Tutorial Bluetooth LE

Tutorial: Bluetooth LE

What it is. Bluetooth Low Energy devices announce themselves in advertising packets on channels 37, 38 and 39. Phones, watches, earbuds, trackers, beacons and sensors do this all the time. OnAir lists them like a scanner app such as nRF Connect: a device table with address, name, signal level and services, plus a packet log. It never connects or pairs.

Read this first. Receive only. Advertisements are public by design, but they identify devices that belong to people. Most phones use random addresses that change every few minutes for privacy. Do not use the list to track individuals. Check your local rules. See Legal and Privacy.

What you need

• A radio that reaches 2.4 GHz at 4 Msps (the mode asks for and works from 4 Msps). An RTL-SDR cannot; use a HackRF, PlutoSDR, LimeSDR or BladeRF.
• A 2.4 GHz antenna.
• Frequencies: 2402, 2426 and 2480 MHz are the advertising channels 37, 38 and 39 (the database lists all three, and the mode starts on 2402 MHz). The mode table covers 2400 to 2484 MHz.

Before you start

You can listen to one channel at a time or let the receiver hop across the three. A device sends on all three, but each packet is seen only on the channel being listened to, so hopping finds more devices. The 2.4 GHz band is crowded; moderate gain.

Step by step

1. In the mode list open IoT & sensors and choose Advertising, 2.4 GHz.
2. Pick the radio at 4 Msps and start the receiver.
3. Choose the Channel: 37, 38 or 39, or tick hop.
4. Open Devices.

What you should see

A growing device table with address type, name (if advertised), vendor from the address or company id, services, iBeacon, Eddystone and exposure notification beacons, and a level history.

Reading the screen

• Devices: Address, Type (public or random), Name, Vendor, Beacon / services, Level, Last seen. Details shows a selected device.
• Packets: Time UTC, Ch, PDU type, Address and payload for every packet.

Options and settings

• Filter by name or address.
• named only hides devices without a name.
• Level above shows only devices stronger than a chosen level.
• Show all clears a selection. Copy and Clear work as in other modes.

Troubleshooting

• Few devices. Turn on hop, move closer, check 4 Msps.
• The same phone appears many times. Random addresses change.
• Names missing. Many devices do not advertise a name.
• No packets at all. The radio may not reach 2.4 GHz at that rate; check the tuner message.

Tips

Use the Level above control to isolate devices in the room.

Legal and privacy notes

Do not track or identify people from addresses. Nothing is connected or decrypted.

Under the hood

GFSK at 1 Mbit/s, access address 0x8E89BED6, advertising PDUs, CRC-24 (Bluetooth Core Specification, Link Layer).

Related

Mode-Bluetooth-LE, Tutorial-Wi-Fi-networks, Tutorial-Zigbee-802-15-4, Tutorial-ANTplus-sensors, Modes, Main-window, Supported-radios, Troubleshooting, FAQ, Legal.