- Turn on Bluetooth HCI Snooping in Developer Settings
- Open app and connect to light
- Pull log via adb (e.g. a.log)
- Turn light on
- Pull log to a different filename (e.g. b.log)
- Open a.log in wireshark and remember the packet number of the last packet.
- Open b.log in wireshark and FOR EACH of the packets sent from localhost after the last packet in a.log: Run gatttool -b --char-write-req -a -n Until the light does what you want.
- Repeat for all the features you wish to elucidate.