BLE·SNIFFER

How to sniff BLE with your phone (no extra hardware)

The fastest way to start sniffing Bluetooth Low Energy is with the phone already in your pocket. No dongle, no soldering, no drivers. For the most common tasks — seeing what's broadcasting nearby, identifying an unknown device, and figuring out roughly where it is — a phone is genuinely the right tool.

This guide walks through doing it on Android, step by step.

What you can (and can't) do this way

Your phone reads the advertisement layer — the public packets that discoverable BLE devices broadcast. That's plenty for a lot of real work:

  • Discover every advertising BLE device around you.
  • Read each device's name, Bluetooth address, signal strength, manufacturer, and service UUIDs.
  • Gauge how close a device is from its signal strength.
  • Log a scan session and export the data.

What a phone can't do is capture the traffic inside live connections — that needs dedicated hardware, as covered in our scanner-vs-packet-sniffer guide. But if your question is "what's here and where is it," advertisement scanning answers it.

Step 1: Get a scanner app

Install BLE Sniffer for Android. It's free, has no ads, and sends nothing over the internet — scan logs stay on your device.

Step 2: Grant the permissions it needs

Android requires apps to hold Bluetooth (and, on many versions, location) permissions to scan for BLE devices. This is an OS rule, not an app quirk: because BLE scan results can hint at physical location, Android gates scanning behind those permissions. Grant them when prompted, and make sure Bluetooth is turned on.

Step 3: Start a scan

Open the app and start scanning. Within seconds you'll see a live list of nearby devices populate. For each one you'll typically see:

  • Name — if the device broadcasts one. Many show as "Unknown," which is normal; broadcasting a name is optional.
  • Address — the device's Bluetooth address. Remember that phones and privacy-minded devices rotate a random address periodically, so the same physical device may appear under changing addresses over time.
  • RSSI — signal strength in dBm. Closer to zero means a stronger (usually nearer) signal.
  • Manufacturer — decoded from the advertisement's company identifier.
  • Service UUIDs — clues about what the device does.

Step 4: Identify a mystery device

Got a device you can't place? A few tactics:

  • Read the manufacturer. The company identifier often narrows it down immediately.
  • Check the service UUIDs. A heart-rate service suggests a wearable; a proprietary UUID suggests a specific product.
  • Watch the name across time. Some devices only include their name in certain advertisement types.

Step 5: Find where it is with the proximity radar

Signal strength is a rough distance gauge, and BLE Sniffer's proximity radar turns that into something you can walk with. Pick a device and sweep the room: as you get closer, its signal strengthens and the radar reflects it. It's the practical way to answer "which drawer is this beacon in" or "where's the tracker in this car." Signal strength is affected by walls, bodies, and interference, so treat it as a warm/cold guide, not a GPS coordinate.

Step 6: Log and export

Every scan session is logged on-device. When you want the raw data in your own hands — for a spreadsheet, a report, or deeper analysis — export it to CSV. Because everything is stored locally, exporting is the only time the data leaves your phone, and it goes only where you send it.

Tips for better results

  • Move around. RSSI is noisy; several readings from different spots beat one.
  • Expect "Unknown" and rotating addresses. Both are normal privacy behaviors, not bugs.
  • Scan in context. To find your own device, toggle it on and off and watch which entry appears and disappears.

When to graduate to hardware

If you reach the point of needing to decode the traffic inside a connection — reverse engineering a protocol or debugging your own firmware's GATT exchanges — that's when you add an nRF52840 dongle and Wireshark. Our hardware guide and protocol analyzer guide cover that next step. Until then, your phone has you covered.

A word on ethics and legality

Listening to public advertisements is passive. Connecting to and probing devices you don't own or aren't authorized to test is a different matter and can carry legal risk. Scan freely; interact only with devices that are yours or that you have explicit permission to assess. General information, not legal advice.

Ready to start? BLE Sniffer for Android is free — scan, log, and export in minutes.