Understand the Bluetooth Low Energy (BLE) connection data package in one minute

Understand the Bluetooth Low Energy (BLE) connection data package in one minute

1. Overview There are three important data packets in the BLE connection process: SCAN_REQ, SCAN_RSP and CONNECT_REQ.
SCAN_REQ: Scan request, by the master device. MasterDEVICE) is sent to the slave device (SLAVE DEVICE) in order to obtain the response from the slave device to get more information about the broadcast data of the slave device (including device name, or service UUID, and other information such as manufacturer-specific format (such as hardware version) , Software version number, device serial number, etc.)
SCAN_RSP: The response of the slave device to the SCAN_REQ initiated by the master device. As a supplement to the broadcast packet, the slave device can give the master device more broadcast data. For example, some devices do not have a device name in the broadcast packet. The device name is placed in this package and sent to the master device CONNECT_REQ: The master device sends a connection request to the slave device. At this point, the connection is established (the slave device will not respond to this request). If the slave device is not connected to the above problem, the master and slave will start to exchange valid data (based on GAP, GATT and SMP protocols) or exchange empty packets in the future.
The following is a detailed interpretation of these three data packets

2. Keywords: Hollong BLE Sniffer, BLE Data Analyzer, BLE Capture Keyword: Hollong BLE Sniffer, BLE Data Analyzer, BLE Capture

3. Preparations for capturing connection data packets * Hardware: a BLE device (slave device) and the corresponding master device (such as related applications in smart phones, or general BLE tool software);
A HOLLONG BLE SNIFFER (Hollong BLE listener)
* Software: Hollong Bluetooth 4.0/4.1 BLE protocol monitoring analyzer software Download link:
http:// ... hollong-4-0-4-1-ble

4. SCAN_REQ package 1) Complete package



2) Access Address For broadcast packets, this is a fixed length (4 bytes) and fixed content (0x8e89bed6) of the master and slave device to identify the access address of the broadcast packet.


3) The header information (Header Info) is fixed to 2 bytes: it is broken down into 16 bits for use. Bit [0:3]: P broadcast packet (PDU) type, there are 6 types in total:

PDU Type
b3b2b1b0 Packet Name
0000 ADV_IND: connectable general connection broadcast 0001 ADV_DIRECT_IND: connectable directed connection (specified device) broadcast 0010 ADV_NONCONN_IND: unconnectable general broadcast 0011 SCAN_REQ: scan request 0100 SCAN_RSP: scan response 0101 CONNECT_REQ: connection request 0110 ADV_SCAN_IND: scannable general broadcast 0111 -1111 Reserved

Bit[4:5]: reserved Bit[6]: RxAdd
Bit [7]: TxAdd
Bit [8:13]: broadcast data length (maximum 37 bytes)
Bit [14:15]: reserved


4) Main device address


5) Slave device address


6) CRC



4. SCAN_RSP package 1) Access address The same as above


2) The header information is defined as above


3) Slave device address Fixed 6 bytes of slave device address (MAC ADDRESS)


4) Response data (broadcast data)
The format is the same as the broadcast data format (see the text "Understanding Bluetooth Low Energy Broadcast Data in 1 Minute" for details). In this package, the data is 0 (no data)


5) CRC
Fixed to 3 bytes


5. CONNECT_REQ package 1) Access address A fixed access address of 4 bytes and content (0x8e89bed6). The BLE chip uses this fixed address as the BLE data reception of the broadcast channel.


2) Header information Two bytes of header information (the parsing format is the same as above)


3) Main device address

4) Slave device address

5) Access address Specify the access address (BLE data channel) used after connection here. This address is an internally designated address with a length of 4 bytes, which is not determined by the fixed content of the broadcast data channel. address.


6) CRC INIT
The initialized CRC value will be used for data CRC check later

7) Window Time (Win Size)


8) Window offset

9) Data interval time (CONNECTION INTERVAL)
The interval between sending two data packets (or empty packets).
The calculation formula is: 24 (0x18) * 1.25ms = 30ms. It can be seen in the captured data packet that the interval between every two packets is 30MS. Registration is required to download this data package.


10) Latency


11) The maximum time delay of disconnection (TIME OUT)
When one of the master and the slave does not receive any data packets or empty packets after this time, it will change from the connected state to the non-connected state (the master device can restart scanning, and the slave device can also restart broadcasting. What to do is determined by the application Procedure decision).
Calculation method: Maximum time delay = TIME_OUT * 10MS, here: 72 (0X48) * 10 = 720 MS, that is to say, if both parties do not receive any data packets or empty packets during 0.72 seconds, the connection is considered interrupted , From the connected state to the non-connected state, start to do what the application requires.


12) Frequency hopping channel map (CHANNEL MAP)
This frequency hopping chart is formulated by the BLE chip according to the BLE channels that can be used in the surrounding environment. It varies according to the different scanning test environment (referring to the different occupied spectrum resources). When this chart (table) is sent to the CONNECT_REQ packet After the slave device, both the master and the slave will synchronize the frequency hopping (HOPPING) according to this picture. Through this method, the low energy Bluetooth device can effectively avoid the congested channel and use a relatively "clean" channel with no (less) interference to exchange Data, thereby greatly improving the stability and reliability of transmitted data.

Since this is a master and slave device that works in a relatively clean environment (almost no BLE devices or other strong signal devices working in the 2.4G frequency band around), it can be seen that it uses all channels (except broadcast Dedicated channels 37, 38, 39) are used as frequency hopping patterns.

13) HOP and CLOCK
0xAF (10101111)
HOP: 10101
CLOCK: 111 => The corresponding crystal accuracy is 0-20PPm
The first 5 bits of a byte specify the data (HOPINCREMENT) required in the HOP (frequency hopping) algorithm, and the other three bits specify the accuracy level of the crystal (how much PPM error can be)
SCA masterSCA, the crystal accuracy grades corresponding to the three bits are as follows: 000: 251 ppm to 500 ppm
001: 151 ppm to 250 ppm
010: 101 ppm to 150 ppm
011: 76 ppm to 100 ppm
100: 51 ppm to 75 ppm
101: 31 ppm to 50 ppm
110: 21 ppm to 30 ppm
111: 0 ppm to 20 ppm



14) CRC
Same as above

Budget Laptop

Everyone want a budget laptop. There are different level according to application scenarios. 14 inch Budget Laptop For Students for your elementary project, 10.1 inch Low Budget Laptop for kids play or online learning, 15.6inch celeron j4125 Budget Laptop For Programmers, 14inch budget i5 laptop for your business projects, 15.6inch budget i7 laptop for university students, officers who love bigger screen and performance focused, etc. Of course, other type laptops also optional, like Yoga Laptop , 2 In 1 Laptop , android laptop, etc

As a professional manufacture of custom laptop, Android Tablet, Mini PC , All In One PC, we can provide unique and satisfy oem service. What you need to do is kindly share the exact parameters and special points care more, thus we can provide solutions accordingly.

When you have tender, you can contact us and send the parameters list require, then will provide the most matched one for you. More simple way is that you share your budget, design, delivery time , etc. Believe you can always get a right solution here.

Budget Laptop,20k Budget Laptop,Low Budget Laptop,Top 10 Budget Laptops,Budget Laptop For Programmers

Henan Shuyi Electronics Co., Ltd. , https://www.shuyitablet.com

Posted on