Heavy scanning activity from Android (and iOS) devices might prevent connecting to BLE GAP Peripheral

[endnode]

Dear Nordic team and community,

Have you encountered the problem where standard BT4.0/4.1 GAP Peripheral device would be "blocked" from connection (kind of "denial of service" situation) by too many actively scanning GAP Scanners/Centrals? We are seeing this with certain mobile phones (especially Android) in "observing" role and this is pretty independent on adv. interval we use (typically 20-200ms). All adv. events are "loaded" with SCAN_REQ packets when there are 5 or more "scanning" phones and beside SCAN_REQ collisions (which are typically not critical for BLE solutions) basically all CONNECT_REQ collide with some SCAN_REQ packet and thus Peripheral never follows the connection.

Any suggestions (beside trying to lower scanning activity on phones' side which obviously isn't always possible)?

Thanks Jan

[endnode]

I totally agree that Web BLE API shouldn't be any danger in terms of DOS (it will provide other attack vectors;), because even if you would stay for longer time on such web site and enabled access to BLE it would hardly achieve such activity from generic BLE chip set. These DOS scenarios described by me above (flooding adv. channels or connecting to every ADV_IND packet which comes around) are already difficult if you run it as embedded application on nRF5x chip and SD S13x, you would most likely need several such fixtures to really block the Peripheral. Web BLE API could disturb BLE app (especially if it isn't designed properly) but I don't think that's worth writing an script by some kiddie;)