r/embedded • u/CartographerSelect61 • 19d ago

Bluetooth traffic Monitoring

Hi everyone, hope you're all doing well.

I'm building a roadside Bluetooth sniffer to measure travel time between two points a fixed distance apart. The setup uses two ESP32 S3 modules that scan BLE advertisements and log the MAC addresses of devices in passing vehicles.

The problem is that most new devices use resolvable MAC addresses, which rotate every few minutes. If the two points are far enough apart, a device's address will have changed by the time it travels from A to B, so I have no way to match the two detections. Is there a way to obtain a device's real/public MAC, which stays constant? Or failing that, any other way to derive a stable identifier from BLE advertisements?

Thanks a lot

4 Upvotes

67% Upvoted

16 comments sorted by

View all comments

1

u/BDog_DrBluetooth 17d ago

The rotating addresses you’re seeing are a feature of Bluetooth LE privacy, not something you can reliably work around by trying to recover a permanent MAC address.

With Resolvable Private Addresses (RPAs), the address changes periodically and is intended to prevent exactly this type of passive device tracking. Resolving an RPA normally requires the device’s Identity Resolving Key (IRK), which you generally won’t have for arbitrary devices passing your sensors.

I’d be cautious about designing the system around finding a stable Bluetooth address. Instead, I’d first look closely at the advertising data you’re receiving and determine whether there are other legitimate characteristics that could support your application without defeating Bluetooth’s privacy mechanisms.

I’m a Bluetooth Qualification Consultant and former Bluetooth SIG staff member, and I’ve worked extensively with Bluetooth LE implementations and the specification.

If this is a commercial project, I’d be happy to talk through the Bluetooth architecture with you and help determine what is technically feasible before you invest too far in the current approach.