Bluetooth - Protocol

Bluetooth - Protocol                                                           Home : www.sharetechnote.com

Overal State Transition   Overall state flow of bluetooth communication is as follows. When you see this kind of circular state diagram, you'd better select one of the starting point and end point. Otherwise, you will keep cycling through the states and your eye ball would be spinning endlessly -:). For example, I just picket "Stand by" as the first point and "Tx/Rx" as the end point and follow through the path marked in red arrows. As you turn on a bluetooth device, it would be into stand by mode and start "inquire". (This is like broadcasting a message to all direction saying "Is there any one listening to me ? If there is, let me know your address". Through this process, the device may get the response from multiple device. If it finds any device it want to connect, it sends Paging message to the device saying "I want to get connected to you". If it gets the acceptance from the other party, the both party gets into connected mode via a complicated steps which will be described next section.   Once in connected mode, both party can transmit and receive data. But what if there is no data to transmit or recieve for a long time ? It they stay awake during that period, it would waste a lot of battery power. To reduce the waste of the battery life, bluetooth support three levels of energy saving mode, called Sniff, Hold, Park.   In Sniff mode, the device still maintain the synchronization with piconet (network between bluetooth devices) but the Tx/Rx cycle gets reduced. This cycle is called "Sniff Interval" and this interval is programmable and depends on application.   In Hold mode, only the internal clock in the device is running. So in this mode, data transfer is not possible but if there is need for data transfer, it can switch to Active mode very quickly. This HOLD mode can be initiated ether Master or Slave.   In Park mode, the device still maintains the synchronization with piconet (network between bluetooth devices) but it does not transmit/recieve any data.. the device even release its MAC address. It just periodically wake up to listen to Master. If it gets any signal from Master requesting data transaction, it has to go through connection process again. It would take a little longer time/process to recover the connection but it saves energy the most.         Overall Protocol Sequence     Following is one example bluetooth protocl log from wiki.wireshark.org - Bluetooth1.cap . Just go through overall sequence first and dig into the detailed parameters in each of the message as it interests you. Step Command 1 Sent HCI Command Inquiry 2 Rcvd HCI Event Command Status (Inquiry) 3 Rcvd HCI Event Inquiry Result 4 Rcvd HCI Event Inquiry Complete 5 Sent HCI Command Remote Name Request 6 Rcvd HCI Event Command Status (Remote Name Request) 7 Rcvd HCI Event Remote Name Req Complete 8 Rcvd HCI Event Connect Request 9 Sent HCI Command Accept Connection Request 10 Rcvd HCI Event Command Status (Accept Connection Request) 11 Rcvd HCI Event PIN Code Request 12 Sent HCI Command PIN Code Request Reply 13 Rcvd HCI Event Command Complete (PIN Code Request Reply) 14 Rcvd HCI Event Connect Complete 15 Rcvd HCI Event Connect Request 16 Sent HCI Command Accept Connection Request 17 Rcvd HCI Event Command Status (Accept Connection Request) 18 Rcvd HCI Event PIN Code Request 19 Sent HCI Command PIN Code Request Reply 20 Rcvd HCI Event Command Complete (PIN Code Request Reply) 21 Rcvd HCI Event Link Key Notification 22 Rcvd HCI Event Connect Complete 23 Sent HCI Command Write Link Policy Settings 24 Rcvd HCI Event Page Scan Repetition Mode Change 25 Rcvd HCI Event Command Complete (Write Link Policy Settings) 26 Sent HCI Command Change Connection Packet Type 27 Rcvd HCI Event Max Slots Change 28 Rcvd HCI Event Command Status (Change Connection Packet Type) 29 Sent HCI Command Remote Name Request 30 Rcvd HCI Event Connection Packet Type Changed 31 Rcvd HCI Event Command Status (Remote Name Request) 32 Sent HCI Command Remote Name Request 33 Rcvd HCI Event Command Status (Remote Name Request) 34 Rcvd HCI Event Remote Name Req Complete 35 Rcvd HCI Event Disconnect Complete   (1) Command Inquiry Bluetooth HCI H4     [Direction: Sent (0x00)]     HCI Packet Type: HCI Command (0x01) Bluetooth HCI Command - Inquiry     Command Opcode: Inquiry (0x0401)         0000 01.. .... .... = ogf: Link Control Commands (0x0001)         .... ..00 0000 0001 = ocf: 0x0001     Parameter Total Length: 5     LAP: 0x9e8b33     Inquiry Length: 16     Num Responses: 0   (2) Command Status (Inquiry) Bluetooth HCI H4     [Direction: Rcvd (0x01)]     HCI Packet Type: HCI Event (0x04) Bluetooth HCI Event - Command Status     Event Code: Command Status (0x0f)     Parameter Total Length: 4     Status: Pending (0x00)     Number of Allowed Command Packets: 1     Command Opcode: Inquiry (0x0401)   (3) Inquiry Result Bluetooth HCI H4     [Direction: Rcvd (0x01)]     HCI Packet Type: HCI Event (0x04) Bluetooth HCI Event - Inquiry Result     Event Code: Inquiry Result (0x02)     Parameter Total Length: 15     Number of responses: 1     BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)     Page Scan Repetition Mode: R1 (0x01)     Page Scan Period Mode: P0 (0x00)     Page Scan Mode: Mandatory Page Scan Mode (0x00)     Class of Device: 0x420204 (Phone - services: Telephony, Networking)     .100 0010 1101 1101 = Clock Offset: 0x42dd     (4) Inquiry Complete Bluetooth HCI H4     [Direction: Rcvd (0x01)]     HCI Packet Type: HCI Event (0x04) Bluetooth HCI Event - Inquiry Complete     Event Code: Inquiry Complete (0x01)     Parameter Total Length: 1     Status: Success (0x00)     (5) Remote Name Request Bluetooth HCI H4     [Direction: Sent (0x00)]     HCI Packet Type: HCI Command (0x01) Bluetooth HCI Command - Remote Name Request     Command Opcode: Remote Name Request (0x0419)         0000 01.. .... .... = ogf: Link Control Commands (0x0001)         .... ..00 0001 1001 = ocf: 0x0019     Parameter Total Length: 10     BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)     Page Scan Repetition Mode: R1 (0x01)     Page Scan Mode: Mandatory Page Scan Mode (0x00)     .000 0000 0000 0000 = Clock Offset: 0x0000 (0 ms)     0... .... .... .... = Clock_Offset_Valid_Flag: false (0)     (6) Command Status (Remote Name Request) Bluetooth HCI H4     [Direction: Rcvd (0x01)]     HCI Packet Type: HCI Event (0x04) Bluetooth HCI Event - Command Status     Event Code: Command Status (0x0f)     Parameter Total Length: 4     Status: Pending (0x00)     Number of Allowed Command Packets: 1     Command Opcode: Remote Name Request (0x0419)     (7) Remote Name Req Complete Bluetooth HCI H4     [Direction: Rcvd (0x01)]     HCI Packet Type: HCI Event (0x04) Bluetooth HCI Event - Remote Name Req Complete     Event Code: Remote Name Req Complete (0x07)     Parameter Total Length: 255     Status: Page Timeout (0x04)     BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)     Remote Name:     (8) Connect Request Bluetooth HCI H4     [Direction: Rcvd (0x01)]     HCI Packet Type: HCI Event (0x04) Bluetooth HCI Event - Connect Request     Event Code: Connect Request (0x04)     Parameter Total Length: 10     BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)     Class of Device: 0x6a0204 (Phone - services: Telephony, Audio, Capturing, Networking)     Link Type: ACL connection (Data Channels) (0x01)     (9) Accept Connection Request Bluetooth HCI H4     [Direction: Sent (0x00)]     HCI Packet Type: HCI Command (0x01) Bluetooth HCI Command - Accept Connection Request     Command Opcode: Accept Connection Request (0x0409)         0000 01.. .... .... = ogf: Link Control Commands (0x0001)         .... ..00 0000 1001 = ocf: 0x0009     Parameter Total Length: 7     BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)     Role: Remain Slave (0x01)     (10) Command Status (Accept Connection Request) Bluetooth HCI H4     [Direction: Rcvd (0x01)]     HCI Packet Type: HCI Event (0x04) Bluetooth HCI Event - Command Status     Event Code: Command Status (0x0f)     Parameter Total Length: 4     Status: Pending (0x00)     Number of Allowed Command Packets: 1     Command Opcode: Accept Connection Request (0x0409)     (11) PIN Code Request Bluetooth HCI H4     [Direction: Rcvd (0x01)]     HCI Packet Type: HCI Event (0x04) Bluetooth HCI Event - PIN Code Request     Event Code: PIN Code Request (0x16)     Parameter Total Length: 6     BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)     (12) PIN Code Request Reply Bluetooth HCI H4     [Direction: Sent (0x00)]     HCI Packet Type: HCI Command (0x01) Bluetooth HCI Command - PIN Code Request Reply     Command Opcode: PIN Code Request Reply (0x040d)         0000 01.. .... .... = ogf: Link Control Commands (0x0001)         .... ..00 0000 1101 = ocf: 0x000d     Parameter Total Length: 23     BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)     PIN Code Length: 4     PIN Code: 1234     (13) Command Complete (PIN Code Request Reply) Bluetooth HCI H4     [Direction: Rcvd (0x01)]     HCI Packet Type: HCI Event (0x04) Bluetooth HCI Event - Command Complete     Event Code: Command Complete (0x0e)     Parameter Total Length: 10     Number of Allowed Command Packets: 1     Command Opcode: PIN Code Request Reply (0x040d)         0000 01.. .... .... = ogf: Link Control Commands (0x0001)         .... ..00 0000 1101 = ocf: 0x000d     Status: Success (0x00)     BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)     (14) Connect Complete Bluetooth HCI H4     [Direction: Rcvd (0x01)]     HCI Packet Type: HCI Event (0x04) Bluetooth HCI Event - Connect Complete     Event Code: Connect Complete (0x03)     Parameter Total Length: 11     Status: Authentication Failure (0x05)     Connection Handle: 0x0029     BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)     Link Type: ACL connection (Data Channels) (0x01)     Encryption Mode: Encryption Disabled (0x00)     (15) Connect Request Bluetooth HCI H4     [Direction: Rcvd (0x01)]     HCI Packet Type: HCI Event (0x04) Bluetooth HCI Event - Connect Request     Event Code: Connect Request (0x04)     Parameter Total Length: 10     BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)     Class of Device: 0x6a0204 (Phone - services: Telephony, Audio, Capturing, Networking)     Link Type: ACL connection (Data Channels) (0x01)     (16) Accept Connection Request Bluetooth HCI H4     [Direction: Sent (0x00)]     HCI Packet Type: HCI Command (0x01) Bluetooth HCI Command - Accept Connection Request     Command Opcode: Accept Connection Request (0x0409)         0000 01.. .... .... = ogf: Link Control Commands (0x0001)         .... ..00 0000 1001 = ocf: 0x0009     Parameter Total Length: 7     BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)     Role: Remain Slave (0x01)     (17) Command Status (Accept Connection Request) Bluetooth HCI H4     [Direction: Rcvd (0x01)]     HCI Packet Type: HCI Event (0x04) Bluetooth HCI Event - Command Status     Event Code: Command Status (0x0f)     Parameter Total Length: 4     Status: Pending (0x00)     Number of Allowed Command Packets: 1     Command Opcode: Accept Connection Request (0x0409)     (18) PIN Code Request Bluetooth HCI H4     [Direction: Rcvd (0x01)]     HCI Packet Type: HCI Event (0x04) Bluetooth HCI Event - PIN Code Request     Event Code: PIN Code Request (0x16)     Parameter Total Length: 6     BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)     (19) PIN Code Request Reply Bluetooth HCI H4     [Direction: Sent (0x00)]     HCI Packet Type: HCI Command (0x01) Bluetooth HCI Command - PIN Code Request Reply     Command Opcode: PIN Code Request Reply (0x040d)         0000 01.. .... .... = ogf: Link Control Commands (0x0001)         .... ..00 0000 1101 = ocf: 0x000d     Parameter Total Length: 23     BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)     PIN Code Length: 4     PIN Code: 1234     (20) Command Complete (PIN Code Request Reply) Bluetooth HCI H4     [Direction: Rcvd (0x01)]     HCI Packet Type: HCI Event (0x04) Bluetooth HCI Event - Command Complete     Event Code: Command Complete (0x0e)     Parameter Total Length: 10     Number of Allowed Command Packets: 1     Command Opcode: PIN Code Request Reply (0x040d)         0000 01.. .... .... = ogf: Link Control Commands (0x0001)         .... ..00 0000 1101 = ocf: 0x000d     Status: Success (0x00)     BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)     (21) Link Key Notification Bluetooth HCI H4     [Direction: Rcvd (0x01)]     HCI Packet Type: HCI Event (0x04) Bluetooth HCI Event - Link Key Notification     Event Code: Link Key Notification (0x18)     Parameter Total Length: 23     BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)     Link Key: ec596f3306bba9e53d7b72de47c1404a     Key Type: Combination Key (0x00)     (22) Connect Complete Bluetooth HCI H4     [Direction: Rcvd (0x01)]     HCI Packet Type: HCI Event (0x04) Bluetooth HCI Event - Connect Complete     Event Code: Connect Complete (0x03)     Parameter Total Length: 11     Status: Success (0x00)     Connection Handle: 0x002a     BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)     Link Type: ACL connection (Data Channels) (0x01)     Encryption Mode: Encryption only for point-to-point packets (0x01)     (23) Write Link Policy Settings Bluetooth HCI H4     [Direction: Sent (0x00)]     HCI Packet Type: HCI Command (0x01) Bluetooth HCI Command - Write Link Policy Settings     Command Opcode: Write Link Policy Settings (0x080d)         0000 10.. .... .... = ogf: Link Policy Commands (0x0002)         .... ..00 0000 1101 = ocf: 0x000d     Parameter Total Length: 4     Connection Handle: 0x002a     .... .... .... ...1 = Enable Master Slave Switch: true (1)     .... .... .... ..1. = Enable Hold Mode: true (1)     .... .... .... .1.. = Enable Sniff Mode: true (1)     .... .... .... 1... = Enable Park Mode: true (1)     (24) Page Scan Repetition Mode Change Bluetooth HCI H4     [Direction: Rcvd (0x01)]     HCI Packet Type: HCI Event (0x04) Bluetooth HCI Event - Page Scan Repetition Mode Change     Event Code: Page Scan Repetition Mode Change (0x20)     Parameter Total Length: 7     BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)     Page Scan Repetition Mode: R1 (0x01)     (25) Command Complete (Write Link Policy Settings) Bluetooth HCI H4     [Direction: Rcvd (0x01)]     HCI Packet Type: HCI Event (0x04) Bluetooth HCI Event - Command Complete     Event Code: Command Complete (0x0e)     Parameter Total Length: 6     Number of Allowed Command Packets: 1     Command Opcode: Write Link Policy Settings (0x080d)         0000 10.. .... .... = ogf: Link Policy Commands (0x0002)         .... ..00 0000 1101 = ocf: 0x000d     Status: Success (0x00)     Connection Handle: 0x002a     (26) Change Connection Packet Type Bluetooth HCI H4     [Direction: Sent (0x00)]     HCI Packet Type: HCI Command (0x01) Bluetooth HCI Command - Change Connection Packet Type     Command Opcode: Change Connection Packet Type (0x040f)         0000 01.. .... .... = ogf: Link Control Commands (0x0001)         .... ..00 0000 1111 = ocf: 0x000f     Parameter Total Length: 4     Connection Handle: 0x002a     .... .... .... ..0. = Packet Type 2-DH1: false (0)     .... .... .... .0.. = Packet Type 3-DH1: false (0)     .... .... .... 1... = Packet Type DM1: true (1)     .... .... ...1 .... = Packet Type DH1: true (1)     .... ...0 .... .... = Packet Type 2-DH3: false (0)     .... ..0. .... .... = Packet Type 3-DH3: false (0)     .... .1.. .... .... = Packet Type DM3: true (1)     .... 1... .... .... = Packet Type DH3: true (1)     ...0 .... .... .... = Packet Type 2-DH5: false (0)     ..0. .... .... .... = Packet Type 3-DH5: false (0)     .1.. .... .... .... = Packet Type DM5: true (1)     1... .... .... .... = Packet Type DH5: true (1)     (27) Max Slots Change Bluetooth HCI H4     [Direction: Rcvd (0x01)]     HCI Packet Type: HCI Event (0x04) Bluetooth HCI Event - Max Slots Change     Event Code: Max Slots Change (0x1b)     Parameter Total Length: 3     Connection Handle: 0x002a     Maximum Number of Slots: 5     (28) Command Status (Change Connection Packet Type) Bluetooth HCI H4     [Direction: Rcvd (0x01)]     HCI Packet Type: HCI Event (0x04) Bluetooth HCI Event - Command Status     Event Code: Command Status (0x0f)     Parameter Total Length: 4     Status: Pending (0x00)     Number of Allowed Command Packets: 1     Command Opcode: Change Connection Packet Type (0x040f)     (29) Remote Name Request Bluetooth HCI H4     [Direction: Sent (0x00)]     HCI Packet Type: HCI Command (0x01) Bluetooth HCI Command - Remote Name Request     Command Opcode: Remote Name Request (0x0419)         0000 01.. .... .... = ogf: Link Control Commands (0x0001)         .... ..00 0001 1001 = ocf: 0x0019     Parameter Total Length: 10     BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)     Page Scan Repetition Mode: R1 (0x01)     Page Scan Mode: Mandatory Page Scan Mode (0x00)     .000 0000 0000 0000 = Clock Offset: 0x0000 (0 ms)     0... .... .... .... = Clock_Offset_Valid_Flag: false (0)     (30) Connection Packet Type Changed Bluetooth HCI H4     [Direction: Rcvd (0x01)]     HCI Packet Type: HCI Event (0x04) Bluetooth HCI Event - Connection Packet Type Changed     Event Code: Connection Packet Type Changed (0x1d)     Parameter Total Length: 5     Status: Success (0x00)     Connection Handle: 0x002a     Usable packet types: DM1 HV1 2-DH1         .... .... .... ..0. = ACL Link Type 2-DH1: False (0)         .... .... .... .0.. = ACL Link Type 3-DH1: False (0)         .... .... .... 1... = ACL Link Type DM1: True (1)         .... .... ...1 .... = ACL Link Type DH1: True (1)         .... ...0 .... .... = ACL Link Type 2-DH3: False (0)         .... ..0. .... .... = ACL Link Type 3-DH3: False (0)         .... .1.. .... .... = ACL Link Type DM3: True (1)         .... 1... .... .... = ACL Link Type DH3: True (1)         ...0 .... .... .... = ACL Link Type 2-DH5: False (0)         ..0. .... .... .... = ACL Link Type 3-DH5: False (0)         .1.. .... .... .... = ACL Link Type DM5: True (1)         1... .... .... .... = ACL Link Type DH5: True (1)         .... .... ..0. .... = SCO Link Type HV1: False (0)         .... .... .0.. .... = SCO Link Type HV2: False (0)         .... .... 0... .... = SCO Link Type HV3: False (0)     (31) Command Status (Remote Name Request) Bluetooth HCI H4     [Direction: Rcvd (0x01)]     HCI Packet Type: HCI Event (0x04) Bluetooth HCI Event - Command Status     Event Code: Command Status (0x0f)     Parameter Total Length: 4     Status: Pending (0x00)     Number of Allowed Command Packets: 1     Command Opcode: Remote Name Request (0x0419)     (32) Remote Name Request Bluetooth HCI H4     [Direction: Sent (0x00)]     HCI Packet Type: HCI Command (0x01) Bluetooth HCI Command - Remote Name Request     Command Opcode: Remote Name Request (0x0419)         0000 01.. .... .... = ogf: Link Control Commands (0x0001)         .... ..00 0001 1001 = ocf: 0x0019     Parameter Total Length: 10     BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)     Page Scan Repetition Mode: R1 (0x01)     Page Scan Mode: Mandatory Page Scan Mode (0x00)     .000 0000 0000 0000 = Clock Offset: 0x0000 (0 ms)     0... .... .... .... = Clock_Offset_Valid_Flag: false (0)     (33) Command Status (Remote Name Request) Bluetooth HCI H4     [Direction: Rcvd (0x01)]     HCI Packet Type: HCI Event (0x04) Bluetooth HCI Event - Command Status     Event Code: Command Status (0x0f)     Parameter Total Length: 4     Status: Pending (0x00)     Number of Allowed Command Packets: 0     Command Opcode: Remote Name Request (0x0419)     (34) Remote Name Req Complete Bluetooth HCI H4     [Direction: Rcvd (0x01)]     HCI Packet Type: HCI Event (0x04) Bluetooth HCI Event - Remote Name Req Complete     Event Code: Remote Name Req Complete (0x07)     Parameter Total Length: 255     Status: Other End Terminated Connection: User Ended Connection (0x13)     BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)     Remote Name:     (35) Disconnect Complete Bluetooth HCI H4     [Direction: Rcvd (0x01)]     HCI Packet Type: HCI Event (0x04) Bluetooth HCI Event - Disconnect Complete     Event Code: Disconnect Complete (0x05)     Parameter Total Length: 4     Status: Success (0x00)     Connection Handle: 0x002a     Reason: Other End Terminated Connection: User Ended Connection (0x13)