diff --git a/host/doc/man/ubertooth-btle.1 b/host/doc/man/ubertooth-btle.1 index 3fd38964..110bd000 100644 --- a/host/doc/man/ubertooth-btle.1 +++ b/host/doc/man/ubertooth-btle.1 @@ -36,6 +36,9 @@ sent between the central and peripheral. After the connection terminates, Ubertooth will return to the advertising channel and wait for another connection. .PP +No\-follow mode is similar to follow mode, but it only logs advertising +packets and will not follow connections as they are established. +.PP Promiscuous mode is an experimental mode for sniffing connections after they have already been established. This mode can be used to sniff long\-lived connections. @@ -83,7 +86,7 @@ advertising packets but only follow connections based on the filter parameters. As of 2018\-06\-R1, advertising packets that do not match the filter are dropped. .PP -In both sniffing modes, Ubertooth can log data to PCAP or PcapNG with a +In all sniffing modes, Ubertooth can log data to PCAP or PcapNG with a variety of pseudoheaders. The recommended logging format is PcapNG (\fB\fC\-r\fR) or PCAP with LE Pseudoheader (\fB\fC\-q\fR). For compatibility with crackle (see [USING WITH CRACKLE][]), use PCAP with PPI (\fB\fC\-c\fR). @@ -110,6 +113,14 @@ ubertooth\-btle \-f \-A 38 \-r log.pcapng .fi .RE .PP +Log advertising packets without following connections: +.PP +.RS +.nf +ubertooth\-btle \-n +.fi +.RE +.PP Interfere with connections recovered with promiscuous mode: .PP .RS @@ -138,6 +149,9 @@ Major modes: \fB\fC\-f\fR : Follow mode: sniff connections as they are established .IP \(bu 2 +\fB\fC\-n\fR : +No\-follow mode: log advertising packets but don't follow connections +.IP \(bu 2 \fB\fC\-p\fR : Promiscuous mode: sniff already\-established connections .IP \(bu 2 diff --git a/host/doc/ubertooth-btle.md b/host/doc/ubertooth-btle.md index 2c2ddfa2..fee2f532 100644 --- a/host/doc/ubertooth-btle.md +++ b/host/doc/ubertooth-btle.md @@ -29,6 +29,9 @@ sent between the central and peripheral. After the connection terminates, Ubertooth will return to the advertising channel and wait for another connection. +No-follow mode is similar to follow mode, but it only logs advertising +packets and will not follow connections as they are established. + Promiscuous mode is an experimental mode for sniffing connections after they have already been established. This mode can be used to sniff long-lived connections. @@ -64,7 +67,7 @@ advertising packets but only follow connections based on the filter parameters. As of 2018-06-R1, advertising packets that do not match the filter are dropped. -In both sniffing modes, Ubertooth can log data to PCAP or PcapNG with a +In all sniffing modes, Ubertooth can log data to PCAP or PcapNG with a variety of pseudoheaders. The recommended logging format is PcapNG (`-r`) or PCAP with LE Pseudoheader (`-q`). For compatibility with crackle (see [USING WITH CRACKLE][]), use PCAP with PPI (`-c`). @@ -88,6 +91,10 @@ PcapNG: ubertooth-btle -f -A 38 -r log.pcapng +Log advertising packets without following connections: + + ubertooth-btle -n + Interfere with connections recovered with promiscuous mode: ubertooth-btle -p -I @@ -105,6 +112,8 @@ Major modes: - `-f` : Follow mode: sniff connections as they are established + - `-n` : + No-follow mode: log advertising packets but don't follow connections - `-p` : Promiscuous mode: sniff already-established connections - `-s` :