Supertooth Wideband Bluetooth Observation with a HackRF

Dalton presents Supertooth, a tool he built to passively observe Bluetooth traffic with a HackRF software-defined radio. He explains why Bluetooth is hard to sniff: once devices pair into a piconet, they hop across the spectrum in a pseudo-random pattern. Decoding also depends on learning the piconet's clock, since timing and whitening both derive from it, and the Ubertooth, the tool this project grew out of, handled that step only for one or two devices at a time.

The live demo shows a spectrogram covering 20 MHz, where Classic and Low Energy packets appear together. A devices view labels transport addresses as central or peripheral, with RSSI and packet-rate figures for each. The tool infers the LAP from packet traffic and works toward the UAP and clock from there. Low Energy advertising addresses are listed too, with names where they are broadcast. Dalton notes the signal processing is CPU-heavy and that weaker hardware drops packets rather than failing.

He closes by listing gaps: EDR payloads are not decoded, Low Energy decoding is basic, and hop-following and an active interrogation mode are planned. Builds for x86 Debian are on GitHub, and he invites issues. The practical takeaway is that passive Bluetooth observation with a cheap SDR is workable, but it demands substantial compute and time to lock onto a piconet.