Bluetooth advertisement decoding

All Efento loggers include a built-in Bluetooth Low Energy (BLE) interface. This enables smartphones, BLE gateways, and custom hardware to communicate with the loggers, retrieve their measurements, and modify their configuration when needed. In this article, we demonstrate how to decode and interpret the data that Efento loggers broadcast in their BLE advertising frames.

Bluetooth Low Energy Advertising Transmissions

Bluetooth Low Energy (BLE) defines two types of radio transmissions: data transmissions and advertising transmissions. Advertising is used by BLE-enabled devices to broadcast information to nearby receivers. These packets may be used to initiate a connection between devices (for example, a smartwatch announcing itself to a phone) or simply to transmit small pieces of information without ever establishing a connection (such as a logger broadcasting temperature values to any listener).

Because advertising transmissions are connectionless, any BLE-capable device in range can receive them. The sender does not expect acknowledgments, and packets are broadcast without a guaranteed delivery mechanism. The structure of BLE advertising packets is defined by the official Bluetooth specification.

Efento loggers – BLE Advertising Behavior

Efento loggers use BLE advertising packets to transmit their most recent measurement along with key technical information. Each packet includes the latest measurement and its type, battery level, firmware version, optional calibration date, and the configured measurement interval. Advertising packets may also be encrypted, ensuring that only devices holding the correct encryption key can decrypt and interpret their contents.

Receiving the data

Efento loggers broadcast advertising packets continuously whenever Bluetooth is enabled. These transmissions cannot be selectively disabled (Bluetooth itself can be turned off, but if it is on, advertising will occur). Any BLE-capable device—such as a phone, tablet, or computer—can receive these packets.

A simple way to view the advertising data is by using Nordic Semiconductor’s nRF Connect mobile application for Android or iOS, which displays advertising information from all nearby BLE devices, including the “Manufacturer data” field used by Efento loggers.

Parsing the data

Efento loggers communicate their current status using BLE advertising frames. To retrieve complete information, the receiving device (e.g., a gateway) must perform active scanning, enabling the logger to send both its standard advertisement and its scan response.

Efento devices running firmware version 6.X.X send their data in two separate frames:

  • Advertisement frame – contains device information

  • Scan response frame – contains the measurement values

To reconstruct the full logger state, the gateway must collect and parse both frames.

Decoding advertisement frame

  • Byte 1-2: Manufacturer ID – unique identifier of Bluetooth Low Energy equipped devices manufacturer. In case of Efento it is always “6C-02”

  • Byte 3: Manufacturing data version – set to “03” for Bluetooth advertisement frames

  • Byte 4-9: Device’s serial number (BLE MAC address)

  • Byte 10-11: Firmware version

    • Bit 0-4: Long term support version

    • Bit 5-10: Minor version

    • Bit 11-15 Major version

  • Byte 12: Status byte:

    • Bit 0: Battery level; 1 – Battery OK, 0 – Battery discharged

    • Bit 1-2: External power supply status: 00 – Battery only device, 01 – External power supply connected, 10 – external power supply disconnected, 11 – Power supply error

    • Bit 3: Encryption status: 0 – disabled, 1 – enabled

    • Bit 4: Time synchronisation: 0 – time synchronised, 1 – time not synchronised

    • Bit 5: Runtime error and modem info logging: 0 – no runtime errors and modem logs disabled, 1 – runtime error or modem logs enabled

    • Bit 6-7: Cellular status: 00 – BLE only device, 01 – cellular device working correctly, 10 – no connection to the server, 11 – network issue or device is not registered in the networkByte 7-10: Measurement counter, incremented at each measurement (used also as CTR counter for AES128-CTR encryption), 32-bit value encoded in big endian (most significant byte first)

  • Byte 13-16: Measurement timestamp in POSIX format

  • Byte 17-18: Measurement period base

  • Byte 19-20: Measurement period factor

  • Byte 21-22: Calibration date – optional field set by Efento and stored in nonvolatile memory

  • Byte 23-24: Checksum; CRC16 calculated from 6-byte serial number (MAC address, starting from first byte) and bytes 1 – 22

Example:

6C 02 03 28 2C 02 4F 00 12 31 44 11 64 21 56 24 00 B4 00 01 00 00 9E 04

1, 2

6C 02

Manufacturing specific data (always “06 02”)

3

03

Manufacturing data format (always “03” for Efento fw 6.X.X advertisement frame)

4, 5, 6, 7, 8, 9

28 2C 02 4F 00 12

Serial number: MAC – 282C024F0012

10, 11

31 44

Firmware version

HEX 31 44 = BIN 00110 001010 00100 Bit 0-4 = BIN 00100 = DEC 4 (LTS version) Bit 5-10 = BIN 001010 = DEC 10 (Minor version) Bit 11-15 = BIN 00110 = DEC 6 (Major version)

FW: 6.10.4

12

11

HEX 11 = Binary 00 0 1 0 00 1

Battery level: Bit 0 = 1: Battery – OK

External power supply status: Bit 1-2 = 00: Battery-operated device only

Encryption status: Bit 3 = 0: Disabled

Time synchronisation: Bit 4 = 0: Time not synchronised

Runtime error and logging on to the modem is inactive: Bit 5 = 0: Runtime error table is empty and logging on to the modem is inactive

Cellular status: Bit 6-7 = 00: BLE only device

13, 14, 15, 16

64 21 56 24

Measurements timestamp:

HEX 64 21 56 24 = 1679906340 = 27 March 2023 08:39:00 UTC

17, 18

00 B4

Measurement period base: HEX 00B4 = DEC 180 seconds

19, 20

00 01

Measurement period factor: HEX 0001 = DEC 1

21, 22

00 00

No calibration date set

23, 24

9E 04

CRC16

Decoding scan response frame

  • Byte 1-2: Manufacturer ID – unique identifier of Bluetooth Low Energy equipped devices manufacturer. In case of Efento it is always “6C-02”

  • Byte 3: Manufacturing data version – set to “04” for scan response frames

  • Byte 4: Type of measurement on slot 1

  • Byte 5-7: Measurement value (slot 1)

  • Byte 8: Type of measurement on slot 2 (optional)

  • Byte 9-11: Measurement value (slot 2) (optional)

  • Byte 12: Type of measurement on slot 3 (optional)

  • Byte 13-15: Measurement value (slot 3) (optional)

  • Byte 16: Type of measurement on slot 4 (optional)

  • Byte 17-19: Measurement value (slot 4) (optional)

  • Byte 20: Type of measurement on slot 5 (optional)

  • Byte 21-23: Measurement value (slot 5) (optional)

  • Byte 24: Type of measurement on slot 6 (optional)

  • Byte 25-27: Measurement value (slot 6) (optional)

  • Byte 28-29: Checksum, CRC16 calculated from 6-bytes serial number (MAC address, starting from first byte) and bytes 1 to 22 from manufacturing format 3 and bytes from 1 to (3+ (channel_number * 4)) from manufacturing format 4.

Measurement types

Efento loggers with firmware version 6.X.X can be equipped with up to six slots and measure up to six values.

Measurements represent physicals values that are measured by the logger assigned to a device slot. Measurement types are divided into two groups: Continuous and Binary measurements.

Each binary measurement can only have 2 states: positive or negative that are translated into appropriate value.

Each continuous measurement consists of a value and optional metadata. Value and metadata are defined by the following formulas:

Value = IntegerPart(raw_value / metadata_factor) * resolution

Metadata = |raw_value| mod metadata_factor

Values are encoded using ZigZag.

Metadata factor and resolution is defined for each measurement type:

Type (HEX)

Type

Min Value

Max Value

Resolution

Unit

Continuous/ binary

Metadata factor

Summary

0x01

TEMPERATURE

-273.2

4 000.0

0.1

°C

continuous

1

Temperature

0x02

HUMIDITY

0

100

1.0

%

continuous

1

Humidity

0x03

ATMOSPHERIC_PRESSURE

1.0

2 000.0

0.1

hPa

continuous

1

Atmospheric pressure

0x04

DIFFERENTIAL_PRESSURE

-10 000

10 000

1.0

Pa

continuous

1

Differential pressure

0x05

OK_ALARM

[-]

[+]

binary

1

Binary format for indicates state OK/Alarm

0x06

IAQ

0

500

1.0

continuous

3

Indoor air quality

0x07

FLOODING

[-]

[+]

binary

1

Binary format for flooding

0x08

PULSE_CNT

0

8 000 000

1.0

continuous

1

Pulse counter

0x09

ELECTRICITY_METER

0

8 000 000

1.0

Wh

continuous

1

Electricity meter (pulse counter)

0x0A

WATER_METER

0

8 000 000

1.0

l

continuous

1

Water meter (pulse counter)

0x0B

SOIL_MOISTURE

-1000

0

1.0

kPa

continuous

1

Soil moisture

0x0C

CO_GAS

0

1 000 000

1.0

ppm

continuous

1

Carbon monoxide

0x0D

NO2_GAS

0

1 000 000

1.0

ppm

continuous

1

Nitrogen dioxide

0x0E

H2S_GAS

0

80 000.00

0.01

ppm

continuous

1

Hydrogen sulfide

0x0F

AMBIENT_LIGHT

0

100 000.0

0.1

lx

continuous

1

Illuminance

0x10

PM_1_0

0

1 000

1.0

µg/m^3

continuous

1

Mass concentration of particles less than 1µm

0x11

PM_2_5

0

1 000

1.0

µg/m^3

continuous

1

Mass concentration of particles less than 2.5µm

0x12

PM_10_0

0

1 000

1.0

µg/m^3

continuous

1

Mass concentration of particles less than 10µm

0x13

NOISE_LEVEL

0

200.0

0.1

dB

continuous

1

Noise level

0x14

NH3_GAS

0

1 000 000

1.0

ppm

continuous

1

Ammonia

0x15

CH4_GAS

0

1 000 000

1.0

ppm

continuous

1

Methane

0x16

HIGH_PRESSURE

0

200 000

1.0

kPa

continuous

1

High pressure

0x17

DISTANCE_MM

0

100 000

1.0

mm

continuous

1

Distance

0x18

WATER_METER_ACC_MINOR

0

99

1.0

liter

continuous

6

Accumulative water meter (pulse counter)

0x19

WATER_METER_ACC_MAJOR

0

999 999

1.0

hectoliter

continuous

4

Accumulative water meter (pulse counter)

0x1A

CO2_GAS

0

1 000 000

1.0

ppm

continuous

3

Carbon dioxide

0x1B

HUMIDITY_ACCURATE

0.0

100.0

0.1

%

continuous

1

Humidity

0x1C

STATIC_IAQ

0

10 000

1.0

continuous

3

Static indoor air quality

0x1D

CO2_EQUIVALENT

0

1 000 000

1.0

ppm

continuous

3

Carbon dioxide equivalent estimate

0x1E

BREATH_VOC

0

100 000

1.0

ppm

continuous

3

Breath-VOC estimate

0x1F

CELLULAR_GATEWAY

0

4 194 303

continuous

1

Cellular gateway

0x20

PERCENTAGE

0.00

100.00

0.01

%

continuous

1

Percentage

0x21

VOLTAGE

0.0

100 000.0

0.1

mV

continuous

1

Voltage

0x22

CURRENT

0.0

10 000.00

0.01

mA

continuous

1

Current

0x23

PULSE_CNT_ACC_MINOR

0

999

1.0

Pulses

continuous

6

Accumulative pulse counter

0x24

PULSE_CNT_ACC_MAJOR

0

999 999

1.0

Kilo Pulses

continuous

4

Accumulative pulse counter

0x25

ELEC_METER_ACC_MINOR

0

999

1.0

Wh

continuous

6

Accumulative electricity meter (pulse counter)

0x26

ELEC_METER_ACC_MAJOR

0

999 999

1.0

kWh

continuous

4

Accumulative electricity meter (pulse counter)

Decoding example (continuous sensor type):

6C 02 04 01 00 01 C0 02 00 00 4C 28 30

1, 2

6C 02

Manufacturing specific data (always “06 02”)

3

04

Manufacturing data format (always “04” for Efento fw 6.X.X scan response frame)

4

01

Slot type: 1 – Temperature

5, 6, 7

00 01 C0

HEX 01 C0 = DEC 448 ZIGZAG 448 = 224/10 = 22,4 Slot 1 measurement value: 22,4°C

8

Slot type: 2 – Humidity

9, 10, 11

00 00 4C

HEX 4C = DEC 76 ZIGZAG 76 = 38 Slot 2 measurement value: 38%

12, 13

28 30

CRC16

Last updated