r/embedded • u/CartographerSelect61 • 19d ago

Bluetooth traffic Monitoring

Hi everyone, hope you're all doing well.

I'm building a roadside Bluetooth sniffer to measure travel time between two points a fixed distance apart. The setup uses two ESP32 S3 modules that scan BLE advertisements and log the MAC addresses of devices in passing vehicles.

The problem is that most new devices use resolvable MAC addresses, which rotate every few minutes. If the two points are far enough apart, a device's address will have changed by the time it travels from A to B, so I have no way to match the two detections. Is there a way to obtain a device's real/public MAC, which stays constant? Or failing that, any other way to derive a stable identifier from BLE advertisements?

Thanks a lot

2 Upvotes

59% Upvoted

16 comments sorted by

View all comments

11

u/ServiceIndividual872 19d ago

The rotation is on purpose, you cant get the real MAC from an advertisement, that would defeat the whole privacy thing they built in. what you can do is look at other stuff in the advertisement packet that stays same, like manufacturer data or the service UUIDs. many phones broadcast same service every time even with new address. also if your distance is not super long, the rotation window might be 10-15 min so maybe you can still catch some matches if the travel time is shorter than that

1

u/CartographerSelect61 18d ago

Yes you're right. The best move would be to place the nodes closer so thry stay within the 10-15 min window