Enabling Bluetooth Low Energy auditing through synchronized tracking of multiple connections

This paper presents Bluetooth Low Energy Multi (BLE-Multi), a firmware enhancement to the open-source Ubertooth One that enables the sniffing of multiple simultaneous long-lived connections. To increase the capture effectiveness for long-lived connections, a novel synchronization mechanism is proposed that uses transmissions of empty packets to infer information about connection timing. Multi-connection sniffing is achieved by opportunistically switching between connections as they move from the active to inactive state, which is an inherent function in Bluetooth Low Energy to help conserve energy. The experimental evaluations demonstrate that BLE-Multi simultaneously captures multiple active connections while outperforming Ubertooth One when it captures a single connection, paving the way for the development and implementation of automated defensive tools for Bluetooth Low Energy and wireless sensor networks.