BLE advertising and scanning in IOT Protocols - Deep Dive

Overview - BLE advertising and scanning

What is it?

BLE advertising and scanning are two key processes in Bluetooth Low Energy communication. Advertising is when a device broadcasts small packets of data to announce its presence. Scanning is when a device listens for these broadcasts to discover nearby devices. Together, they enable devices to find and connect with each other efficiently using very little power.

Why it matters

Without advertising and scanning, BLE devices would not be able to find each other or exchange information easily. This would make many smart devices, like fitness trackers or smart home sensors, slow, power-hungry, or impossible to use. These processes solve the problem of discovering devices quickly while saving battery life, which is crucial for small, wireless gadgets.

Where it fits

Before learning BLE advertising and scanning, you should understand basic Bluetooth concepts and wireless communication principles. After mastering this topic, you can explore BLE connection establishment, data exchange protocols, and security features in BLE communication.

Mental Model

Core Idea

BLE advertising is like a device shouting its name in a crowd, and scanning is like others listening carefully to find who is nearby.

Think of it like...

Imagine you are at a party where people want to meet new friends. Advertising is like someone holding up a sign with their name and interests, while scanning is like others walking around looking at signs to decide who to talk to.

┌───────────────┐       ┌───────────────┐
│ Advertising   │──────▶│ Scanning      │
│ Device        │       │ Device        │
│ (Broadcasts)  │       │ (Listens)     │
└───────────────┘       └───────────────┘
       ▲                        │
       │                        ▼
  BLE Devices Nearby      Device Discovery
  Receive Advertisements  and Potential Connection

Build-Up - 7 Steps

1

Foundation

What is BLE Advertising

Concept: Introduction to the basic idea of BLE advertising as broadcasting data packets.

BLE advertising is when a device sends out small packets of data repeatedly on specific channels. These packets contain information like device name, type, or services offered. Advertising happens without needing a connection and uses very little power.

Result

Devices nearby can detect these advertising packets and learn about the advertising device.

Understanding advertising as a simple broadcast helps grasp how devices announce themselves without complex setup.

2

Foundation

What is BLE Scanning

Concept: Introduction to scanning as listening for advertising packets from other devices.

BLE scanning is when a device listens on advertising channels to detect packets sent by advertising devices. Scanning can be passive (just listening) or active (sending a request to get more data).

Result

The scanning device discovers nearby advertising devices and can decide to connect or ignore them.

Knowing scanning is a listening process clarifies how devices find others without broadcasting themselves.

3

Intermediate

Advertising Packet Structure

🤔Before reading on: do you think advertising packets contain full device data or just small summaries? Commit to your answer.

Concept: Understanding the format and content of advertising packets.

Advertising packets have a fixed size limit (31 bytes for data) and include fields like flags, device name, service UUIDs, and manufacturer data. Because of size limits, devices send only essential info to save power and bandwidth.

Result

Devices get a quick summary of what the advertiser offers, enough to decide if they want to connect.

Knowing the packet size limit explains why advertising data is concise and why scanning devices may need to request more info.

4

Intermediate

Active vs Passive Scanning

🤔Before reading on: do you think active scanning uses more or less power than passive scanning? Commit to your answer.

Concept: Difference between passive scanning (just listening) and active scanning (sending scan requests).

Passive scanning only listens for advertising packets. Active scanning sends a scan request to the advertiser, which can reply with extra data in a scan response packet. Active scanning uses more power but gets more info.

Result

Active scanning allows richer device discovery but costs more battery.

Understanding scanning modes helps balance power use and information needs in device design.

5

Intermediate

Advertising Intervals and Channels

Concept: How advertising timing and channels affect discovery and power consumption.

BLE advertising happens on three dedicated channels to avoid Wi-Fi interference. Devices choose advertising intervals (20ms to 10.24s) to balance discovery speed and battery life. Short intervals mean faster discovery but more power use.

Result

Adjusting intervals and channels controls how quickly devices find each other and how long batteries last.

Knowing the tradeoff between interval and power guides practical BLE device configuration.

6

Advanced

Scan Filtering and Duplicate Detection

🤔Before reading on: do you think scanning devices always process every advertising packet they receive? Commit to your answer.

Concept: How scanning devices filter and ignore duplicate or unwanted advertisements.

Scanning devices can filter by device address, service UUIDs, or data content to reduce processing. They also detect duplicates to avoid handling the same packet multiple times, saving CPU and power.

Result

Efficient scanning reduces unnecessary work and extends battery life.

Understanding filtering and duplicate detection is key to building scalable BLE scanners.

7

Expert

Privacy and Randomized Addresses in Advertising

🤔Before reading on: do you think BLE devices always advertise with fixed addresses? Commit to your answer.

Concept: How BLE uses randomized addresses in advertising to protect user privacy and prevent tracking.

BLE devices can use private resolvable or non-resolvable random addresses that change periodically. This prevents third parties from tracking a device by its address. The device and trusted peers share keys to resolve these addresses.

Result

Privacy features make BLE suitable for sensitive applications like health devices.

Knowing how address randomization works reveals the balance between discoverability and privacy in BLE.

Under the Hood

BLE advertising uses three specific radio channels (37, 38, 39) to broadcast small packets repeatedly. The radio hardware transmits these packets at set intervals. Scanning devices tune their radios to these channels to listen for packets. When active scanning is used, the scanner sends a scan request packet, and the advertiser responds with a scan response packet. The BLE controller manages timing, channel hopping, and packet formatting automatically.

Why designed this way?

The three advertising channels were chosen to avoid Wi-Fi interference, improving reliability. Broadcasting small packets repeatedly allows devices to be discovered quickly without maintaining a connection, saving power. Active scanning lets devices get more info only when needed, balancing power and data. Randomized addresses were introduced to address privacy concerns as BLE became widely used in personal devices.

┌───────────────┐        ┌───────────────┐
│ Advertising   │        │ Scanning      │
│ Device        │        │ Device        │
│ (Sends on    │◀──────▶│ (Listens on   │
│ Channels 37-39)│        │ Channels 37-39)│
└───────────────┘        └───────────────┘
       │                        ▲
       │                        │
       │  Scan Request          │
       └──────────────────────▶│
                                │
                        Scan Response
                                │
                                ▼
                      ┌───────────────┐
                      │ Application   │
                      │ Layer         │
                      └───────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Does scanning always require sending packets to discover devices? Commit yes or no.

Common Belief: Scanning always involves sending requests to find devices.

Reality: Scanning can be passive, where the device only listens without sending any packets.

Why it matters: Believing scanning always sends packets can lead to unnecessary power use and complexity in device design.

Quick: Do advertising packets contain all device information? Commit yes or no.

Common Belief: Advertising packets carry complete device data for full discovery.

Reality: Advertising packets are limited in size and only contain summary info; full data requires connection or scan response.

Why it matters: Expecting full data in advertising packets can cause confusion and failed device discovery.

Quick: Are device addresses in advertising always fixed and permanent? Commit yes or no.

Common Belief: BLE devices always advertise with fixed, unchanging addresses.

Reality: Devices often use randomized addresses that change periodically to protect privacy.

Why it matters: Ignoring address randomization can cause tracking vulnerabilities or connection failures.

Quick: Does advertising on all channels happen simultaneously? Commit yes or no.

Common Belief: Advertising packets are sent on all channels at the same time.

Reality: Advertising packets are sent sequentially on three separate channels to avoid interference.

Why it matters: Misunderstanding channel use can lead to incorrect assumptions about discovery speed and reliability.

Expert Zone

1

Some BLE devices use extended advertising with larger packets and more channels, but this increases power use and complexity.

2

Scan response data is optional and not all devices support or send it, affecting discovery completeness.

3

The timing of advertising intervals and scan windows must be carefully balanced to optimize discovery latency and battery life.

When NOT to use

BLE advertising and scanning are not suitable for high-throughput or continuous data streaming applications; in those cases, direct connections or other wireless protocols like Wi-Fi or classic Bluetooth are better.

Production Patterns

In production, devices often use adaptive advertising intervals that start fast for quick discovery then slow down to save power. Scanners implement filtering and duplicate suppression to handle many devices efficiently. Privacy features like address randomization are mandatory in consumer products to comply with regulations.

Connections

Wi-Fi Beacon Frames

Similar pattern of broadcasting presence without connection

Understanding BLE advertising helps grasp how Wi-Fi devices announce networks using beacon frames, both enabling discovery without active connections.

Event-driven Programming

Builds-on the idea of listening and reacting to events

Scanning is like event-driven programming where the device waits for advertising events and reacts, helping understand asynchronous communication.

Human Social Interaction

Parallel in how people introduce themselves and listen for others

Recognizing BLE advertising and scanning as social signaling clarifies the balance between sharing info and privacy.

Common Pitfalls

#1 Ignoring power impact of advertising intervals

Wrong approach:

Set advertising interval to 20ms for all devices regardless of use case

Correct approach:

Use fast advertising intervals only during initial discovery, then switch to slower intervals to save battery

Root cause:

Misunderstanding that shorter intervals increase power consumption significantly

#2 Not handling duplicate advertising packets in scanning

Wrong approach:

Process every advertising packet received without filtering duplicates

Correct approach:

Implement duplicate detection to ignore repeated packets from the same device within a time window

Root cause:

Assuming every packet is new leads to wasted processing and battery drain

#3 Assuming device address is fixed for identification

Wrong approach:

Use device address as a permanent unique ID for tracking devices

Correct approach:

Use resolvable private addresses and pairing keys to identify devices securely

Root cause:

Not accounting for privacy features that randomize addresses periodically

Key Takeaways

BLE advertising and scanning enable devices to find each other efficiently using small, repeated broadcasts and listening.

Advertising packets are limited in size and contain summary information, requiring scanning or connection for full data.

Scanning can be passive or active, balancing power use and information richness.

Privacy is protected by randomized device addresses that change over time to prevent tracking.

Proper configuration of advertising intervals, channels, and scanning filters is essential for reliable and power-efficient BLE communication.

Practice

1. What is the main purpose of BLE advertising in Bluetooth Low Energy communication?

easy

A. To broadcast small packets of data repeatedly to nearby devices

B. To establish a full connection between devices

C. To encrypt data between devices

D. To scan for other devices' signals

Solution

1. Step 1: Understand BLE advertising role

   BLE advertising sends small data packets repeatedly to announce presence.

2. Step 2: Differentiate from scanning and connection

   Advertising is broadcasting, not scanning or connecting.

3. Final Answer:

   To broadcast small packets of data repeatedly to nearby devices -> Option A

4. Quick Check:

   Advertising = broadcast small data [OK]

Hint: Advertising means sending out info repeatedly [OK]

Common Mistakes:

• Confusing advertising with scanning
• Thinking advertising establishes connections
• Assuming advertising encrypts data

2. Which of the following is the correct command to start BLE scanning using the Linux tool bluetoothctl?

easy

A. ble scan start

B. start scan

C. scan start

D. scan on

Solution

1. Step 1: Recall bluetoothctl scan command

   The correct command to start scanning is exactly scan on.

2. Step 2: Check other options for syntax

   Other options are incorrect commands or invalid syntax in bluetoothctl.

3. Final Answer:

   scan on -> Option D

4. Quick Check:

   bluetoothctl scan on = start scanning [OK]

Hint: Use exact command 'scan on' in bluetoothctl [OK]

Common Mistakes:

• Using 'start scan' instead of 'scan on'
• Typing commands not supported by bluetoothctl
• Confusing scan commands with advertising commands

3. Given this Python snippet using a BLE library to scan devices:

devices = scanner.scan(5.0)
for dev in devices:
    print(dev.addr)

What will this code output?

medium

A. Empty list because scan time is too short

B. List of device addresses found during 5 seconds scan

C. Error because scan() needs no arguments

D. List of device names found during 5 seconds scan

Solution

1. Step 1: Understand scan() usage with timeout

   The scan method scans for devices for given seconds and returns device objects.

2. Step 2: Identify printed attribute

   Printing dev.addr outputs device MAC addresses found.

3. Final Answer:

   List of device addresses found during 5 seconds scan -> Option B

4. Quick Check:

   scan(5.0) returns devices; dev.addr prints addresses [OK]

Hint: scan(timeout) returns devices; print dev.addr for addresses [OK]

Common Mistakes:

• Thinking scan() takes no arguments
• Confusing device address with device name
• Assuming scan always returns empty list

4. You wrote this code to scan BLE devices but get no output:

scanner = Scanner()
devices = scanner.scan()
for dev in devices:
    print(dev.addr)

What is the likely problem?

medium

A. print(dev.addr) is incorrect attribute

B. Scanner() class does not exist

C. Missing scan timeout argument causes no devices found

D. scan() method should be called with 'start' keyword

Solution

1. Step 1: Check scan() method requirements

   scan() requires a timeout argument to specify scan duration.

2. Step 2: Understand effect of missing timeout

   Without timeout, scan may return immediately with no devices.

3. Final Answer:

   Missing scan timeout argument causes no devices found -> Option C

4. Quick Check:

   scan() needs timeout to find devices [OK]

Hint: Always provide scan timeout to get results [OK]

Common Mistakes:

• Omitting scan timeout argument
• Assuming dev.addr is invalid
• Thinking scan() uses 'start' keyword

5. You want to filter BLE scan results to only show devices advertising a specific service UUID. Which approach correctly applies this filter in Python?

hard

A. Use a list comprehension: [dev for dev in devices if '1234' in dev.getScanData()]

B. Check if '1234' in dev.addr for each device

C. Filter devices by comparing dev.name to '1234'

D. Use devices.filter('1234') method directly

Solution

1. Step 1: Understand filtering by service UUID

   Service UUIDs appear in scan data, not in address or name.

2. Step 2: Use list comprehension with getScanData()

   getScanData() returns advertised data; check if UUID '1234' is present.

3. Final Answer:

   Use a list comprehension: [dev for dev in devices if '1234' in dev.getScanData()] -> Option A

4. Quick Check:

   Filter by UUID in scan data using list comprehension [OK]

Hint: Filter devices by checking UUID in scan data list [OK]

Common Mistakes:

• Checking UUID in device address
• Filtering by device name instead of UUID
• Using non-existent filter() method on devices