Bluetooth Low Energy (BLE) Packet Format, from Link Layer to ATT, covering advertising channel PDU and data channel PDU.

1. Bluetooth Low Energy (BLE)
Packet Format
Winfred LU
AMG GCSA
STMicroelectronics

2. BLE Protocol Stack

3. Link Layer Packet Format
1 byte 4 bytes 2 – 39 (33*) bytes 3 bytes
Preamble Access Address Protocol Data Unit (PDU) CRC
Data Channel PDUAdvertising Channel PDU
2 bytes 6 – 37 bytes
Header Payload
2 bytes 0 – 27 bytes 4 bytes
Header Payload MIC*
* 33 bytes for Data Channel PDUs w/o DPLE
* MIC: Message Integrity Check (option)
• Advertising Payload
• Scan Request/Response Payload
• Connection Request Payload
• Link Layer Control Payload
• Data Payload

4. Advertising Channel Packets

5. Advertising Packet
1 byte 4 bytes ≤ 39 bytes 3 bytes
Preamble Access Address Protocol Data Unit (PDU) CRC
2 bytes 6 – 37 bytes
Header Advertising payload
6 bytes 0 – 31 bytes
ADV Address Advertising Data
AD0 AD … … ADn
Advertising Channel PDU
0x8E89BED6
1 byte 1 byte AD Length (≤ 29 bytes)
AD Length AD Type AD Data
4 bits 2 bits 1 bit 1 bit 6 bits 2 bits
PDU type RFU TxAdd RxAdd Length RFU
0xAA
0
0000 ADV_IND
0001 ADV_DIRECT_IND
0010 ADV_NONCONN_IND
0011 SCAN_REQ
0100 SCAN_RSP
0101 CONNECT_REQ
0110 ADV_SCAN_IND

6. Scan Request
1 byte 4 bytes ≤ 39 bytes 3 bytes
Preamble Access Address Protocol Data Unit (PDU) CRC
2 bytes 12 bytes
Header Scan Request payload
6 bytes 6 bytes
Scanner Address Advertising Address
Advertising Channel PDU
0x8E89BED6
4 bits 2 bits 1 bit 1 bit 6 bits 2 bits
PDU type RFU TxAdd RxAdd Length RFU
0xAA
123
0000 ADV_IND
0001 ADV_DIRECT_IND
0010 ADV_NONCONN_IND
0011 SCAN_REQ
0100 SCAN_RSP
0101 CONNECT_REQ
0110 ADV_SCAN_IND

7. Connection Request
1 byte 4 bytes ≤ 39 bytes 3 bytes
Preamble Access Address Protocol Data Unit (PDU) CRC
2 bytes 34 bytes
Header Connection Request payload
6 bytes 6 bytes 22 bytes
Initiator Address Advertising Address Link Layer Data
Advertising Channel PDU
0x8E89BED6
4 bits 2 bits 1 bit 1 bit 6 bits 2 bits
PDU type RFU TxAdd RxAdd Length RFU
0xAA
5 34
4 bytes 3 bytes 1 byte 2 bytes 2 bytes 2 bytes 2 bytes 5 bytes 5 bits 3 bits
AA CRCInit WinSize WinOffset Interval Latency Timeout ChM Hop SCA
5 - 16
for data channel PDUs
0000 ADV_IND
0001 ADV_DIRECT_IND
0010 ADV_NONCONN_IND
0011 SCAN_REQ
0100 SCAN_RSP
0101 CONNECT_REQ
0110 ADV_SCAN_IND

8. Advertising Packet : iBeacon
1 byte 4 bytes ≤ 39 bytes 3 bytes
Preamble Access Address Protocol Data Unit (PDU) CRC
2 bytes 36 bytes
Header Advertising payload
6 bytes 30 bytes
ADV Address Advertising Data
AD0 AD1
Advertising Channel PDU
0x8E89BED6
1 byte 1 byte 1 byte
AD
Length
AD
Type
Flags
4 bits 2 bits 1 bit 1 bit 6 bits 2 bits
PDU type RFU TxAdd RxAdd Length RFU
0xAA
0x02 0x01 0x06
1 byte 1 byte 2 bytes 1 byte 1 byte 16 bytes 2 bytes 2 bytes 1 byte
AD
Length
AD
Type
Com. ID
iBcn
Type
iBcn
Length
Proximity UUID Major Minor
TX
power
0x1A 0xFF 0x004C 0x02 0x15
Manufacturer specific Apple, Inc.
b0: limited discoverable
b1: general discoverable
b2: BR/EDR supported
b3: BR/EDR controller
b4: BR/EDR host
Proximity beacon
Tx Power
• at 1 m for iBeacon
• at 0 m for Eddystone

9. Advertising Packet : Eddystone Beacon
1 byte 4 bytes ≤ 39 bytes 3 bytes
Preamble Access Address Protocol Data Unit (PDU) CRC
2 bytes ≤ 37 bytes
Header Advertising payload
6 bytes ≤ 31 bytes
ADV Address Advertising Data
AD0 AD1 AD2
Advertising Channel PDU
0x8E89BED6
1 byte 1 byte 1 byte
AD
Length
AD
Type
Flags
4 bits 2 bits 1 bit 1 bit 6 bits 2 bits
PDU type RFU TxAdd RxAdd Length RFU
0xAA
0x02 0x01 0x06
1 byte 1 byte 2 bytes ≤ 20 bytes
AD
Length
AD
Type
Eddystone
UUID
Eddystone Frame
1 byte 1 byte 2 bytes
AD
Length
AD
Type
Eddystone
UUID
0x03 0x03 0xFEAA • UID frame
• URL frame
• TLM frame
0x16 0xFEAA

10. Eddystone Beacon Cont.
6 bytes ≤ 31 bytes
ADV Address Advertising Data
AD0 AD1 AD2
1 byte 1 byte 1 byte
AD
Length
AD
Type
Flags
0x02 0x01 0x06
1 byte 1 byte 2 bytes ≤ 20 bytes
AD
Length
AD
Type
Eddystone
UUID
Eddystone Frame
1 byte 1 byte 2 bytes
AD
Length
AD
Type
Eddystone
UUID
0x03 0x03 0xFEAA 0x16 0xFEAA
1 byte 1 byte 2 bytes 2 bytes 4 bytes 4 bytes
Frame
Type
Version
Battery
Voltage
Beacon
Temp
Adv PDU Count
since boot
Time since boot
1 byte 1 byte 1 byte 0 – 17 bytes
Frame
Type
Tx
Power
URL
Schem
Encoded URL
1 byte 1 byte 10 bytes 6 bytes 2 bytes
Frame
Type
Tx
Power
Namespace ID Instance ID RFU
0x00
0x10
0x20 0x00
UID frame
URL frame
TLM frame
Tx Power
• at 1 m for iBeacon
• at 0 m for Eddystone
Not covered:
• EID frame
• Type = 0x30
• Encrypted TLM
• Version = 0x01

11. Data Channel Packets

12. Link Layer Control Packet
1 byte 4 bytes 2 – 29 bytes 3 bytes
Preamble Access Address Protocol Data Unit (PDU) CRC
Data Channel PDU
2 bytes 0 – 27 bytes
Header Data payload
2 bits 1 bit 1 bit 1 bit 3 bits 8 bits
LLID NESN SN MD RFU Length
0xAA 0~
or
0x55 1~
01: LL Data PDU – Continuation or Empty
10: LL Data PDU – Start of message
11: LL Control PDU
3
1 byte 0 – 26 bytes
Opcode Control Data
0x00: LL_CONNECTION_UPDATE_IND
0x01: LL_CHANNEL_MAP_IND
0x02: LL_TERMINATE_IND
……: Refer to Spec 6,B,2.4.2

13. Data Packet
1 byte 4 bytes 2 – 257 (33*) bytes 3 bytes
Preamble Access Address Protocol Data Unit (PDU) CRC
2 bytes ≤ 251 (27*) bytes
Header Data payload
* 39,33,27,23: without DPLE
* MIC: Message Integrity Check
4 bytes ≤ 247 (23*) bytes ≤ 251 (27*) w/o MIC
L2CAP Header
1 byte ≤ 246 (22*) bytes ≤ 250 (26*) w/o MIC
Opcode Data
L2CAP protocol PDU
Data Channel PDU
ATT protocol PDU
0xAA 0~
or
0x55 1~ 4 bytes
MIC*

14. LE Data Packet Length Extension (DPLE)
1 byte 4 bytes 2 – 257 (33*) bytes 3 bytes
Preamble Access Address Protocol Data Unit (PDU) CRC
2 bits 1 bit 1 bit 1 bit 3 bits 5 bits 3 bits
LLID NESN SN MD RFU Length RFU
Data Channel PDU
2 bytes ≤ 255 (31*) bytes
Header Data payload, including optional MIC
2 bits 1 bit 1 bit 1 bit 3 bits 8 bits
LLID NESN SN MD RFU Length
Core Spec 4.1
• Max length = 11111b = 31
Core Spec 4.2
• Max length = 11111111b = 255
0xAA 0~
or
0x55 1~
01: LL Data PDU – Continuation or Empty
10: LL Data PDU – Start of message
11: LL Control PDU
* 33, 31: without DPLE

15. L2CAP Fragmentations (w/o DPLE)
1 byte 4 bytes ≤ 33 bytes 3 bytes
Preamble Access Address Protocol Data Unit (PDU) CRC
0xAA 0~
or
0x55 1~ 2 bytes ≤ 27 bytes
Header Data payloadData Channel PDU
4 bytes
MIC*
4 bytes 23 bytes
L2CAP Header ATT protocol PDU
27 bytes
ATT protocol PDU
L2CAP protocol PDU
27 bytes or less
ATT protocol PDU
……..
Fragment 1
Fragment 2
Fragment n
2 bytes 2 bytes
Length Channel IDL2CAP Header
≤ ATT_MTU (up to 512)

16. Attribute (ATT) Protocol PDU
1 byte ≤ ATT_MTU - 1
Opcode Data
ATT protocol PDU
Attribute Parameters
12 bytes
Authentication Signature
2 bytes 2 or 16 bytes variable length implementation specific
Attribute Handle Attribute Type Attribute Value Attribute Permissions
1 0x2800 0x1801 Read
2 0x2803 20 03 00 05 2a Read
… …

17. Thank you