PAGES
← all tools
◆ Hacking Hardware

ubertooth

2020-12-R1 open-source

Ubertooth is an open source wireless development platform for Bluetooth experimentation, shipping with a BLEBLEBluetooth Low Energy, a wireless protocol maintained by the Bluetooth SIG for short-range communication at minimal power draw, making it useful for cyber tools that interact with IoT devices or proximity-based systems. sniffer and Basic Rate Bluetooth Classic sniffing capability.

Summary

ubertooth is an open-source wireless development platform, paired with its own hardware, for Bluetooth experimentation, built around a BLE (Bluetooth Smart) sniffer that can also pull data from Bluetooth Classic (BR) connections. It runs as a set of command-line tools driving a physical Ubertooth device rather than as software alone, so evaluating it means budgeting for the board as well as the code. It suits people doing hands-on Bluetooth protocol research or wireless red-teaming, such as reverse engineers and radio-security testers, rather than teams looking for a passive network monitoring service. It sits in the wireless-security category alongside other RF-analysis sniffer hardware rather than any single named competitor. Development has slowed sharply: first committed in 2010 with 53 contributors over its life, but only one commit in the past year, so treat it as mature but largely dormant.

Ubertooth is an open source wireless development platform for Bluetooth experimentation, shipping with a BLE sniffer and Basic Rate Bluetooth Classic sniffing capability.

How ubertooth helps

Which Bluetooth Low Energy devices nearby are advertising, and what are they broadcasting?

listens across the BLE advertising channels and reports each device's address and advertising data as it is captured over the air

What is actually happening inside a BLE connection between two devices I don't control?

follows the connection's channel-hopping sequence after capturing its access address, decoding link-layer packets exchanged between master and slave

Can I recover the identity of a Bluetooth Classic piconet I only see radio traffic from?

survey mode extracts the LAP and UAP address pairs from Classic BR traffic and lists the piconets it can identify without needing prior pairing information

Did a capture miss packets during a burst of activity, or can I trust the timing in this trace?

later releases fixed freezing under high traffic and corrected time discontinuities in the saved capture files, but older captures or heavy traffic can still show gaps worth checking

Can I inject or emulate a BLE peripheral to see how a central reacts?

faux slave mode lets the device answer as a BLE peripheral and transmit crafted packets, useful for probing how another device's central role behaves

Is the channel map for a connection I'm tracking still accurate after it changes mid-session?

the sniffing engine follows partial channel map updates during an active connection so tracking survives the target renegotiating its hopping pattern

all 14 features, with the evidence for each →

Languages

Not documented

Features

14 capabilities · 3 backed by code, an API document or a real run

Built from ubertooth's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What ubertooth offers you

  • Command-line interface5
  • Plugin system1
All capabilities 14 capabilities
Bluetooth Low Energy sniffing shipped Sniffs Bluetooth Smart (Low Energy) traffic, including connection setup procedures and promiscuous modes. 10 releases · first seen Jan 2014

release 10 total

  • New LE sniffing engine driven by interrupts for higher packet capture rates 2018-08-R1 · Aug 2018 · source · release history
  • No-follow mode added to log only advertising packets without following connections 2018-08-R1 · Aug 2018 · source · release history
  • Improved filtering applying to all advertising packets with CIDR-style netmask support for BD ADDR filters 2018-08-R1 · Aug 2018 · source · release history
  • Partial channel map support in the new BLE sniffing engine to capture connections from modern BLE devices 2018-08-R1 · Aug 2018 · source · release history
  • ubertooth-btle -t now filters advertising packets in addition to connections 2018-06-r1 · Jun 2018 · source · release history
  • Adds support for partial channel maps and channel map updates during connection 2018-06-r1 · Jun 2018 · source · release history
Unified Basic Rate monitoring shipped Provides a unified command-line interface for monitoring Bluetooth Basic Rate traffic, replacing previous dedicated flags. 4 releases · 1 other source · first seen Feb 2014

Also counts toward: Command-line interface

release

  • Enables Basic Rate PCAP output format readable by latest Wireshark without plugins 2017-03-r2 · Mar 2017 · source · release history
  • Adds -w PCAP file output to ubertooth-rx and ubertooth-follow for Bluetooth Basic Rate traffic. 2015-09-R2 · Sep 2015 · source · release history
  • Adds -p flag to ubertooth-rx and ubertooth-follow to save captures in the new PCAP format instead of legacy btbb 2015-09-R1 · Sep 2015 · source · release history
  • Adds ubertooth-rx subcommand to replace -lap, -uap, and -hop flags for unified Bluetooth Basic Rate monitoring 2014-02-R2 · Feb 2014 · source · release history

example

  • Capture Bluetooth BR/EDR packets to a PCAP file for later analysis with the new btbredr plugin. ubertooth-rx -d <device_id> -w capture.pcap 2015-09-R2 · Sep 2015 · source
Firmware update capability shipped Identifies Ubertooth devices and allows entry into firmware upgrade mode to flash new firmware. 3 releases · 1 other source · first seen Jan 2014

release

  • Ubertooth tools may now complain that firmware is out of date if the version does not match the host code. 2017-03-r2 · Mar 2017 · source · release history
  • Adds USB API versioning to detect firmware/host mismatches and prevent operation errors 2017-03-r2 · Mar 2017 · source · release history
  • Updates ubertooth-dfu to identify Ubertooth devices and enter firmware upgrade mode, allowing multiple arguments passed in order 2012-10-R1 · Jan 2014 · source · release history

example

  • Flash new firmware to a Ubertooth device using the updated dfu tool ubertooth-dfu --write <firmware_image.dfu> --detach 2012-10-R1 · Jan 2014 · source
Classic Bluetooth sniffing and control shipped Enables sniffing of Classic (Basic Rate) Bluetooth traffic and provides basic device functionality such as l2ping, inquiry, and page scanning. 2 releases · 1 other source · first seen Mar 2017

release

  • ubertooth-btbr enables classic Bluetooth sniffing and basic device functionality (l2ping, inquiry/page scanning) 2020-12-R1 · Dec 2020 · source · release history
  • Produces Basic Rate PCAP output natively readable by latest Wireshark versions without plugins 2017-03-R2 · Mar 2017 · source · release history

docs

  • Open source wireless development platform for Bluetooth experimentation, including BLE sniffing and Bluetooth Classic BR connection analysis.
Pairing and encryption support shipped Enables pairing and decryption of encrypted Bluetooth communications when integrated with external cracking tools. 2 releases · 1 other source · first seen Feb 2014

release

  • Added holiday light demo via ubertooth-util -x 2020-12-R1 · Dec 2020 · source · release history
  • Adds pairing / encryption support when paired with [crackle](https://github.com/mikeryan/crackle) 2014-02-R2 · Feb 2014 · source · release history

example

  • Trigger the holiday light display feature ubertooth-util -x 2020-12-R1 · Dec 2020 · source
Bluetooth piconet scanning verified Discovers Bluetooth piconet devices by recovering LAP and UAP pairs, with options to target a specific UAP, run in continuous survey mode, and set a timeout for AFH map detection. 3 other sources · first seen Mar 2017

command line

  • -u — UAP of target piconet (1 byte / 2 hex digits) 2017-03-R2 · Mar 2017 · command-line history
  • -z — Survey mode: recover all LAP and UAP pairs and display them. Will run 2017-03-R2 · Mar 2017 · command-line history
  • -t — timeout for initial AFH map detection (not required) 2017-03-R2 · Mar 2017 · command-line history
Verbosity control verified Allows the user to set the level of output verbosity during tool operation. 1 release · 2 other sources · first seen Jan 2014

release

  • Updates ubertooth-dfu to identify Ubertooth devices and enter firmware upgrade mode, allowing multiple arguments passed in order 2012-10-R1 · Jan 2014 · source · release history

command line

example

  • Flash new firmware to a Ubertooth device using the updated dfu tool ubertooth-dfu --write <firmware_image.dfu> --detach 2012-10-R1 · Jan 2014 · source
Firmware versioning shipped Manages USB API versions for the Ubertooth device to ensure compatibility with updated firmware binaries. 2 releases · first seen Mar 2017

release

  • USB API bumped to version 1.07 2020-12-R1 · Dec 2020 · source · release history
  • Adds USB API versioning to detect mismatches between firmware and host code 2017-03-R2 · Mar 2017 · source · release history
Basic Rate traffic analysis shipped Provides specialized plugin support for decoding and analyzing captured Basic Rate Bluetooth traffic. 2 releases · first seen Sep 2015

Also counts toward: Plugin system

release

  • Introduces the btbredr Wireshark plugin for decoding the new Basic Rate PCAP format. 2015-09-R2 · Sep 2015 · source · release history
  • Distributes a new Wireshark plugin named btbredr for analyzing Basic Rate Bluetooth traffic captured by Ubertooth 2015-09-R1 · Sep 2015 · source · release history
Physical device injection support shipped Configures a secondary Ubertooth device to emulate a USB Rubber Ducky for physical injection attacks. 1 release · first seen Dec 2018

Also counts toward: Command-line interface

release

  • Adds ubertooth-ducky subcommand to trigger a second Ubertooth device configured as an Uberducky USB Rubber Ducky. 2018-12-R1 · Dec 2018 · source · release history
Extended device information retrieval verified Retrieves additional information about target Bluetooth devices beyond basic scan results. 1 other source · first seen Mar 2017

command line

  • -x — eXtended scan - retrieve additional information about target devices 2017-03-R2 · Mar 2017 · command-line history
Bluetooth device interference shipped Interferes with or disrupts specific Bluetooth-enabled devices through targeted commands. 1 release · first seen Sep 2015

Also counts toward: Command-line interface

release

  • Adds ubertooth-ego command-line tool specifically for interfering with BLE-enabled skateboards such as Yuneec E-go 2015-09-R1 · Sep 2015 · source · release history
Survey mode with mixed hardware support shipped Combines Ubertooth hardware with standard Bluetooth dongles for comprehensive device surveying. 1 release · first seen Feb 2014

Also counts toward: Command-line interface

release

  • Adds ubertooth-scan subcommand as a survey tool combining Ubertooth hardware and standard Bluetooth dongles 2014-02-R2 · Feb 2014 · source · release history
Piconet synchronization shipped Synchronizes with a piconet's hopping sequence using clock values retrieved from the system Bluetooth stack. 1 release · first seen Jan 2014

Also counts toward: Command-line interface

release

  • Adds the ubertooth-follow commandline tool to synchronize hopping with a piconet using clock values from libbluetooth 2012-10-R1 · Jan 2014 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for ubertooth, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail ubertooth puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

12 entries

  1. December 20201
  2. December 20181
  3. August 20181
  4. June 20181
  5. March 20172
  6. October 20152
  7. September 20152
  8. February 20141
  9. January 20141
    Show

    12 entries

    Project health

    Issue, contributor and maintainer activity in greatscottgadgets/ubertooth, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 1 +1 vs prior 12 months
    2. Maintainers 0 +0 joined · −0 left, last 12 months
    3. Bus factor 0 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close 407 days issues closed, last 12 months
    6. Open backlog 40 of 433 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 40
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 2,134
    Issue themes, last 12 months
    • other 100%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    browse all tools → score card for your toolchain →