3 ms·
How easy is it to put consumer BLE chipsets into a monitor mode? It sounds like it'd be fun to "wardrive" (more likely walking around) with a BLE "scanner".
by EvanAnderson 3y ago
How easy is it to put consumer BLE chipsets into a monitor mode? It sounds like it'd be fun to "wardrive" (more likely walking around) with a BLE "scanner".
- lyu07282 3y agoimpossible afaik, but SDR's are so cheap and available now anyway..
- invalidator 3y agoIt's a piece of cake. BLE doesn't try to hide anything. Install "nRF Connect" on a mobile device and have fun.
- dmitrygr 3y agoIf you only want to listen to advertising channels, it is trivial because this is the norm - this is how connections are established. If you want to listen in on data channels you'll need an SDR with a lot of bandwidth or 40 receivers to cover every channel. If you want to monitor a single connection, you can channel-hop with it in the same sequence, but if you miss out on the connection establishment message, you'll not know the channel hopping sequence and not manage. Most BLE comms are encrypted nowadays so you'll not get much out of this anyways.
- jlarocco 3y agoBLE is basically designed to work that way, so it’s very easy. On Linux you can start a bluetooth device scan (using “scan on” in bluetoothcl), and all of the nearby devices will show up as DBus objects under “org.bluez”. You can manipulate them and read their properties/attributes with any DBus interface. Could probably be a shell one liner.