Bluetooth Clock Recovery and Hop Sequence Synchronization Using Software Defined Radios

Bluetooth communication is based on frequency hopping spread-spectrum and time division duplexing. Bluetooth devices must be properly synchronized so that they can hop together; the synchronization is done by using the same channel set as well as the same hopping sequence within that channel set along with the time synchronization. Frequency hopping sequences are derived from Bluetooth device addresses and clock values. During the inquiry procedure as well as in the page procedure, frequency hop synchronization (FHS) packets are exchanged which contain the device addresses and clock values for the derivation of the frequency hop sequences. This paper presents the different possibilities to intercept and demodulate the frequency hop synchronization packets exchanged during the inquiry or the page procedure. It also presents a complete SDR prototype solution to get the master's device address and its clock value, just listing for a short time on a fixed RF frequency out of the 79 Bluetooth channels, without capturing the FHS packet. The prototype system is build and interfaced with an Ettus's USRP mother board and RFX2400 daughter board using the GNU radio framework.