BLE 101:
THE BASICS

Bluetooth Low Energy (BLE) is a lightweight wireless communication protocol designed for short-range data transfer with minimal power consumption. It was introduced as part of the Bluetooth 4.0 standard to support battery-powered devices like smartwatches, fitness bands, medical sensors, and IoT gadgets.

Unlike classic Bluetooth which is built for continuous streaming like music or large file transfers, BLE is optimized for brief, quick exchanges of small data packets. Think of it as a "check-in and move on" protocol.

BLE works on the 2.4 GHz ISM band and uses a system of advertising and connecting. Devices either broadcast data or scan for other devices to connect with. Once connected, they follow a structured format using profiles, services, and characteristics to exchange data.

Before diving into packet logs, writing payloads, or reverse-engineering devices, it's important to understand the foundational building blocks of Bluetooth Low Energy (BLE). Here's everything you need to get started the right way.

GAP defines the rules for device discovery, advertising, and connections. It handles how BLE devices become visible, connect, and exchange roles.

In short, GAP is the matchmaking layer—it makes sure the devices find each other and establish a connection in a power-efficient way.

Once connected, devices switch to GATT mode. This is where all the actual data communication happens.

GATT is built around:

The communication follows a request-response model over ATT (Attribute Protocol)—this is where we work with handles and hex values.

These roles are fixed per session, but some devices (like smartphones) can switch roles dynamically if needed.

Advertising is the broadcast mechanism used by peripherals to announce their presence. These are small packets (max 31 bytes + 31 optional scan response bytes) that include:

Scanning is how a Central listens for these packets. Once it finds a relevant device, it may initiate a connection request based on the advertisement data.

After a successful scan + connect, a secure and lightweight BLE connection is established. Key points:

• Data is exchanged on 37 data channels (out of 40 total 2.4GHz channels)
• Connection interval, latency, and supervision timeout are negotiated to save power
• The link is maintained using regular connection events, even when no data is being sent

Think of it as a chatroom they stay connected but don't need to talk constantly.

Every BLE device exposes a GATT Profile, consisting of:

Each characteristic has a handle, UUID, value, and properties. This hierarchy is what we interact with using tools like gatttool. When we do char-write-req -a 0x0035 we're writing to a specific characteristic handle.

Each service and characteristic is identified using a 16-bit or 128-bit UUID, and the order matters because tools like Wireshark show them as grouped attributes.

Association Models (how the keys are exchanged):

We've covered the basics of Bluetooth Low Energy—how it works, why it's used, key concepts like GAP, GATT, advertising, scanning, and how BLE devices communicate through services and characteristics. This foundation gives you the context needed to start interacting with real devices.

Let's move from learning how BLE works to actually making it work for us.