nRF840 - S140 : How to fetch MAC addresses of surrounding mobile devices during nRF52840 scanning using Bluetooth 5.

[Bharat]

Hello Nordic Team,

We are using nRF52840 ble chip with S140 nordic stack and SDK 15.2.0 on the  SEGGER IDE installed on  the Windows OS. We want nRF52840 chip  to detect surrounding mobile devices and also nRF52840 can fetch MAC addresses of mobile devices during scanning. We would like to know from your side that whether this is feasible or not ?. If yes, then can you please suggest us how to do it.

We are looking forward to hear from you.

Thanks
Bharat Gopani
Lumium Design
India.

[Einar Thorsrud]

Hi,

You can find example projects that scans and logs in this post. It does active scanning as well, but you can adapt it to not do active scanning and only log the MAC address. You can refer to this post in the same thread for how to add logging of the MAC address.

[Bharat]

Hello Einar,

Thanks for the reply.

We have procured nRF52-DK development board from Mouser India and we are using S140 stack on the Windows platform for our PoC.

Our application requires that nRF52840 should be able to scan and fetch MAC address (public address) of surrounding Android smart phone.

Currently, we are able to scan and fetch random private resolvable and  non resolvable addresses of surrounding Android smart phone and also public address of the smart BLE  watch but our project needs public address of the smart phone, so whether it's possible or not and if yes then how it can be done ?

It would be helpful if you could suggest for the same.

Thanks

Bharat Gopani

Lumium Design

India

[Bharat]

Hi Einar,

Kindly let us know if you do not understand above.

Regards

Bharat

[Einar Thorsrud]

Hi,

Modern phones will typically always use Random private resolvable address for privacy reasons (prevent tracking), so you cannot obtain a public MAC address. The phones will change the resolvable address regularly, and when it does you cannot know that it is the same phone as before, unless you have the Identity Resolving Key (IRK). Moreover, the IRK cannot be obtained by passively listening to advertising packets, and the only standardized way to obtain the IRK is to bond with the device.

In a nutshell it seems like you want to implement something similar to tracking, and that is effectively prevented by the privacy feature of BLE.

[Bharat]

Hello Einar,

Thank you very much for your support.

Where bonding initiated by smart phone is detected in the stack  ? and which stack nRF52840 should use either peripheral or central ?

Let's assume that android phone is bonded with nRF52840, How we can get IRK from the event handler  ??

Can we channge bluetooth range from 9 meters to 5 meters  ?

Regards

Bharat

[Einar Thorsrud]

Hi,

Bharat said:

Where bonding initiated by smart phone is detected in the stack  ?

When acting as a peripheral, the nRF has to start connectable advertising. Then a central can connect, which is signaled to the device (see Peripheral Connection Establishment and Termination). Subsequently pairing/bonding can be initiated by either peer, in several ways. See Peripheral Security Procedures. Handling pairing and bonding is quite complex, so I do not recommend that you use the SoftDevice APIs directly. Instead, you should use the peer manager, as is also done in all BLE peripheral examples in the SDK that support connections.

Bharat said:

Let's assume that android phone is bonded with nRF52840, How we can get IRK from the event handler  ??

The IRK is exchanged during the bonding procedure and stored in flash by the peer manager, and can be obtained from there. The Peer manager also supports resolving MAC addresses, so that you can see if the MAC represents the device you are searching for (pm_address_resolve()). This can also be done in HW by the radio if you use whitelisting, but that does not seem sensible in a product where you want to scan and track any device.

Bharat said:

Can we channge bluetooth range from 9 meters to 5 meters  ?

You cannot determine the range on such exact levels. Rang depends on a lot of of the product which you can control fairly good: PCB layout, antenna, antenna matching, housing etc. There is also a significant chip-to-chip variation. Then there is factors that is difficult to control. How is the product positioned in the environment? Is it covered by a human some times? is there line of sight, or are there reflections? This tends to change all the time in a real world situation.

However, you can influence the range of transmitted signals by selection a lower TW power. For receiving signals (as this case is about a device scanning for mobile phones which are advertising), you have no such method. However the scan report from the SoftDevice will include the RSSI, which is the power of the received signal. You can chose to filter out signals with a low RSSI in your application based on that.

[Bharat]

Hi Einar,

Thanks for your support.

1 . We have tried peer manager  programs like ble_app_proximity and ble_app_hids_keyboard,              , however it connects initially and disconnects immediately.

We are using nRF UART v2.0 to connect with nRF52840.

What coud be possible reason for this  ??

2. In ble_app_uart  pheripheral example, Device manager is used instead of peer manager. can you guide us for implementing peer manager in place of device manager  ?

It would be helpful if you could guide us for the above.

Regards

Bharat