Probes connect the circuit to the scope. They are not passive: they have impedance, capacitance, bandwidth, and they can substantially load the circuit. Choosing a probe is as important as choosing the scope.
10.1 1x probe (passive, no division)
A simple coax cable with a clip. The scope sees exactly what's at the tip, but it sees it through the cable's capacitance plus the scope's input cap, total typically 80-150 pF. Useful only for low-frequency, low-impedance circuits. Bandwidth often only 6 MHz despite a 100 MHz scope.
10.2 10x probe (passive, divider)
The standard probe. Inside the probe tip is a 9 M resistor; combined with the scope's 1 M input, you get a 10:1 voltage divider:
Tip ──9 MΩ──┬────── coax ──── Scope (1 MΩ // 20 pF)
│
─┴─ C1 (~13 pF, adjustable)
│
⏚The probe attenuates by 10 (so a 5 V signal shows as 0.5 V on the scope, multiplied by 10 in software). Net input impedance: 10 M // ~13 pF (much higher than the bare scope), a much lighter load on the circuit.
The trick is that the probe also has a parallel cap that compensates for the scope's input cap . For frequency-flat response, the time constants must match: i.e., , so when matched. In practice the probe has a screwdriver-adjustable trimmer in the BNC end that you tweak while looking at a square wave from the scope's "probe comp" output. Properly compensated: square edges, flat tops. Over-compensated: overshoots. Under-compensated: rounded tops.
Always compensate a new probe before measuring; thermal drift, swapping scopes, or just time can change the cap values. A 10-second adjustment can save you hours of confusion when a square wave doesn't look square.
10.3 Active probes
For sub-nanosecond rise times, the 13 pF input cap of a passive probe is too much. Active probes have a buffer amp (FET-input op-amp or specialized GaAs MESFET) right at the tip, presenting picofarads of input cap and gigaohms of input resistance. They are powered (often through a special probe interface on the scope) and they have bandwidth-matched coax back to the scope. Examples: Keysight InfiniiMax, Tektronix TPP and P series, LeCroy ZS series. Bandwidth: 1 to 30+ GHz.
10.4 Differential probes
Measures voltage between two points, neither of which is ground. Essential for floating measurements (across a switching transistor whose source is not ground, or across a strain-gauge bridge output). Inside is a difference amplifier with high common-mode rejection. The probe takes V+ and V- inputs and reports V+ - V-.
For hardware security: differential probes are essential for measuring chip-core power. The chip's rises above ground by some amount, but to measure relative to ground you need to subtract them, and a differential probe does this with high CMRR (common-mode rejection ratio) so noise on the ground reference is rejected.
10.5 Current probes
Measure current without breaking the circuit. Two main types.
Hall-effect current probe. A clamp-on probe with a Hall sensor in the magnetic gap. Reads DC and AC; bandwidth typically MHz range. Tektronix TCP series.
Rogowski coil. A flexible coil that wraps around a conductor; sensitive to dI/dt, integrated to recover I(t). AC only, but very high bandwidth (MHz to GHz on small coils). Useful for transient currents, switching power supplies, high-current measurement.
For side-channel attacks, current probes are popular because they don't require breaking into the power line. A small Rogowski or Hall probe around a chip's trace can get a clean power signature. (For the very best signals, a low-value sense resistor in series and a differential voltage probe across it usually outperforms current probes; lower noise.)
10.6 High-voltage probes
Built-in resistive divider for kilovolt measurements. Tektronix P5100A handles 2.5 kV. Specialized HV probes go to 40 kV or more. Used in CRT repair, X-ray tube work, ignition systems, particle physics.
10.7 EM near-field probes
Not really a scope probe, but they pair with a scope. A small loop or stub antenna placed millimeters above a chip picks up the chip's EM emissions. Used in EMC testing (find the leak), and intensely in side-channel attacks (EMA, electromagnetic analysis): the EM emissions of a chip while it computes leak the same key information as power traces, sometimes with better SNR because they are local to one part of the die rather than averaged across the whole chip's power consumption.