Tracing Bluetooth With Wireshark and Hcidump

Bt-keyboard-screenshot 2Did you know that there's a very easy way to trace the Bluetooth interface between a PC and a Bluetooth dongle on a Linux PC and visualize the result with Wireshark? I didn't and also searching for it on the net only revealed bits and pieces of the puzzle on different web sites. So here's a quick overview of how it all fits together.

Many Linux distributions (such as Ubunutu) ship with the Bluez Bluetooth stack. Part of the stack are a number of very helpful command line tools. Have a look at 'hcitool' (HCI stands for Host Controler Interface, a term defined in the Bluetooth specs) to get general information about connected devices and 'hciconfig' to learn more about the capabilities of the Bluetooth chip in the PC. The most useful tool, however, is 'hcidump' that can be used to trace all Bluetooth messages that are passed between the PC and the Bluetooth chip. On my Ubuntu 12.04 LTS the 'hcidump' tool wasn't installed by default but a simple 'apt-get install bluez-hcidump' does the trick.

Bt-keyboard-screenshot 1'hcidump -X' does some basic level decoding of the messages and outputs the result in real time to the console which is an interesting first step. For more details use the 'hcidump -w filename' command to dump the raw data flow into a file. The file can then be opened in Wireshark without any conversion necessary for full decoding. The two images on the left show how a message looks like in Wireshark that establishes 'HID Interrupt Channel' for a Bluetooth keyboard and how a message looks like that is transmitted to the PC when a key is pressed on the keyboard.

When you use Wireshark make sure you have the latest version as its Bluetooth decoding capabilities have been significantly extended in the past two years. Older versions such as the one included in the Ubuntu 12.04 LTS repository can only partly decode a frame. Compiling and configuring the latest Wireshark version is a bit of a tricky thing though and I'll describe the details of that in a follow up post.

Wireless Data Usage Stats Comparison – New Year’s Eve 2011 and 2013

Two years ago, Vodafone Germany reported that they had transported 25 terabytes of data on New Year's Eve 2011 between 8 p.m. and 3 a.m. That was an average throughput of 7.93 Gbit/s as I calculated at the time. For the same period in 2013, Vodafone now has again given out numbers and the comparison is quite interesting. According to this report on Teltarif, the data traffic this time was 66 terabyte, which translates into an average throughput of 21 Gbit/s. An impressive increase perhaps partly also due to their efforts to provide high speed Internet access in underserved rural areas via LTE. In terms of yearly growth rate that's a CAGR (compound anual growth rate) of 62.7%.

What if FM Radio Had Been Invented After Internet Radio?

Over Christmas, demand for Internet radio streaming must be significantly higher than during other times. Like every year, some of the stations in my favorite list started to get a hick-up on the 23rd of December. This made me wonder what people would say if FM radio today if it had been invented after Internet radio streaming and not long before?

For sure people would say that it's a great idea because it fixes the capacity problem as there is no limit to the number of people who can listen simultaneously. Which is pretty much the only advantage from an everyday perspective, until power fails and the Internet connection drops dead, but an interesting one around Christmas.

But then the number of stations at a location is very limited compared to the thousands of web radio streams one can receive, there are different stations when one is on vacation, they might not play the music one wants to hear, too much talking, too much advertisement, etc. So if we were all used to Internet radio, would a newly invented FM radio actually have a chance if it had to start from scratch?

France Is Playing LTE Catch-Up – Deployment Statistics

So far I wasn't exactly impressed by French network operators and their LTE deployments. But it seems 2013 was the year they started to be serious about it. Today I came across current figures of 2G, 3G and LTE deployments of all network operators released by the French regulator and updated monthly. Have a look here for lots of interesting details.

Currently, Bouygues leads with 5.392 active LTE base stations. That compares to around 6.000 LTE base stations currently in operation by Vodafone in Germany (reference). The difference, however, is that most Vodafone LTE sites use the 800 MHz band and thus cover a wider area than those of Bouygues. 3G wise, Bouygues has 10.542 base stations, which is a far lower number than those of Orange and SFR.

Orange, number two in the LTE race in France has 3.879 LTE base stations on air and 17.100 UMTS base stations.

For the numbers of the other operators, have a look at the link above.

The Selfoss RSS Reader – Half A Year Later

SelfossAt the beginning of 2013, Google announced that they would shut down their Google Reader RSS service in June and so they did. Many were not amused, including me at first, but it was an incentive to make myself independent of yet another one of the few centralized cloud services I used – by setting up my own RSS server at home. After looking around I opted for Selfoss as it looked easy to use and had all the functions I required.

Some things come and go, but Selfoss has stayed. Except for a small hiccup once it keeps doing its job marvelously and even when I'm somewhere without 3G or LTE coverage and have to fall back to GPRS/EDGE, the posts remain perfectly readable as images in the posts are only loaded if a button is pressed.

Thanks Tobias (Zeising), an excellent program I can fully recommend!

The GSM Power Socket in Action – For The First Time

Power recovery in actionBack in May, I've bought a GSM enabled power socket to be able to reset my homecloud from abroad should something become stuck. Since then everything has been extremely stable and I didn't need it once. But then while I was abroad on vacation recently there was a power failure, quite a rare event and the first one this year. I noticed it quite quickly of course because my RSS server stopped responding.

What I found odd was that I didn't get a warning SMS from the GSM power socket as I've tested the functionality in the past and it was working then. There are a number of explanations for this, one of them being that the power outage was a bit more widespread and the GSM base station was also affected. I then sent a status query which was not answered. That had me worried for a bit. But at least I got an sms immediately after power was restored 50 minutes later.

The figure on the left shows how I queried the power status when I noticed that something was wrong and got no answer at first. The following two messages were then received once power was restored together with an answer to my initial status query that was stored in the SMS service center in the network an delievered once power was restored.

Hm, perhaps I should start thinking about buying a USV now. But even if my homecloud at home stays up I wonder where the DSLAM in the street gets its power from… There are some things that are just out of your hands…

Some Wi-Fi 802.11n and 802.11ac speeds in practice

Believe it or not but I am still using an 802.11g access point at home because the 802.11n access point that is part of my high end VDSL router at home is just crap. In most cases the 20 Mbit/s I can get out of it through two walls is good enough for my purposes. But my VDLS line gives me 25 Mbit/s so this is hardly a state I can tolerate much longer.

I do have another Wi-Fi access point at home who's 802.11n implementation works a lot better and I get around 70-80 Mbit/s out of it at close range in the 5 GHz band and around 50 Mbit/s through my walls. Next time I manage to be at home for more than just a few days I'll try to port my VPN server configuration from my 802.11g OpenWRT router to this box that also runs on OpenWRT and if it is as stable as my current setup it will be my configuration for the foreseeable future.

Time has moved on, however, and 802.11ac products are already on the market. The recent 1/2014 issue of the German C't computer magazine has an interesting benchmark test with real life scenarios. Speeds measured are between 700 Mbit/s at very close range between a 3×3 MIMO capable 802.11ac access point and a PCI Express card in a PC with three external antennas. But that's rather an exception.

802.11ac USB sticks are only 2×2 MIMO capable and according to the magazine, up to 200 Mbit/s are possible at very close range. In their 20 m + walls scenario the throughput is cut down to 100 Mbit/s. Quite far away from the 700 Mbit/s above but still respectable. In most other combinations that make use of 3×3 MIMO, speeds were in the 350 Mbit/s category at close range (same room but at some distance) to 150-170 Mbit/s in their 20 m + walls scenario.

Interesting numbers to be kept in mind when seeing advertisements of 1300 Mbit/s capable routers (which stands for 3×3 MIMO in the 5 GHz range). Some even advertise their routers as AC1800 because they add the theoretical maximum of 450 Mbit/s of 802.11n in the 2.4 GHz band to the 1300 Mbit/s in the 5 GHz band of 802.11ac. That's what I guess is called creative marketing.

Review – 802.11ac: A Survival Guide

When I first wanted to learn about the ins and outs of Wi-Fi many years ago I discovered what I consider the bible on the topic, '802.11 Wireless Networks – The Definite Guide' by Matthew Gast. It has since held a prime spot in my bookshelf but obviously it is now a bit outdated as it doesn't include information on 802.11n and the current latest and greatest 802.11ac standard. So when I recently wanted to deep dive into 11ac I had a look around on the web and discovered Matthew's '802.11ac survival guide'. After reading it I can very much recommend it because the level of detail and writing style was just what I've been looking for.

While it can be read on it's own if you have some background on how Wi-Fi works, newbies are better advised to first read the general chapters of his original book and then jump into the 11ac survival guide. Both books and his 802.11n survival guide are available as ebooks. If you buy directly from O'Reilly you can download it it in various formats and all of them are DRM free. I'm glad I looked before I bought the DRM protected Kindle edition over at Amazon.

To get a first impression I can also recommend this video on Youtube where he gives a talk about 11ac.

The Three Levels of SSL Security: RC4, Better Encryption, PFS

Client-helloAnother outcome of my recent activities around SSL certificates and https encryption is that I've become aware that there are quite a number of different encryption algorithms a web server can choose from to secure a connection. These range from 'probably breakable instantly' by certain security agencies to pretty much unbreakable even if the key is compromised later on. So I've categorized the SSL encryption algorithms used today as follows:

Level 1 – breakable, should not be used anymore: This category contains encryption based on the RC4 stream cipher which is still used by quite a number of websites today including banks. This is surprising but many organizations felt that their use was a necessary evil because other algorithms were at some point prone to the so called BEAST attack.

Level 2: This category contains algorithms that do not use the RC4 stream cipher but which were unfortunately prone to the BEAST attack mentioned above. All browser manufacturers have reacted in the meantime and mitigated this sort of attack. One disadvantage of algorithms in this category is that data can be decrypted in real time or even later on if was recorded should an attacker be able to obtain of the private key.

Level 3: Perfect Forward Secrecy (PFS): Algorithms in this category use Diffie-Helman (DHE) or Elliptic Curve Diffie-Hellman key exchange (ECDHE) methods to negotiate session keys. This makes it impossible to decrypt recorded traffic should the private key be compromised in the future.

Server-heloUnfortunately web browsers do not indicate which algorithm is used to secure a https connection. Agreed, most people wouldn't know what to do with the information anyway but the same is true of the certificate details that can be viewed, e.g. in Firefox. So perhaps a feature for the future?

But while browsers are little help, Wireshark comes to the rescue. The first image on the left shows an excerpt of a 'Client Hello' message during the establishment of a HTTPS connection that gives the web server a list of all supported ciphering suites the browser supports. The list is actually quite long and cipher suites are ordered by preference. RC4 based cipher suits are pretty much at the bottom of the list and so far down they didn't even make it into the screenshot. The web server then selects one of the cipher suits and informs the web browser with a 'Sever Hello' message which one it has selected. This is shown in the second picture on the left. In this case an Elliptic Curve Diffie-Hellman cipher suite with perfect forward secrecy was selected. Excellent!

For further information I can recommend the SSL-Labs website. It offers an interesting SSL test for web sites and shows which ciphering suites are used when used with different browsers and gives lots of interesting background information (such as why RC4 should not be used anymore and why PFS is the way to go).

My Personal Technology Highlights in 2013

The year is drawing to a close and I had some time over Christmas to reflect what has been going on this year and I found quite a number of defining moments on the technology front. Here's my personal top 10 list of things that mattered to me personally in technology in 2013

1. LTE goes Mainstream

While first networks were deployed already in 2009, this year has been the year of LTE in the mass market. There is a myriad of LTE smartphones in the market now, and I use it myself day in and day out over Wi-Fi tethering to acccess the Internet. Actually, from a daily duration perspective, I access the Internet more over LTE than over my VDSL line at home. Also, 2013 saw circuit switched fallback (CSFB) delays significantly shrinking in some networks and it has thus become usuable on a smartphone as well and not only for PC tethering.

2. Raspberry Pi

A breakthrough on many fronts came when I bought my first Raspberry Pi this year. In one sentence I would say that the Raspi opens the world to inexpensive computing with Linux and Internet connectivity and bridges the gap (which is perhaps only in my mind) between standard desktop computing, embedded computing , and mobile devices such as smartphones. Hallo of them (can) have a Linux kernel today and are programmed in the same way and with the same tools.

3. Owncloud

Cloud services have become popular in the past few years for file sharing, backup, synchronization of calendar and address books between devices, etc. One thing that kept me away from cloud services over the years was that I would have had to put my private data at the mercy of huge companies and I was not willing to do that. And then I discovered Owncloud which which I could finally benefit from cloud services and have everything stored on my own hardware in my own place. Running Owncloud on a Raspberry Pi completed the setup for me and I'm not only in the cloud now, I'm in heaven. Finally the cloud makes sense to me.

4. The PRISM shock

In the global scale, Edward Snowdon's revelations that started with the PRISM scandal had me shocked beyond imagination and I'm still not sure I'm out of it. In the aftermath I've written many blog posts on how I further tightened the security and secrecy of my online communication with Owncloud only being one part of the puzzle. I started using TOR for sensitive web browsing, I've protected my Owncloud setup with a real SSL certificate, instant messaging communication between familiy members now runs of my own Messaging server at home, I have a VPN server at home to tunnel all Internet traffic via my VDLS line at home while I'm not there, I've experimented with email encryption etc. etc. And the PRISM shock has altered my voting behavior in the general elections as the party I wanted to vote for was in a constant denial of the state of things and unfortunately still is. Lots more could be said about this but I let my many posts on the topic speak for themselves.

5. Busch 2090

On the history track I discovered my first computer I always wanted to have but never got, the Busch 2090 experimental kit. It inspired my to have a closer look at electronics tinkering again and I managed to get an original via ebay.

6. Finding Out How a CPU works

The Busch 2090 that lead me down the history trail also made me starting thinking again how a CPU works. I had a rough idea but the big mystery was how the control unit worked. I finally found two resources that explained the concept of a hard wired control unit and a microcode based control unit and in only a few hours I could finally understand what had remained a mystery so far. For me it was the last piece in the puzzle between digital electronics and a working computer.

7. Data Roaming in Europe becomes affordable

2013 has been the year in which data roaming became cheap enough in Europe so I no longer had to  get local SIM cards in many cases. I still did in other places such as Hong Kong and South Korea but not in Europe anymore.

8. OpenStreetMap and Osmand – Google Mapping Independence

Another liberator has been OpenStreetMap and the corresponding Android Application, 'Osmand'. Finally I no longer have to tell Google, Yahoo or Microsoft where I am when looking at maps, it can remain private now. Also, Osmand is offline capable and it can navigate perfectly with maps downloaded to a smartphone. Very important when roaming as despite reduced data roaming prices, navigation and map downloading remains expensive in Europe and not affordable in the rest of the world. Privacy and offline maps, a great combination!

9. Bye Bye Symbian – Shedding Tears

2013 has also been the year in which I had to say good-bye to Symbian. For me it was THE smarpthone operating system that brought the breakthrough for the Internet on mobile devices. I would have loved to migrate to Meego but that was not to be due to the unfortunate events at Nokia. It makes me sad as Nokia was the last European mobile device manufacturer. So I replaced Symbian with Android as it was the least bad of the available alternatives for me. But looking ahead things look brighter with activities around Meego's successor 'Sailfish' and other projects such as Ubuntu on smartphones that might restore my need for privacy again that Google's Android can't give me.

10. Bye Bye Windows – Not Sheeding Tears

And finally, one thing I won't shed tears about is that I got rid of the last Windows computer at home. Not only mine but alll PCs and notebooks at home are now running Linux which puts me at great ease as open source now reigns at home.

So those were my personal 2013 technology highlights paving the way for an interesting 2014!