Skip to content

Commit

Permalink
doc: document no-follow mode in ubertooth-btle
Browse files Browse the repository at this point in the history
  • Loading branch information
mikeryan committed Aug 7, 2018
1 parent fec3f3d commit 57e0426
Show file tree
Hide file tree
Showing 2 changed files with 25 additions and 2 deletions.
16 changes: 15 additions & 1 deletion host/doc/man/ubertooth-btle.1
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,9 @@ sent between the central and peripheral. After the connection
terminates, Ubertooth will return to the advertising channel and wait
for another connection.
.PP
No\-follow mode is similar to follow mode, but it only logs advertising
packets and will not follow connections as they are established.
.PP
Promiscuous mode is an experimental mode for sniffing connections after
they have already been established. This mode can be used to sniff
long\-lived connections.
Expand Down Expand Up @@ -83,7 +86,7 @@ advertising packets but only follow connections based on the filter
parameters. As of 2018\-06\-R1, advertising packets that do not match the
filter are dropped.
.PP
In both sniffing modes, Ubertooth can log data to PCAP or PcapNG with a
In all sniffing modes, Ubertooth can log data to PCAP or PcapNG with a
variety of pseudoheaders. The recommended logging format is PcapNG
(\fB\fC\-r\fR) or PCAP with LE Pseudoheader (\fB\fC\-q\fR). For compatibility with
crackle (see [USING WITH CRACKLE][]), use PCAP with PPI (\fB\fC\-c\fR).
Expand All @@ -110,6 +113,14 @@ ubertooth\-btle \-f \-A 38 \-r log.pcapng
.fi
.RE
.PP
Log advertising packets without following connections:
.PP
.RS
.nf
ubertooth\-btle \-n
.fi
.RE
.PP
Interfere with connections recovered with promiscuous mode:
.PP
.RS
Expand Down Expand Up @@ -138,6 +149,9 @@ Major modes:
\fB\fC\-f\fR :
Follow mode: sniff connections as they are established
.IP \(bu 2
\fB\fC\-n\fR :
No\-follow mode: log advertising packets but don't follow connections
.IP \(bu 2
\fB\fC\-p\fR :
Promiscuous mode: sniff already\-established connections
.IP \(bu 2
Expand Down
11 changes: 10 additions & 1 deletion host/doc/ubertooth-btle.md
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,9 @@ sent between the central and peripheral. After the connection
terminates, Ubertooth will return to the advertising channel and wait
for another connection.

No-follow mode is similar to follow mode, but it only logs advertising
packets and will not follow connections as they are established.

Promiscuous mode is an experimental mode for sniffing connections after
they have already been established. This mode can be used to sniff
long-lived connections.
Expand Down Expand Up @@ -64,7 +67,7 @@ advertising packets but only follow connections based on the filter
parameters. As of 2018-06-R1, advertising packets that do not match the
filter are dropped.

In both sniffing modes, Ubertooth can log data to PCAP or PcapNG with a
In all sniffing modes, Ubertooth can log data to PCAP or PcapNG with a
variety of pseudoheaders. The recommended logging format is PcapNG
(`-r`) or PCAP with LE Pseudoheader (`-q`). For compatibility with
crackle (see [USING WITH CRACKLE][]), use PCAP with PPI (`-c`).
Expand All @@ -88,6 +91,10 @@ PcapNG:

ubertooth-btle -f -A 38 -r log.pcapng

Log advertising packets without following connections:

ubertooth-btle -n

Interfere with connections recovered with promiscuous mode:

ubertooth-btle -p -I
Expand All @@ -105,6 +112,8 @@ Major modes:

- `-f` :
Follow mode: sniff connections as they are established
- `-n` :
No-follow mode: log advertising packets but don't follow connections
- `-p` :
Promiscuous mode: sniff already-established connections
- `-s<BD ADDR>` :
Expand Down

0 comments on commit 57e0426

Please sign in to comment.