Can Scanner know the advertising channel? - bluetooth-lowenergy

As described, BLE Scanner can not know the advertising channel.
How to get BLE advertising channel index number
But, in the link below, at first graph,
the Initiator send the CONNECT_REQ to the Advertiser through Ch.38 which is used to send ADV_IND.
it is something like that the Initiator knows which the advertising channel is used.
https://microchipdeveloper.com/wireless:ble-link-layer-connections
Can Scanner know the advertising channel?

The scanner of course knows which advertising channel is being used. It's just that it's not part of the Bluetooth Specification to expose this information to an application using the Bluetooth stack. In particular, the HCI events for advertisements do not contain such a field. It is possible though that some embedded devices can expose this info to the application, if they have defined a custom API for this.

Related

Implement notification in BLE

How do I implement notification in BLE?
I have a smartphone, and every hour it will send notification to all nearby BLE devices (smartwatch, RFduino, etc) for time synchronization purpose.
Other devices are server now (since it provides data), and smartphone is the client that collect the data.
Could I piggyback into the advertisement packages? For example, the smartphone always broadcast an advertisement packet to annoucement its presence (that's how other devices can find it). Can I modify that packet to be a time sync?
In order to send notifications or advertisements, your smartphone has to act as a server, which also means that in order to be able to receive notifications or scan for advertisements, your peripheral devices must act as clients.
This can be a bit tricky, because if two devices act as client and server, they may not simultaneously fulfil the other role. You need to switch roles whenever needed, which is an open field for all kinds of problems.
Also, I am not convinced that it is really the optimal choice to let the smartphone regularly notify all devices in the vicinity. Each of the devices that wants to receive the notification has to be connected with the device in order to receive the notification, and this connection has to be already active when the notification is sent in order to really get the correct time. So all these devices need to connect in advance to the expected notification time, and hold up the connection until the notification has come.
It might be better to just advertise the current time, but remember that you can't connect to the smartphone as a server while it is advertising, because the link layer may not be in scanning and advertising mode at the same time, and you may also not be connected when advertising for a similar reason.
If you want to do it that way, you can include the time information in the advertising data. See the Supplement to the Bluetooth Core Specification v6, Part A for further information on the structure of the advertising data. You could put it in the manufacturer specific data.
However, another option would be to write the time directly to the device using a write request. You can define your own service and characteristics. You can include a "time synch necessary" information in the advertisement data of the servers, and when the smartphone evaluates the advertisement, it can connect to the corresponding device and send the time directly.
The advantage of this procedure is that time is only updated if you really need it on the device, and that you do not have to switch client/server roles, because the device in server role may advertise as normal, and the smartphone can always stay in client role.

BLE Scan Request used for signaling to an iBeacon?

Is it possible to send a signal to an iBeacon in the form of a scan request to let the beacon know their advertising packet was heard?
This way we could turn on an LED whenever the beacon detects that some other device heard it.
Bluetooth LE advertisements, including beacon advertisements are one way. There is no standard mechanism to acknowledge receipt.
The typical alternative to do what you want is to actually connect to the beacon using a GATT Service. This can let it know you heard the advertisement. The disadvantage is that connections stop advertising, so you need to make it short lived.
Another alternative is to make the beacon also scan for other advertisements around it. You could then echo the same advertisement back to it (with a change in the beacon type bytes to differentiate it) but because advertisement delivery is not guaranteed, you would certainly need to send the response back many times to maki it reliable.
None of these solution s are standard. All would require a custom beacon.

Zigbee CC2531 USB Dongle and Intruder Alarm System

I have a problem with my CC2531 USB Dongle. I use it as a Zigbee coordinator. I can see all the devices inside my PAN, but IAS zones are not communicating with it. When I change the state of contact switch, or Motion sensor, I don't get data in my gateway app. But, I have IAS remote controller, and in my gateway application i get data on TCP port when i click remote controller button. I read something about Enrollment function on coordinator, but I don't really understand what it means. I guess that problem is that I don't have IAS CIE and I need my CC2531 to act like one.
Does anyone have idea what to do? Do I need to flash other firmware or change something in config files. I am quite new in this so I don't really know what is important, so if you need some additional info please ask.
IAS Devices work slightly differently than other Zigbee devices in that they are "locked" to a CIE node. This basically means that commissioning IAS devices requires the following steps
Write your USB dongle's IEEE/MAC address to the IAS CIE attribute on the device
If the device is "trip to pair", trip the sensor and it will send in a ZoneEnrollRequest message, to which you respond with a ZoneEnrollResponse with a status of SUCCESS
If the device does not require "trip to pair", you can just directly send a ZoneEnrollResponse message after writing the IAS CIE attribute.
Out of curiosity, which brand of sensors are you testing with?

Transmit or Simulate SMS-CB (Short Messaging Service-Cell Broadcast)

Can a cell phone transmit SMS-CB (Short Messaging Service-Cell Broadcast) ?
If not, Can I get a device that can transmit SMS-CB messages ?
Else, Is there a good simulator that can simulate SMS-CB transmission and receiving mobile phones ?
Thank You
NOTE: Cell Broadcast (SMS-CB) is designed for simultaneous delivery of messages to multiple users in a specified area. For example, information such as Location, Tower name, Ads or Emergency messages can be transmitted.
Technically, the SMS-CB messages originate at a device called "Cell Broadcast Centre (CBC)", which is part of the network operators equipment. It sends the SMS-CB through the Base Station Controller (BSC). This cannot be done over the air, it is something which happens inside the mobile operators network. It would probably be too much to explain all GSM/3G/UMTS network components here, you might want to read up on mobile network architecture.
So the simple answer is no, a handset (mobile phone) cannot directly send SMS-CB messages.
Now the question is, how to tell the CBC to send an SMS-CB to some network cells. There exist some standardized interfaces for that, which are used for emergency alerting, e.g. the Commercial Mobile Alert System (CMAS) in the US. If these interfaces are designed sensibly, they cannot be abused by just about anyone using a mobile handset. But I would not be surprised if there were security gaps in some operator's networks which would allow unauthorized parties to send SMS-CB, e.g. via insecure Internet/SS7 gateways. But that is wild speculation. Normally, it should not be possible to send unauthorized SMS-CB from outside of the operator's network.

SMS encryption over GSM

I have read this somewhere:
Most mobile operators encrypt all mobile communication data, including SMS messages In GSM, messages are encrypted using A5/1 but even when encrypted, the data held by SMS is readable for the operator. Mobile phone operators have the ability to filter and modify short messages during delivery. Also, it is possible that the operator might not filter messages on purpose but might use equipment that cannot handle encrypted messages.
I want to know..is it true..?
Can someone explain how this filtering is done..? and is there any solution to avoid such loss of messages on the network..?
A5/1 is being used on the radio link between mobile and base station controller (BSC, the network entity entity that manages the radio resources). The radio link transports a couple of higher level protocols, among them MAP which is used to transport SMS.
The BSC is relaying SMS over MAP into the core network. The protocol stack between BSC and core network is not encrypted as well as the communication inside the core network. This was deemed as not needed at time GSM was designed, the links are supposed to be mobile operators very own property and territory and therefore assumed being secure.
The core network typically delivers SMS to an SMSC (short message service center) which is reponsible for routing messages to receipients.
A network operator can read SMS in clear text in various places, e.g.
With a protocol analyzer, tapping links between network nodes
On the SMSC, in message queues (databases...) or even log files
On an MSC when tracing MAP messages
Message filtering and modification may happen on the SMSC, depending on the network operator needs.

Resources