I am trying to understand the operation between BLE device & android application... After "CONNECT_REQ", I can see several "SERVICE PROFILES" but I can't find those UUID in WireShark data. What I did is pressing buttons - Scan & Connect. Surely I can see ATT packet, but I didn't click any Service Profile yet.
When Android App got those UUID? I've checked HCI event log in Android system, but I couldn't find it well.
Devices can cache the details of the attributes to save power. If none of the services include the Service Changed characteristic and there's enough memory available to store the details, there's no reason to waste time or power re-querying them.
I haven't done much of this type of testing using Android devices. If you want to force the full discovery process you may have to do either a) restart the application, b) restart bluetooth services on the Android device, c) restart the Android device itself, or d) if the device has been paired you may need to force the Android device to "forget" it.
It's a bit easier to use another Nordic board and Nordic's Master Control Panel to force Service Discovery. That is, I run the sniffer on one dongle and the Master Control Panel on another.
I've attached a trace from Service Discovery using the Master Control Panel. I filtered out empty packets, so there are some time gaps. The highlighted packet shows the slave sending details of the Heart Rate Service. Since this is all Bluetooth SIG specified types they use 16-bit UUIDs rather than 128-bit UUIDs. (Note that the highlighted packet contains only 0x2a39, not the full 128-bit version which is 00002a39-0000-1000-8000-00805F9B34FB)
Bill
