Bluetooth - Protocol                                                           Home : www.sharetechnote.com

 

 

 

 

Overal State Transition

 

Overall state flow of bluetooth communication is as follows. When you see this kind of circular state diagram, you'd better select one of the starting point and end point. Otherwise, you will keep cycling through the states and your eye ball would be spinning endlessly -:).

For example, I just picket "Stand by" as the first point and "Tx/Rx" as the end point and follow through the path marked in red arrows.

As you turn on a bluetooth device, it would be into stand by mode and start "inquire". (This is like broadcasting a message to all direction saying "Is there any one listening to me ? If there is, let me know your address". Through this process, the device may get the response from multiple device. If it finds any device it want to connect, it sends Paging message to the device saying "I want to get connected to you". If it gets the acceptance from the other party, the both party gets into connected mode via a complicated steps which will be described next section.

 

Once in connected mode, both party can transmit and receive data. But what if there is no data to transmit or recieve for a long time ? It they stay awake during that period, it would waste a lot of battery power. To reduce the waste of the battery life, bluetooth support three levels of energy saving mode, called Sniff, Hold, Park.

 

In Sniff mode, the device still maintain the synchronization with piconet (network between bluetooth devices) but the Tx/Rx cycle gets reduced. This cycle is called "Sniff Interval" and this interval is programmable and depends on application.

 

In Hold mode, only the internal clock in the device is running. So in this mode, data transfer is not possible but if there is need for data transfer, it can switch to Active mode very quickly. This HOLD mode can be initiated ether Master or Slave.

 

In Park mode, the device still maintains the synchronization with piconet (network between bluetooth devices) but it does not transmit/recieve any data.. the device even release its MAC address. It just periodically wake up to listen to Master. If it gets any signal from Master requesting data transaction, it has to go through connection process again. It would take a little longer time/process to recover the connection but it saves energy the most.

 

 

 

 

Overall Protocol Sequence

 

 

Following is one example bluetooth protocl log from wiki.wireshark.org - Bluetooth1.cap . Just go through overall sequence first and dig into the detailed parameters in each of the message as it interests you.

 

(1) Command Inquiry

    Bluetooth HCI H4

        [Direction: Sent (0x00)]

        HCI Packet Type: HCI Command (0x01)

    Bluetooth HCI Command - Inquiry

        Command Opcode: Inquiry (0x0401)

            0000 01.. .... .... = ogf: Link Control Commands (0x0001)

            .... ..00 0000 0001 = ocf: 0x0001

        Parameter Total Length: 5

        LAP: 0x9e8b33

        Inquiry Length: 16

        Num Responses: 0

 

(2) Command Status (Inquiry)

    Bluetooth HCI H4

        [Direction: Rcvd (0x01)]

        HCI Packet Type: HCI Event (0x04)

    Bluetooth HCI Event - Command Status

        Event Code: Command Status (0x0f)

        Parameter Total Length: 4

        Status: Pending (0x00)

        Number of Allowed Command Packets: 1

        Command Opcode: Inquiry (0x0401)

 

(3) Inquiry Result

    Bluetooth HCI H4

        [Direction: Rcvd (0x01)]

        HCI Packet Type: HCI Event (0x04)

    Bluetooth HCI Event - Inquiry Result

        Event Code: Inquiry Result (0x02)

        Parameter Total Length: 15

        Number of responses: 1

        BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)

        Page Scan Repetition Mode: R1 (0x01)

        Page Scan Period Mode: P0 (0x00)

        Page Scan Mode: Mandatory Page Scan Mode (0x00)

        Class of Device: 0x420204 (Phone - services: Telephony, Networking)

        .100 0010 1101 1101 = Clock Offset: 0x42dd

 

 

(4) Inquiry Complete

    Bluetooth HCI H4

        [Direction: Rcvd (0x01)]

        HCI Packet Type: HCI Event (0x04)

    Bluetooth HCI Event - Inquiry Complete

        Event Code: Inquiry Complete (0x01)

        Parameter Total Length: 1

        Status: Success (0x00)

 

 

(5) Remote Name Request

    Bluetooth HCI H4

        [Direction: Sent (0x00)]

        HCI Packet Type: HCI Command (0x01)

    Bluetooth HCI Command - Remote Name Request

        Command Opcode: Remote Name Request (0x0419)

            0000 01.. .... .... = ogf: Link Control Commands (0x0001)

            .... ..00 0001 1001 = ocf: 0x0019

        Parameter Total Length: 10

        BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)

        Page Scan Repetition Mode: R1 (0x01)

        Page Scan Mode: Mandatory Page Scan Mode (0x00)

        .000 0000 0000 0000 = Clock Offset: 0x0000 (0 ms)

        0... .... .... .... = Clock_Offset_Valid_Flag: false (0)

 

 

(6) Command Status (Remote Name Request)

    Bluetooth HCI H4

        [Direction: Rcvd (0x01)]

        HCI Packet Type: HCI Event (0x04)

    Bluetooth HCI Event - Command Status

        Event Code: Command Status (0x0f)

        Parameter Total Length: 4

        Status: Pending (0x00)

        Number of Allowed Command Packets: 1

        Command Opcode: Remote Name Request (0x0419)

 

 

(7) Remote Name Req Complete

    Bluetooth HCI H4

        [Direction: Rcvd (0x01)]

        HCI Packet Type: HCI Event (0x04)

    Bluetooth HCI Event - Remote Name Req Complete

        Event Code: Remote Name Req Complete (0x07)

        Parameter Total Length: 255

        Status: Page Timeout (0x04)

        BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)

        Remote Name:

 

 

(8) Connect Request

    Bluetooth HCI H4

        [Direction: Rcvd (0x01)]

        HCI Packet Type: HCI Event (0x04)

    Bluetooth HCI Event - Connect Request

        Event Code: Connect Request (0x04)

        Parameter Total Length: 10

        BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)

        Class of Device: 0x6a0204 (Phone - services: Telephony, Audio, Capturing, Networking)

        Link Type: ACL connection (Data Channels) (0x01)

 

 

(9) Accept Connection Request

    Bluetooth HCI H4

        [Direction: Sent (0x00)]

        HCI Packet Type: HCI Command (0x01)

    Bluetooth HCI Command - Accept Connection Request

        Command Opcode: Accept Connection Request (0x0409)

            0000 01.. .... .... = ogf: Link Control Commands (0x0001)

            .... ..00 0000 1001 = ocf: 0x0009

        Parameter Total Length: 7

        BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)

        Role: Remain Slave (0x01)

 

 

(10) Command Status (Accept Connection Request)

    Bluetooth HCI H4

        [Direction: Rcvd (0x01)]

        HCI Packet Type: HCI Event (0x04)

    Bluetooth HCI Event - Command Status

        Event Code: Command Status (0x0f)

        Parameter Total Length: 4

        Status: Pending (0x00)

        Number of Allowed Command Packets: 1

        Command Opcode: Accept Connection Request (0x0409)

 

 

(11) PIN Code Request

    Bluetooth HCI H4

        [Direction: Rcvd (0x01)]

        HCI Packet Type: HCI Event (0x04)

    Bluetooth HCI Event - PIN Code Request

        Event Code: PIN Code Request (0x16)

        Parameter Total Length: 6

        BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)

 

 

(12) PIN Code Request Reply

    Bluetooth HCI H4

        [Direction: Sent (0x00)]

        HCI Packet Type: HCI Command (0x01)

    Bluetooth HCI Command - PIN Code Request Reply

        Command Opcode: PIN Code Request Reply (0x040d)

            0000 01.. .... .... = ogf: Link Control Commands (0x0001)

            .... ..00 0000 1101 = ocf: 0x000d

        Parameter Total Length: 23

        BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)

        PIN Code Length: 4

        PIN Code: 1234

 

 

(13) Command Complete (PIN Code Request Reply)

    Bluetooth HCI H4

        [Direction: Rcvd (0x01)]

        HCI Packet Type: HCI Event (0x04)

    Bluetooth HCI Event - Command Complete

        Event Code: Command Complete (0x0e)

        Parameter Total Length: 10

        Number of Allowed Command Packets: 1

        Command Opcode: PIN Code Request Reply (0x040d)

            0000 01.. .... .... = ogf: Link Control Commands (0x0001)

            .... ..00 0000 1101 = ocf: 0x000d

        Status: Success (0x00)

        BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)

 

 

(14) Connect Complete

    Bluetooth HCI H4

        [Direction: Rcvd (0x01)]

        HCI Packet Type: HCI Event (0x04)

    Bluetooth HCI Event - Connect Complete

        Event Code: Connect Complete (0x03)

        Parameter Total Length: 11

        Status: Authentication Failure (0x05)

        Connection Handle: 0x0029

        BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)

        Link Type: ACL connection (Data Channels) (0x01)

        Encryption Mode: Encryption Disabled (0x00)

 

 

(15) Connect Request

    Bluetooth HCI H4

        [Direction: Rcvd (0x01)]

        HCI Packet Type: HCI Event (0x04)

    Bluetooth HCI Event - Connect Request

        Event Code: Connect Request (0x04)

        Parameter Total Length: 10

        BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)

        Class of Device: 0x6a0204 (Phone - services: Telephony, Audio, Capturing, Networking)

        Link Type: ACL connection (Data Channels) (0x01)

 

 

(16) Accept Connection Request

    Bluetooth HCI H4

        [Direction: Sent (0x00)]

        HCI Packet Type: HCI Command (0x01)

    Bluetooth HCI Command - Accept Connection Request

        Command Opcode: Accept Connection Request (0x0409)

            0000 01.. .... .... = ogf: Link Control Commands (0x0001)

            .... ..00 0000 1001 = ocf: 0x0009

        Parameter Total Length: 7

        BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)

        Role: Remain Slave (0x01)

 

 

(17) Command Status (Accept Connection Request)

    Bluetooth HCI H4

        [Direction: Rcvd (0x01)]

        HCI Packet Type: HCI Event (0x04)

    Bluetooth HCI Event - Command Status

        Event Code: Command Status (0x0f)

        Parameter Total Length: 4

        Status: Pending (0x00)

        Number of Allowed Command Packets: 1

        Command Opcode: Accept Connection Request (0x0409)

 

 

(18) PIN Code Request

    Bluetooth HCI H4

        [Direction: Rcvd (0x01)]

        HCI Packet Type: HCI Event (0x04)

    Bluetooth HCI Event - PIN Code Request

        Event Code: PIN Code Request (0x16)

        Parameter Total Length: 6

        BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)

 

 

(19) PIN Code Request Reply

    Bluetooth HCI H4

        [Direction: Sent (0x00)]

        HCI Packet Type: HCI Command (0x01)

    Bluetooth HCI Command - PIN Code Request Reply

        Command Opcode: PIN Code Request Reply (0x040d)

            0000 01.. .... .... = ogf: Link Control Commands (0x0001)

            .... ..00 0000 1101 = ocf: 0x000d

        Parameter Total Length: 23

        BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)

        PIN Code Length: 4

        PIN Code: 1234

 

 

(20) Command Complete (PIN Code Request Reply)

    Bluetooth HCI H4

        [Direction: Rcvd (0x01)]

        HCI Packet Type: HCI Event (0x04)

    Bluetooth HCI Event - Command Complete

        Event Code: Command Complete (0x0e)

        Parameter Total Length: 10

        Number of Allowed Command Packets: 1

        Command Opcode: PIN Code Request Reply (0x040d)

            0000 01.. .... .... = ogf: Link Control Commands (0x0001)

            .... ..00 0000 1101 = ocf: 0x000d

        Status: Success (0x00)

        BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)

 

 

(21) Link Key Notification

    Bluetooth HCI H4

        [Direction: Rcvd (0x01)]

        HCI Packet Type: HCI Event (0x04)

    Bluetooth HCI Event - Link Key Notification

        Event Code: Link Key Notification (0x18)

        Parameter Total Length: 23

        BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)

        Link Key: ec596f3306bba9e53d7b72de47c1404a

        Key Type: Combination Key (0x00)

 

 

(22) Connect Complete

    Bluetooth HCI H4

        [Direction: Rcvd (0x01)]

        HCI Packet Type: HCI Event (0x04)

    Bluetooth HCI Event - Connect Complete

        Event Code: Connect Complete (0x03)

        Parameter Total Length: 11

        Status: Success (0x00)

        Connection Handle: 0x002a

        BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)

        Link Type: ACL connection (Data Channels) (0x01)

        Encryption Mode: Encryption only for point-to-point packets (0x01)

 

 

(23) Write Link Policy Settings

    Bluetooth HCI H4

        [Direction: Sent (0x00)]

        HCI Packet Type: HCI Command (0x01)

    Bluetooth HCI Command - Write Link Policy Settings

        Command Opcode: Write Link Policy Settings (0x080d)

            0000 10.. .... .... = ogf: Link Policy Commands (0x0002)

            .... ..00 0000 1101 = ocf: 0x000d

        Parameter Total Length: 4

        Connection Handle: 0x002a

        .... .... .... ...1 = Enable Master Slave Switch: true (1)

        .... .... .... ..1. = Enable Hold Mode: true (1)

        .... .... .... .1.. = Enable Sniff Mode: true (1)

        .... .... .... 1... = Enable Park Mode: true (1)

 

 

(24) Page Scan Repetition Mode Change

    Bluetooth HCI H4

        [Direction: Rcvd (0x01)]

        HCI Packet Type: HCI Event (0x04)

    Bluetooth HCI Event - Page Scan Repetition Mode Change

        Event Code: Page Scan Repetition Mode Change (0x20)

        Parameter Total Length: 7

        BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)

        Page Scan Repetition Mode: R1 (0x01)

 

 

(25) Command Complete (Write Link Policy Settings)

    Bluetooth HCI H4

        [Direction: Rcvd (0x01)]

        HCI Packet Type: HCI Event (0x04)

    Bluetooth HCI Event - Command Complete

        Event Code: Command Complete (0x0e)

        Parameter Total Length: 6

        Number of Allowed Command Packets: 1

        Command Opcode: Write Link Policy Settings (0x080d)

            0000 10.. .... .... = ogf: Link Policy Commands (0x0002)

            .... ..00 0000 1101 = ocf: 0x000d

        Status: Success (0x00)

        Connection Handle: 0x002a

 

 

(26) Change Connection Packet Type

    Bluetooth HCI H4

        [Direction: Sent (0x00)]

        HCI Packet Type: HCI Command (0x01)

    Bluetooth HCI Command - Change Connection Packet Type

        Command Opcode: Change Connection Packet Type (0x040f)

            0000 01.. .... .... = ogf: Link Control Commands (0x0001)

            .... ..00 0000 1111 = ocf: 0x000f

        Parameter Total Length: 4

        Connection Handle: 0x002a

        .... .... .... ..0. = Packet Type 2-DH1: false (0)

        .... .... .... .0.. = Packet Type 3-DH1: false (0)

        .... .... .... 1... = Packet Type DM1: true (1)

        .... .... ...1 .... = Packet Type DH1: true (1)

        .... ...0 .... .... = Packet Type 2-DH3: false (0)

        .... ..0. .... .... = Packet Type 3-DH3: false (0)

        .... .1.. .... .... = Packet Type DM3: true (1)

        .... 1... .... .... = Packet Type DH3: true (1)

        ...0 .... .... .... = Packet Type 2-DH5: false (0)

        ..0. .... .... .... = Packet Type 3-DH5: false (0)

        .1.. .... .... .... = Packet Type DM5: true (1)

        1... .... .... .... = Packet Type DH5: true (1)

 

 

(27) Max Slots Change

    Bluetooth HCI H4

        [Direction: Rcvd (0x01)]

        HCI Packet Type: HCI Event (0x04)

    Bluetooth HCI Event - Max Slots Change

        Event Code: Max Slots Change (0x1b)

        Parameter Total Length: 3

        Connection Handle: 0x002a

        Maximum Number of Slots: 5

 

 

(28) Command Status (Change Connection Packet Type)

    Bluetooth HCI H4

        [Direction: Rcvd (0x01)]

        HCI Packet Type: HCI Event (0x04)

    Bluetooth HCI Event - Command Status

        Event Code: Command Status (0x0f)

        Parameter Total Length: 4

        Status: Pending (0x00)

        Number of Allowed Command Packets: 1

        Command Opcode: Change Connection Packet Type (0x040f)

 

 

(29) Remote Name Request

    Bluetooth HCI H4

        [Direction: Sent (0x00)]

        HCI Packet Type: HCI Command (0x01)

    Bluetooth HCI Command - Remote Name Request

        Command Opcode: Remote Name Request (0x0419)

            0000 01.. .... .... = ogf: Link Control Commands (0x0001)

            .... ..00 0001 1001 = ocf: 0x0019

        Parameter Total Length: 10

        BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)

        Page Scan Repetition Mode: R1 (0x01)

        Page Scan Mode: Mandatory Page Scan Mode (0x00)

        .000 0000 0000 0000 = Clock Offset: 0x0000 (0 ms)

        0... .... .... .... = Clock_Offset_Valid_Flag: false (0)

 

 

(30) Connection Packet Type Changed

    Bluetooth HCI H4

        [Direction: Rcvd (0x01)]

        HCI Packet Type: HCI Event (0x04)

    Bluetooth HCI Event - Connection Packet Type Changed

        Event Code: Connection Packet Type Changed (0x1d)

        Parameter Total Length: 5

        Status: Success (0x00)

        Connection Handle: 0x002a

        Usable packet types: DM1 HV1 2-DH1

            .... .... .... ..0. = ACL Link Type 2-DH1: False (0)

            .... .... .... .0.. = ACL Link Type 3-DH1: False (0)

            .... .... .... 1... = ACL Link Type DM1: True (1)

            .... .... ...1 .... = ACL Link Type DH1: True (1)

            .... ...0 .... .... = ACL Link Type 2-DH3: False (0)

            .... ..0. .... .... = ACL Link Type 3-DH3: False (0)

            .... .1.. .... .... = ACL Link Type DM3: True (1)

            .... 1... .... .... = ACL Link Type DH3: True (1)

            ...0 .... .... .... = ACL Link Type 2-DH5: False (0)

            ..0. .... .... .... = ACL Link Type 3-DH5: False (0)

            .1.. .... .... .... = ACL Link Type DM5: True (1)

            1... .... .... .... = ACL Link Type DH5: True (1)

            .... .... ..0. .... = SCO Link Type HV1: False (0)

            .... .... .0.. .... = SCO Link Type HV2: False (0)

            .... .... 0... .... = SCO Link Type HV3: False (0)

 

 

(31) Command Status (Remote Name Request)

    Bluetooth HCI H4

        [Direction: Rcvd (0x01)]

        HCI Packet Type: HCI Event (0x04)

    Bluetooth HCI Event - Command Status

        Event Code: Command Status (0x0f)

        Parameter Total Length: 4

        Status: Pending (0x00)

        Number of Allowed Command Packets: 1

        Command Opcode: Remote Name Request (0x0419)

 

 

(32) Remote Name Request

    Bluetooth HCI H4

        [Direction: Sent (0x00)]

        HCI Packet Type: HCI Command (0x01)

    Bluetooth HCI Command - Remote Name Request

        Command Opcode: Remote Name Request (0x0419)

            0000 01.. .... .... = ogf: Link Control Commands (0x0001)

            .... ..00 0001 1001 = ocf: 0x0019

        Parameter Total Length: 10

        BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)

        Page Scan Repetition Mode: R1 (0x01)

        Page Scan Mode: Mandatory Page Scan Mode (0x00)

        .000 0000 0000 0000 = Clock Offset: 0x0000 (0 ms)

        0... .... .... .... = Clock_Offset_Valid_Flag: false (0)

 

 

(33) Command Status (Remote Name Request)

    Bluetooth HCI H4

        [Direction: Rcvd (0x01)]

        HCI Packet Type: HCI Event (0x04)

    Bluetooth HCI Event - Command Status

        Event Code: Command Status (0x0f)

        Parameter Total Length: 4

        Status: Pending (0x00)

        Number of Allowed Command Packets: 0

        Command Opcode: Remote Name Request (0x0419)

 

 

(34) Remote Name Req Complete

    Bluetooth HCI H4

        [Direction: Rcvd (0x01)]

        HCI Packet Type: HCI Event (0x04)

    Bluetooth HCI Event - Remote Name Req Complete

        Event Code: Remote Name Req Complete (0x07)

        Parameter Total Length: 255

        Status: Other End Terminated Connection: User Ended Connection (0x13)

        BD_ADDR:000e:6d:072efa (MurataMa_07:2e:fa)

        Remote Name:

 

 

(35) Disconnect Complete

    Bluetooth HCI H4

        [Direction: Rcvd (0x01)]

        HCI Packet Type: HCI Event (0x04)

    Bluetooth HCI Event - Disconnect Complete

        Event Code: Disconnect Complete (0x05)

        Parameter Total Length: 4

        Status: Success (0x00)

        Connection Handle: 0x002a

        Reason: Other End Terminated Connection: User Ended Connection (0x13)