Snippet 14: Bluetooth Classic and Low Energy

Bluetooth is one name for two very different protocols. Bluetooth Classic handles longer, higher-power connections while Bluetooth Low Energy handles low-power bursts, and most of the devices in a space are BLE beacons rather than paired links. This primer walks the physical-layer differences, the scanning tools, and why Bastille’s ability to see even paired BLE devices is unusual.

Key Takeaways

• Bluetooth Classic and Bluetooth Low Energy share little beyond a name, serving different power and use-case needs
• Classic uses 79 channels hopping every 625 microseconds; BLE uses a completely different physical layer
• Most BLE devices found in a space are beacons for wayfinding or advertising, not paired connections
• Off-the-shelf scanning tools transmit to discover devices, so they should not be run where transmitting is prohibited, and Bastille can passively see even paired BLE pairs

Video Transcript

So Bluetooth, there's one name, but there's two very distinct protocols. One of the research papers that I was reading the other day was actually saying that the only thing they really share in common is a name. They're more different than they are alike, other than their name. The overall Bluetooth spec has been around since the '90s, the late '90s. And we're at version 5 now. At version 4, a new version of the Bluetooth split where you've got Bluetooth Classic and Bluetooth Low Energy. So a couple things I want to point out.

One is that Low Energy doesn't displace Classic. They have different use cases. Bluetooth Classic is made for longer running connections, but that consumes more power. Bluetooth Low Energy consumes less battery power for your device and is made for a burst of your traffic transmissions. Many devices like laptops, and even we've seen Bose headsets have both interfaces, one to do connection setup and one to stream data. Just a couple high level things about Bluetooth classic and the lower layers of the stack. 79 1 megahertz channels, signals.

The users are hopping channels every 625 microseconds. The networks organized as piconets that support up to eight devices. And there's this inquiry scanning procedure that hops through 16 channels and can take up to 10.25 seconds. There are Bluetooth scanning tools, off-the-shelf tools, penetration testers that other people use. HCI tool, for instance, is one that comes with Linux BlueZ package and lets you get some visibility into Bluetooth. Bluetooth Low Energy, the physical layer is completely different, 42 megahertz channels.

Use cases are different. If you look for Bluetooth Low Energy devices in a space, you'll typically find a whole bunch of beacons. These can be access points that also have a Bluetooth Low Energy beacon. They can be ad tech devices that are beaconing in order to do advertising. Or they could be cooperative localization devices that where your phone is cooperating with Bluetooth and backhauling which beacons it sees so that the apps on your phone understand where your phone is inside a space.

You can also pair Bluetooth devices and do data transfer. But the vast majority of the devices out in the wild are beacons that aren't really made for pairing. They're more like wayfinder points. So yeah, one of the things we're proud about is we can see Bluetooth Low Energy devices even when they're paired. We found ways to do that even though the standard makes that difficult. So we've got a patent pending on that. And the net result is our users can see pairs of Bluetooth Low Energy devices on their screen.

They can also see that for Bluetooth Classic. So one more slide on this. If you have a Debian machine or Linux machine, in general, you can go install BlueZ. And it'll give you HCI tool. You can do a Low Energy scan or HCI tool scan and you'll see the list of all the devices in your space. One thing to note, though, is when you do that, your device is actually transmitting. It's transmitting inquiry packets or these scan request packets and asking all the other devices to respond to you.

So don't do that in a space where you're not allowed to transmit.