Menu
iBeacon is a small-scale network device that uses Bluetooth Low Energy (BLE) and acts as a transmitter to detect and track smartphones.
iBeacon is a Bluetooth communication protocol introduced by Apple in 2013. The iBeacon enables smartphones, tablets and other devices to trigger actions when they get in close proximity to a device that transmits iBeacon (commonly those devices are called beacons).
To identify each iBeacon, an iBeacon is identified using three numbers: Proximity UUID (16-bytes), Major (2 bytes), and Minor (2 bytes) (see Figure 1). Figure 1: Three numbers are used to identify an iBeacon . The assignment of these three numbers is totally up to the implementers.
To use an iOS device as an iBeacon, you do the following: Obtain or generate a 128-bit UUID for your device. Create a CLBeaconRegion object containing the UUID value along with appropriate major and minor values for your beacon. Advertise the beacon information using the Core Bluetooth framework.
For an iBeacon with ProximityUUID E2C56DB5-DFFB-48D2-B060-D0F5A71096E0, major 0, minor 0, and calibrated Tx Power of -59 RSSI, the transmitted BLE advertisement packet looks like this:
d6 be 89 8e 40 24 05 a2 17 6e 3d 71 02 01 1a 1a ff 4c 00 02 15 e2 c5 6d b5 df fb 48 d2 b0 60 d0 f5 a7 10 96 e0 00 00 00 00 c5 52 ab 8d 38 a5
This packet can be broken down as follows:
d6 be 89 8e # Access address for advertising data (this is always the same fixed value)
40 # Advertising Channel PDU Header byte 0. Contains: (type = 0), (tx add = 1), (rx add = 0)
24 # Advertising Channel PDU Header byte 1. Contains: (length = total bytes of the advertising payload + 6 bytes for the BLE mac address.)
05 a2 17 6e 3d 71 # Bluetooth Mac address (note this is a spoofed address)
02 01 1a 1a ff 4c 00 02 15 e2 c5 6d b5 df fb 48 d2 b0 60 d0 f5 a7 10 96 e0 00 00 00 00 c5 # Bluetooth advertisement
52 ab 8d 38 a5 # checksum
The key part of that packet is the Bluetooth Advertisement, which can be broken down like this:
02 # Number of bytes that follow in first AD structure
01 # Flags AD type
1A # Flags value 0x1A = 000011010
bit 0 (OFF) LE Limited Discoverable Mode
bit 1 (ON) LE General Discoverable Mode
bit 2 (OFF) BR/EDR Not Supported
bit 3 (ON) Simultaneous LE and BR/EDR to Same Device Capable (controller)
bit 4 (ON) Simultaneous LE and BR/EDR to Same Device Capable (Host)
1A # Number of bytes that follow in second (and last) AD structure
FF # Manufacturer specific data AD type
4C 00 # Company identifier code (0x004C == Apple)
02 # Byte 0 of iBeacon advertisement indicator
15 # Byte 1 of iBeacon advertisement indicator
e2 c5 6d b5 df fb 48 d2 b0 60 d0 f5 a7 10 96 e0 # iBeacon proximity uuid
00 00 # major
00 00 # minor
c5 # The 2's complement of the calibrated Tx Power
Any Bluetooth LE device that can be configured to send a specific advertisement can generate the above packet. I have configured a Linux computer using Bluez to send this advertisement, and iOS7 devices running Apple's AirLocate test code pick it up as an iBeacon with the fields specified above. See: Use BlueZ Stack As A Peripheral (Advertiser)
This blog has full details about the reverse engineering process.
It seems to based on advertisement data, particularly the manufacturer data:
4C00 02 15 585CDE931B0142CC9A1325009BEDC65E 0000 0000 C5
<company identifier (2 bytes)> <type (1 byte)> <data length (1 byte)>
<uuid (16 bytes)> <major (2 bytes)> <minor (2 bytes)> <RSSI @ 1m>
I have this node.js script working on Linux with the sample AirLocate app example.
Just to reconcile the difference between sandeepmistry's answer and davidgyoung's answer:
02 01 1a 1a ff 4C 00
Is part of the advertising data format specification [1]
02 # length of following AD structure
01 # <<Flags>> AD Structure [2]
1a # read as b00011010.
# In this case, LE General Discoverable,
# and simultaneous BR/EDR but this may vary by device!
1a # length of following AD structure
FF # Manufacturer specific data [3]
4C00 # Apple Inc [4]
0215 # ?? some 2-byte header
Missing from the AD is a Service [5] definition. I think the iBeacon protocol itself has no relationship to the GATT and standard service discovery. If you download RedBearLab's iBeacon program, you'll see that they happen to use the GATT for configuring the advertisement parameters, but this seems to be specific to their implementation, and not part of the spec. The AirLocate program doesn't seem to use the GATT for configuration, for instance, according to LightBlue and or other similar programs I tried.
References:
If the reason you ask this question is because you want to use Core Bluetooth to advertise as an iBeacon rather than using the standard API, you can easily do so by advertising an NSDictionary such as:
{
kCBAdvDataAppleBeaconKey = <a7c4c5fa a8dd4ba1 b9a8a240 584f02d3 00040fa0 c5>;
}
See this answer for more information.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With