It seems like BLE jamming is technically possible by just jamming the 3 advertising channels 37, 38 and 39 https://github.com/lws803/BLE-jammer and it has been proven to work on an STM32 + 3x NRF24l01 transceivers. Can the hackRF switch between these 3 frequencies fast enough to produce a consistent jamming effect?

Disclaimer: I understand that this is illegal and I would like to know about this for educational purposes only.


1 Answer 1


I am not revealing any big secrets here on jamming and anti-jamming techniques, nor would I condone creating any such interference. What I am about to say is quite simplistic and well known, but knowing more details in how jamming can take place and being more educated on it in general can help good actors in minimizing vulnerabilities in future designs.

Yes this is completely feasible but I would do this much more simply:

Create a single sinusoidal tone at 15 MHz and at 39 MHz.

Upconvert this tone using a carrier at 2441 MHz.

This will produce two symmetric sidebands with a tone at:

2402 MHz
2426 MHz
2456 MHz
2480 MHz

So there is one additional channel rather than just the targeted three channels in the hopping approach, but still significantly better and more effective over trying to jam the entire spectrum from 2402 to 2420 MHz, and conveniently the suppressed carrier that is at 2441 MHz is in between channels.

These tones themselves can be modulated if necessary to spread the energy over the channel bandwidth, since single tone jammers can be easily defeated with tone excision. By spreading the bandwidth, it becomes a simple SNR competition and it can't be defeated given sufficient energy, as the duration of the signal occupation will be continuous in time.

jamming condition

If no sources were readily available, below shows a feasible implementation for comparison to alternative approaches. A custom 2 layer circuit board layout would be sufficient and is \$65 from Express PCB , (the sensitive RF areas should be minimized in pcb track lengths, and for this application there would be no issue implementing this design on such a pcb with attention to proper RF layout techniques in those areas)- so a total cost of \$127 not including the low frequency noise source or DC supplies and DC control voltages. For single tones the low frequency noise source can be replaced with the same circuit as shown for the 51 MHz LO since the crystal oscillator (XO) can also be programmed for a 12 MHz output frequency. The noise source (modulated and filtered 12 MHz waveform) would be ideal for jamming purposes. The optional "carrier nulling" shown is a small DC offset (coupled in with a resistor) that can be adjusted to null any residual carrier feedthrough leakage at 2441 MHz if desired. Not shown in the spectrum above, but this would also result in suppressed carriers from the first upconverter stage in the output at 2413 MHz and 2467 MHz (also conveniently in between channels). The nulling control for this is in having a small DC offset control in the originating noise source. The nulling is feasible (and effective!) since the IF ports of both mixers have a response to DC.


  • $\begingroup$ Thank you so much for the suggestion, if you're curious I need this for a side project to build a more resilient BLE discovery algorithm, and I need to generate interference to demonstrate. Hmm if I were to visualize this in GNUradio, would it be doing it as such? (signal_source, signal_source2) ---> add -> output_sink I've tried it with the hackRF but it seems to be producing only sidebands at 2440 and 2442. $\endgroup$
    – lws803
    Commented Oct 22, 2020 at 3:08
  • $\begingroup$ I doubt the baseband bandwidth is big enough to support a 39 MHz sideband (that would be the first question). What you did if it has sidebands at 2440 and 2442 was create a 1 MHz tone. But if you are able to create the 2441 MHz carrier, and then separately generate 15 MHz and 39 MHz tones somehow at levels you can control/adjust, resistively combine them with 3 100 ohm resistors, and buy a connectorized mixer from mini-circuits and some wifi antenna and your done. $\endgroup$ Commented Oct 22, 2020 at 3:41
  • $\begingroup$ Hmm can we do it by software switching the centre frequency of the HackRF? I've heard that the HackRF has a pretty fast sweep speed. $\endgroup$
    – lws803
    Commented Oct 23, 2020 at 2:58
  • 1
    $\begingroup$ The issue is what you will be doing in each channel: it will be a pulsed jammer creating worst case a broadband sinc function jamming signal spreading across multiple adjacent channels and not just the channel of interest- to avoid that you need to transition gracefully from on to off which then limits your switch time. If you don’t care about the adjacent channels that will be less of an issue but in contrast what I suggested is quite simple; it would be more effective and take much less time to get operating consistently and effectively (could build it in 10 minutes if the sources exist) $\endgroup$ Commented Oct 23, 2020 at 3:03
  • 1
    $\begingroup$ @lws803 I updated what could be done "from scratch" assuming you didn't have any sources actually available, for comparison to what you may otherwise do with he HackRF, and the significant difference here is you will blanket all four channels shown with a continuous noise jamming signal, which can't be defeated. $\endgroup$ Commented Oct 23, 2020 at 12:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.