nRF840 - S140 : How to fetch MAC addresses of surrounding mobile devices during nRF52840 scanning using Bluetooth 5.

[Bharat]

Hello Nordic Team,

We are using nRF52840 ble chip with S140 nordic stack and SDK 15.2.0 on the  SEGGER IDE installed on  the Windows OS. We want nRF52840 chip  to detect surrounding mobile devices and also nRF52840 can fetch MAC addresses of mobile devices during scanning. We would like to know from your side that whether this is feasible or not ?. If yes, then can you please suggest us how to do it.

We are looking forward to hear from you.

Thanks
Bharat Gopani
Lumium Design
India.

[Einar Thorsrud]

Hi,

You can find example projects that scans and logs in this post. It does active scanning as well, but you can adapt it to not do active scanning and only log the MAC address. You can refer to this post in the same thread for how to add logging of the MAC address.

[Bharat]

Hello Einar,

Thanks for the reply.

We have procured nRF52-DK development board from Mouser India and we are using S140 stack on the Windows platform for our PoC.

Our application requires that nRF52840 should be able to scan and fetch MAC address (public address) of surrounding Android smart phone.

Currently, we are able to scan and fetch random private resolvable and  non resolvable addresses of surrounding Android smart phone and also public address of the smart BLE  watch but our project needs public address of the smart phone, so whether it's possible or not and if yes then how it can be done ?

It would be helpful if you could suggest for the same.

Thanks

Bharat Gopani

Lumium Design

India

[Einar Thorsrud]

You cannot get the MAC address of the peer from the IRK directly. However, you can resolve the MAC address based on the IRK. That is: when you have obtained both the IRK and a MAC address of the peer you can verify that the MAC address is derived from the IRK. So, when the MAC address change, you can resolve it again and know that even if it changed, it was from the same peer (same IRK).

[Bharat]

Thank you very much.

Could you please elaborate resolving process for the peer address  ?

If peer address changes and if we resolves it again  then how can we come conclude that it is same peer  ?

where can we get the IRK  in the stack ?

Regards

Bharat

[Einar Thorsrud]

If you use whitelist scanning, then this can be handled by the AAR peripheral, but it would filter out any other advertising packets, so this is probably not what you want if I understood your use case correct (track any BLE advertisers in range). Therefor you probably want to use pm_address_resolve(), and iterate over all IRK you have in the list of bonded devices. You can get a list of all bonds using pm_peer_id_list().

[Bharat]

Thanks for the reply.

IRK for bonded device is fixed or variable  ??

Can you please tell us more about working of resolving process using  these  functions pm_address_resolve() and pm_peer_id_list().

If possible, can you please share the document related to this procedure.

Regards

Bharat

[Einar Thorsrud]

Hi,

Bharat said:

IRK for bonded device is fixed or variable  ??

The IRK is typically fixed for the lifetime of a device. It is possible to change it, but in that case any already bonded devices will not be able to resolve the address any more (since it is derived from a new IRK that is different from what they got during the bonding procedure).

Bharat said:

Can you please tell us more about working of resolving process using  these  functions pm_address_resolve() and pm_peer_id_list().

If possible, can you please share the document related to this procedure.

We do not have any documentation that describes it, but it is quite straight-forward:

1. Get the MAC address you want to resolve (typically from a advertising packet in this case).
2. Check that the MAC address type is a private resolvable address. If no, then just use the MAC address as is. This is indicated by the most significant bits in the address.
3. If the MAC address is resolvable, iterate over the IRK's you have by using pm_peer_id_list(). Call pm_address_resolve() with the MAC address you want to resolve and a IRK, and iterate through the list of IRK's until you get a match or the end of the list. If you get a match, stop as you have already resolved it. If you don't get a match you know that this address was derived from an IRK which you don't have, so you cannot resolve it.

[Bharat]

Thanks for the reply.

Can we use S132 SoftDevice  for the  nRF52840  as we are planning to use it on the Arduino IDE  since we could not find S140 SoftDevice for the Arduino IDE.

Regards

Bharat

[Einar Thorsrud]

Hi Bharat,

Using the S132 on the nRF52840 is not recommended or supported. We do not test it, nor does it support any of the additional features of the nRF52840. Lastly it is not Bluetooth qualified together with the nRF52840.

[Bharat]

Hi Einar,

Thank you very much for your inputs.

Can we get IRK key from smart phone directly without bonding with nRF52840  ??

In our application, nRF52840 is connected to Raspeberry pi controller using UART. We are using nRF52840  for authentication purpose only.

Now, We are able to resolve address using peer manager  but we are having concern that how Raspeberry pi controller can decide who is authenticated mobile or not. For that we can put authenticated IRK list in the software so that when rasprberry pi controller receives IRK from nRF52840, it can compare with the predefined list and take the decision.

Is this possible or not ?  if not can you please suggest any other alternatives for the same ?

Regards

Bharat

[Einar Thorsrud]

Hi Bharat,

Bharat said:

Can we get IRK key from smart phone directly without bonding with nRF52840  ??

I am not aware of any way of obtaining the RK from smart phones (iOS or Android) without bonding.

Bharat said:

Is this possible or not ?  if not can you please suggest any other alternatives for the same ?

This is application specific and I do not have a full overview of your application. It is possible to transfer the list of IRK's and MAC address when scanning to the RPi. From my perspective it does not matter much if you resolve the IRK on the nRF and report back to the RPi if it is known or not, or if you send both the IRK and MAC to the RPi. The advantage of doing it on the nRF is perhaps that you have it working already using the Peer manager, so it might save you some time. On the other hand, it might give you more flexibility to do it on the RPi, but I cannot say which is more sensible.

[Bharat]

Hello Einar,

Our application needs that when address is not resolved at that time nRF52840 must be  able to disconnect with smart phone.

we are using function sd_ble_gap_disconnect in the ble_evt_handler with the case BLE_GAP_EVT_CONNECTED  , however when  this function executes, it disconnects with smart phone and it gives following error.

Error 8 [NRF_ERROR_INVALID_STATE]

Fatal error and System Reset.

Can you please suggest us possible reason behind this ?

Regards

Bharat