How to identify an unknown Bluetooth device
You open your Bluetooth settings, or run a scan, and there it is: a device you don't recognize. Maybe it's called "Unknown," maybe it's a string of hex, maybe it's something cryptic like KP-4471. This guide walks through how to work out what it actually is.
The short version: a device that broadcasts nothing but a random address is genuinely hard to identify from the payload alone, but most devices give away far more than they intend to.
Why so many devices show as "Unknown"
Broadcasting a name is optional. Plenty of well-behaved devices skip it — beacons, sensors, and anything trying to conserve the 31-byte advertisement budget. "Unknown" is the normal state of affairs, not a sign that something is hiding.
There's a second reason a name goes missing: it may be in the scan response rather than the advertisement. Devices can hold a second 31-byte payload that they only send when a scanner actively asks for it. If a name appears a second or two after the device does, that's why.
Clue 1: the manufacturer
This is the single most useful field. Every advertisement carrying manufacturer-specific data begins that field with a company identifier assigned by the Bluetooth SIG, and a scanner decodes it for you.
It won't name the product, but it collapses the search space immediately. "Unknown device, Apple" and "Unknown device, Espressif" are very different problems — the first is a phone, watch, or AirTag; the second is a hobbyist or IoT board running an ESP32.
Watch for one trap: the company identifier belongs to whoever wrote the firmware, not necessarily the brand on the box. Plenty of consumer gadgets ship with a chipmaker's identifier because nobody bothered to register their own.
Clue 2: service UUIDs
Advertised service UUIDs tell you what the device does, and they come in two flavors.
16-bit UUIDs are assigned by the Bluetooth SIG and have standard, public meanings. These are the giveaways:
| UUID | Service | Suggests |
|---|---|---|
0x180D |
Heart Rate | Chest strap, fitness watch |
0x180F |
Battery | Almost anything battery-powered |
0x1809 |
Health Thermometer | Medical or environmental sensor |
0x1816 |
Cycling Speed and Cadence | Bike sensor |
0x181A |
Environmental Sensing | Temperature/humidity sensor |
0xFD6F |
Exposure Notification | Contact-tracing beacon |
128-bit UUIDs are vendor-defined and mean nothing standard — but they're highly specific, which makes them excellent search terms. Paste one into a search engine verbatim. Vendor SDKs, GitHub repos, and reverse-engineering write-ups routinely name the exact product.
Clue 3: the appearance field
Some devices include an Appearance value, a SIG-defined code that states the device category outright — keyboard, mouse, watch, thermometer, heart-rate sensor, and so on. It's underused, but when present it's the most direct answer you'll get.
Clue 4: the address type
The Bluetooth address itself carries a hint, because the advertisement declares whether it's public or random.
A public address is permanent and globally registered, and its first three bytes are an OUI — an Organizationally Unique Identifier assigned to a manufacturer by the IEEE. You can look an OUI up in the IEEE registry and get a company name. This is a genuinely strong identification when it's available.
A random address gets you nothing from a registry, because it isn't registered anywhere. Worse, resolvable private addresses rotate every fifteen minutes or so specifically to prevent this kind of correlation. Phones, headphones, and trackers all behave this way. If your mystery device keeps reappearing under new addresses, that's expected — see our advertisement format guide for how address types work.
Clue 5: the manufacturer data payload
Beyond the company identifier, the rest of a 0xFF manufacturer-specific data field is whatever the vendor decided to put there. It's opaque by default, but two tricks make it talk:
- Match known formats. Some layouts are widely documented — an iBeacon frame, for instance, is recognizable on sight from its
4C 00 02 15prefix. - Watch which bytes move. If you can interact with the physical device — press a button, warm the sensor, open the door — scan before and after and diff the payload. Bytes that change map to the thing you changed. This is the whole basis of reverse-engineering an undocumented device.
Clue 6: make it appear and disappear
When the payload won't tell you, behavior will. This is the fastest identification technique there is, and it needs no decoding at all:
Power-cycle test. Turn a suspected device off. Rescan. If your mystery entry vanished, you've found it. Turn it back on and confirm it returns.
Proximity test. Walk the device in question into another room, or out to the car, and rescan from a fixed spot. Whichever entry's signal collapses is the one that moved.
Elimination sweep. Turn off everything you own that has Bluetooth, one at a time, checking the list after each. Tedious, but conclusive — and it usually ends after two or three items.
When nothing identifies it: find it physically
If you've exhausted the payload clues and the device isn't yours, locate it. Signal strength gets you there: sweep the space watching RSSI, narrow coarse-to-fine, and check high and low. Our device-finding walkthrough covers the full technique.
If the reason you're asking is that you suspect something was planted, read the hidden tracker guide instead — it covers the platform alerts that catch what a generic scan can't infer.
The usual suspects
Before assuming the worst, know that a typical home or office scan turns up a long tail of ordinary things: wireless earbuds and headphones, smart TVs and streaming sticks, fitness trackers and smartwatches, smart bulbs, plugs, and thermostats, car infotainment systems and tire-pressure sensors, printers, wireless keyboards and mice, electric toothbrushes, and continuous glucose monitors. Dozens of broadcasters in one room is normal.
Reading the clues on your phone
BLE Sniffer for Android decodes all of the above from a scan — name, address, RSSI, manufacturer, and service UUIDs — logs sessions on-device so you can compare before-and-after payloads, and exports to CSV. Free, no ads, nothing leaves your phone.
The takeaway
Work the clues in order of yield: manufacturer first, then service UUIDs, then appearance and address type. A 128-bit UUID pasted into a search engine identifies more devices than people expect. When the payload won't say, fall back on behavior — the power-cycle test settles it in seconds, and if the device isn't yours at all, signal strength will walk you to wherever it's sitting.