../

Bluetooth & short-range

How Bluetooth works: the two kinds (Classic and Low Energy), channels and frequency hopping, how an LE device advertises, connects and sleeps, GATT services and characteristics, profiles, pairing and privacy, what each version added, LE Audio and Auracast, Bluetooth mesh, and the other short-range radios: NFC, UWB and RFID. Radio basics (frequency, antennas, modulation) are in Radio fundamentals; Zigbee, Thread and LoRa are in Mesh & IoT networks; the 2.4 GHz neighbor it shares the air with is Wi-Fi.

Two Bluetooths: Classic and LE

Bluetooth is a short-range radio standard for connecting devices directly, without an access point, in the unlicensed 2.4 GHz band. It is maintained by the Bluetooth SIG (Special Interest Group), formed in 1998 by Ericsson, IBM, Intel, Nokia and Toshiba; the name is a 10th-century Danish king's nickname. There are really two radios under one name:

Classic (BR/EDR)Low Energy (LE)
Introduced1.0, 19994.0, 2010
Channels79 × 1 MHz40 × 2 MHz, 3 of them for advertising
Raw rate1 Mbit/s (BR, basic rate), 2–3 Mbit/s (EDR, enhanced data rate)1 Mbit/s; 2 Mbit/s (2M PHY); 125 or 500 kbit/s (Coded PHY, long range)
Topologypiconet: one central and up to 7 active peripheralsmany connections, broadcast advertising, mesh
Finding devicesinquiry and pagingadvertising and scanning
Powerradio on often; fine for headphones with rechargeable batteriessleeps between short events; coin-cell sensors last months to years
Data modelprofiles over L2CAP and RFCOMM channelsGATT services and characteristics
Typical usesclassic audio streaming, call headsets, car kits, older keyboardswearables, sensors, beacons, locks, item trackers, smart home, LE Audio

Phones and laptops have dual-mode chips that do both; sensors and tags are usually LE-only. The two radios don't talk to each other: an LE-only fitness band can't connect to an old Classic-only laptop.

The 2.4 GHz band and channels

Bluetooth uses the ISM (industrial, scientific and medical) band at 2400–2483.5 MHz, open to anyone within power limits and shared with Wi-Fi, microwave ovens and countless gadgets. Classic splits it into 79 channels of 1 MHz (2402 to 2480 MHz); LE uses 40 channels of 2 MHz. LE's three advertising channels, numbered 37, 38 and 39 (2402, 2426 and 2480 MHz), are where devices announce themselves; the other 37 (0 to 36) carry connections.

the 2.4 GHz band, 2400–2483.5 MHz Classic (BR/EDR): 79 channels of 1 MHz Classic LE: 40 channels of 2 MHz; 37, 38 and 39 carry advertising 37 38 39 LE Wi-Fi channels 1, 6 and 11 (≈ 20 MHz each), for comparison ch 1 ch 6 ch 11 Wi-Fi 2400 2420 2440 2460 2480 the advertising channels sit at the band edges and in the gap between Wi-Fi 1 and 6
LE's advertising channels sit beside, not under, the three common Wi-Fi channels.
  • Both use GFSK (Gaussian frequency-shift keying): ones and zeros are slightly higher and lower frequencies. EDR adds phase modulation for 2 and 3 Mbit/s; LE Coded adds error-correcting codes that trade speed for range.
Power classMax transmit powerTypical use
1100 mW (+20 dBm)USB dongles, long-range modules
1.510 mW (+10 dBm)some LE devices
22.5 mW (+4 dBm)phones, headsets: ≈ 10 m indoors
31 mW (0 dBm)tiny sensors

A link is only as good as its weaker end: a powerful laptop dongle doesn't help an earbud answer back.

Frequency hopping

Instead of staying on one channel, both sides of a link hop to a new channel many times a second, in a pseudo-random order both can compute. Interference on any one channel then hits only a few packets, which are resent on the next hop. (Frequency hopping was patented as torpedo anti-jamming by Hedy Lamarr and George Antheil in 1942.)

  • Classic hops 1600 times a second, once per 625 µs slot, in an order derived from the central's address and clock.
  • LE hops once per connection event, using a hop increment (channel selection algorithm #1) or a pseudo-random sequence (#2, from version 5.0).
  • Adaptive frequency hopping (AFH, version 1.2, 2003): devices mark channels where packets keep failing, typically under a busy Wi-Fi network, and hop only over the good ones. Classic must keep at least 20 channels in use; LE at least 2.
plain hopping 3 of 8 hops land on Wi-Fi and are lost adaptive hopping (AFH) busy channels are taken out of the list Wi-Fi time → Wi-Fi time → each column is one time slot; Classic Bluetooth makes 1600 hops per second

One hop per slot, slowed down about 1600 times. AFH drops the channels Wi-Fi is using.

LE roles, advertising and connecting

RoleDoesExample
advertiser (broadcaster)sends advertising packets; may accept a connectiona beacon, a sensor
scanner (observer)listens for advertisinga phone looking for devices
peripheralthe advertiser once connected; usually the small device and the GATT serverheart-rate strap, lock, earbud
centralstarts the connection and sets its timingphone, laptop, hub

Older documents say master and slave; the specification now says central and peripheral. Many devices take several roles at once.

  • Advertising packets carry up to 31 bytes in the original format: flags, a name, service UUIDs and manufacturer data (beacon formats such as iBeacon and Eddystone are just agreed layouts of these bytes). A device advertises every advertising interval, 20 ms to 10.24 s, plus a random 0–10 ms so two devices don't keep colliding.
  • Scannable advertisers answer a scan request with 31 more bytes; connectable ones accept a connection; non-connectable ones (beacons) only broadcast.
  • Extended advertising (5.0) moves the payload, up to about 250 bytes per packet and 1,650 bytes when chained, to the data channels, with only a short pointer on 37/38/39; periodic advertising broadcasts on a fixed schedule that receivers can follow without connecting.
peripheral (sensor) central (phone) time → 37 37 38 38 39 39 37 37 38 38 39 39 adv interval, e.g. 100 ms adv interval, e.g. 100 ms scan on 38 CONNECT_IND: interval, channel map, hop rule ch 12 ch 12 ch 30 ch 30 ch 7 ch 7 connection interval, e.g. 30 ms radio off radio off awake ≈ 1 ms or less per interval, asleep the rest

1/5

Advertise: the sensor sends a short advertising packet on channels 37, 38 and 39, one after another, then sleeps until the next advertising interval.

Connection parameterRangeTrade-off
connection interval7.5 ms to 4 s in 1.25 ms steps; 6.2 adds shorter ones, down to 375 µsshort: fast and responsive; long: saves power
peripheral latencyhow many events the peripheral may skipsleeps longer when idle but still answers fast when needed
supervision timeout100 ms to 32 show long silence lasts before the link counts as lost
ATT MTU23 bytes by default, negotiated up to 517 in practicebigger values per packet
data length27 to 251 bytes per link-layer packet (4.2 and later)higher throughput

Phones usually choose the interval; a peripheral can request one but the central decides. iOS and Android each set their own limits.

GATT: how LE devices expose data

Once connected, LE devices exchange data through the ATT (attribute protocol): the server holds a table of attributes, each with a 16-bit handle, a type (a UUID), permissions and a value. GATT (generic attribute profile) organizes the table into a tree:

  • a service groups related data, e.g. Heart Rate;
  • a characteristic is one value inside it, with properties that say what a client may do;
  • a descriptor adds metadata to a characteristic; the most important is the CCCD (client characteristic configuration descriptor), where a client switches notifications on.
heart-rate strap GATT server (peripheral) Heart Rate service 0x180D Battery service 0x180F Device Information service 0x180A Heart Rate Measurement 0x2A37 · notify Body Sensor Location 0x2A38 · read Heart Rate Control Point 0x2A39 · write Battery Level 0x2A19 · read, notify Manufacturer Name 0x2A29 · read CCCD descriptor 0x2902 a phone (GATT client) finds services, then reads a value, writes a command, or turns notifications on in the CCCD so the strap pushes each new reading
A heart-rate strap's GATT tree: services, their characteristics and what a client may do with each.
OperationDirectionConfirmedTypical use
readclient asks, server answersyesbattery level, settings
write (request)client to serveryescommands, configuration
write without responseclient to servernostreaming data to the device, firmware updates
notifyserver to clientnosensor readings as they change
indicateserver to clientyesevents that must not be missed
  • UUIDs. The SIG assigns 16-bit numbers such as 0x180D to standard services and characteristics; each is short for a 128-bit UUID built on the base 0000xxxx-0000-1000-8000-00805F9B34FB. Vendors use their own random 128-bit UUIDs for custom services.
  • Notifications need the CCCD: the client writes 01 00 (indications: 02 00) to it; without that the server stays quiet.
  • Values are bytes, defined per characteristic. A Heart Rate Measurement of 06 48 means: flags 0x06 (8-bit value, sensor contact detected), then 0x48 = 72 beats per minute.
  • GAP (generic access profile) covers everything before the data: advertising, discovery, roles, connection and security modes.

Profiles

A profile is the SIG's recipe for one kind of device: which protocols, services and behaviors it must implement so that any two certified products work together.

ProfileRadioWhat it does
A2DPClassicstereo audio streaming; SBC codec required, AAC, aptX or LDAC optional
AVRCPClassicremote control: play, pause, volume, track info
HFP (hands-free)Classiccalls through a headset or car: two-way mono voice
HIDClassickeyboards, mice and game controllers
HOGP (HID over GATT)LEthe same devices over LE, with far better battery life
SPPClassica virtual serial cable for older gadgets
PBAP, MAPClassicphone book and messages for car systems
Heart Rate, Cycling Speed and Cadence, GlucoseLEstandard health and fitness sensors
BAP, CAP, TMAP, HAPLELE Audio streaming, coordination, telephony and media, hearing aids

The familiar drop in quality when your headset's microphone turns on is Classic switching from A2DP (stereo, one way) to HFP (mono, narrow, both ways); LE Audio carries both directions at once.

Pairing, bonding and privacy

Pairing creates shared encryption keys between two devices; bonding stores them (the long-term key, LTK, plus an identity key, IRK) so they reconnect later without asking.

  • LE Legacy Pairing (4.0, 4.1) derived keys from a short secret: zero for Just Works, a 6-digit passkey otherwise. Anyone who records the pairing can brute-force it.
  • LE Secure Connections (4.2 and later) uses an ECDH (elliptic-curve Diffie–Hellman) key exchange on the P-256 curve, so a passive eavesdropper learns nothing. How the user confirms the exchange, the association model, decides whether an active man-in-the-middle (MITM) is stopped:
ModelWhat the user doesStops MITMFor devices with
Just Worksnothing, or taps "pair"nono screen and no keyboard: earbuds, sensors
Numeric Comparisonchecks the same 6-digit number on both screens and confirmsyestwo displays with yes/no buttons
Passkey Entrytypes a 6-digit code shown on one device into the otheryesa keyboard on one side, a display on the other
Out of Band (OOB)taps NFC or scans a QR code that carries the keysyes, if that channel is safeNFC or a camera
  • Classic got the same models with Secure Simple Pairing (2.1, 2007), replacing typed PINs such as 0000.
  • Attacks on implementations and older modes (KNOB, BIAS and others since 2019) were mostly fixed by firmware updates and later spec changes such as encryption key size control (5.3). Keep devices updated; insist on numeric comparison or passkey pairing for anything that matters.

Privacy. A device that always advertises the same address can be tracked. LE devices instead use a resolvable private address (RPA): a random-looking address, generated from the IRK, that changes regularly (often every 15 minutes; 6.1 randomizes the timing so changes can't be matched up). Bonded devices hold the IRK and recognize each other; everyone else sees strangers. Item trackers rotate their identities too, and phones now warn when an unknown tracker seems to be traveling with you.

Versions

VersionYearHeadline features
1.x1999–2003Classic at 1 Mbit/s; 1.2 added adaptive frequency hopping
2.0 + EDR2004Enhanced Data Rate: 2 and 3 Mbit/s
2.12007Secure Simple Pairing
3.0 + HS2009high-speed transfers over a Wi-Fi link; rarely used, removed in 5.3
4.02010Bluetooth Low Energy, GATT
4.12013LTE coexistence, devices acting as central and peripheral at once
4.22014LE Secure Connections, longer LE packets (data length extension), link-layer privacy, an IPv6 profile
5.020162M PHY (twice the speed), Coded PHY (about 4 times the range), extended advertising
5.12019direction finding (angle of arrival and departure), GATT caching
5.22019isochronous channels (the basis of LE Audio), Enhanced ATT, LE power control
5.32021connection subrating, channel classification, encryption key size control
5.42023periodic advertising with responses (PAwR, built for electronic shelf labels), encrypted advertising data
6.02024Channel Sounding: secure distance measurement between two devices; decision-based advertising filtering
6.12025randomized timing of private address changes
6.22025shorter connection intervals (down to 375 µs), Channel Sounding hardened against amplitude-based attacks
6.32026Channel Sounding refinements; the old data-signing feature removed
  • Channel Sounding measures distance with phase-based ranging and round-trip timing across many channels, aiming at decimeter-level accuracy, for digital keys and finding things.
  • Almost every feature after 4.0 is optional: a "Bluetooth 5.3" label doesn't mean a device has Coded PHY or LE Audio. Check for the feature, not the version number.

LE Audio and Auracast

LE Audio moves audio from Classic onto LE, using the isochronous channels of 5.2: streams with fixed timing that several receivers can stay in sync with. Its specifications were completed in 2022.

  • LC3 (Low Complexity Communication Codec) is the required codec; the SIG's listening tests found it better than SBC at the same bit rate, or as good at about half the rate.
  • Multi-stream: each earbud gets its own synchronized stream instead of one bud relaying to the other; calls and music use the same high-quality link.
  • Hearing aids have a standard profile (HAP), so they can stream from any LE Audio phone or TV.
  • Auracast broadcast audio: one transmitter, any number of listeners. TVs in gyms and bars, gate announcements, assistive listening in theaters, or sharing music with friends; listeners join from a list or by scanning a QR code, much like picking a Wi-Fi network.
  • Support arrived in phones, earbuds and hearing aids from about 2022–23 (Android 13 added it) and is still uneven; both ends need it.

Bluetooth mesh

Bluetooth mesh (2017; version 1.1 in 2023) connects hundreds or thousands of LE devices, such as all the lights in an office building, without a hub and without connections. Messages travel by managed flooding: a message is broadcast in advertising packets, and every relay node that hears a new one rebroadcasts it once.

  • Each message carries a TTL (time to live). A relay passes on only messages with TTL 2 or more, and decrements it; a message arriving with TTL 1 goes no further. The source picks a TTL just big enough to cross the building.
  • Every node keeps a message cache and drops copies it has already seen, so the flood dies out.
hop 1: the switch broadcasts "light on" with TTL 3 hop 2: relays repeat it with TTL 2; R4 hears it twice and drops the copy hop 3: the next relays repeat it with TTL 1; the light receives it the light turns on; with TTL 1 nobody relays further switch R1 R2 R3 R4 R5 light

Managed flooding: each relay repeats a new message once, with the TTL counting down.
  • Node features: relay (rebroadcasts), proxy (lets a phone reach the mesh over an ordinary GATT connection), friend (stores messages for a sleepy low-power node, which wakes now and then to collect them).
  • Security: a network key for the whole mesh, application keys per use (lights vs locks) and a device key per node; adding a device is called provisioning.
  • Models define behavior: generic on/off, light lightness and color temperature, sensors; devices publish to and subscribe to group addresses ("all lights in room 3").
  • Version 1.1 added directed forwarding (routes instead of pure flooding), remote provisioning and over-the-air firmware updates. Routed mesh networks such as Thread and Zigbee are compared in Mesh & IoT networks.

Range and throughput in practice

  • Range depends on transmit power, antennas, the PHY, walls and bodies. A phone and earbuds manage about 10 m indoors; class 1 devices and LE Coded PHY can reach hundreds of meters in open space, and about a kilometer has been shown in ideal line-of-sight tests.
  • Bodies block 2.4 GHz: water absorbs it, so a phone in a back pocket and earbuds on the other side of the head can drop out in a crowd.
  • Coexistence: in phones and laptops Wi-Fi and Bluetooth often share one antenna and chip and take turns, so heavy 2.4 GHz Wi-Fi traffic can make Bluetooth audio stutter; moving Wi-Fi to 5 or 6 GHz helps.
LinkRaw rateRealistic application throughput
Classic EDR3 Mbit/s≈ 2 Mbit/s
LE 1M1 Mbit/sbest case ≈ 0.7 Mbit/s
LE 2M2 Mbit/sbest case ≈ 1.4 Mbit/s
LE Coded500 or 125 kbit/swell under that

Best cases need long packets, a large MTU and a short connection interval; typical apps move far less. Classic audio streams are a few hundred kbit/s: SBC at high quality about 330 kbit/s, LDAC up to 990 kbit/s. Audio latency over Classic A2DP is often 100–300 ms, which is why video players delay the picture to match; LE Audio and gaming modes cut it.

Other short-range radios

RadioFrequencyRangeDataUsed for
NFC13.56 MHz≈ 4 cm, at most ≈ 10 cm106–424 kbit/stap to pay, transit cards, door badges, pairing
UWB3.1–10.6 GHz, in channels ≥ 500 MHz wide (mostly ≈ 6.5 and 8 GHz)tens of metersranging; data up to ≈ 27 Mbit/sprecise distance and direction: trackers, car keys, door locks
RFID (passive)125 kHz, 13.56 MHz, 860–960 MHzcentimeters (LF, HF) to several meters (UHF)an ID number and a little memoryinventory, retail tags, libraries, toll and access cards
Zigbee, Thread2.4 GHz (IEEE 802.15.4)≈ 10–30 m per hop, meshed250 kbit/ssmart home sensors and lights; see Mesh & IoT networks

NFC

NFC (near-field communication) works by magnetic induction between two coils, like a transformer, rather than by radio waves sent into the distance; the field fades within centimeters, which is the point: you have to mean it. A passive card or tag is powered by the reader's field. Phones can be a reader (of tags and cards), act as a card (card emulation: contactless payments and transit, from a secure chip or app), and exchange small records (NDEF messages, standardized by the NFC Forum). Contactless payment cards follow ISO/IEC 14443 and the EMV payment rules.

UWB

Ultra-wideband sends very short pulses, about 2 ns long, spread over 500 MHz or more at very low power density. Short pulses give sharp arrival times, and arrival times give distance: radio covers about 30 cm per nanosecond. In two-way ranging, one device sends a poll, the other replies after a delay it reports, and the first computes the time of flight.

phone tag distance d phone tag ToF ToF t_round, measured by the phone t_reply, sent in the response d = c × ToF c ≈ 30 cm per ns 1 poll: phone → tag 2 tag waits a fixed, known reply time 3 response: tag → phone 4 phone: ToF = (t_round − t_reply) / 2 1 ns of timing error ≈ 30 cm, so UWB uses pulses about 2 ns long

Two-way ranging: subtract the reply delay from the round trip, halve it, multiply by the speed of light.
ToF = (t_round - t_reply) / 2
d   = c × ToF            c ≈ 30 cm per ns
error of 1 ns in ToF → ≈ 30 cm of distance error
  • With several antennas, the phone also measures the angle of arrival, so it can point an arrow at a lost tag ("precision finding").
  • Accuracy is typically around 10 cm. IEEE 802.15.4z (2020) added a scrambled timestamp sequence so an attacker can't fake a shorter distance, which is why digital car keys (the Car Connectivity Consortium's Digital Key 3.0) use Bluetooth LE to connect and UWB to confirm that the phone is really next to the car.
  • The FiRa Consortium certifies UWB interoperability. Bluetooth 6.0's Channel Sounding targets some of the same uses with ordinary Bluetooth radios.

RFID

RFID (radio-frequency identification) tags hold an ID and a little memory and are usually passive, powered by the reader. Low-frequency (125 kHz) and high-frequency (13.56 MHz, the NFC family) tags are read at centimeters: access badges, pet chips, library books. UHF tags (860–960 MHz, sold as RAIN RFID) reflect the reader's signal back and are read at several meters, hundreds per second: warehouse pallets, clothing labels, road tolls.

Try it

Linux (BlueZ):

# Is the adapter powered? Then scan for 15 s
bluetoothctl show
bluetoothctl --timeout 15 scan on
# Devices seen; details: name, RSSI, service UUIDs
bluetoothctl devices
bluetoothctl info AA:BB:CC:DD:EE:FF
# Pair, trust (reconnect automatically), connect
bluetoothctl pair AA:BB:CC:DD:EE:FF
bluetoothctl trust AA:BB:CC:DD:EE:FF
bluetoothctl connect AA:BB:CC:DD:EE:FF
# Watch every HCI packet: advertising, pairing, GATT
sudo btmon

Subscribe to a heart-rate strap's readings in the interactive shell (output abridged):

$ bluetoothctl
[bluetooth]# connect AA:BB:CC:DD:EE:FF
[HR strap]# menu gatt
[HR strap]# list-attributes
[HR strap]# select-attribute 00002a37-0000-1000-8000-00805f9b34fb
[HR strap]# notify on
[CHG] Attribute .../char000e Value: 06 48     flags 0x06, 72 bpm
[CHG] Attribute .../char000e Value: 06 4a     74 bpm
  • nRF Connect for Mobile (Nordic Semiconductor, iOS and Android) scans for devices and shows their advertising data, RSSI and interval; connect to browse services and characteristics, read values and switch on notifications. It decodes the standard SIG services.
  • To capture the air itself, a cheap nRF52 board running Nordic's nRF Sniffer feeds advertising and connections into Wireshark; encrypted links need the keys.
  • macOS: system_profiler SPBluetoothDataType lists the controller, its features and paired devices.

References