OnAir

IoT & sensors · Experimental

Decode Bluetooth LE with an SDR

OnAir receives Bluetooth LE. Bluetooth Low Energy advertising on channels 37, 38 and 39 (2402 / 2426 / 2480 MHz): device names, vendors, services, iBeacon and Eddystone, like a scanner app (receive only: never connects or pairs).

What Bluetooth LE is

Bluetooth Low Energy devices announce themselves in advertising packets on channels 37, 38 and 39. OnAir lists them like a scanner app, and never connects or pairs.

Frequencies and where it is used

Advertising on channels 37, 38 and 39 (2402 / 2426 / 2480 MHz), one at a time or hopping, 4 Msps.

In OnAir the tuning shortcut is Advertising, 2.4 GHz; you can enter any frequency your radio reaches.

What OnAir shows for Bluetooth LE

What a scanner app such as nRF Connect shows: a device table with address type, name, level history, vendor, services, iBeacon, Eddystone and exposure notification beacons, and a packet log. Receive only: it never connects, pairs or transmits and does not follow connections; most phones use random addresses that change every few minutes for privacy.

This receiver is built from the published specification and checked end to end on simulated signals. It has had little or no testing on real transmissions yet, so reports and recordings on Discord are welcome.

Which radio you need

This mode sits at a high frequency, so check that your radio tunes it: a HackRF covers 1 MHz to 6 GHz, and RTL-SDR stops near 1.7 GHz. Some modes at these frequencies also need a fast radio (10 to 20 Msps) or a dish and an LNB.

Questions about Bluetooth LE

Can I decode Bluetooth LE with an RTL-SDR?

Probably not: an RTL-SDR tunes up to about 1.7 GHz. A HackRF (1 MHz to 6 GHz) or another wideband radio is the usual choice for this frequency range.

Is it legal to receive Bluetooth LE?

This mode is passive. It only receives, never connects, pairs or joins networks, and never decrypts payloads. Check the rules where you live.

Can I try Bluetooth LE in OnAir without a radio?

Yes. Most modes include a built-in synthetic test signal, so you can open the screen and try the controls before you own a radio.

Try it without a radio

OnAir includes built-in synthetic test signals for most modes, so you can open this screen, see the layout and try the controls before you own a radio. The Tour button walks you through the app.

Receiving and the law. This mode is passive. It only receives, never connects, pairs or joins networks, and never decrypts payloads. Check the rules where you live.

More in IoT & sensors

← MeshCore  ·  Zigbee / 802.15.4 →