11 User Manual Chapter 6 Saving and Importing Data Event Display Export File name C Users Frontline Desktop NFE wifi Save as type CSW File F ce v Event range Side AA Selection Both HME DCE 1 to 2000 Events Per How Co Headers Multiple Events Per Row No Timestamps E Show Preamble One Event Per Row Show Timestamp3 W Show Column Headings Help Cancel Save Figure 6 5 Event Display Exp
222. ping Enabled Timestamping was turned on Events following this event have timestamps Truncated Frame A frame that is not the same size as indicated within its protocol Underrun Error z a u a a I I I I a a a cj I I A a a E A a n a A 59 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data Table 4 3 Event Symbols continued Unknown Event 4 3 7 6 Font Size The font size can be changed on several Event Display windows Changing the font size on one window does not affect the font size on any other window To change the font size 1 Click on Event Display menu Options and select Change the Font Size Options Window Help Set Timestamp Format Change the Font Size Choose CRC Method FF Figure 4 18 Event Display Options menu 2 Choose a font size from the list Change Font 5ize kasi a Cain Size E Cancel Cancel g 10 Hep Help 11 la 14 16 Figure 4 19 Event Display Font Size Selection 3 Click OK 4 4 Analyzing Protocol Decodes 4 4 1 Frame Display Window To open this window Click the Frame Display icon on the Control window toolbar or select Frame Display from the View menu 60 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual Gh frere baplay Horeca eE PH YA STA POLA Sa kb Paga BE ee
223. ping and Display In order to assure that the data you are seeing in Frame Display are current the following messages appear describing the state of the data as it is being captured e All Frame Display panes except the Summary pane display No frame selected when the selected frame is in the buffer i e not wrapped out but not accessible in the Summary pane This can happen when a tab is selected that doesn t filter in the selected frame e When the selected frame wraps out regardless of whether it was accessible in the Summary pane all Frame Display panes except the Summary pane display Frame wrapped out of buffer 262 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual e When the selected frame is still being captured all Frame Display panes except the Summary pane display Frame incomplete 4 4 1 1 Frame Display Toolbar The buttons that appear in the Frame Display window vary according to the particular configuration of the analyzer For controls not available the icons will be grayed out Table 4 4 Frame Display Toolbar Icons Pp leon O Description P Control Brings the Control window to the front Open File Opens a capture file a O Settings Opens the I O Settings dialog Start Capture Begins data capture to a user designated file Stop Capture Closes a capture file and stops data capture to disk Save Save the currently selected bytes or the entire buffer to file J Clear
224. play p N for more information z Hexadecimal Colors are used to show which protocol layer each byte belongs ae to The colors correspond to the layers listed in the Decode E Octal pane The Event Radix Binary Character and Decode panes are all synchronized with one another Clicking on an element in any one of the panes highlights the corresponding element in all the other panes 4 4 1 11 6 Character Pane The Character pane represents the logical bytes in the frame BE TU YS tC 5 5 AN GS HR E 4 in ASCII EBCDIC or Baudot The character set can be A A Cha Pane changed from the Format menu or by right clicking on the 4 pane and choosing the appropriate character set c Copy Selection to Clipboard 2 Because the Character pane displays the logical bytes rather Select Entire Frame than the physical bytes the data in the Character pane may p Change Text Highlight Color be different from that in the Event pane See Physical vs A Kon Logical Byte Display for more information E v ASCI 7 bit ASCI Colors are used to show which protocol layer each byte KO belongs to The colors correspond to the layers listed in the EBCDIC Decode pane Baudot The Event Radix Binary Character and Decode panes are all synchronized with one another Clicking on an element in any one of the panes highlights the corresponding element in all the other panes 77 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data
225. ps affect sistem performance Display Options Display Raw Timestamp Value Display Relative Timestamps Number of digits to display to the right of the decimal point Figure 7 1 Timestamping Options dialog 7 1 4 2 Enabling Disabling Timestamp To enable timestamping click to make a check appear in the check box Store Timestamps This time takes effect immediately Removing the check will disable timestamping 7 1 4 3 Changing the Timestamp Resolution This option affects the resolution of the timestamp stored in the capture file The default timestamp is 10 milliseconds This value is determined by the operating system and is the smallest normal resolutions possible Note The raw timestamp value is the number of 100 nanosecond intervals since the beginning of H January 1 1601 This is standard Windows time It is also possible to use high resolution ag E l l timestamping High resolution timestamp V Store Timestamps This item takes effect immediately values are marked by an asterisk as high Capture Options resolution in the drop down list To change Storage Resolution 0 50 Mictoseconds high resolution mi timestamping resolutions Note 1 To apply resolution changes you must restart the program 1 Goto the Capture Options section of the window Note 2 Finer resolutions increase the capture file size 2 Change the resolution listed in the Storage Resolution box 179 ComProbe 802 11 U
226. r Decoding When Frame Information Is Missing There may be times when you need to provide information to the analyzer because the context for decoding a frame is missing For example if the analyzer captured a response frame but did not capture the command frame 50 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual indicating the command The analyzer provides a way for you to supply the context for any frame provided the decoder supports it The decoder writer has to include support for this feature in the decoder so not all decoders support it Note that not all decoders require this feature If the decoder supports user provided context three items are active on the Options menu of the Control window and the Frame Display window These items are Set Initial Decoder Parameters Automatically Request Missing Decoding Information and Set Subsequent Decoder Parameters These items are not present if no decoder is loaded that supports this feature Set Initial Decoder Parameters is used to provide required information to decoders that is not context dependent but instead tends to be system options for the protocol Choose Set Initial Decoder Parameters in order to provide initial context to the analyzer for a decoder A dialog appears that shows the data for which you can provide information If you need to change this information for a particular frame 1 Right click on the frame in the Frame Display window 2
227. r and displays those that match the filter criteria Frames that do not match the filter criteria are not displayed Display filters allow a user to look at a subset of captured data without affecting the capture content There are three general classes of display filters e Protocol Filters e Named Filters e Quick Filter Protocol Filters Protocol filters test for the existence of a specific single layer The system creates a protocol filter for each decoder that is loaded if that layer is encountered in a capture session There are also three special purpose filters that are treated as protocol filters e All Frames with Errors e All Frames with Bookmarks e All Special Information Nodes Named Filters e Named filters test for anything other than simple single layer existence Named filters can be constructed that test for the existence of multiple layers field values in layers frame sizes etc as well as combinations of those things Named filters are persistent across sessions 80 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual e Named filters are user defined User defined filters persist in a template file User defined filters can be deleted Quick Filters e Quick Filters are combinations of Protocol Filters and or Named Filters that are displayed on the Quick Filter tab e Quick Filters cannot be saved and do not persist across sessions e Quick Filters are created on the Quick Filter Dialog
228. r export file would contain only special events and data bytes classified as printable In ASCII printable characters are those with hex values between 20 and S7e 6 6 2 2 Exporting Baudot When exporting Baudot you need to be able to determine the state of the shift character In a text export the state of the shift bit can be determined by the data in the Character field When letters is active the character field shows letters and vice versa 170 Chapter 7 General Information 7 1 System Settings and Progam Options 7 1 1 System Settings Open the System Settings window by choosing System Settings from the Options menu on the Control window To enable a setting click in the box next to the setting to place a checkmark in the box To disable a setting click in the box to remove the checkmark When viewing a capture file settings related to data capture are grayed out 171 ComProbe 802 11 User Manual Chapter 7 General Information Single File System Settings xe Capture Mode Single File i Restart Capturing After Saving or Clearing Capture File Wrap File File Size in K 81373 Min Max Sta Advanced Figure 7 1 System Settings Single File Mode This option allows the analyzer to capture data to a file Each time you capture the file you must provide a file name The size of each file cannot larger than the number given in File Size in K The name of each file is the name you gi
229. r that has a value of O through RSSI Max This parameter isa measure by the PHY of the energy observed at the antenna used to receive the current PPDU RSSI shall be measured between the beginning of the SFD and the end of the PLCP HEC RSSI is intended to be used in arelative manner Absolute accuracy of the RSSI reading is not specified 2 RSSI in DSSS PHY The RSSI shall be a measure of the RF energy received by the DSSS PHY RSSI indications of up to 8 bits 256 levels are supported 3 RSSI in OFDM PHY The allowed values for the RSSI parameter are in the range from O through RSSI maximum This parameter is a measure by the PHY of the energy observed at the antenna used to receive the current PPDU RSSI shall be measured during the reception of the PLCP preamble RSSI is intended to be used in arelative manner and it shall be a monotonically increasing function of the received power Different vendors implement these value in their own way The ComProbe 802 11 uses an Atheros chipset which provides RSSI values in the range of 0 to 128 The radio hardware in the ComProbe 802 11 has two receive chains one for each antenna Each received packet has RSSI values for both antennas as well as the combined value 28 ComProbe 802 11 User Manual Chapter 3 Configuration Settings The hardware provides the following five values 1 2 rssi_ant00 Receive signal strength indicator of control channel chain 0 rssi_ant01 Receive signal st
230. rames You are in effect filtering out any other technology frames e HCI o All will filter in all HCI frames You are in effect filtering out any other technology frames Frame Display TestFileSlimmer cfa File Edit View Format Liwe Filte Bookmarks Options Window Help A 3 Ya a Quick Filtering z a AG F m as li bi ane 6 471 Master Len 289 Apply Modify Display Filters O g Fimt Q B O Sum E rors ts Baseband Packet Status CAL DAG sis rhein Baseband Hide Show Display Filters i Header Length 11 Rename Display Filters p Header Version 3 hess Add lt CAC ADADDA Fran Delta Timestamp eae Connection Filter p Classic AI 4 2 2015 10 55 32 661 a n0 ah 01 Fe nmn noaa 3 Aa aie AA 6 464 Bluetooth low energy Link t 0 10 55 32 668 i gq ar aay rmpQyr 0 rrrm To Clock 0x0001 dOc0 pa G poaa Packet Status CRC Error 0 6 466 80 00 00 10 56 32 6901 FLOW Go 6 467 56 O00 00 1 110 55 32 692 TYPE 2 DH3 6 465 56 00 00 00 0 4 13 2075 10 55 32 694 i Payload Data Rate 3 Mbps 6 469 17 00 00 00 0 4213 2015 10 56 32 701 Figure 4 37 Connection Filter from the Frame Display Menu From the Frame Display toolbar Right click anywhere in the toolbar and select Connection Filter from the pop up menu The procedure for creating a connection filter are identical as described in From the Frame Disp
231. rch by time function 1 Opena capture file to search 2 Open the Event Display PD or Frame Display 5 window 3 Click on the Find icon AA or choose Find from the Edit menu 4 Click on the Errors tab of the Find dialog Note The tabs displayed on the Find dialog depend on the product you are running and the content Si of the capture file you are viewing J Find BPA500 cfa Decode Pattern Time Search for event where One or more of these changed a This exactly O One or more of these occured 7 AA we pate Find Previous C One or more of these was off Help Side Restriction il A Search without regard to data origin Search only these sides E Slave E Master Figure 5 11 Find Error tab Searching for event where The first three options are all fairly similar and are described together These options are searching for an event where e one or more error conditions changed e one or more error conditions occurred e one or more error conditions were off i e no errors occurred Selecting Which Errors to Search The section with the check boxes allows you to choose which errors the analyzer should look for Click on a box to check or un check it 152 Chapter 5 Navigating and Searching the Data ComProbe 802 11 User Manual If you want to search only for overrun errors e check the box if shown e un check the other boxes To search for all types of errors e check all boxe
232. rdware and one ComProbe 802 11 o 80211 AMP hardware O 802 11 AMP Interlaced Page Scan For Classic low energy 802 11 coexistence analysis 3 802 11 and NFC 9 802 11 and SD Captures Bluetooth Classic low energy and 802 11 data and displays in Q 20211 and USB the Frame Display and Coexistence View 802 11 Interlaced Page Scan 429 802 11 5D and USB 3 802 11 Bluetooth Coexistence Bluetooth Classic LE BPA 500 amp 802 11 49 Bluetooth Classic LE BPA 500 amp NFC Bluetooth Classic LE BPA 500 amp USB Bluetooth Classic LE BPA 600 amp 802 11 42 Bluetooth Classic LE BPA 600 amp NFC 42 Bluetooth Classic LE BPA 600 amp USB lt Q Two 802 11 and One BPA 500 modi Two 802 11 and One BPA 600 9 NFC 43 NFC SDIO Sniffing idi Bluetooth SDIO K SD 2 0 J E USB Sniffing 43 USB Virtual Sniffing 49 CPAS Side modi IEEE11073 c 802 11 LARI our DIGITAL VO u58 POWER robes 4 m r Run Cancel Help Create Shortcut When Run e Requires one ComProbe BPA 600 hardware and one ComProbe 802 11 hardware e For Bluetooth Classic Bluetooth low energy and 802 11 coexistence analysis 2 2 4 Virtual Sniffing The Virtual Sniffer is a live import facility within ComProbe software that makes it possible to access any layer ina stack that the programmer has access to and feed this data into the Virtual Sniffer Please refer to the Show Live Import Information butt
233. reams directly into the ComProbe software where they are decoded decrypted and analyzed Within the ComProbe software you see packets frames events coexistence binary hex radix statistics errors and much more This manual is a user guide that takes you from connecting and setting up the hardware through all of the ComProbe software functions for your ComProbe hardware Should you have any questions contact the Frontline Technical Support Team ComProbe 802 11 User Manual Chapter 1 ComProbe Hardware amp Software 1 1 What is in this manual The ComProbe User Manual comprises the following seven chapters The chapters are organized in the sequence you would normally follow to capture and analyze data set up configure capture analyze save You can read them from beginning to end to gain a complete understanding of how to use the ComProbe hardware and software or you can skip around if you only need a refresher on a particular topic Use the Contents Index and Glossary to find the location of particular topics e Chapter 1 ComProbe Hardware and Software This chapter will describe the minimum computer requirements and how to install the software e Chapter 2 Getting Started Here we describe how to set up and connect the hardware and how to apply power This chapter also describes how to start the ComProbe software in Data Capture Methods You will be introduced to the Control window that is the primary operating dialog in the ComPr
234. rength indicator of control channel chain 1 rssi ant10 Receive signal strength indicator of extension channel chain O rssi ant11 Receive signal strength indicator of extension channel chain 1 rssi_ combined Receive signal strenth indicator of combination of all active chains on the control and extension channels All five of these values are shown in the PHY layer decoder for every packet The Wi Fi scanner shows the combined value 3 1 3 Wi Fi Device MAC Address Editor If you know the MAC Address of the device you can enter it manually 1 2 3 4 From the I O Settings dialog select the Edit button On the MAC Address Editor enter the MAC Address for the device MAC Address e g 0014bf72b3a6 Listen Channel e g 1 6 or 11 0014bfF2b3a6 6 OK Cancel Help Figure 3 14 Wi Fi Direct MAC Address Editor Enter achannel number in Listen Channel Select OK The MAC Address appears on the I O Settings dialog Once you close the dialog the last MAC Address shown will appear when you reopen the dialog 3 2 Decoder Parameters Some protocol decoders have user defined parameters These are protocols where some information cannot be discovered by looking at the data and must be entered by the user in order for the decoder to correctly decode the data For example such information might be a field where the length is either 3 or 4 bytes and which length is being used is a system option There ma
235. resume capture Stopping capture means no data will be added to the capture file until capture is resumed but the previously captured data remains in the file 5 Toclear captured data click the Clear icon J e If you select Clear after selecting Stop Capture a dialog appears asking whether you want to save the data o You can click Save File and enter a file name when prompted o If you choose Do Not Save all data will be cleared o Ifyou choose Cancel the dialog closes with no changes e lf you select the Clear icon while a capture is occurring o The capture stops o A dialog appears asking if you want to save the capture o You can select Yes and save the capture or select No and close the dialog In either case the existing capture file is cleared and a new capture file is started o Ifyou choose Cancel the dialog closes with no changes To see how to capture to a single file choose System Settings from the Options menu on the Control window When live capture stops no new packets are sniffed but there can still be packets that were previously sniffed but not yet read by the ComProbe analyzer This happens when packets are being sniffed faster than the ComProbe analyzer can process them These packets are stored either on the ComProbe hardware itself or in a file on the PC If there are remaining packets to be processed when live capture stops the Transferring Packets dialog below is displayed showing the packets yet to be re
236. rks 154 Find Introduction 139 Font Size 60 Frame Display 60 63 66 67 69 70 75 79 Frame Display Change Text Highlight Color 78 Frame Display Find 67 Frame Display Status Bar 66 Frame Display Toolbar 63 Frame Display Window 61 Frame Recognizer Change 59 Frame Symbols 76 Frame Information on the Control Window 13 Freeze 55 FS 185 FTS Serial Driver 185 Go To 146 Graphs 138 Green Dots in Summary Pane 76 GS 184 H Hardware Settings Overview 802 11 18 27 Hex 56 Hexadecimal 77 Hiding Display Filters 85 Hiding Protocol Layers 66 High Resolution Timestamping 180 HT 185 I O Settings 11 208 Appendicies I O Settings Change 59 Icons in Data on Event Display 58 Importable File Types 163 Importing Capture Files 162 INCLUDE 82 Include Exclude 82 Layer Colors 79 LF 185 Live Update 55 Logical Byte Display 67 Logical Bytes 67 Long Break 59 Low Power 59 Main Window 11 Master 11 Minimizing 17 Mixed Channel Sides 57 Mixed Sides Mode 57 Modem Lead Names 177 Modify Display Filters 87 88 Multiple Event Displays 54 Multiple Frame Displays 70 N NK 184 Node Filters 85 Nonprintables 170 Notes 161 NU 184 Number Set 56 Appendicies Numbers 182 Octal 56 Open 54 Open Capture File 162 Options 171 173 174 178 Other Term Subterm 16 Overriding Frame Information 50 Overrun Errors 153 Panes 70 Pattern 142 Pause 39 Performance Notes 181 Pie Charts 137 Port A
237. rs in sequence The chapters are organized in such a way to introduce you to DecoderScript writing step by step Screenshots of the ComProbe protocol analyzer have been included in the manual to illustrate what you see on your own screen as you develop decoders But you should be aware for various reasons the examples may be slightly different from the ones that you create The differences could be the result of configuration differences or because you are running a newer version of the program Do not worry if an icon seems to be missing a font is different or even if the entire color scheme appears to have changed The examples are still valid Examples of decoders methods and frame recognizers are included in this manual You can cut and paste from these examples to create your own decoders A quick note here Usually the pasted code appears the same as the original in your editor Some editors however change the appearance of the text when it is pasted something to do with whether it is ASCII or Unicode text If you find that the pasted text does not appear the same as the original you can transfer the code into a simple text editor like Notepad save it as an ANSI ASCII file then use it in your decoder These files are installed in the FTE directory of the system Common Files directory The readme file in the root directory of the protocol analyzer installation contains a complete list of included files Most files are located in My
238. rting Data ComProbe 802 11 User Manual Events Per Row You can choose to display Multiple Events Per Row but this method contains no timestamps If you select One Event Per Row you can display timestamps multiple events or single events per row Note The raw timestamp value is the number of 100 nanosecond intervals since the H beginning of January 1 1601 This is standard Windows time The timestamp data types displayed in columns for One Event Per Row Timestamp Delta Event Number Byte Number Frame Number Type Hex Dec Oct Bin Side ASCII 7 bit ASCII EBCDIC Baudot RTS CTS DSR DTR CD RI UART Overrun Parity Error Framing Error 7 Ifyou select csv as the file type choose whether you want to hide display Preambles or Column Headings in the exported file 8 Click Save The Event Display Export file is saved to the locations you specified in File name 169 ComProbe 802 11 User Manual Chapter 6 Saving and Importing Data al A B C D E F G H l J K 1 Timestamp Delta Event Number Byte Number Frame Number Type Hex iDec Oct Bin ASCII 632 11 30 2012 12 20 02 895166 PM 0 00 00 00 631 626 3 Data 0 0 0 0 633 11 30 2012 12 20 02 895166 PM 0 00 00 00 632 627 3 Data oi 0 0 0 634 11 30 2012 12 20 02 895166 PM 0 00 00 00 633 628 3 Data oi 0 0 0 635 11 30 2012 12 20 02 895166 PM 0 00 00 00 634 629 3 Data 98 152 230 10011000 636 11 30 2012 12 20 02 895166 PM 0 00 00 00 635 630 3 Data 70 112 160 1
239. s The most common search is looking for a few scattered errors in otherwise clean data To do this type of search e choose to Search for an event where one or more error conditions occurred e choose which errors to look for e By default the analyzer looks for all types of errors In contrast searching for an event where one or more error conditions were off means that the analyzer looks for an event where the errors were not present For example if you have data that is full of framing errors and you know that somewhere in your 20 megabyte capture file the framing got straightened out you could choose to search for an event where one or more error conditions were off and choose to search only for framing The analyzer searches the file and finds the point at which framing errors stopped occurring Searching for an event where the error conditions changed means that the analyzer searches the data and stop at every point where the error condition changed from on to off or off to on For example if you have data where sometimes the framing is wrong and sometimes right you would choose to search framing errors where the error condition changed This first takes you to the point where the framing errors stopped occurring When you click Find Next the analyzer stops at the point when the errors began occurring again Clicking Find Previous will search backwards from the current postion The analyzer takes the current selected byte as its init
240. s 85 Copying Statistics 137 CPAS Control Window Toolbar 12 CR 184 CRC 54 CSV Files 167 Custom Protocol Stack 46 48 Custom Stack 47 48 Customizing Fields in the Summary Pane 75 D D 1 184 D 2 184 D 3 184 D 4 184 D E 184 Appendicies Data 55 159 160 Capturing 39 Data Byte Color Denotation 79 Data Errors 152 Data Extraction 130 Data Rates 55 Decimal 56 Decode Pane 76 decoder 185 Decoder Parameters 30 DecoderScript 185 Decodes 29 46 51 60 66 76 140 Default File Locations 175 Delete aTemplate 32 Deleting Display Filters 85 Delta Times 55 Direction 85 Directories 175 Disabling 171 Display Filters 80 86 88 Display Options 181 DL 184 Dots 76 Driver 185 Duplicate View 52 54 69 70 E E B 184 E C 184 Easy Protocol Filtering 95 EBCDIC 57 EBCDIC Codes 183 207 ComProbe 802 11 User Manual EIR 46 EM 184 EQ 184 Errors 152 177 ET 184 Event Display 51 69 167 Event Display Export 167 Event Display Toolbar 52 Event Numbering 182 Event Pane 78 Event Symbols 58 EX 184 Exclude 82 Exclude Radio Buttons 82 Expand All Collapse All 76 Expand Decode Pane 70 Export Export Baudot 170 Export Events 168 Export Filter Out 170 Extended Inquiry Response 46 F F F 184 FCSs 54 Field Width 75 File 159 162 171 File Locations 175 File Series 171 File Types Supported 162 Filtering 94 Filters 80 83 85 88 95 ComProbe 802 11 User Manual Find 140 143 144 146 147 152 Find Bookma
241. s to ensure exact test processes automating those processes is one answer When testing multiple devices long test runs can occur and automating can free up personnel to perform additional tasks This is alist of possible situations when automation would improve testing and developments operations and save money Figure 2 ComProbe GUI e Automate long test runs free up personnel for other tasking or run overnight e Automatic bookmarking capture data for specific events helps developers focus on specific rest results e Automatic adherence to test procedures ensures test repeatability and eliminates human error e Automatic exporting captured data extracting specific data for post testing analysis outside of the ComProbe software e g export to CSV e Automate other Windows based applications while capturing data for example controlling other testing equipment related to the test e Automate regression testing 195 ComProbe 802 11 User Manual Appendicies The larger your task size the more benefit realized in cost avoidance and efficient resource usage through automation of the Frontline ComProbe protocol analyzers The extra effort to program the test automation is minimal compared to the time saved to manually test Frontline s Automation Server provides the means to programmatically control ComProbe software and hardware in a client server configuration The Automation Server is provided when you purchase yo
242. scription O escription g Scroll Lock Unlock during live capture mode Reset during live capture mode Clears the display 4 4 2 3 Coexistence View Throughput Indicators Packets O All Selected Viewport Awg throughput 1 sec throughput bits 5 LESES Figure 4 47 Coexistence View Throughput Indicators Throughput indicatorsshow average throughput and 1 second throughput for Classic Bluetooth all devices master devices and slave devices are each shown separately Bluetooth low energy and 802 11 4 4 2 4 Throughput Throughput is total packet or payload size in bits of the included packets divided by the Throughput duration of the included packets where O Packet Pavload Both e Packet size is used if the Packet or Both radio button is selected in the Throughput group e Payload size is used if the Payload radio button is selected in the Throughput group e Included packets are defined separately for each of the radio buttons that appear above the throughput indicators e Duration of the included packets is measured from the beginning of the first included packet to the end of the last included packet 105 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data 4 4 2 5 Radio Buttons Packets All Selected Viewport The radio buttons above the throughput indicators specify which packets are included Radio button descriptions are modified per the following e
243. se information as to the type of error and where it occurred The Summary pane is synchronized with the other panes in this window Click on a frame in the Summary pane and the bytes for that frame is highlighted in the Event pane while the Decode pane displays the full decode for that frame Any other panes which are being viewed are updated accordingly If you use one pane to select a subset of the frame then only that subset of the frame is highlighted in the other panes Protocol Tabs Protocol filter tabs are displayed in the Frame Display above the Summary pane e These tabs are arranged in separate color coded groups These groups and their colors are General white Classic Bluetooth blue Bluetooth low energy green 802 11 orange USB purple and SD brown The General group applies to all technologies The other groups are technology specific noes O oo Classic Bluetooth blue Danlumaiks magpa J Baseband L2CAP TES LE BB LE PET LE ADV 802 11 Radio 802 11 MAC Data aaa Bluetooth low energy green z Frari wiesa OO Co 156011 NS AKO ai 802 11 orange 15 400 NG BO Figure 4 27 Example Protocol Tags e Clicking on a protocol filter tab in the General group filters in all packets containing that protocol regardless of each packet s technology e Clicking on a protocol filter tab in a technology specific group filters in all packets containing th
244. se locations are set at installation Follow the steps below to change the default locations 1 Choose Directories from the Options menu on the Control window to open the File Locations window 175 ComProbe 802 11 User Manual Chapter 7 General Information File Locations File Types Location My Capture Files C Users Public DocumentsFrontine Test Equipment hMy Capture Files My Configurations C Users Public DocumentsFronthne Test EquipmentsMy Configurations My Decoders CA sers4Public 3D ocuments4Prontine Test Equipment Decoders My Log Files C AU sers4Publie Documents Frontline Test EquipmentyhMy Log Files My Methods C Users Public DocumentssFrontline Test EquipmentsMy Methods 4 IF Modify CO Use Last Opened Folder for Capture Files Figure 7 4 File Locations dialog 2 Select the default location you wish to change 3 Click Modify 4 Browse to a new location Specify My Decoders directory a di Public b gt di Desktop F d Public Documents r di Frontline Test Equipment di My Capture Files di My Configurations My Decoders di My Log Files gt di My Methods d My Node Databases _ lb e Figure 7 5 File Locations Browse dialog 5 Click OK 6 Click OK when finished 176 Chapter 7 General Information ComProbe 802 11 User Manual If a user sets the My Decoders directory such that it is up directory from an installation path multiple instances
245. sed because the largest possible connection interval in Bluetooth low energy is 4 0 s A discontinuity is drawn as a vertical dashed line A discontinuity for a 109 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data timestamp going backward is called a negative discontinuity and is shown in red A discontinuity for a timestamp going forward by more than 4 01 s is called a positive discontinuity and is shown in black A positive discontinuity is a cosmetic nicety to avoid lots of empty space A negative discontinuity is an error E os 4 776 800 ms data point 215 data points plot Ed Si ae N NAA af a a EN bg NYU yy ily JUN Figure 4 54 A negative discontinuity i 223 634 400 ms data point 194 data points plot Throughput Over Time 8 780 N3T2ANT 12 3 30 1 461 7 PM 0 01 34 659531 SUT 12235 084 805707 PM Figure 4 55 Three positive discontinuities 4 4 2 15 Viewport The viewport is the purple rectangle in the Throughput Graph It indicates a specific starting time ending time and resulting duration and is precisely the time range used by the Timeline The packet range that occurs within this time range is shown above the sides of the viewport 110 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual Figure 4 56 Throughput Graph Viewport The viewport is moved by dragging it or by clicking on the desired location in the Throughput Graph the viewpor
246. sed on the standard port assignments However it is quite common to come across network systems in which upper layer protocols use user defined port numbers for both standard and custom protocols In such cases the analyzer users can tell the software which port numbers are assigned to which protocols The analyzer autotraverses the stack from TCP UDP and IPX based on the source or destination port number Many systems use user defined port numbers for both standard and custom protocols Here s how to tell the analyzer about a custom port assignment on the system you are monitoring Add a New Port Assignment 1 Choose Set Initial Decoder Parameters from the Options menu on the Control Ay window 2 Click the TCP tab or UDP or IPX for those protocols 3 Choose the Single Port radio button 4 Enter the port number in the Port Number box 5 Inthe Protocol drop down list choose the protocol to traverse to 6 Click the Add button The system adds the new entry to the bottom of the port number list Modify an Existing Port Assignment 1 Choose Set Initial Decoder Parameters from the Options menu on the Control window 2 Click the TCP tab or UDP or IPX for those protocols 3 Select click on and highlight the port assignment to modify 4 Change the port number and or choose the protocol to traverse to 5 Select the Port Range radio button and specify the starting and ending port numbers The range is inclusive 6 Click the Modify
247. sed the selected channel No 3 1 2 6 1 File Menu Under the File menu you can select Export to file which converts the information in the table to a text file 26 ComProbe 802 11 User Manual Chapter 3 Configuration Settings 3 4 Select Export to CSV file The Save As menu appears Select where you want to save the file in Save in Enter a File Name Select Save 3 1 2 6 2 Configure From the Configure menu you can select Hardware Settings and I O Settings 3 1 2 6 3 ComProbe 802 11 Hardware Settings The Hardware Settings dialog provides the ability to select a device to sniff scan The dialog only lists devices with a MAC address that match the Frontline devices To access the Hardware Settings dialog 1 Select Hardware Settings from the Options menu on the 802 11 Control window Wi Fi Scanner Hardware Settings Sniffer ComProbe 002 11 SH 0102170057 Refresh List OF Cancel Help Figure 3 12 802 11 Hardware Settings Dialog 2 Select a device from the drop down list 3 Select OK If no devices are found the list is blank J Note Upon launching the Air Sniffer the first device in the drop down is the default device 3 1 2 6 4 Wi Fi Device Scanner I O Settings The Device Scanner I O Settings dialog is used to set a listening time and to activate a probe request To access the I O Settings dialog 27 Chapter 3 Configuration Settings ComProbe 802 11 User Manua
248. ser Manual Rename Filters Filters Filter Description Indude each frame where the protocol Baseband field LT ADDR Is Equal To 6 New Name Filter0 1 Apply Figure 4 36 Rename Filters Dialog 2 Select the filter to be renamed from the combo box 3 Enter a new name for the filter in the New Name box Optionally click the Apply button and the new name will appear in the Filters combo box and the New Name box will empty This option allows you to rename several filters without closing the Rename Filter dialog each time 4 Click OK The Rename Filter dialog box closes and the system renames the filter 4 4 1 13 2 Connection Filtering Connection Filtering allows the user to view a subset of the total available packets within the Frame Display The subset can include data from a single Bluetooth connection or all of the BR EDR packets all of the low energy packets all of the 802 11 packets or all of the HCI packets Bluetooth Applicability A connection device pair is identified by 1 A Link for Classic Bluetooth 2 An Access Address for Bluetooth low energy The link ID is a number that the ComProbe software assigns to identify a pair of devices in a BR EDR connection In the Frame Display details pane the Baseband layer contains the link ID field if the field s value is not O An Access Address is contained in every Bluetooth low energy packet The Access Address identifies a conn
249. ser Manual Chapter 7 General Information Note If you change the resolution you need to exit the analyzer and restart in order for the H change to take effect 7 1 4 3 1 Performance Issues with High Resolution Timestamp There are two things to be aware of when using high resolution timestamps The first is that high resolution timestamps take up more space in the capture file because more bits are required to store the timestamp Also more timestamps need to be stored than at normal resolutions The second issue is that using high resolution timestamping may affect performance on slower machines For example if 10 bytes of data are captured in 10 milliseconds at a rate of 1 byte per millisecond and the timestamp resolution is 10 milliseconds then only one timestamp needs to be stored for the 10 bytes of data If the resolution is 1 millisecond then 10 timestamps need to be stored one for each byte of data If you have two capture files both of the same size but one was captured using normal resolution timestamping and the other using high resolution the normal resolution file has more data events in it because less room is used to store timestamps You can increase the size of your capture file in the System Settings 7 1 4 4 Switching Between Relative and Absolute Time With Timestamping you can choose to employ Relative Time or Absolute time 1 Choose System Settings from the Options menu on the Control window and click the Timestamp
250. sometimes additional information in the status lines at the bottom of the Event Display window For example clicking on a control signal change symbol displays which signal s changed In addition to data bytes the events shown are in alphabetical order Table 4 3 Event Symbols Broken Frame The frame did not end when the analyzer expected it to This occurs most often with protocols where the framing is indicated by a specific character control signal change or other data related event Buffer Overflow Indicates a buffer overflow error A buffer overflow always causes a broken frame Control Signal Change One or more control signals changed state Click on the symbol and the analyzer displays which signal s changed at the bottom of the Event Display window Data Capture Paused The Pause icon was clicked pausing data capture No data is recorded while capture is paused bp Data Capture Resumed The Pause icon was clicked again resuming data capture Dropped Frames Some number of frames were lost Click on the symbol and the analyzer displays many frames were lost at the bottom of the Event Display window End of Frame Marks the end of a frame lAn event is anything that happens on the circuit or which affects data capture Data bytes control signal changes and long and short breaks are all events as are I O Settings changes and Data Capture Paused and Resumed 58 Chapter 4 Capturing and Analyzing Da
251. splay Print dialog Select Print if you just want to print your data to your default printer Select Print Preview if you want access to printer options 2 Choose to include the Summary pane check the box in the print output The Summary pane appears at the beginning of the printed output in tabular format If you select All layers in the Detail Section the Data Bytes option becomes available 3 Inthe Detail Section choose to exclude No decode section the decode from the Detail pane in the Frame Display or include All Layers or Selected Layers Only If you choose to include selected layers then select click on and highlight the layers from the list box 4 Click on selected layers in the list to de select or click the Reset Selected Layers button to de select all selected layers Frame Display Print Prowde information lo export dala tram the cumenlly selected fher tab Irecbude Detal Section 7 Summary C Mo decode nection C Al layers O Selected layers onbe S071 AMP 802 10 STP Selection Se 1 ASDP AMP Manager Dl mi mg Frame Range Delete File Hote Binasa pani opbong map alfect whether argy gray background ic panted See Help for mka 100k cance Hop Figure 6 2 Frame Display Print Dialog 164 Chapter 6 Saving and Importing Data ComProbe 802 11 User Manual 5 Select the range of frames to include All or Selection in the Frame Range section of the Frame Display Print dialog Choos
252. ssignment 35 Printing 138 166 Printing from the Frame Display 163 Progress Bars 182 Protocol Protocol Layer Colors 79 Protocol Layer Filtering 94 Protocol Stack 47 48 50 Q Quick Filtering 94 R Radix 56 77 Reframe 49 Reframing 49 Relative Time 144 180 209 ComProbe 802 11 User Manual Remove Bookmarks 156 157 Columns 75 Custom Stack 47 Filters 85 86 Framing Markers 49 Reset Panes 70 Resetable Tab 136 Resolution 179 Resumed 58 Revealing Protocol Layers 66 RS 184 RSSI 28 Save 82 159 161 Save As 159 Saving 160 161 Display Filter 81 Imported Capture Files 171 Saving the Capture File using File amp gt Save or the Save icon 159 Search 140 142 144 146 147 152 155 157 binary value 142 bookmarks 157 character string 142 errors 152 eventnumber 147 frame number 146 hex pattern 142 pattern 142 special event 147 timestamp 144 ComProbe 802 11 User Manual wildcards 142 Security 802 11 I O Settings 18 WPA Key 33 Seed Value 54 Serial Driver 185 Short Break 59 Side Names 177 Sides 177 Slave 11 Sorting Frames 67 Special Events 147 Start 58 Start Up Options 174 Statistics 133 Statistics Graphs 137 Summary 72 Summary Pane 72 75 76 Sync Dropped 59 Sync Found 59 Sync Hunt Entered 59 Sync Lost 59 Synchronization 69 System Settings 171 173 T Technical Support 187 Test Device Began Responding 59 Test Device Stopped Responding 59 Timestamp 156 179 180 Timestamping 156 17
253. such as frame check errors e Search for Information Frame only searches information frames 1 Enter the search string 2 Check Ignore Case to do a case insensitive search 3 When you have specified the time interval you want to use click on the Find Next or Find Previous buttons to start the search from the current event The result of the search is displayed in the Decode pane in Frame Display 141 ComProbe 802 11 User Manual Chapter 5 Navigating and Searching the Data Side Restrictions Side Restriction means that the analyzer looks for a pattern coming wholly from the DTE or DCE side If you 9 Event Display KIER choose to search without regard for data origin the analyzer looks Fie Edt View Format Options Window Help for a pattern coming from one or both sides For example if you Pa a MB bi S2 AF ss 8 choose to search for the pattern ABC and you choose to search without regard for data origin the analyzer finds all three instances of ABC shown here The first pattern with the A and the C coming from the DTE device Event 16to 42 of Ea a and the B coming from the DCE is a good example of how using a Rate Deka CRC DTE CRC DCE side restriction differs from searching without regard to data origin No Timestamp No Timestamp 9c 35 While searching without regard for data origin finds all three For Help Press F1 patterns searching using a side restriction never finds the first pattern because it does not
254. t present if no decoder is loaded that supports this feature Enable Disable Audio Expert When enabled the Audio Expert System is active other wise it is not available Only available when an Audio Expert System licensed device is connected System The Windows menu selection applies only to the Control window and open analysis windows Frame Display Event Display Message Sequence Chart Bluetooth Timeline Bluetooth low energy Timeline and Coexistence View All other windows such as the datasource are not affected by these selections 46 ComProbe 802 11 User Manual Chapter 2 Getting Started Table 2 7 Control Window Windows Menu Selections Live amp Cascade Ctrl W Arranges open analysis windows in a cascaded view with Capture window captions visible oe Close All Views Closes Open analysis windows Minimize Control When checked minimizing the Control window also Minimizes All minimizes all open analysis windows Frame Display and When these windows are open the menu will display these Event Display selections Clicking on the selection will bring that window to the front Control Window Help Menu Selections Live amp Help Topics gt Opens the ComProbe Help window Capture Fil P About ComProbe Provides a pop up showing the version and release Protocol Analysis information Frontline contact information and copyright System Information Support on the Web pe Opens a browser to fte com tech
255. t the mouse pointer is kept in place if possible 5 Select the Zoom to Data Point Packet Range menu item which zooms to the packet range shown in the most recently displayed tool tip 6 Select the Zoom to Selected Packet Range menu item which zooms to the selected packet range as indicated in the Selected Packets text in the timeline header 7 Select the Custom Zoom menu item This is the zoom level from the most recent drag of a viewport side selection of Zoom to Data Point Packet Range or selection of Zoom to Selected Packet The zoom buttons and tools step through the zoom presets and custom zoom where the custom zoom is logically inserted in value order into the zoom preset list for this purpose 4 4 2 32 Discontinuities A discontinuity is when the timestamp going from one packet to the next either goes backward by any amount or forward by more than 4 01 s this value is used because the largest possible connection interval in Bluetooth low energy is 4 0 s A discontinuity is drawn as a vertical cross hatched area one Bluetooth slot 625 us in width A discontinuity for a timestamp going backward is called a negative discontinuity and is shown in red A discontinuity for a timestamp going forward by more than 4 01 s is called a positive discontinuity and is shown in black A positive discontinuity is a cosmetic nicety to avoid lots of empty space A negative discontinuity is an error ST hed A15 POT ae HA TEREPE a jih NLA A
256. t will be centered at the click point The viewport is sized by dragging one of its sides or by using one of the other zooming techniques See the Zooming subsection in the Timeline section for a complete list 4 4 2 16 Swap button The Throughput Graph and Timeline can be made to trade positions by clicking the Swap button Clicking the Swap button swaps the positions of the Throughput Graphs and the Timelines 111 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data 4 Coexistence View bpa bt le wf hs 18 842 packets cfa File Format Zoom fais Spectrum Help a H E H EE7 ARN Packets O All Selected Viewport pr Swap Viewport Packet Range 590 Packets Throughput Awg throughput 4 sec throughput ng zg Sejected Packet None z bits s ae 4 CO Packet bits s O Payload Both Timeline 5GHz 2 4GHz Both Selected Auto Retransmit B Bad Packet Can t Decrypt width 1 sec peak 6 216 LE Devices Configured All 2 4 GHz Channels 802 11 Te 00 00 00 22 21 be i 8 17 2011 10 39 03 736043 AM 8 17 2011 10 39 13 7 96043 AN irk ee Am For Help Press F1 Figure 4 57 Small Timeline and large Throughput Graph after pressing the Swap button 4 42 17 Dots button The dots on the data points can be toggled on and off by clicking the Dots button Dots are different sizes for each technology so that they reveal overlapping data points which otherwise woul
257. ta ComProbe 802 11 User Manual Table 4 3 Event Symbols continued Flow Control Active An event occurred which caused flow control to become active i e caused the analyzer to stop transmitting data Events which activate flow control are signal changes or the receipt of an XON character Flow Control Inactive An event occurred which caused flow control to become inactive i e caused the analyzer to transmit data Events which deactivate flow control are signal changes or the receipt of an XOFF character Frame Recognizer Change A lowest layer protocol was selected or removed here causing the frame recognizer to be turned off or on I O Settings Change A change was made in the I O Settings window which altered the baud parity or other circuit setting Long Break Low Power The battery in the ComProbe is low Short Break SPY Event SPY Mode only SPY events are commands sent by the application being spied on to the UART Start of Frame Marks the start of a frame Begin Sync Character Strip End Sync Character Strip Sync Dropped Sync Found Sync Hunt Entered Sync Lost Test Device Stopped Responding The analyzer lost contact with the ComProbe for some reason often because there is no power to the ComProbe Test Device Began Responding The analyzer regained contact with the ComProbe Timestamping Disabled Timestamping was turned off Events following this event are not timestamped Timestam
258. tab i Deskiog dats extractonM Fip dala edraction Grashed Files whose extensions ane umkuinicrern ay n Status BipBppFtpOppProfiles cfa kais Chapter 4 Capturing and Analyzing Data i AFH 0 FH Change Cfa frm GP AFH Charge Cfa Path cfa Save irc Recent File lupas ace determined awomabcaly trom the esdrected data Audio Extraction Status BipBppFtpOppProfile Status File Type One Steven File Path C Documents and SethngstshDesktopdata Fieras Staus Foma Oud Processing Frame 540 1003 CADocument and Setlings tab Desktopidata edractonBipSippF ipl ppProfbes BPP 1 Unknown Figure 4 14 Data and Audio Extraction Status If you selected Open Files s After Extraction the files open automatically 10 If you did not select this option you can open a file by simply double clicking on the name Also if a file type is unknown you can select the file and it appears in the Rename to text box 132 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual Data Extraction 5tatus BiphppFipOppProfiles cta Bip data extraction started File C Documerts and Setting Vab Desktop date extractor Eine ppApOppProfie4BIP U2 ing is Opened Ep data extacton finished Figure 4 15 Rename To in the bottom section of Data Extraction Status Then you can rename the file adding a file type to attempt to open the file When you are finished select Close to clos
259. tamps while the B uetoothTimeline uses Bluetooth clocks and they do not always match up exactly This mismatch can result in the data for a particular packet being included in different intervals in the two Throughput Graphs and can have a significant impact on the shapes of the two respective graphs This can also result in the total duration of the two Throughput Graphs being different Another factor that can affect total duration is that the BluetoothTimeline s Throughput Graph stops at the last Classic Bluetooth packet while the Coexistence View s Throughput Graph stops at the last packet regardless of technology 115 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data 4 4 2 21 Coexistence View Set Button The Set button is used to specify the 802 11 source address where any o02 11 Ta O0 0e 23 55 F3 31 packet with that source address is considered a Tx packet and is shown with a purple border in the timelines All source MAC addresses that have been seen during this session are listed in the dialog that appears when the Set button is clicked Also listed is the last source MAC address that was set in the dialog in the previous session If that address has not yet been seen in this session it is shown in parentheses 6072 11 Ix Address Each 802 11 packet with this source address is considered a Tx packet and is shown with a purple border All source MAC addresses that hawe been seen during this session are
260. te a second Frame Display click the Duplicate View icon dg on the Frame Display toolbar This creates another Frame Display window You can have as many Frame Displays open as you wish Each Frame Display is given a number in the title bar to distinguish it from the others e To navigate between multiple Frame Displays click on the Frame Display icon O in the Control window toolbar A drop down list appears listing all the currently open Frame Displays e Select the one you want from the list and it comes to the front 4 Note When you have multiple Frame Display windows open and you are capturing data you H may receive an error message declaring that Filtering cannot be done while receiving data this fast If this occurs you may have to stop filtering until the data is captured Note When you create a filter in one Frame Display that filter does not automatically appear in the other Frame Display You must use the Hide Reveal feature to display a filter created in one Frame Display in another 4 4 1 9 Working with Panes on Frame Display When the Frame Display first opens all panes are displayed except the Event pane To view all the panes select Show All Panes from the View menu e The Toggle Expand Decode Pane icon F makes the decode pane longer to view lengthy decodes better e The Show Default Panes icon i returns the Frame Display to its default settings e The Show only Summary Pane icon gE displays on the Summar
261. te a section in the ini file called Service Base Handles 186 Chapter 7 General Information ComProbe 802 11 User Manual A A will be your first service Make the base handle equal to the handle of your service You can use all upper and lower case letters so you can have up to 52 service handles Next add the following section Advertiser Handles Generic Access Profile GAP AO 1800 A1 2803 A2 2a00 A3 2803 A4 2a01 A5 2803 A6 2a04 A few tings of note e Inthe code above lines begging with a semi colon are comments e If you want to change the base handle of the GAP service change the 1 to some other number e If you want to comment out the entire service comment out the base handle If no A is defined the software will ignore A1 A2 and so on 7 3 Contacting Technical Support Technical support is available in several ways The online help system provides answers to many user related questions Frontline s website has documentation on common problems as well as software upgrades and utilities to use with our products On the Web http fte com support supportrequest aspx Email tech_support fte com If you need to talk to a technical support representative about your ComProbe 802 11 product support is available between 9 am and 5 pm U S Eastern Time zone Monday through Friday Technical support is not available on U S national holidays Phone 1 434 984 4500 Fax
262. ters that you create using the Named Filter and Set Condition dialogs When you select the checkbox for the Name Filters a tab appears on the Summary Pane that Mamed Filters Filter displays the frame containing the specific data identified in the filter The Filter named Filter tab remains on the Frame Display Summary F Filter Filters Pane unless you hide it using the Hide Show Display Filters F SCO link Supported dialog Check the small box next to the name of each protocol you want to filter in i Role Slave hide or Named Filter to display IM Configured BT low energy devic Exclude NULL and POLL Then click OK 4 4 1 13 3 2 Easy Protocol Filtering There are two types of easy protocol filtering The first method lets you filter on the protocol shown in the Summary pane and the second lets you filter on any protocol discovered on the network so far 4 4 2 Coexistence View The Coexistence View displays Classic Bluetooth Bluetooth low energy and 802 11 packets and throughput in one view You access the Coexistence View by clicking its button Z in the Control window or Frame Display toolbars or Coexistence View from the View menus 95 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data m Coexistence View bpa bt le wf hs 18 842 packets cfa File Format Zoom Navigate Spectrum Help BOO a gt 9 4 9 44 dD ARR Packets O All Selected Viewport 8 842 Aw
263. the Event Display Print dialog to Selection and allows the user to choose the All radio button When only one event is selected the All radio button in the Event Display Print dialog is selected How to Print Event Display Data to a Browser 1 Select Print or Print Preview from the File menu on the Event Display window to display the Event Display Print dialog Select Print if you just want to print your data to your default printer Select Print Preview if you want preview the print in your browser 2 Select the range of events to include from either All or Selection in the Event Range section Choosing All prints all of the events in the capture file or buffer Choosing Selection prints only the selected events in the Event Display window Note In order to prevent a Print crash you cannot select All if there are more than H 100 000 events in the capture buffer Note See Configure the Print File Range in the Event Display Print Dialog above for an H explanation of these selections 166 Chapter 6 Saving and Importing Data ComProbe 802 11 User Manual Event Display Print Evert range O Al Selection Note Browser piri ophons may alfect whether ary gray background amp parted See Help lo ino Figure 6 4 Event Display Print Dialog 3 Click the OK button If you chose Print Preview the system displays your data in a browser print preview display with options for printing such as page orientation and
264. ther than the Control window open 181 ComProbe 802 11 User Manual Chapter 7 General Information e If you are still experiencing buffer overflows after trying all of the above options then you need to use a faster PC 7 2 2 Ring Indicator The following information applies when operating the analyzer in Spy mode or Source DTE No FTS Cables mode When using the cables supplied with the analyzer to capture or source data Ring Indicator RI is routed to a different pin which generates interrupts normally There is a special case involving Ring Indicator and computers with 8250 UARTs or UARTs from that family where the state of RI may not be captured accurately Normally when a control signal changes state from high to low or low to high an interrupt is generated by the UART and the analyzer goes to see what has changed and record it Ring Indicator works a little differently An interrupt is generated when RI changes from high to low but not when RI changes from low to high If Ring Indicator changes from low to high the analyzer does not know that RI has changed state until another event occurs that generates an interrupt This is simply the way the UART works and is not a deficiency in the analyzer software To minimize the chance of missing a Ring Indicator change the analyzer polls the UART every millisecond to see if RI has changed It is still possible for the analyzer to miss a Ring Indicator change if RI and only RI changes
265. to enter the requested parameters in the fields provided until the condition statement is complete 3 Click OK The system displays the Save Named Condition dialog Ensure that the filter name is displayed in the text box at the top of the dialog and click OK If you choose to create an additional filter then provide a new name for the filter condition or accept the default name provided by the system and click OK The Set Condition dialog box closes and the system applies the modified filter Note When a display filter is applied a description of the filter appears to the right of the toolbar in H the Frame Display windows Note The OK button on the Set Condition dialog box is unavailable grayed out until the H condition selections are complete Deleting a Condition in a Filter If a display filter has two or more conditions you can delete conditions If there is only one condition set in the filter you must delete the filter using Delete Display Filters from the Filters menu 87 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data 1 Click the Display Filters icon Y on the Frame Display window or select Apply Modify Display Filters from the Filter menu to open the Set Condition dialog box Click on the Advanced button to show the condition in Boolean format The dialog box displays the current filter definition To display another filter click the Open P3 icon and select the filter from the pop up
266. to include The MAC header for an 802 11 frame can contain up to 4 address fields Most frames do not have that many In general the first address is the intended receiver and the second address is the device that transmits the frame The third and fourth address fields depend on the context of the frame Some of the control type frames do not include the transmitter address but they may be determined from previous frames 5 Select OK to close the dialog Once you have MAC addresses on the main dialog you can modify them using four options e Remove Address Highlight an address that you want to delete and select Remove Address to remove it from the list e Edit Address Highlight an address that you want to edit and select Edit to bring up a dialog where you can edit the address The address and any of the prior settings may be changes Click OK to save and close Edit Mac Address e g O014bf72b3a6 00 1a7Odd6c79 o kxe Field In MAC Frame C Parke i Address 1 Receive Address 2 Transmit Address 3 lj Address 4 W Implicit Transmit e g Transmitting an ACK Figure 3 7 802 11 I O Settings Capture Filters Edit MAC Address Dialog e Move Address Up moves the selected address up in the queue e Move Address Down moves the selected address down in the queue 3 1 2 4 Firmware Update This tab displays the current firmware version in the hardware You can check for the firmware updates by first noting the current
267. trl Alt Delete ww Wireshark Capture Options oja 8 Capture Capture Interface Link layer header Prom Mode Snaplen B Buffer MB Broadcom NetXtreme Gigabit Et fe80 2c73 c88e6abltef53 Ethernet enabled default 1 1921680159 v pipe capture using fte comp Ethernet enabled default 1 j Capture on all interfaces Manage Interfaces v Capture all in promiscuous mode Capture File s Display Options Fie Browse Z Update list of packets in realtime Use multiple files V Use pcap ng format Z Automatic scrolling in live capture Next file every megabyte s Next file every minute s F Hide capture info dialog Ring buffer with 2 files f Name Resolution Stop capture after file s Stop Capture V Enable MAC name resolution after packet s Enable network name resolution E after megabyte s ly i F after ae V Enable transport name resolution a Figure 4 9 Wireshark Capture Options e f you capture more than a few millions of packets e g 4 million Wireshark crashes 43 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data 4 1 4 Combining BPA 600 802 11 and HSU with ProbeSync ProbeSync allows multiple ComProbe analyzers to work seamlessly together and to share a common clock Clock sharing allows the analyzers to precisely synchronize communications stream and to display resulting packets in a s
268. ts containing that protocol regardless of each packet s technology e Clicking on a protocol filter tab in a technology specific group filters in all packets containing that protocol on that technology e A protocol filter tab appears in the General group only if the protocol occurs in more than one of the technology specific tab groups For example if L2CAP occurs in both Classic Bluetooth and Bluetooth low energy there will be L2CAP tabs in the General group the Classic Bluetooth group and the Bluetooth low energy group Select the Unfiltered tab to display all packets There are several special tabs that appear in the Summary Pane when certain conditions are met These tabs appear only in the General group and apply to all technologies The tabs are e Bookmarks appear when a bookmark is first seen e Errors appear when an error is first seen An error is a physical error in a data byte or an error in the protocol decode e Info appears when a frame containing an Information field is first seen The tabs disappear when the capture buffer is cleared during live capture or when decoders are reloaded even if one of the tabs is currently selected They subsequently reappear as the corresponding events are detected Comparing Frames If you need to compare frames you can open additional Frame Display windows by clicking on the Duplicate View icon Bg You can have as many Frame Display windows open at a time as you wish Frame Wrap
269. tton _s and the High Speed View will appear Ww 129 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data ComProbe Protocol Analysis System 802 11 File View Live Options Window Help Configuration Con he 802 11 SN 0102120052 l Capture fle C use lt Pocuments Frontine Test Equ My Capture Fles Capture 2012 12 21 140206 cfa Captur a File 14 Packets on h w 0 ForHe 1 Click on Start Capture x and then m 2 Click on Coexistence View to see the High Speed View The Coexistence View High Speed Live Mode window will appear Coexistence View High Speed Live Mode File Format Zoom Navigate Help COOGO09 lt 9 4 9 49 44939 22 8 Captured Packets Dropped Packets Graph Info m 2 325 packets 100 m O packets 0 m 0 01 24 624649 m 60 packets s 27 avg Packets dropped at m 212 data points 103 048 bits s 62 084 avg MW Bluetooth driver 0 0 m 400 ms point m Bluetooth datasource 0 0 802 11 driver 0 0 302 11 datasource 0 0 Throughput Over Time High Speed Live Mode For Help Press F1 Figure 4 12 High Speed Live Window 4 5 Data Audio Extraction You use Data Audio Extraction to pull out data from various decoded Bluetooth protocols Once you have extracted the data you can save them into different file types such as text files graphic files email files mp3 files and more Then you
270. tured UGE Event Display framed data only Opens a Event Display with the currently selected bytes highlighted Frame Display framed data only Opens a Frame Display with the frame of the currently selected bytes highlighted Notes Opens the Notes dialog Cascade Arranges windows in a cascaded display lad Coexistence View Opens the Coexistence View dialog o Wi Fi Error Statistics Opens the Wi Fi Error Statistics dialog JI ComProbe 802 11 User Manual Chapter 2 Getting Started 2 3 2 Configuration Information on the Control Window The Configuration bar just below the toolbar displays the hardware configuration and may include I O settings It also provides such things as name of the network card address information ports in use etc 2 3 3 Status Information on the Control Window The Status bar located just below the Configuration bar on the Control window provides a quick look at current activity in the analyzer Capture Status Not Active Capture to Single File NA used Utilization 0 Host 04 Control Events 0 e Capture Status or Status for Sodera displays Not Active Paused or Running and refers to the state of data capture o Not Active means that the analyzer is not currently capturing data o Paused means that data capture has been suspended o Running means that the analyzer is actively capturing data e Used The next item shows how much of the buffer or capture file has b
271. ucts Should you have difficulty with your Wireshark product contact the manufacturer for support or maintenance Click on the ComProbe 802 11 with Wireshark short cut to launch and start capturing the Wi Fi packets If you do not see any packets on the Wireshark window then check the status message indication on the Wi Fi Datasource window to see if sniffing has stopped Click on the Start button 9 Wi Fi Datasouree File Sniffing View Help Il Stopped sniffing 802 11 packets Number of 802 11 packets sent to Wireshark 386 Figure 4 4 Datasource Stopped Sniffing 41 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data When the ComProbe 802 11 is sniffing the datasource will display the following message Sniffing can be stopped by clicking the Stop button i 1G Wifi Datasource N File Sniffing View Help Sniffing 802 11 packets Number of 802 11 packets sent to Wireshark 428 File Edit View Go Capture Analyze Statistics Telephony Tools Ir eF TC E S amp Interfaces Cti E p gp FH J Options Ctrl K Start Ctrl E 80211 Channel Cha Stop Ctrl E Restart Ctrl R i Capture Filters ae feo gt lost Popular Version 1 8 3 SVN Rev 45256 from Filter Figure 4 6 Wireshark Capture Dialog Note Whenever you give Start Capture command on Wireshark the status message on the Wi Fi Datasource window should display Please START capturing on the Wires
272. ued When clicked Ctrl Minus Viewport time duration increases The following two selectioins are mutually exclusive Scroll Tool Mouse Wheel Scrolls Ctrl Key When checked sets the mouse wheel to scroll Switches to Zoom Tool the Viewport Pressing the Ctrl key while scrolling switches to zooming the Viewport Zoom Tool Mouse Wheel Zooms Ctrl Key When checked sets the mouse wheel to zoom Switches to Scroll Tool the Viewport Pressing the Ctrl key while Zooming switches to scrolling the Viewport Zoom To Time Range of Selected Packets Active only when packets are selected When clicked the Viewport duration changes to the time range covered by the selected packets Zoom To Throughput Graph Data Point When clicked the Viewport duration changes to the time range of the Throughput Graph selected data point Custom Zoom Set by Zoom To Time Range of Automatically checked when taking any zoom Selected Packets Zoom To Throughput Graph action other than the fixed Viewport zoom Data Point or dragging Viewport Slide durations listed below 100 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual Table 4 8 Coexistence View Zoom Menu Selections continued The following 21 selections are mutually exclusive Each of these Zoom selections sets the Viewport and the Timeline to a fixed time duration 625 usec 1 Bluetooth slot 1 25 msec 2 Bluetooth slots 1 875 msec 3 Bluetooth slots 2 5 msec
273. up uses coaxial cable to directly connect the Device Under Test DUT to the analyzer antenna connectors The coaxial cable provides the isolation from the environment through shielding A 1 1 Test Equipment The following equipment is required for the test setup All cables connectors and adapters and attenuators should be relatively flat from 2 GHz to 6 GHz 1 Coaxial cable All cable must be 500 and should be double shielded 2 Coaxial T connectors 50Q 3 RP SMA adapters for connecting coaxial cable or attenuators to the antenna connectors 500 4 AT1 AT9 20 dB attenuators 500 5 Frontline ComProbe 802 11 analyzer 6 Computer for running ComProbe software A 1 2 Test Setup 802 11 The following figure show the conductive test setup For information on setting up and operating the ComProbe 802 11 refer to the ComProbe User Manuals at fte com 193 ComProbe 802 11 User Manual DUT 1 ANT2 ANT2 ANT1 AT7 AT8 AT4 ind AT5 AT1 AT2 o o gt pi lt lt lt ANT1 ANT2 ANT3 ComProbe 802 11 Appendicies DUT 2 ANT3 ANT2 ANT1 Figure A 1 ComProbe 802 11 Conductive Test Setup for 3X3 MIMO The above test setup if for 3X3 MIMO 802 11 devices If not testing this configuration the ANT3 connection to the DUTs and the ComProbe 802 11 is not used A 1 3 Test Process After connecting DUT1 DUT2 and the ComProbe 802 1
274. ur ComProbe analyzer and is stored in the Frontline ComProbe Protocol Analysis System directory The ComProbe Automation Server Protocol Programmers Guide is located in this same directory The process for automating your data capture is accomplished in three steps 1 Connect the ComProbe hardware to a computer running ComProbe software and the Automation Server 2 Launch the Automation Server program The program will listen to the commands from the Automation Client program and according control the ComProbe software 3 Write your Automation Client program use the template provided with the installation package and run it As long as there is no change in the programmed capture process step 3 can be repeated reliably and without deviation Should the test plan change the program written in step 1 can serve as a template to minimze development timeand to provide quality control tracability A 2 1 Automation Server Topology The Automation Server executes the commands issued by a user created Automation client script The client script can run either on the local PC or on a remote over a TCP IP connection The Automation Client program can be written in any language and uses the syntax defined in the ComProbe Automation Server Protocol Programmers Guide The client will bypass the local Microsoft Windows interface and interacts directly with ComProbe software One or more instances of the ComProbe software must be running along with on
275. us Not Active Capture to Single File N A used Packets on h w 0 Events 0 0 Slave O Master Events 0 For Help Press F1 Figure 7 BPA 600 Control window Stop Capture is to the right of the red button At the end of the program you will want to stop the ComProbe software so at line 900 we have the following code StopFTS Finally good programming housekeeping dictates that you should clear all connections The following procedure will disconnect the client server and breakdown the TCP connection FTEBaseCleanup This section has hit only the highlights of the sample script but it has illustrated the connection between Automation and the manual sniffing and capture of data Your programs may be more detailed and will certainly use many more commands Refer to the ComProbe Automation Server Protocol Programmers Guide for more information on the command set A 2 4 Saving Automation Captured Data The Automation Server sample script gives you a building block for building your ComProbe hardware and software sniffing and data capture process Of course the primary purpose for using ComProbe products may be to analyze the captured data to solve design and development issues and to test your products The sample script does not provide sample code for the saving and exporting of the captured data 201 ComProbe 802 11 User Manual Appendicies The Save Capture command is equivalent to clicking on the ComProbe software Control
276. ve it in the Name box followed by the date and time The date and time are when the series was opened e Restart Capturing After Saving or Clearing Capture File If the Automatically Restart feature is enabled the analyzer restarts capture to the file immediately after the file is closed e Wrap File When enabled the analyzer wraps the file when it becomes full The oldest events are moved out of the file to make room for new events Any events moved out of the file are lost When disabled the analyzer stops capture when the file becomes full Either reset the file or close your capture file to continue e File Size The size of the file will depend of the available hard disk space 1 Click the Min button to see set the minimum acceptable value for the file size 2 Click the Max button to see set the maximum acceptable value for the file size 1 2 Chapter 7 General Information ComProbe 802 11 User Manual FTS4USB dl You can accept these values or you can enter a unique file size Butif you try to close the dialog after entering a value greater A Enter an integer between 1096 and 1848267 than the maximum or less than the minimum you will see the following dialog e Start up Opens the Program Start up Options window Start up options let you choose whether to start data capture immediately on opening the analyzer e Advanced Opens the Advanced System Options window The Advanced Settings should only be changed
277. ve you to the first and last frames in the buffer respectively Use the Go To icon ka to move to a specific frame number Placing the mouse pointer on a summary pane header with truncated text displays a tooltip showing the full header text KJ Frame Display HTC Headset A2DP cfa File Edit View Format Filter Bookmarks Options Window Help GSLEG6YF S2 MD PO MALAS la kB i PAPA TAU Master Len 36 a 0o E 8 O Find X A A f i ate SDP Header Length 11 _ Unfiltered Info Configured BT low energy devices Errors Header Version 3 Baseband LMP PreConnection FHS Bluetooth FHS L2CAP OM RFCOMM AVDTP AVDTP Signaling hk AVDTP Media Hands Free A2DP Non Captured Info Role Master Ox00 07 62 0F 00 00 1 Channel 29 2431 MHz B A lock cht ane 1 Ox0001 5 earch Attib Requ 5 Handsfree Audio Gat FLOW Go 10 054 Slave 1 00001 Search Attrib Resp 00 00 00 C TYPE DH1 10 102 Slave 1 Ox0000 Search Attrib Requ Handsfree 00 00 00 4 1 1 1 Frame Role ddr Trans ID PDU ID Param L UUID S e Handle Fram Delta LT ADDR 1 10 104 Master Ox0000 Search Attrib Resp 00 00 00 C SEDN 0 10 134 Slave Ox0000 Search Attrib Requ AudioSink 00 00 00 7 ARON 0 10 135 Master Ox0000 Search Attrib Resp 00 00 00 C _ 4 m Total Frames 28 707 Frames Filtered In 18 Frame s Selected 10 053 1 total For Help Press Fl Figure 4 28 Summary pane right with T
278. version and then clicking on the Check For Updates button me ee Chapter 3 Configuration Settings ComProbe 802 11 User Manual Settings Status Capture Fitters Firmware Update Current firmware versions in hardware FPGA Version 2 2 Application Version 0 4 Interface Version Check For Updates Figure 3 8 802 11 I O Settings Firmware Update Tab The Check for Updates dialog will open If an update is available you can install it by clicking on the Start Update button The update process will begin and when finished the dialog will show a list of all completed actions Upon completion of the update you will be notified of successful installation and returned to the Firmware Update dialog The I O Settings dialog Firmware tab will open and show the old firmware version At this point the ComProbe 802 11 is rebooting You will notice the Activity LED blinking on the ComProbe hardware Click OK on the I O Settings dialog An error message will appear Ignore the message and click on the Cancel button Completely exit the ComProbe software by selecting Exit the ComProbe Protocol Analysis System from the Control window File menu Wait for a solid Activity LED on the ComProbe hardware Important Remove power from the ComProbe 802 11 hardware and reapply power Wait until the Activity LED comes back on and resume normal ComProbe operation 24 ComProbe 802 11 User Manual Chapter 3 Configuration Settings
279. vs Logical Byte Display The Event Display window and Event Pane in the Frame Display window show the physical bytes In other words they show the actual data as it appeared on the circuit The Radix Binary and Character panes in the Frame Display window show the logical data or the resulting byte values after escape codes or other character altering codes have been applied a process called transformation As an example bytes with a value of less than 0x20 the Ox indicates a hexadecimal value cannot be transmitted in Async PPP To get around this a Ox7d is transmitted before the byte The 0x7d says to take the next byte and subtract 0x20 to obtain the true value In this situation the Event pane displays 0x7d 0x23 while the Radix pane displays 0x03 4 4 1 5 Sorting Frames By default frames are sorted in ascending numerical sequence by frame number Click on a column header in the Summary pane to sort the frames by that column For example to sort the frames by size click on the Frame Size column header An embossed triangle next to the header name indicates which column the frames are sorted by The direction of the triangle indicates whether the frames are in ascending or descending order with up being ascending Note that it may take some time to sort large numbers of frames 4 4 1 6 Frame Display Find Frame Display has a simple Find function that you can use to search the Decode Pane for any alpha numeric value This functio
280. ws the details of the throughput in the time range covered Graph by the viewport in the Throughput Graph Performs the same function as the Show Zoom button When not checked the Zoomed Throughput Graph is hidden Performs the same function as the Hide Zoom button See Coexistence View Throughput Graph on page 108 Freeze Y Only active when the Zoomed Throughput Graph is visible Scales in Jovi When checked it freezes the y axis scales and makes it possible to compare all time ranges and durations Performs the same fuction as the Freeze Y button which appears Throughput l Graph with the Zoomed Throughput Graph When not checked the y axis scales are unfroozen Performs the same function as the Unfreeze Y button which appears with the Zoomed Throughput Graph See Coexistence View Throughput Graph on page 108 Show Tooltips When checked Timeline and Throughput Graph tooltips will appear in the upper left in Upper Left corner of your computer sceen You can relocate the tool tip for convenience or to see Corner of the timeline or throughput graph unobstructed while displaying packet information See Screen Coexistence View Timelines on page 118 m Menu Selections Table 4 8 Coexistence View Zoo aCtior Descriptior When clicked Ctrl Plus Viewport time duration decreased 99 ComProbe 802 11 User Manual Chapter 4 Capturing and Analyzing Data Table 4 8 Coexistence View Zoom Menu Selections contin
281. y Pane To close a pane right click on the pane and select Hide This Pane from the pop up menu or de select Show Pane Name from the View menu To open a pane right click on the any pane and select Show Hidden Panes from the pop up menu and select the pane from the fly out menu or select Show Pane Name from the View menu To re size a pane place the cursor over the pane border until a double arrow cursor appears Click and drag on the pane border to re size the pane 4 4 1 10 Frame Display Byte Export The captured frames can be exported as raw bytes to a text file 70 Chapter 4 Capturing and Analyzing Data ComProbe 802 11 User Manual 1 From the Frame Display File menu select Byte Export J Frame Display le modified channel maps HID_kbd cant_decrypt_ Edit View Format Filter Bookmarks Options Window Go Live Open Capture File Close Save Selection Reframe 1 le modified channel maps HID_kbd cant_decrypt_GATT cfa 2 example_btsnoop_hcilog cfa 3 C Users BPA500 cfa 4 C Users SDIO_20121005 cfa Print Print Preview Export Byte Export HTML Export Reload Decoders Recreate Companion File Figure 4 23 Frame Display File menu Byte Export 2 From the Byte Export window specify the frames to export e All Frames exports all filtered in frames including those scrolled off the Summary pane Filtered in frames are dependent on the selected Filter tab above t
282. y be times when the context for decoding a frame is missing For example if the analyzer captures a response frame but does not capture the command frame then the decode for the response may be incomplete The Set Initial Decoder Parameters window allows you to supply the context for any frame The dialog allows you to define any number of parameters and save them in a template for later use The decoder template function provides the capacity to create multiple templates that contain different parameters This capability allows you to maintain individual templates for each Bluetooth network monitored 29 Chapter 3 Configuration Settings ComProbe 802 11 User Manual Applying a template containing only those parameters necessary to decode transmissions particular to an individual network enhances the efficiency of the analyzer to decode data If you have decoders loaded which require decoder parameters a window with one tab for every decoder that requires parameters appears the first time the decoder is loaded For help on setting the parameters click the Help button on each tab to get help information specific to that decoder If you need to change the parameters later e Choose Set Initial Decoder Parameters from the Options menu on the Control and Frame Display windows Options Window Help Hardware Settings VO Settings System Settings Alt Enter Directories Check for New Releases at Startup Side Nam
283. your original file untouched When you first open the file the analyzer brings up the Protocol Stack window and ask you what protocol decodes if any you want to use You must choose a protocol decode at this point for the analyzer to decode the data in the file If you open a file without using any decodes and decide later that you want to apply a decode choose Reframe from the File menu on the Control window At present the analyzer supports the following file types e Frontline Serialtest Async and Serialtest Com Probe for DOS requires the byt for data and the tim for timestamps see note on importing DOS timestamps e Greenleaf ViewComm 3 0 for DOS requires the byt for data and the tim for timestamps see note on importing DOS timestamps e Frontline Ethertest for DOS requires 3 files filename cap filename caO and filename ca1 e Sniffer Type 1 supports files with the enc extension Does not support Sniffer files with a cap extension e Snoop or Sun Snoop files with a cap extension based on RFC 1761 For file format see http www fags org rfcs rfc1761 html e Shomiti Surveyor files in Snoop format files with a cap extension For file format contact Technical Support e CATC Merlin files with a csv extension Files must be exported with a specific format See File Format for Merlin Files for information e CATC Chief files with a txt extension 6 5 Printing 6 5 1 Printing from the Frame Displ

ComProbe 802.11 User Manual

Contents

Download Pdf Manuals

Related Search

Related Contents