what is initiator address in CONNECT_REQ?

[yiran]

I sniffer the packets when I use a phone to connect to a BLE device.

However, in the packet with CONNECT_REQ label, the source address (init address) is not the bluetooth address of my mobile phone. So what is this init address from?

[shibshab]

This is described in Bluetooth Core Specification 4.0 Volume 6, part B, section 2.3.3.1:

The CONNECT_REQ PDU has the Payload as shown in Figure 2.10 . TxAdd in the Flags field indicates whether the initiator’s device address in the InitA field is public (TxAdd = 0) or random (TxAdd = 1). The RxAdd in the Flags field indi- cates whether the advertiser’s device address in the AdvA field is public (RxAdd = 0) or random (RxAdd = 1).The Payload field consists of InitA, AdvA and LLData fields. The InitA field shall contain the Initiator’s public or random device address as indicated by TxAdd. The AdvA field shall contain the advertiser’s public or random device address as indicated by RxAdd.

It might be that the device is using a random address (TxAdd field equal to 0).

[Hung Bui]

@yiran & shibshab: Random address doesn't mean it can be changed all the time. It only means that it's not a public address. Random address could be static ( random static device address) or non-static (random resolvable address).

iOS device has random resolvable address. It changes the address every 15 minutes for privacy reason. But the IRK to resolve it remains. So that the phone can recognize the phone when reconnecting.

Most Android phone has random static address and public address.

Again, please let me know how did you get to know that the InitAddress is not your phone's address.