BLE Packet Structure: A Byte-by-Byte Guide
Learn Preamble, Access Address, Header, Payload and CRC components and analyze a BLE packet step by byte.
Contents
Seeing a string of bytes in Sniffer is scary at first. By breaking the packet into several fixed parts and then interpreting the Header and Payload, the same raw data is converted into an understandable message. This is the basic debugging skill of all subsequent steps.
The overall frame of the packet
The over-the-air packet begins with a preamble to allow the receiver to coordinate bit timing. Access Address Specifies whether the packet belongs to the primary Advertising or a specific connection. Then comes the PDU containing Header and Payload and CRC reveals transmission errors. The exact length of some segments depends on the PHY and PDU type.
What does the header say?
In the Advertising channel, the Header bits of the PDU type specify the address information and the Payload length. In the data channel, the Header carries things like logical channel identifier, sequence number and more data presence. Always specify the channel type and PDU type before interpreting the following bytes.
Payload analysis
Payload may be sender address, AD structures, ATT data or Link Layer control. The byte order in many multibyte fields is Little Endian; That is, the least valuable byte is seen first. A good sniffer will open the fields, but the ability to manually check to detect a length, endianness, or UUID error is necessary.
Timing and IFS
In a connected exchange, the default interval between some exchange of two T_IFS sides is equal to 150 microseconds; In newer controllers with distance negotiation capability, the value can be different and the sequence number prevents duplicate data delivery. If the response is not received in time, the transmission can be repeated in the same Connection Event or the next event. The timing graph will tell you if the problem is with the data or the timing of the radio.
Simple example of byte parsing
In an Advertising, first read the PDU type and Length from the Header. Then separate the 6 byte address. Break the rest of the Payload into "Length, Type, Data" blocks. For example, Type equal to 0x09 shows the complete local name and Type equal to 0xFF shows the manufacturer's data.
Byte-by-byte example: advertisement data of an environmental sensor
The string below is just Advertising Data a legacy example; Radio header, device address and CRC are not included in this string.
02 01 06 | 03 03 1A 18 | 05 09 4C 43 45 4E| bytes | interpretation |
|---|---|
| 02 01 06 | Length=2, Flags type=0x01 and value 0x06. |
| 03 03 1A 18 | Length=3, full list of 16-bit UUIDs; 0x181A Environmental Sensing service with Little Endian order. |
| 05 09 4C 43 45 4E | Length=5, local full name with type 0x09; Four ASCII bytes equal to LCEN. |
Length, Type and Data bytes after itself count and do not count itself. The total of these three structures is 13 bytes. For safe parsing, check that Length does not exceed the remaining data before reading each structure.
The default interval between related exchanges is 150 microseconds; The Frame Space Update feature in new versions can change it with the support and negotiation of both sides. Retransmission may also occur in the same Connection Event or a subsequent event; Don't always limit it to the next event.
Question and answer article
Ask your technical question
Questions and answers are published after moderation. Authors can see their own pending drafts.
No confirmed questions have been registered for this article yet.