The SDC-WB40NBT is a Wi-Fi and Bluetooth Device Server module that supports 802.11a/b/g/n and Bluetooth 2.1. The module is a complete wireless communications subsystem that may be integrated into a variety of host devices via a number of available electronic and logical interfaces including UART, SPI, SDIO and Ethernet. The module features a fully integrated IP stack and web server running on a Linux 3.0 kernel and may be accessed via a provided command line or browser interface for easy configuration and monitoring.


BT Capable
BT Chipset
BT Dual Mode
BT Interfaces
Dimension (Height - mm)
3 mm
Dimension (Length - mm)
47 mm
Dimension (Width - mm)
37 mm
Spatial Streams
Temp Spec
-30C +80C
Wi-Fi Chipset
BCM 4329
Wi-Fi Interfaces
Wi-Fi Spec
Part NumberAntenna TypeChipset (Wireless)Frequency Range (Max)Frequency Range (Min)Frequency Range 2 (Max)Frequency Range 2 (Min)Logical InterfacesOS/SoftwareProduct TypeSystem ArchitectureTechnologyType
End of Life (EOL)
Buy Now
External Broadcom BCM4329 2495 MHz2400 MHz5825 MHz5150 MHzSPI, USB, I2C, GPIO, PCM, Ethernet, Serial, SDIO Linux Embedded Module Hostless 802.11abgn, Bluetooth Classic Module


Name Part Type Last Updated
Application Note - WB Firmware Update.pdf All Application Note 01/17/2019
Antenna DS - HS Sencity.pdf All Certification 01/17/2019
RoHS 3 Compliance - Wi-Fi Products All Certification 01/11/2024
User Guide - WB40NBT Command Line Utility.pdf All Documentation 01/17/2019
Quick Start Guide - WB40NBT.pdf All Documentation 01/17/2019
Application Note - 40 Series Bluetooth.pdf All Documentation 01/17/2019
User Guide - Summit Software Developers Kit.pdf All Documentation 01/17/2019
User Guide - Laird Command Line Interface.pdf All Documentation 01/17/2019
Reference Guide - Common Vulnerabilities and Exposures All Documentation 02/14/2019
Datasheet - WB40NBT.pdf All Datasheet 02/22/2021
wb40nbt rev6 3d model.zip All Software 01/17/2019
src wb40n-laird- All Software 01/17/2019
wb40n-laird- All Software 01/17/2019
Application Note - Guidelines for Replacing Antennas v1.0 All Application Note 01/17/2019
EU Certifications - WB40NBT - 2020 All Certification 10/06/2020
FCC Certifications - WB40NBT All Certification 10/02/2020
ISED (Canada) Certifications - WB40NBT All Certification 10/02/2020
NCC (Taiwan) Certifications - WB40NBT All Certification 10/02/2020
AS/NZS Certifications - WB40NBT All Certification 10/02/2020
Regulatory Information - WB40NBT All Certification 06/10/2021
ISED ICES-003 Issue 7 Declaration of Compliance All Certification 05/18/2021


Does the Kr00k vulnerability have an impact on the 40 series radios?

Ezurio (formerly Laird Connectivity) is actively working with our vendor to patch the kr00k vulnerability on Ezurio products. Unfortunately, at this time a firmware fix has not been provided for the BCM4329 (used in the 40 Series products). Based on an understanding that this vulnerability has a severity level of “low” by NIST, it is recommended that customers use TLS data encryption whenever possible as TLS tunneled data is not at risk for the kr00k vulnerability.

For more information on the vulnerability, please visit:


For EAP tunnel authentication, what is the outer ID set in the packet?

By default, it will show annoSUMMIT as outer ID to protect the ID not showing in public. If really need to show the real ID in outer ID, then need to add semicolon (;) at the end of ID configuration to make it happen.



Who is responsible for providing the Bluetooth QDID for a host system?

The responsability for providing the QDID for a host system is with the provider of the stack that is used on that system. If for instance the host system uses a module that requires the Bluetooth stack to run on that system (e.g. Lairds Sterling-LWB in a Linux platform) the QDID must be provided by the stack vendor whos stack is running on that Linux platform. Challenges might occur when an open-source, community based stack is used. If a module with integrated stack us used (e.g. Lairds BL652) the QDID is provided by the module vendor.  



Can our wireless bridge products (WB40, 45, 50) be used as a SoM (System on Module)?

Yes, we can position our WB as a SoM.  Technically speaking, the WB is a SoM, but we historically haven?t marketed it as such. Our Wireless Bridges are suitable for instance as the main processing unit for a headless (no screen) IoT product. The WBs have everything needed for a SoM except graphics/screen capabilities.   

How can I control / switch between different WiFi modes on Laird WiFi modules in a Linux system? E.g. Access Point, Ad-hoc, Client, Wi-Fi direct/P2P when available?

All this can be controlled through standard Linux commands/programs like ?iw?, ?hostapd?, ?wpa_supplicant?, ?wpa_cli?, etc.

What is the ECCN for "Summit" Wi-Fi radios?

The ECCN for the radios listed, which comprise the "Summit" line of Wi-Fi radios, is 5A002.

Does Ezurio provide 3D files for modules?

Ezurio provides 3D files (STEP) files for most but not all of it's modules.  Based on the nature of the information in the files, in most cases Laird requires a login to access these files as well as layout files and software/firmware downloads.  As such, for most modules, the 3D files are found under the Software Downloads tab of the product page.  The page offers a credentials request link for customers who need credentials.  In most cases, the credentials are provided via return email within about 10 minutes. Please contact support if you have any additional questions or have any issues accessing our downloads.

Do we recommend conformal coating your modules?

We highly do not recommend conformal coating the radio module. If you plan on encapsulating the radio module in a potting compound or conformal coating, you must assure that the compound in liquid or solid form does not enter under the shield where there are sensitive RF components. Some of the capacitive and inductance values are as low (pF and nH) and could be sensitive to contacting materials such as potting compounds. There are potting compounds and conformal coatings which have very good dielectric constants and are suitable for 2.4 GHz potting applications, however, when you apply any of these, they were not accounted for in the circuit design and might reduce performance of the device (or all together cause it not to function).  You should run tests on their particular potting compound and evaluate radio's performance and range.  Also, it's worth mentioning that applying any compound, conformal coating or potting directly to the module WILL void the warranty. If your application requires 100% sealing of the radio module, there is a way to do this very successfully without impacting the module performance. Simply place the module on your PCB. Place a plastic cover over the module (like a hat), make the cover large enough to cover the whole module. Apply glue around the bottom perimeter of the cover where it sits on the PCB. This allows the module to function in free air-space while there is a complete seal around it. This information is only for reference and we recommend you should conduct your own testing with your prototype of your end application to find the best suitable fit for your design.  

How many reflows do you recommend for your modules?

We only recommend reflowing our modules once as it can damage the module and void the warranty.

What are the available CAD file formats?

Ezurio provides layout files PADS and PADS ASCII formats. The ASCII files will import to Altium (and Protel varients) as well as Cadence (Orcad and Allegro) CAD packages. As far as we know, there is no way to import to Eagle CAD. Please be sure to use the .asc file for PCB and the .txt file for the schematic when importing to Altium. Ezurio uses ORCAD for schematics (Gerbers). 

What's the recommended process to clean modules?

The recommended cleanser is "hydrocarbon cleaning oil", which can be used to clean the RF shield and PCB. We do not recommend the use of alcohol as it doesn't work as well and could leave residue on the boards.  

Which EAP types Laird supports in CCKM?

CCKM is supported with all EAP types Laird supports?LEAP, EAP-FAST, PEAP-MSCHAPv2, PEAP-GTC, PEAP-TLS, EAP-TLS and EAP-TTLS. ACS supports all of the EAP types except EAP-TTLS. However, supporting CCKM is not dependent on using ACS as the RADIUS server. Laird can do CCKM with any RADIUS server since CCKM support is in the wireless infrastructure.

As the PMKcaching, two options in the setting, standard or opmk. What is the definition of these two options?

Standard: indicates PMK Caching: This means that the 802.1x authentication can be skipped on an access point that a client has already authenticated to once before. Only the 4-way handshake needs to happen. This is useful for a client that needs to reconnect to an access point that it roamed away from previously, due to signal loss etc. However, if a client has not roamed to a particular access point during its current working session, it must then authenticate to that specific access point using 802.1x. PMK Caching is the method defined in the 802.11x (WPA/WPA2) specification. Opportunistic Key Caching: With this method, a client device can skip the 802.1x authentication with an access point after a full authentication,and only needs to perform the 4 way handshake when roaming to access points that are centrally managed by the same WLC in an LWAPP or other controller-based infrastructure. This means that the client doesn't need to authenticate with access points that it wants to roam to, as long as the client has authenticated successfully to at least one of the access points in the same zone as the access point that handled the previous successful authentication. In this case, the PMK identifier has been cached at a central location, like the WLC (or wireless switch.) With OKC, the client must support this method for it to be used, even if the infrastructure has been configured with OKC enabled.

How can I receive BT and WLAN packets simultaneously?

Q: I was told that the the module is able to receive BT and WLAN packets in the same time and it is able to address the packet in the right way. But I do not understand if it is possible, using the SRU (in test mode), to set the receiving mode for the BT and the WLAN in the same time. Could you help me?

A: Here are considerations you can take.

  • 40NBT supports 802.11a/b/g/n dual band radio but not simultaneous dual-band operation.
  • 40NBT supports simultaneous BT/WLAN receive with single antenna.
  • Aux and Main port can receive a signal at a time (played by a switch) So, only case that can receive signal at the same in the below table is BT 2.4Ghz + WLAN 2.4Ghz on Aux port.

KCC domain

The attached document is the list current channels for the KCC domain as of 2015. In document, red means DFS required.

What is the difference between eap-mschapv2 and mschapv2 in EAP_TTLS?

With EAP-MS-CHAPv2, the data sent in tunnel will be encapsulated as EAP-MESSAGE AVP (attribute-value pair). In the case of MS-CHAPv2, there is no such extra encapsulation it is just the MS-CHAPv2 message.


What connector types do your Wi-Fi radios support?

A list of our radios and supported connector types can be found here: WiFi + Bluetooth Modules

How do you go about switching via uboot to a good partition?

Here are the instructions to switch partitions from u-boot: #To revert to kernel-a and rootfs-a: setenv bootargs 'console=ttyS0,115200 loglevel=4 rw noinitrd mem=64M rootfstype=ubifs root=ubi0:rootfs ubi.mtd=6' setenv bootcmd 'nand read 0x22000000 0x000E0000 0x00280000; run _mtd; bootm' saveenv #To revert to kernel-b and rootfs-b: setenv bootargs 'console=ttyS0,115200 loglevel=4 rw noinitrd mem=64M rootfstype=ubifs root=ubi0:rootfs ubi.mtd=7' setenv bootcmd 'nand read 0x22000000 0x00360000 0x00280000; run _mtd; bootm' saveenv note: setenv your ubi.mtd might be different depending on kernel version.

DFS channels in KCC

The following channels require DFS in Korea KCC/KC domain. Channel Frequency MHz 52 5260 56 5280 60 5300 64 5320 100 5500 104 5520 108 5540 112 5560 116 5580 120 5600 124 5620


What are the reasons for the null packets in an RF trace?

There are two reasons to send out null packets with p bit enabled. 1. Its RSSI has crossed over the Roam Trigger and the client radio is supposed to start scanning for a new AP. 2. The client radio is running one of our power-save modes (Fast or Max) and is going to sleep for a brief (e.g. 20 ms) period and is telling the AP so it will buffer traffic for it while it sleeps. After a radio has slept for some period of time (defined as the interval between DTIM periods) it is supposed to wake up and indicate to the AP that it is awake by sending a null packet with the P-bit turned off. The radio should only wake if it has traffic to send or it sees from the DTIM in the AP?s beacons that the AP has traffic to send to it.


How do I set console loglevel in WB40/WB45 in run time and how to keep the setting even after next boot?

To change the loglevel in run time, you can echo the number to /proc/sys/kernel/printk. However, this setting is in RAM and won't be kept in next boot. # echo 8 > /proc/sys/kernel/printk To keep this setting, you need to set it in bootargs in boot loader configuration. Such as add an extra setting "loglevel=4" as below. bootargs='mem=32M console=ttyS0,115200 ubi.mtd=6 root=ubi0:rootfs rootfstype=ubifs loglevel=4 rootflags=bulk_read,chk_data_crc rw'

In EAP-TLS, there is a setting of username. What is the purpose of it? Will it be used during the authentication? Does it need to be the same as in CA?

EAP-TLS is a tunnel authentication. outer identity: this is the User-Name in the RADIUS packet and visible to all intermediate parties inner identity: this is the actual user identification. It is only visible to the user himself and the Identity Provider The user cert is issued to a user identified by the username, so the username has to be configured so we know which user cert we should be using for the authentication. By default, the username is also used during authentication as the outer identity which gets sent in the identity response packet.


mandatory/optional input for EAP type

mandatory/optional input for EAP type   EAP credentials Mandatory input Optional input LEAP User name, user password   EAP FAST User name, user password PAC file, FAC password PEAP MSCHAP User name, user password CA cert PEAP GTC User name, user password CA cert EAP TLS User name, user cert CA cert EAP TTLS User name, user password CA cert PEAP TLS User name, user cert CA cert   Note 1: this settings should be read in user perspective but not for actual implementation. For example, when a user does not input PAC file, it will use auto PAC provisioning. If a user inputs it, it will do a manual PAC provisioning. Note 2: user password is not used for TLS but only user cert is used instead.    


Why is my device using the 40NBT disconnecting from WiFi when scanning for a bluetooth connection?

The WB40NBT uses WiFi/BT Coexistence on the module. This disconnection is normal as the antennas on the device are saturated from the scanning and discovery process. WiFi will reestablish a connection when the Bluetooth scanning is complete. This happens because the BT portion of the radio requests access to the RF portion of the radio.  The request will have a priority associated with it depending on the type of request (tx, rx, scan, etc.).The WLAN portion will then either grant or deny access to the RF based on what it is currently doing and taking into account the priority of the BT request.

40NBT SDK: Can I send data over SPP via BT SDK?

Q: Do you have any C / C++ examples of how to set up an SPP service and exchange data across it using the Laird BT SDK? For example a simple "Chat" example? What I want to do is set up an SPP connection between the Laird module (running on our system acting as a server) and an Android tablet / phone acting as a client. I want to be able to send / receive data over this SPP link.

A: The Bluetooth SDK does not handle the SPP data directly. The SPP data is piped through a Virtual Serial Port that is installed on the system when the stack starts. Also, by default the stack has an SPP Service running when it starts. Typically when the SPP Service is installed it is running on COM Port #7 (this is the default number that the SPP service uses). You will have to.

  1. Have the tablet discover and pair with your Laird module (on your system acting as a server).
  2. The tablet should do a search for services and will find the Laird module has an SPP service available.
  3. The tablet will then connect on your service. From there, you will have to open a COM port using Microsofts API call of CreateFile(). Something similar to the effect of CreateFile("COM7:", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL ); Here is an example for opening the COM port. You must make sure that your tablet supports SPP as well. If SPP isn't supported then your tablet will not be able to discover your Laird Modules' SPP service.

Become an Ezurio Customer to Gain Exclusive Access to Our Design Experts

  • Antenna Scans
  • Antenna selection and placement
  • Custom antenna design
  • Worldwide EMC testing / certifications
  • Embedded RF hardware / firmware design
  • Cloud architecture and integration
  • Mobile application development
  • Product & Industrial Design

Talk to an Expert


Distributor Phone Number Region Website
Arrow Electronics 1-855-326-4757
+44 2039 365486
APAC, North America, South America, EMEA Website
Avnet 1-480-643-2000
+44 1628 512900
APAC, North America, South America, EMEA Website
Braemac Australia, New Zealand, South East Asia +61 2 9550 6600
+64 9 477 2148
APAC Website
Cal-Chip Connect 1-215-942-8900
North America Website
DigiKey 1-800-344-4539
North America, South America, APAC, EMEA Website
EBV Elektronik EMEA Website
Farlink Technology China, Hong Kong +86 13266922199
APAC Website
Farnell 1-800-936-198
+44 3447 11 11 22
EMEA Website
Future Electronics 1-800-675-1619
North America, South America, APAC, EMEA Website
Glyn +49-6126-590-0
EMEA Website
Hy-Line Germany Only +49 89 614 503 0
EMEA Website
Jetronic China, Hong Kong and Taiwan 852-27636806 
APAC Website
Laird Connectivity 1-847-839-6925
+44 1628 858941
North America, South America, APAC, EMEA Website
M2M Germany +49-6081-587386-0
EMEA Website
Martinsson +46 8 7440300
EMEA Website
McCoy South East Asia +65 6515 2988
APAC Website
Mouser 1-800-346-6873
+44 1494 427500
North America, South America, APAC, EMEA Website
RS Components +852-2421-9898
+44 3457-201201
North America, South America, APAC, EMEA Website
Ryoyo Japan +81-3-3543-7711
APAC Website
Solsta UK Only +44 (0) 1527 830800
EMEA Website
Supreme Components International India, South East Asia +65 6848-1178
APAC Website
Symmetry Electronics 1-866-506-8829
North America Website
Tekdis Australia and New Zealand +61 3 8669 1210
APAC Website
Telsys +972 3 7657666
EMEA Website
WPG +44 1628 958460
EMEA Website