Ubertooth One
Definition
An open-source USB Bluetooth sniffing platform developed by Michael Ossmann that can capture raw Bluetooth BR/EDR and BLE frames from the air. It operates by hopping channels to follow active piconets. Output is typically a PCAP file readable in Wireshark. It is a common tool in forensic Bluetooth capture because it is open-source, inexpensive, and produces standard packet captures.
- Type
- Open-source USB Bluetooth sniffing platform
- Creator
- Michael Ossmann
- Captures
- Bluetooth BR/EDR and BLE frames
- Method
- Channel hopping to follow active piconets
- Output
- PCAP file readable in Wireshark
Common questions
Why is the Ubertooth One favoured in forensic Bluetooth capture over commercial Bluetooth sniffers?+
It is open-source and inexpensive compared to enterprise-grade protocol analysers, and because it produces standard PCAP output it integrates directly into existing packet-analysis workflows built around Wireshark rather than requiring proprietary software.
What limits the Ubertooth One's usefulness for capturing encrypted Bluetooth traffic?+
It captures the raw over-the-air frames but cannot itself decrypt link-layer encryption, so examiners still need the pairing keys or another means of decryption to read the content of an encrypted session, limiting capture alone to traffic analysis and metadata.
Related terms
- BD_ADDR (Bluetooth Device Address)
- The 48-bit hardware address assigned to each classic Bluetooth device by its manufacturer. Analogous to a MAC address on Ethernet. Unlike BLE...
- GATT (Generic Attribute Profile)
- The protocol framework used by BLE for data exchange. A GATT server exposes data as Services and Characteristics; a GATT client reads...
- Link Key / Long-Term Key (LTK)
- The cryptographic secret negotiated during Bluetooth pairing that is stored on both devices and used to authenticate and encrypt subsequent connections. In...
- Resolvable Private Address (RPA)
- A BLE address type that rotates on a timer (typically every 15 minutes) but can be resolved back to the device's true...
- RFCOMM
- Radio Frequency Communication, the Bluetooth protocol that emulates a serial RS-232 connection over an L2CAP channel. Used by profiles including Serial Port...