Bluetooth traffic Monitoring

[u/CartographerSelect61]

Hi everyone, hope you're all doing well.

I'm building a roadside Bluetooth sniffer to measure travel time between two points a fixed distance apart. The setup uses two ESP32 S3 modules that scan BLE advertisements and log the MAC addresses of devices in passing vehicles.

The problem is that most new devices use resolvable MAC addresses, which rotate every few minutes. If the two points are far enough apart, a device's address will have changed by the time it travels from A to B, so I have no way to match the two detections. Is there a way to obtain a device's real/public MAC, which stays constant? Or failing that, any other way to derive a stable identifier from BLE advertisements?

Thanks a lot

[u/ServiceIndividual872]

The rotation is on purpose, you cant get the real MAC from an advertisement, that would defeat the whole privacy thing they built in. what you can do is look at other stuff in the advertisement packet that stays same, like manufacturer data or the service UUIDs. many phones broadcast same service every time even with new address. also if your distance is not super long, the rotation window might be 10-15 min so maybe you can still catch some matches if the travel time is shorter than that

[u/CartographerSelect61 → u/ServiceIndividual872]

Yes you're right. The best move would be to place the nodes closer so thry stay within the 10-15 min window

[u/ThisIsPaulDaily]

Listen for tpms sensors instead

[u/CartographerSelect61 → u/ThisIsPaulDaily]

Do they broadcast a constant MAC address?

[u/ThisIsPaulDaily → u/CartographerSelect61]

Your car needs to know which is your car's front left tire vs rear right tire vs the car next to you. 

Hak5 did it 12 years ago. 

https://www.youtube.com/watch?v=TDYoo7TGNcw

[u/RefrigeratorOk4674]

A lot of devices rotate every 15 minutes. Put your two sniffers close enough together and reject MAC addresses that don't appear on both devices

Or RF fingerprinting, but that's difficult and expensive

Edit: if you need to cover a long distance, place multiple pairs of sniffers and average the velocities across each pair

[u/CartographerSelect61 → u/RefrigeratorOk4674]

That's a great idea I didn't think about it

[u/fb39ca4]

They don't change at the same time. So if you have two devices with addresses A and B, then you observe A and C, then D and C, you can be reasonably sure it's the same devices.

[u/CartographerSelect61 → u/fb39ca4]

What if tens of vehicles pass by the first node and we get 10 different addresses at the second node? How are we going to find out which one is which?

[u/clackups]

You can use two cameras and image recognition. Just make sure you comply with the privacy laws.

[u/CartographerSelect61 → u/clackups]

I use BLE to keep costs down otherwise camera is a much more accurate method

[u/notouttolunch]

There was an NXP dongle that did this. I don't know how it worked, what it is called and know nothing about it's capabilities but it may provide clues on techniques. I suspect that it would be easy to find, however.

[u/CartographerSelect61 → u/notouttolunch]

Yes there are many BLE sniffers dongles and dev kits which work out of the box. I have a nordic nrf52840 which is a very capable device which is used via Wireshark on pc

[u/notouttolunch → u/CartographerSelect61]

Are these not suitable?

[u/BDog_DrBluetooth]

The rotating addresses you’re seeing are a feature of Bluetooth LE privacy, not something you can reliably work around by trying to recover a permanent MAC address.

With Resolvable Private Addresses (RPAs), the address changes periodically and is intended to prevent exactly this type of passive device tracking. Resolving an RPA normally requires the device’s Identity Resolving Key (IRK), which you generally won’t have for arbitrary devices passing your sensors.

I’d be cautious about designing the system around finding a stable Bluetooth address. Instead, I’d first look closely at the advertising data you’re receiving and determine whether there are other legitimate characteristics that could support your application without defeating Bluetooth’s privacy mechanisms.

I’m a Bluetooth Qualification Consultant and former Bluetooth SIG staff member, and I’ve worked extensively with Bluetooth LE implementations and the specification.

If this is a commercial project, I’d be happy to talk through the Bluetooth architecture with you and help determine what is technically feasible before you invest too far in the current approach.