I am working on a project which involves scanning all the BLE devices which are present in the vicinity. I can send scan requests and receive scan response from devices which are in discoverable mode. For this I used following commands on my laptop:
hcitool lescan & btmon
In scan response I am able to get name, bluetooth address, rssi.
However, I am not able to scan devices which are already connected to some other device. E.g. I have bluetooth earphones which are connected to my mobile and after that if I perform hcitool lescan from my laptop then I am not getting earphones in scanned devices. But while going through videos about BLE I found https://youtu.be/be9ct7OKI7s video (screenshot attached)
and in this video around 05:00, application is able to show nearby devices even when they are connected. So is it possible to sniff ble packets in the air and figure out all devices present in the vicinity? As per my understanding, advertisements are unencrypted but once the connection is established then all the communication between connected devices is encrypted. So how can we get the list of devices which are in the vicinity and connected to some other devices?