Obtaining Bluetooth LE scan response data with iOS

Question

I am working with Bluetooth Low Energy devices, and I was wondering whether it is possible to read the Scan Response Data to an advertisement with iOS and Core Bluetooth without connecting.

I understand that after reading an advertisement packet, you can request additional data from the peripheral in the format of a 31 byte scan response. I know that Core Bluetooth suggests that if the ad packet is full, you can put the local name in the scan response packet, but does it allow you to see the whole packet?

Answer 1

Yes, you can use CoreBluetooth to read the full manufacturer data or service data bytes of a BLE advertisement as long as it is NOT an iBeacon advertisement. If it is an iBeacon advertisement, CoreBluetooth will block your ability to see the bytes. The callback you use is as follows:

- (void)   centralManager:(CBCentralManager *)central
didDiscoverPeripheral:(CBPeripheral *)peripheral
    advertisementData:(NSDictionary *)advertisementData
                 RSSI:(NSNumber *)RSSI

The raw service data or manufacturer data bytes will be present inside the NSDictionary *advertisementData. But they key holding those data will be removed by the operating system for iBeacons.

Here's an example of what you get in the advertisementData NSDictionary in the callback. This example is for detecting an AltBeacon advertisement (an open-source beacon standard), with identifiers 2F234454-CF6D-4A0F-ADF2-F4911BA9FFA6 1 2

{
    kCBAdvDataIsConnectable = 0;
    kCBAdvDataManufacturerData = <1801beac 2f234454 cf6d4a0f adf2f491 1ba9ffa6 00010002 be00>;
}

You can see how to decode the above bytes by looking at the AltBeacon spec here.

For more details about why you can't read iBeacon data along with additional code showing how you set this up, see here:

http://developer.radiusnetworks.com/2013/10/21/corebluetooth-doesnt-let-you-see-ibeacons.html

Answer 2

I am working with a peripheral that has some manufacturer data which I believe is transmitted in the scan response because there's no room for it in the initial advertisement with a 128-bit UUID plus channel, RSSI, and connectable flag. I am receiving two calls to didDiscoverPeripheral:... in quick succession (3ms apart including some handling time in my code). The first does not have the kCBAdvDataManufacturerData key in the dict, but the second does. I am assuming that the scan response is being requested automatically and the reply results in the second call.