Ellysis Bluetooth Sniffing Apple Airpods

Question

I'm trying to determine how Apple Airpods pair and connect as seamlessly as they do, but I couldn't find any in-depth technical explanation so I embarked on a journey to figure it out for myself. I have used an Ellysis Explorer Bluetooth sniffer to sniff both BLE and Bluetooth Classic packets from the Airpods and the iPhone I have used to connect with it.

The issue is that I lack the background knowledge in Bluetooth to fully understand what I am looking at so I'm hoping somebody can explain what is appearing on the BT sniffer in the snapshots below:

The below picture is a list of the BLE packets captured after the Airpods case has been opened but BEFORE connecting to the phone.

The below picture is a list of the Bluetooth Classic packets captured after the Airpods case has been opened but BEFORE connecting to the phone.

The below picture is a list of the Bluetooth Classic packets AFTER connecting to the phone captured on top of the previous ones.

Note that there are no new BLE packets picked up after connecting.

Answer 1

Before analysing packets you need to learn about CoreBluetooth framework. CoreBluetooth deals with scanning, connecting and writing and reading data from "Bluetooth Low Energy" (BLE) devices. BLEs (Peripherals) continuously broadcast a small packet of data when they are not connected with any device Central.

First images shows data which is being broadcasted by BLE, in your case an airpod.

Answer 2

The 1st pic shows that both ears are sending advertising packets. Then one of the ear is paging the other ear and exchanging information. Then the iPhone is connected to one of the ear just like normal A2DP connection. More captures while audio is just started playing would be helpful.