Passive scanning with bluez or_pattern to filter on device address

[LeCyberDucky]

Hey there!

I'm trying to monitor measurements from a bluetooth scale via passive scanning using a Raspberry 3b+. But I'm unable to get even a minimal example to work.

I'm running Raspbian 12, bookworm (Linux 6.1.41-v7+ armv7l).
I built bluez from source a couple of days ago (including experimental features), landing me at version 5.76.

Here's the code I have at the moment:

import asyncio
import bleak

filter_settings = {
    "or_patterns": [[0x1B, 0x00, b'\xD8\xE7\x2F\xA6\x11\x21']]
}

async def main():
    async with bleak.BleakScanner(scanning_mode = "passive", bluez = filter_settings) as scanner:
        print("Scanning!")

        n = 0
        async for bd, ad in scanner.advertisement_data():
            print(f"{n}: {bd!r} with {ad!r}\n")
            n += 1

asyncio.run(main())

The 0x1B part of the pattern is the LE Bluetooth Device Address, as stated here: https://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Assigned_Numbers/out/en/Assigned_Numbers.pdf?v=1720033659741
and here https://www.bluetooth.com/specifications/css-11/

The b'\xD8\xE7\x2F\xA6\x11\x21' part is the MAC address of my device.

I get no results whatsoever using the above code. Does anybody have an idea about what might be going wrong?

---

Edit: From looking through the issues for this repo, I just stumbled upon the btmon tool. Running this in another window, while executing the above script, yields an error:
= bluetoothd: Invalid argument of property Patterns of the Adv Monitor at path /org/bleak/3072/197..

This begs the question what is wrong with my pattern.

---

Edit 2:
I found an issue with some example code showing just how wrong my attempt at creating a pattern was.
Now I have this:

import asyncio
import bleak
from bleak.backends.bluezdbus.advertisement_monitor import OrPattern
from bleak.backends.bluezdbus.scanner import BlueZScannerArgs

filter_settings = BlueZScannerArgs(
    or_patterns = [OrPattern(0, 0x1B, b'\xD8\xE7\x2F\xA6\x11\x21')]
)

async def main():
    async with bleak.BleakScanner(scanning_mode = "passive", bluez = filter_settings) as scanner:
        print("Scanning!")

        n = 0
        async for bd, ad in scanner.advertisement_data():
            print(f"{n}: {bd!r} with {ad!r}\n")
            n += 1

asyncio.run(main())

With that, my program still doesn't provide any results. But btmon gives me a bunch of much more interesting output. In fact, the data I'm looking for appears in the output of btmon:

= bluetoothd: Path /org/bleak/3435/1972420368 reserved for Adv Monitor app :1.79                     [hci0] 1124.949840
@ MGMT Command: Add Advertisement Patterns Monitor (0x0052) plen 35                         {0x0001} [hci0] 1124.954358
        Number of patterns: 1
          Pattern 1:
            AD type: 27
            Offset: 0
            Length: 6
            Value [6]: d8e72fa61121
@ MGMT Event: Command Complete (0x0001) plen 5                                              {0x0001} [hci0] 1124.954404
      Add Advertisement Patterns Monitor (0x0052) plen 2
        Status: Success (0x00)
        Handle: 1
< HCI Command: LE Set Scan Parameters (0x08|0x000b) plen 7                                        #1 [hci0] 1124.954589
        Type: Passive (0x00)
        Interval: 60.000 msec (0x0060)
        Window: 30.000 msec (0x0030)
        Own address type: Public (0x00)
        Filter policy: Accept all advertisement (0x00)
> HCI Event: Command Complete (0x0e) plen 4                                                       #2 [hci0] 1124.954918
      LE Set Scan Parameters (0x08|0x000b) ncmd 1
        Status: Success (0x00)
< HCI Command: LE Set Scan Enable (0x08|0x000c) plen 2                                            #3 [hci0] 1124.954985
        Scanning: Enabled (0x01)
        Filter duplicates: Enabled (0x01)
> HCI Event: Command Complete (0x0e) plen 4                                                       #4 [hci0] 1124.955331
      LE Set Scan Enable (0x08|0x000c) ncmd 1
        Status: Success (0x00)

> HCI Event: LE Meta Event (0x3e) plen 36                                                        #34 [hci0] 1134.929495
      LE Advertising Report (0x02)
        Num reports: 1
        Event type: Connectable undirected - ADV_IND (0x00)
        Address type: Public (0x00)
        Address: D8:E7:2F:A6:11:21 (Chipsea Technologies (Shenzhen) Corp.)
        Data length: 24
        Flags: 0x06
          LE General Discoverable Mode
          BR/EDR Not Supported
        16-bit Service UUIDs (partial): 1 entry
          Body Composition (0x181b)
        Service Data: Body Composition (0x181b)
          Data[13]: 0204b207011209080a0000083e
        RSSI: -50 dBm (0xce)
@ MGMT Event: ADV Monitor Device Found (0x002f) plen 40                                     {0x0001} [hci0] 1134.929549
        Handle: 0
        Address: D8:E7:2F:A6:11:21 (Chipsea Technologies (Shenzhen) Corp.)
        Addr Type: 1
        RSSI: -50
        Flags: 0x00000000
        AD Data Len: 24
        AD Data[24]: 02010603021b1810161b180204b207011209080a0000083e

[dlech]

and here https://www.bluetooth.com/specifications/css-11/

This has an "X" in the "AD" and "SRD" columns for "LE Bluetooth Device Address", so I don't think this would work.

I think the best you can do is filter on the service UUID in the Service Data.

[LeCyberDucky]

Thanks for having the patience to walk me through this so far. I very much appreciate your explanation of the possible AD Data filters.

Regrettably, using OrPattern(0, 0x16, b"\x1b\x18") does not work. I believe that the first value provided to OrPattern marks the index of the AD field where pattern matching should start. Just to make sure, I also tried adding multiple patterns, in order to cover the full range of possible starting indices (in chunks of 5 at a time - adding too many patterns would cause problems). This gave me no results either.

The only thing that has actually worked so far, is OrPattern(0, 0x01, b'\x06'). This seems to work well, and I could probably accomplish what I want by using that pattern.
I would still like to figure out why OrPattern(0, 0x16, b"\x1b\x18") doesn't work, though. Do you have any more ideas, if you don't mind?

[dlech]

Not sure why it wouldn't work, especially when the 0x06 flags match is working. Maybe a typo somewhere?

I was able to get bluez=BlueZScannerArgs(or_patterns=[OrPattern(0, 0xFF, b"\x97\x03")]) to work matching the 09ff9703004107ac6300 in

AD Data: 020106110723d1bcea5f782316deef12122316000009ff9703004107ac6300

So I don't think there is any misunderstanding of what the correct pattern should be.

Does OrPattern(0, 0x02, b"\x1b\x18") work (matching "16-bit Service UUIDs (partial)") for your device?

[LeCyberDucky]

Hmm, no. I don't think it's a typo - I have checked everything multiple times. The btmon output is copied directly from my terminal, so I don't think there should be a typo in that. And then I simply copy the commands you list here and paste them directly into my editor.

The pattern OrPattern(0, 0x02, b"\x1b\x18") does not work either. It's strange, really.

[dlech]

Maybe a change/regression in BlueZ? I'm using BlueZ 5.72 on Ubuntu.

Or it could be that the adapter has hardware pattern matching that isn't working correctly and a different adapter might work better.

[LeCyberDucky]

I tried downgrading to BlueZ 5.72, but that did not help.

I've now raised an issue with BlueZ bluez/bluez#901. I might also end up dusting off my laptop, just to experiment with different hardware.

I'll update you if anything interesting happens.