Skip to content
BLE·SNIFFER

How to find BLE devices around you (and physically locate them)

Discovering that something is broadcasting nearby is easy. Working out which drawer it's in is the hard part. This guide covers both: enumerating the BLE devices around you, then narrowing an unknown one down to a physical spot.

Step 1: See what's there

Start a scan with BLE Sniffer for Android and give it thirty seconds. Devices with slow advertising intervals — beacons and battery-conscious sensors — can take several seconds to appear, so a two-second glance undercounts badly.

Expect a crowd. A quiet apartment usually has a dozen broadcasters; a coffee shop or office can have fifty. Earbuds, TVs, fitness trackers, car head units, smart bulbs, thermostats, tire pressure sensors, and every phone in the room with a rotating address.

Step 2: Narrow the list before you start walking

Physically hunting a device is slow, so cut the candidate list down first:

  • Read the manufacturer. Decoded from the company identifier in the advertisement, it often names the vendor outright and eliminates most of the list.
  • Check service UUIDs. A heart-rate service means a wearable. A proprietary 128-bit UUID means a specific product, and pasting it into a search engine frequently identifies it.
  • Toggle the suspect. If you own the device, power it off and watch which entry stops updating, then power it back on. This is the fastest identification there is.
  • Sort by RSSI. Whatever is strongest is usually closest. Start there.

Our guide to identifying an unknown Bluetooth device works through each of these clues in depth, and if you want to know what the fields themselves actually mean, the advertisement format guide breaks a packet down byte by byte.

Step 3: Read RSSI honestly

RSSI is received signal strength in dBm — always negative, closer to zero is stronger. Rough calibration:

RSSI Typically means
−30 to −50 dBm Very close, within arm's reach
−50 to −70 dBm Same room
−70 to −85 dBm Through a wall or two
−85 to −100 dBm Edge of range, about to drop out

The physics behind it: signal falls off roughly as RSSI = TxPower − 10·n·log₁₀(distance), where n is about 2 in open air and 2.7 to 4 indoors. In free space that works out to about 6 dB lost per doubling of distance. Our RSSI-to-distance guide works the formula through with real numbers and shows how much the answer swings on the exponent you pick.

What that formula hides is everything that makes it unreliable in practice. TxPower varies by device and is often unknown. A human body between the phone and the device costs several dB on its own — 2.4 GHz is absorbed readily by water, and people are mostly water. Metal reflects, drywall attenuates, microwave ovens and Wi-Fi share the band, and multipath reflections can make a signal stronger a step farther away.

So treat RSSI as a warm/cold indicator, not a distance readout. Anyone reporting BLE distance to the centimeter is showing you a number their hardware can't support.

Step 4: The hot-and-cold sweep

This is the technique that actually works. Pick your target device and watch its signal while you move.

  1. Take several readings, not one. RSSI on a stationary device still jitters by 5–10 dB. Pause a few seconds at each spot and use the trend, not a single sample.
  2. Walk a coarse loop first. Cross the room, or walk the hallway end to end, noting where the signal peaks. You're looking for the general direction before you look for the object.
  3. Then halve the space. Move toward the peak, re-read, and repeat. Each pass should cut the search area down.
  4. Check vertically too. Under a car seat, on top of a cabinet, inside a ceiling fixture. It's easy to sweep a room thoroughly at waist height and miss entirely.

BLE Sniffer's proximity radar is built for exactly this loop — lock onto one device and it turns the running signal strength into a live display you can walk with, so you're watching the radar instead of squinting at a number in a list.

Step 5: Use your body as an antenna shield

BLE has no direction information — the radio just reports strength. But you can manufacture directionality: put your body between the phone and the room, and turn slowly in place.

Your torso attenuates the signal noticeably, so the reading dips when you're blocking the path to the device and peaks when you're facing it with a clear line. One full slow rotation, watching for the peak, gives you a bearing. It's crude, and reflections can produce a false peak off a wall, but from two different positions in the room two bearings will usually cross near the target.

For a formal version of the same idea, take readings from three widely separated points and estimate the intersection — trilateration, by hand. The accuracy is poor indoors, but it's often enough to pick the right room.

Step 6: When the address keeps changing

Privacy-conscious devices rotate a resolvable private address every fifteen minutes or so, which means your target can vanish from the list mid-hunt and reappear as a new entry. This is normal, not a malfunction — why Bluetooth addresses change explains the mechanism and what you can still track across a rotation.

Ways through it:

  • Track by payload, not address. Manufacturer-specific data and service UUIDs frequently stay constant across rotations, so a device that changes address but keeps an identical 0xFF payload signature is very likely the same one.
  • Track by continuity. A new address that shows up at the same RSSI, at the same moment an old one disappeared, is almost certainly the same device.
  • Move fast. You typically have a fifteen-minute window. That's plenty for a hot-and-cold sweep of one room.

A note on unwanted trackers

If you're specifically looking for an AirTag, Tile, or similar tracker that might be following you, use the purpose-built tools first: Android's built-in unknown tracker alerts and Apple's Tracker Detect app both know the specific advertisement signatures these devices use when separated from their owner, and they'll flag one that has been traveling with you. A general scanner will show you the same broadcast, but without that "has been with you for a while" context.

Once you know a tracker is present, a scanner plus the hot-and-cold sweep is how you find where it's hidden — our hidden tracker guide covers that case end to end.

Step 7: Log it, if one pass isn't enough

Some questions only answer themselves over time. Log your scan sessions and export to CSV, then compare:

  • Which addresses appear in every session? Fixed infrastructure — a thermostat, a TV, a neighbor's speaker.
  • Which appeared once and never again? Someone walking past, or an address rotation.
  • How does one device's RSSI change across locations? A handful of logged sessions taken from different rooms will localize a device better than any single live sweep.

Everything BLE Sniffer records stays on-device; exporting is the only time the data goes anywhere, and it goes where you send it.

A word on ethics and legality

Listening to advertisements is passive — they're public broadcasts, sent to anyone in range. Connecting to devices, probing their services, or attempting to interact with hardware you don't own is a different matter and can carry real legal risk. Scan freely; interact only with devices that are yours or that you're explicitly authorized to test. General information, not legal advice.

The takeaway

Finding BLE devices around you takes one scan. Finding where they are takes a method: narrow by manufacturer and service UUID first, then treat RSSI as warm/cold rather than a distance, sweep coarse-to-fine while averaging several readings, and use your own body to fake a directional antenna. Address rotation will interrupt you — track the payload instead. BLE Sniffer for Android is free and does all of it, including the proximity radar for the final sweep.

If what you're hunting for is your own missing gear rather than an unknown broadcaster, how to find a lost Bluetooth device covers the cases where a scan can't help and what to try instead.