1
\$\begingroup\$

I am working on a project which involves scanning all the BLE devices which are present in the vicinity. I can send scan requests and receive scan response from devices which are in discoverable mode. For this I used following commands on my laptop:

hcitool lescan &
btmon

In scan response I am able to get name, bluetooth address, rssi.

However, I am not able to scan devices which are already connected to some other device. E.g. I have bluetooth earphones which are connected to my mobile and after that if I perform hcitool lescan from my laptop then I am not getting earphones in scanned devices. But while going through videos about BLE I found https://youtu.be/be9ct7OKI7s video (screenshot attached)

enter image description here

and in this video around 05:00, application is able to show nearby devices even when they are connected. So is it possible to sniff ble packets in the air and figure out all devices present in the vicinity? As per my understanding, advertisements are unencrypted but once the connection is established then all the communication between connected devices is encrypted. So how can we get the list of devices which are in the vicinity and connected to some other devices?

\$\endgroup\$
3
  • \$\begingroup\$ I'm not sure I understand 100% What are you trying to accomplish, but peripheral devices will advertise and make their intent available, e.g. "I'm connectable" other peripheral will advertise that "Hey I'm here, but you cant connect to me" .. Some peripherals support multiple connections from central devices. Some peripherals will call stopAdvertisement() on a connect request from a central, encryption depends on whether or not you have a passkey, handshake etc. From a sercurity perspective I would encrypt and stop advertisement and allow maybe 2-3 conn. on something such as earbuds for sure. \$\endgroup\$
    – Sorenp
    Commented Jan 7, 2021 at 12:57
  • \$\begingroup\$ Peripherals which are advertising can be scanned using scan request and response. However consider a peripheral (e.g. bluetooth earphones) which supports only one connection and it is already connected to my mobile. This peripheral won't be advertising as it is already connected and supports only 1 connection. So can I scan this device in any way? My aim is to scan all ble devices (including already connected) which are present in the vicinity. \$\endgroup\$
    – Tejas Pawar
    Commented Jan 7, 2021 at 16:23
  • \$\begingroup\$ Not that I am aware of, if the peripheral stops advertisements you cannot connect it to via traditional means. \$\endgroup\$
    – Sorenp
    Commented Jan 7, 2021 at 17:27

1 Answer 1

Reset to default
1
\$\begingroup\$

This depends on the Bluetooth hardware you're scanning for. Most devices will not be advertising once they are connected, because the whole purpose of advertising is to invite connections from remote devices. Therefore, once a connection is made, there is no need to continue advertising. However, this is not the case for all devices, and some would continue to advertise because they convey extra information in their adverts that may be useful to other scanning devices even if the device is already connected.

For example, the bluetooth earphones that you mentioned only advertise to invite connections from phones/PCs. Once a connection is made, the earphones don't need continue advertising because the purpose of broadcasting its presence has been achieved. There are some exceptions though - e.g. there are earphones that continue advertising even after a connection is made, and the purpose of this is to allow connection from multiple devices.

So to answer your question:-

"So how can we get the list of devices which are in the vicinity and connected to some other devices?"

Unfortunately in most cases you will not be able to detect these devices because they no longer advertise once they are in a connection.

Finally, regarding this statement:-

"As per my understanding, advertisements are unencrypted but once the connection is established then all the communication between connected devices is encrypted."

It is true that advertisements are generally not encrypted, but once a connection is made it doesn't automatically make the communication encrypted. Encryption is achieved once two devices are paired and one of the devices actively encrypts the connection. In many cases, the connection and communication can remain unencrypted.

For more info, I recommend the following links:-

\$\endgroup\$
5
  • \$\begingroup\$ In the reference video, Ellisys application is able to find out that 2 devices are paired and communicating. Is this possible with monitoring data channels and analysing headers? Or am I missing something ? \$\endgroup\$
    – Tejas Pawar
    Commented Jan 8, 2021 at 10:37
  • \$\begingroup\$ In the reference video, the Ellisys Bluetooth Analyzer is used which is an advanced Bluetooth sniffer with specialised hardware. The sniffer inspects the packets that are being sent over the air to determine the types of packets and their direction. You might be able to achieve something similar with Wireshark but I haven't tried this myself. \$\endgroup\$
    – Youssif Saeed
    Commented Jan 8, 2021 at 11:13
  • \$\begingroup\$ After reading more I realised that there are other sniffers as well (ubertooth one,etc.) which can do exactly what I am trying to achieve. However I am not sure about the limitation that is stopping my ubuntu laptop from scanning/sniffing active devices in the vicinity. If we can listen on advertising channel, shouldn't we be able to listen on other channels and figure out what all devices are present ? \$\endgroup\$
    – Tejas Pawar
    Commented Jan 11, 2021 at 11:43
  • \$\begingroup\$ It is not something that the general BlueZ commands support. Have you tried using Wireshark? \$\endgroup\$
    – Youssif Saeed
    Commented Jan 11, 2021 at 12:17
  • \$\begingroup\$ I could not find bluetooth interface in wireshark. I guess even wireshark needs third party bluetooth sniffers. \$\endgroup\$
    – Tejas Pawar
    Commented Jan 11, 2021 at 12:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.