HCI_INQUIRY fails if device is pinging others

[prc]

Hello.

I found out a little problem with bluetooth devices when working on my bachelor's thesis project.

We have a kind of middleware software under development for mobile devices.

To find devices (on bt connection) we use hci_inquiry function in linux (c/c++) which works quite well. Our inquiry interval at the moment is approx 30 seconds, if we try to inquiry too fast, we don't find any devices.

Now.. our middleware has an option to monitor a specific device (based on device mac addr). This monitoring is basically a PING sent to the other device, which should respond to it. And they do respond.

Problem is that when device A is pinging device X, the device A's inquiry fails totally, it will not find any devices at all. Our ping interval is 1 second, which I think is too short and interferes with the inquiry method of bt protocol.

I am going to try to set much much longer ping interval, but I had a thought that this could be used as kind of DoS attack against other BT devices. (Dunno if I have time to test this).

But the attack might be doable like this.

1) HCI_INQUIRY (store devices to some where)

2) START N pinger threads (1 for each device)

3) PING all devices really fast.

I am not sure, if this will cripple the target device's inquiry, but at least at this point it seems the source cant get any responses to it, so it might be possible that the target device wont either. I think this should not affect target device, if it just drops the PING packets, but dunno about it either.

Imagine someone running such program for example on mobile phone while moving in public places

-- Update --

Apparently we had a small testing application that I could modify in a few minutes to do some ping testing on devices.

Not all bt-devices which are pinging others lose their inquiry functionality, seems that most badly affected one here is 3COM (3creb96) usb-bluetooth dongle. Tho others lose some of the inquiry tries.

3COM also seems to get some inquiries trough, when there is only inquiry running while its pinging. When I run my own service which polls several connections with select, inquiries other devices via Daemon, and pings device being monitored it will lose them all. So it is related to load on the connection / protocol stack.

The device being pinged is hardly affected. Only 2 failed inquiries (empty inquiries) out of approx 30-40 tries.