Bluetooth Low Energy (BLE)
Packet Format
Winfred LU
AMG GCSA
STMicroelectronics
BLE Protocol Stack
Link Layer Packet Format
1 byte 4 bytes 2 – 39 (33*) bytes 3 bytes
Preamble Access Address Protocol Data Unit (PDU) CRC
Data Channel PDUAdvertising Channel PDU
2 bytes 6 – 37 bytes
Header Payload
2 bytes 0 – 27 bytes 4 bytes
Header Payload MIC*
* 33 bytes for Data Channel PDUs w/o DPLE
* MIC: Message Integrity Check (option)
• Advertising Payload
• Scan Request/Response Payload
• Connection Request Payload
• Link Layer Control Payload
• Data Payload
Advertising Channel Packets
Advertising Packet
1 byte 4 bytes ≤ 39 bytes 3 bytes
Preamble Access Address Protocol Data Unit (PDU) CRC
2 bytes 6 – 37 bytes
Header Advertising payload
6 bytes 0 – 31 bytes
ADV Address Advertising Data
AD0 AD … … ADn
Advertising Channel PDU
0x8E89BED6
1 byte 1 byte AD Length (≤ 29 bytes)
AD Length AD Type AD Data
4 bits 2 bits 1 bit 1 bit 6 bits 2 bits
PDU type RFU TxAdd RxAdd Length RFU
0xAA
0
0000 ADV_IND
0001 ADV_DIRECT_IND
0010 ADV_NONCONN_IND
0011 SCAN_REQ
0100 SCAN_RSP
0101 CONNECT_REQ
0110 ADV_SCAN_IND
Scan Request
1 byte 4 bytes ≤ 39 bytes 3 bytes
Preamble Access Address Protocol Data Unit (PDU) CRC
2 bytes 12 bytes
Header Scan Request payload
6 bytes 6 bytes
Scanner Address Advertising Address
Advertising Channel PDU
0x8E89BED6
4 bits 2 bits 1 bit 1 bit 6 bits 2 bits
PDU type RFU TxAdd RxAdd Length RFU
0xAA
123
0000 ADV_IND
0001 ADV_DIRECT_IND
0010 ADV_NONCONN_IND
0011 SCAN_REQ
0100 SCAN_RSP
0101 CONNECT_REQ
0110 ADV_SCAN_IND
Connection Request
1 byte 4 bytes ≤ 39 bytes 3 bytes
Preamble Access Address Protocol Data Unit (PDU) CRC
2 bytes 34 bytes
Header Connection Request payload
6 bytes 6 bytes 22 bytes
Initiator Address Advertising Address Link Layer Data
Advertising Channel PDU
0x8E89BED6
4 bits 2 bits 1 bit 1 bit 6 bits 2 bits
PDU type RFU TxAdd RxAdd Length RFU
0xAA
5 34
4 bytes 3 bytes 1 byte 2 bytes 2 bytes 2 bytes 2 bytes 5 bytes 5 bits 3 bits
AA CRCInit WinSize WinOffset Interval Latency Timeout ChM Hop SCA
5 - 16
for data channel PDUs
0000 ADV_IND
0001 ADV_DIRECT_IND
0010 ADV_NONCONN_IND
0011 SCAN_REQ
0100 SCAN_RSP
0101 CONNECT_REQ
0110 ADV_SCAN_IND
Advertising Packet : iBeacon
1 byte 4 bytes ≤ 39 bytes 3 bytes
Preamble Access Address Protocol Data Unit (PDU) CRC
2 bytes 36 bytes
Header Advertising payload
6 bytes 30 bytes
ADV Address Advertising Data
AD0 AD1
Advertising Channel PDU
0x8E89BED6
1 byte 1 byte 1 byte
AD
Length
AD
Type
Flags
4 bits 2 bits 1 bit 1 bit 6 bits 2 bits
PDU type RFU TxAdd RxAdd Length RFU
0xAA
0x02 0x01 0x06
1 byte 1 byte 2 bytes 1 byte 1 byte 16 bytes 2 bytes 2 bytes 1 byte
AD
Length
AD
Type
Com. ID
iBcn
Type
iBcn
Length
Proximity UUID Major Minor
TX
power
0x1A 0xFF 0x004C 0x02 0x15
Manufacturer specific Apple, Inc.
b0: limited discoverable
b1: general discoverable
b2: BR/EDR supported
b3: BR/EDR controller
b4: BR/EDR host
Proximity beacon
Tx Power
• at 1 m for iBeacon
• at 0 m for Eddystone
Advertising Packet : Eddystone Beacon
1 byte 4 bytes ≤ 39 bytes 3 bytes
Preamble Access Address Protocol Data Unit (PDU) CRC
2 bytes ≤ 37 bytes
Header Advertising payload
6 bytes ≤ 31 bytes
ADV Address Advertising Data
AD0 AD1 AD2
Advertising Channel PDU
0x8E89BED6
1 byte 1 byte 1 byte
AD
Length
AD
Type
Flags
4 bits 2 bits 1 bit 1 bit 6 bits 2 bits
PDU type RFU TxAdd RxAdd Length RFU
0xAA
0x02 0x01 0x06
1 byte 1 byte 2 bytes ≤ 20 bytes
AD
Length
AD
Type
Eddystone
UUID
Eddystone Frame
1 byte 1 byte 2 bytes
AD
Length
AD
Type
Eddystone
UUID
0x03 0x03 0xFEAA • UID frame
• URL frame
• TLM frame
0x16 0xFEAA
Eddystone Beacon Cont.
6 bytes ≤ 31 bytes
ADV Address Advertising Data
AD0 AD1 AD2
1 byte 1 byte 1 byte
AD
Length
AD
Type
Flags
0x02 0x01 0x06
1 byte 1 byte 2 bytes ≤ 20 bytes
AD
Length
AD
Type
Eddystone
UUID
Eddystone Frame
1 byte 1 byte 2 bytes
AD
Length
AD
Type
Eddystone
UUID
0x03 0x03 0xFEAA 0x16 0xFEAA
1 byte 1 byte 2 bytes 2 bytes 4 bytes 4 bytes
Frame
Type
Version
Battery
Voltage
Beacon
Temp
Adv PDU Count
since boot
Time since boot
1 byte 1 byte 1 byte 0 – 17 bytes
Frame
Type
Tx
Power
URL
Schem
Encoded URL
1 byte 1 byte 10 bytes 6 bytes 2 bytes
Frame
Type
Tx
Power
Namespace ID Instance ID RFU
0x00
0x10
0x20 0x00
UID frame
URL frame
TLM frame
Tx Power
• at 1 m for iBeacon
• at 0 m for Eddystone
Not covered:
• EID frame
• Type = 0x30
• Encrypted TLM
• Version = 0x01
Data Channel Packets
Link Layer Control Packet
1 byte 4 bytes 2 – 29 bytes 3 bytes
Preamble Access Address Protocol Data Unit (PDU) CRC
Data Channel PDU
2 bytes 0 – 27 bytes
Header Data payload
2 bits 1 bit 1 bit 1 bit 3 bits 8 bits
LLID NESN SN MD RFU Length
0xAA 0~
or
0x55 1~
01: LL Data PDU – Continuation or Empty
10: LL Data PDU – Start of message
11: LL Control PDU
3
1 byte 0 – 26 bytes
Opcode Control Data
0x00: LL_CONNECTION_UPDATE_IND
0x01: LL_CHANNEL_MAP_IND
0x02: LL_TERMINATE_IND
……: Refer to Spec 6,B,2.4.2
Data Packet
1 byte 4 bytes 2 – 257 (33*) bytes 3 bytes
Preamble Access Address Protocol Data Unit (PDU) CRC
2 bytes ≤ 251 (27*) bytes
Header Data payload
* 39,33,27,23: without DPLE
* MIC: Message Integrity Check
4 bytes ≤ 247 (23*) bytes ≤ 251 (27*) w/o MIC
L2CAP Header
1 byte ≤ 246 (22*) bytes ≤ 250 (26*) w/o MIC
Opcode Data
L2CAP protocol PDU
Data Channel PDU
ATT protocol PDU
0xAA 0~
or
0x55 1~ 4 bytes
MIC*
LE Data Packet Length Extension (DPLE)
1 byte 4 bytes 2 – 257 (33*) bytes 3 bytes
Preamble Access Address Protocol Data Unit (PDU) CRC
2 bits 1 bit 1 bit 1 bit 3 bits 5 bits 3 bits
LLID NESN SN MD RFU Length RFU
Data Channel PDU
2 bytes ≤ 255 (31*) bytes
Header Data payload, including optional MIC
2 bits 1 bit 1 bit 1 bit 3 bits 8 bits
LLID NESN SN MD RFU Length
Core Spec 4.1
• Max length = 11111b = 31
Core Spec 4.2
• Max length = 11111111b = 255
0xAA 0~
or
0x55 1~
01: LL Data PDU – Continuation or Empty
10: LL Data PDU – Start of message
11: LL Control PDU
* 33, 31: without DPLE
L2CAP Fragmentations (w/o DPLE)
1 byte 4 bytes ≤ 33 bytes 3 bytes
Preamble Access Address Protocol Data Unit (PDU) CRC
0xAA 0~
or
0x55 1~ 2 bytes ≤ 27 bytes
Header Data payloadData Channel PDU
4 bytes
MIC*
4 bytes 23 bytes
L2CAP Header ATT protocol PDU
27 bytes
ATT protocol PDU
L2CAP protocol PDU
27 bytes or less
ATT protocol PDU
……..
Fragment 1
Fragment 2
Fragment n
2 bytes 2 bytes
Length Channel IDL2CAP Header
≤ ATT_MTU (up to 512)
Attribute (ATT) Protocol PDU
1 byte ≤ ATT_MTU - 1
Opcode Data
ATT protocol PDU
Attribute Parameters
12 bytes
Authentication Signature
2 bytes 2 or 16 bytes variable length implementation specific
Attribute Handle Attribute Type Attribute Value Attribute Permissions
1 0x2800 0x1801 Read
2 0x2803 20 03 00 05 2a Read
… …
Thank you

Bluetooth Low Energy Packet Format

  • 1.
    Bluetooth Low Energy(BLE) Packet Format Winfred LU AMG GCSA STMicroelectronics
  • 2.
  • 3.
    Link Layer PacketFormat 1 byte 4 bytes 2 – 39 (33*) bytes 3 bytes Preamble Access Address Protocol Data Unit (PDU) CRC Data Channel PDUAdvertising Channel PDU 2 bytes 6 – 37 bytes Header Payload 2 bytes 0 – 27 bytes 4 bytes Header Payload MIC* * 33 bytes for Data Channel PDUs w/o DPLE * MIC: Message Integrity Check (option) • Advertising Payload • Scan Request/Response Payload • Connection Request Payload • Link Layer Control Payload • Data Payload
  • 4.
  • 5.
    Advertising Packet 1 byte4 bytes ≤ 39 bytes 3 bytes Preamble Access Address Protocol Data Unit (PDU) CRC 2 bytes 6 – 37 bytes Header Advertising payload 6 bytes 0 – 31 bytes ADV Address Advertising Data AD0 AD … … ADn Advertising Channel PDU 0x8E89BED6 1 byte 1 byte AD Length (≤ 29 bytes) AD Length AD Type AD Data 4 bits 2 bits 1 bit 1 bit 6 bits 2 bits PDU type RFU TxAdd RxAdd Length RFU 0xAA 0 0000 ADV_IND 0001 ADV_DIRECT_IND 0010 ADV_NONCONN_IND 0011 SCAN_REQ 0100 SCAN_RSP 0101 CONNECT_REQ 0110 ADV_SCAN_IND
  • 6.
    Scan Request 1 byte4 bytes ≤ 39 bytes 3 bytes Preamble Access Address Protocol Data Unit (PDU) CRC 2 bytes 12 bytes Header Scan Request payload 6 bytes 6 bytes Scanner Address Advertising Address Advertising Channel PDU 0x8E89BED6 4 bits 2 bits 1 bit 1 bit 6 bits 2 bits PDU type RFU TxAdd RxAdd Length RFU 0xAA 123 0000 ADV_IND 0001 ADV_DIRECT_IND 0010 ADV_NONCONN_IND 0011 SCAN_REQ 0100 SCAN_RSP 0101 CONNECT_REQ 0110 ADV_SCAN_IND
  • 7.
    Connection Request 1 byte4 bytes ≤ 39 bytes 3 bytes Preamble Access Address Protocol Data Unit (PDU) CRC 2 bytes 34 bytes Header Connection Request payload 6 bytes 6 bytes 22 bytes Initiator Address Advertising Address Link Layer Data Advertising Channel PDU 0x8E89BED6 4 bits 2 bits 1 bit 1 bit 6 bits 2 bits PDU type RFU TxAdd RxAdd Length RFU 0xAA 5 34 4 bytes 3 bytes 1 byte 2 bytes 2 bytes 2 bytes 2 bytes 5 bytes 5 bits 3 bits AA CRCInit WinSize WinOffset Interval Latency Timeout ChM Hop SCA 5 - 16 for data channel PDUs 0000 ADV_IND 0001 ADV_DIRECT_IND 0010 ADV_NONCONN_IND 0011 SCAN_REQ 0100 SCAN_RSP 0101 CONNECT_REQ 0110 ADV_SCAN_IND
  • 8.
    Advertising Packet :iBeacon 1 byte 4 bytes ≤ 39 bytes 3 bytes Preamble Access Address Protocol Data Unit (PDU) CRC 2 bytes 36 bytes Header Advertising payload 6 bytes 30 bytes ADV Address Advertising Data AD0 AD1 Advertising Channel PDU 0x8E89BED6 1 byte 1 byte 1 byte AD Length AD Type Flags 4 bits 2 bits 1 bit 1 bit 6 bits 2 bits PDU type RFU TxAdd RxAdd Length RFU 0xAA 0x02 0x01 0x06 1 byte 1 byte 2 bytes 1 byte 1 byte 16 bytes 2 bytes 2 bytes 1 byte AD Length AD Type Com. ID iBcn Type iBcn Length Proximity UUID Major Minor TX power 0x1A 0xFF 0x004C 0x02 0x15 Manufacturer specific Apple, Inc. b0: limited discoverable b1: general discoverable b2: BR/EDR supported b3: BR/EDR controller b4: BR/EDR host Proximity beacon Tx Power • at 1 m for iBeacon • at 0 m for Eddystone
  • 9.
    Advertising Packet :Eddystone Beacon 1 byte 4 bytes ≤ 39 bytes 3 bytes Preamble Access Address Protocol Data Unit (PDU) CRC 2 bytes ≤ 37 bytes Header Advertising payload 6 bytes ≤ 31 bytes ADV Address Advertising Data AD0 AD1 AD2 Advertising Channel PDU 0x8E89BED6 1 byte 1 byte 1 byte AD Length AD Type Flags 4 bits 2 bits 1 bit 1 bit 6 bits 2 bits PDU type RFU TxAdd RxAdd Length RFU 0xAA 0x02 0x01 0x06 1 byte 1 byte 2 bytes ≤ 20 bytes AD Length AD Type Eddystone UUID Eddystone Frame 1 byte 1 byte 2 bytes AD Length AD Type Eddystone UUID 0x03 0x03 0xFEAA • UID frame • URL frame • TLM frame 0x16 0xFEAA
  • 10.
    Eddystone Beacon Cont. 6bytes ≤ 31 bytes ADV Address Advertising Data AD0 AD1 AD2 1 byte 1 byte 1 byte AD Length AD Type Flags 0x02 0x01 0x06 1 byte 1 byte 2 bytes ≤ 20 bytes AD Length AD Type Eddystone UUID Eddystone Frame 1 byte 1 byte 2 bytes AD Length AD Type Eddystone UUID 0x03 0x03 0xFEAA 0x16 0xFEAA 1 byte 1 byte 2 bytes 2 bytes 4 bytes 4 bytes Frame Type Version Battery Voltage Beacon Temp Adv PDU Count since boot Time since boot 1 byte 1 byte 1 byte 0 – 17 bytes Frame Type Tx Power URL Schem Encoded URL 1 byte 1 byte 10 bytes 6 bytes 2 bytes Frame Type Tx Power Namespace ID Instance ID RFU 0x00 0x10 0x20 0x00 UID frame URL frame TLM frame Tx Power • at 1 m for iBeacon • at 0 m for Eddystone Not covered: • EID frame • Type = 0x30 • Encrypted TLM • Version = 0x01
  • 11.
  • 12.
    Link Layer ControlPacket 1 byte 4 bytes 2 – 29 bytes 3 bytes Preamble Access Address Protocol Data Unit (PDU) CRC Data Channel PDU 2 bytes 0 – 27 bytes Header Data payload 2 bits 1 bit 1 bit 1 bit 3 bits 8 bits LLID NESN SN MD RFU Length 0xAA 0~ or 0x55 1~ 01: LL Data PDU – Continuation or Empty 10: LL Data PDU – Start of message 11: LL Control PDU 3 1 byte 0 – 26 bytes Opcode Control Data 0x00: LL_CONNECTION_UPDATE_IND 0x01: LL_CHANNEL_MAP_IND 0x02: LL_TERMINATE_IND ……: Refer to Spec 6,B,2.4.2
  • 13.
    Data Packet 1 byte4 bytes 2 – 257 (33*) bytes 3 bytes Preamble Access Address Protocol Data Unit (PDU) CRC 2 bytes ≤ 251 (27*) bytes Header Data payload * 39,33,27,23: without DPLE * MIC: Message Integrity Check 4 bytes ≤ 247 (23*) bytes ≤ 251 (27*) w/o MIC L2CAP Header 1 byte ≤ 246 (22*) bytes ≤ 250 (26*) w/o MIC Opcode Data L2CAP protocol PDU Data Channel PDU ATT protocol PDU 0xAA 0~ or 0x55 1~ 4 bytes MIC*
  • 14.
    LE Data PacketLength Extension (DPLE) 1 byte 4 bytes 2 – 257 (33*) bytes 3 bytes Preamble Access Address Protocol Data Unit (PDU) CRC 2 bits 1 bit 1 bit 1 bit 3 bits 5 bits 3 bits LLID NESN SN MD RFU Length RFU Data Channel PDU 2 bytes ≤ 255 (31*) bytes Header Data payload, including optional MIC 2 bits 1 bit 1 bit 1 bit 3 bits 8 bits LLID NESN SN MD RFU Length Core Spec 4.1 • Max length = 11111b = 31 Core Spec 4.2 • Max length = 11111111b = 255 0xAA 0~ or 0x55 1~ 01: LL Data PDU – Continuation or Empty 10: LL Data PDU – Start of message 11: LL Control PDU * 33, 31: without DPLE
  • 15.
    L2CAP Fragmentations (w/oDPLE) 1 byte 4 bytes ≤ 33 bytes 3 bytes Preamble Access Address Protocol Data Unit (PDU) CRC 0xAA 0~ or 0x55 1~ 2 bytes ≤ 27 bytes Header Data payloadData Channel PDU 4 bytes MIC* 4 bytes 23 bytes L2CAP Header ATT protocol PDU 27 bytes ATT protocol PDU L2CAP protocol PDU 27 bytes or less ATT protocol PDU …….. Fragment 1 Fragment 2 Fragment n 2 bytes 2 bytes Length Channel IDL2CAP Header ≤ ATT_MTU (up to 512)
  • 16.
    Attribute (ATT) ProtocolPDU 1 byte ≤ ATT_MTU - 1 Opcode Data ATT protocol PDU Attribute Parameters 12 bytes Authentication Signature 2 bytes 2 or 16 bytes variable length implementation specific Attribute Handle Attribute Type Attribute Value Attribute Permissions 1 0x2800 0x1801 Read 2 0x2803 20 03 00 05 2a Read … …
  • 17.