I dont think there is much of a message in there, its just a iBeacon packet type. Just using the default iBeacon structure - you could have a hash tucked into

I dont think there is much of a message in there, its just a iBeacon packet type. Just using the default iBeacon structure - you could have a hash tucked into the major/minor bytes (4 bytes tot) which would correspond to a value blasted out by Avahi on the network the AppleTV is connected to. You could also just blast out a list of valid iBeacon UUID'a out in the same way. Requiring your phone be on wifi and be on the same network at the AppleTV would allow for that. You could even, for example have a ATV device trying to connect require an AppleID and a network connection which could cause a valid iBeacon UUID be seeded to the mobile devices attached to that account. That all said, There does appear to be a handshake before data is sent, because at that point is no longer a BLE iBeacon being used to send the data, you would need to connect to the device - which would involve either pairing or a handshake. So this appears to just be a nuisance attack, rather than a actual attack.