> ## Content Index
> Fetch the complete content index at: https://novelbits.io/llms.txt
> Use this file to discover other available public pages before exploring further.

# A Practical Guide to Debugging Bluetooth LE Communication on iOS
- URL: https://novelbits.io/debugging-sniffing-secure-ble-ios/
- Published: 2024-02-27T03:52:57.000Z
- Updated: 2026-08-31T16:28:24.000Z
- Description: Debug Bluetooth LE on iOS with Apple's Packet Logger. Capture HCI commands and events, extract LTK security keys, and decrypt encrypted traffic.
- Author: Mohammad Afaneh
- Tags: Mobile Development, Bluetooth Low Energy, Debugging, HCI, iOS, Security, Wireshark

Debugging Bluetooth LE is tricky, and on mobile devices, it can be even more so!

In this guide, I lay out the different steps in detail on how you can debug and sniff Bluetooth LE communication on iOS devices. Specifically, we'll be capturing the HCI commands and events between the Host and Controller on the iOS device.

## Host Controller Interface (HCI)

Before we dive into the details of how to achieve this, let's go over a few essential concepts.

The **Host Controller Interface (HCI)** layer is a communication interface defined in the Bluetooth Core Specification document. It standardizes the way that a Bluetooth Host communicates with a Bluetooth Controller.

![Host Controller Interface (HCI)](https://storage.ghost.io/c/86/70/8670d5a8-12b7-448c-b3db-a85bc1fcdea7/content/images/2025/07/additional-images_05-1.png)

Host Controller Interface (HCI)

It is an optional interface that is needed in cases where the controller and host are present on separate hardware components. If it is omitted, it means in such a device, the same processor will implement the functionality of a host and a controller. Here's an example:

![Host and Controller on the same microcontroller](https://storage.ghost.io/c/86/70/8670d5a8-12b7-448c-b3db-a85bc1fcdea7/content/images/2025/07/additional-images_06-1.png)

Host and Controller on the same microcontroller

If it is included, then it allows a device to implement the Bluetooth LE functionality using a host from one vendor and a controller from another vendor (on different chipsets). Physically, the HCI may run on top of an interface like UART, RS-232, USB, or SD. The set of packets that can be exchanged on this interface is defined by the Bluetooth specification.

Examples of where the Host and Controller are separated across different microcontrollers/processors, and HCI is implemented include:

A. Bluetooth USB dongle connected to a PC:

![Bluetooth USB Dongle HCI](https://storage.ghost.io/c/86/70/8670d5a8-12b7-448c-b3db-a85bc1fcdea7/content/images/2025/07/additional-images_07-1.png)

Bluetooth USB Dongle HCI

B. Smartwatch

![Smartwatch HCI](https://storage.ghost.io/c/86/70/8670d5a8-12b7-448c-b3db-a85bc1fcdea7/content/images/2025/07/additional-images_08-1.png)

Smartwatch HCI

The different aspects of HCI include:

- **HCI Commands**: these are sent from the Host to the Controller to request an operation. Examples include creating a connection, starting advertising, stopping advertising, starting scanning, stopping scanning, creating CIS, creating BIS, etc.
- **HCI Events**: these are sent from the Controller to the Host, reporting back with important information such as the status of a command. Examples include connection complete, advertising report, scan request received, etc.

Different operations in Bluetooth LE are split across the Host and Controller. Some are the Host's responsibility, while others are the Controller's. If we can get a peek at the commands and events that are being passed between the two subsystems, this gives us developers a lot more insight into what's happening in a Bluetooth LE device (or app).

Many might not know that both Android and iOS actually expose the HCI layer to us (*I* certainly didn't realize this until later in my Bluetooth LE development journey!). This is a powerful feature that can be very useful in many debugging scenarios.

For example, did you know that:

- You can capture the GATT operations being triggered by any mobile app?
- Or, that you can capture the advertising reports from the smartphone's Controller when scanning for Bluetooth LE devices?
- Or, that you can capture the security keys used to secure communication between the smartphone and another Bluetooth LE device? and then use that to decrypt the encrypted data exchanged between the two devices?!

All of these are possible on both iOS and Android. In this post, we'll cover how to do this on iOS. In a follow-up article, we'll cover the Android case.

## Requirements

To be able to do this on iOS, we need the following:

- A macOS laptop/desktop
- An Apple Developer Account
- An iOS device running iOS 13 or later
- A cable for connecting the iOS device to the Mac

## HCI Capture Steps on iOS

Here are the steps to take to capture HCI communication on iOS:

**Step 1:** Download and install Apple's Bluetooth Profile on an iOS device. You can do this in two ways:

- Download the [Bluetooth for iOS Profile](https://developer.apple.com/bug-reporting/profiles-and-logs/?name=bluetooth&ref=novelbits.io) directly on your iOS device
- Or you can [download it on your Mac](https://developer.apple.com/bug-reporting/profiles-and-logs/?name=bluetooth&ref=novelbits.io), AirDrop it to your iOS device, and then open it there.

Here's a short screen recording detailing this step:

*Downloading Apple's *Bluetooth for iOS Profile**

Once installed, you'll be able to find it under **Settings** → **General** → **VPN & Device Management**:

![Bluetooth for iOS Profile installed on iPhone](https://storage.ghost.io/c/86/70/8670d5a8-12b7-448c-b3db-a85bc1fcdea7/content/images/2025/07/img_2393-1.png)

**Bluetooth for iOS Profile** installed

**Step #2:** Now that we have the Profile installed on our iOS device, we can move on to the next step, which is to download and run a tool from Apple called the Packet Logger. You can download the Packet Logger tool from the Additional Tools for Xcode package **[here](https://developer.apple.com/download/all/?q=additional%20tools%20for%20Xcode&ref=novelbits.io)** \[*simply download the latest version*\].

![Apple Packet Logger Tool](https://storage.ghost.io/c/86/70/8670d5a8-12b7-448c-b3db-a85bc1fcdea7/content/images/2025/07/packet-logger-tool-1.jpg)

Packet Logger Tool

**Step #3:** Now, let's run the Packet Logger tool (you can also drag and drop it to your local Applications folder so you can quickly run it next time).

![Packet Logger Tool Window](https://storage.ghost.io/c/86/70/8670d5a8-12b7-448c-b3db-a85bc1fcdea7/content/images/2026/01/Screenshot-2024-02-26-at-9.40.21-E2-80-AFPM.png)

Packet Logger Tool Window

**Step #4:** Next, connect your iOS device to your Mac (and accept any dialogs asking to allow access to your device).

**Step #5:** Click on the **File** → **New iOS Trace** menu item:

![New iOS Trace in the Packet Logger Tool](https://storage.ghost.io/c/86/70/8670d5a8-12b7-448c-b3db-a85bc1fcdea7/content/images/2025/07/ios-trace-1.jpg)

New iOS Trace in the Packet Logger Tool

**Step #6:** After starting the iOS Trace, you should start seeing some Bluetooth traffic, and the iOS device should show a "signal" status at the top of the screen:

![Bluetooth for iOS Profile running on iOS device](https://storage.ghost.io/c/86/70/8670d5a8-12b7-448c-b3db-a85bc1fcdea7/content/images/2025/07/img_2393-copy-1.png)

Bluetooth for iOS Profile running on iOS device

**Step #7:** As an advanced tip, you can actually export the log file to a BTSnoop format, which can be opened in Wireshark for additional analysis.

💡

**BTSnoop** is a file format defined for storing a log of Bluetooth HCI traffic (commands and events). Wireshark and many different sniffer software packages support this file format for analysis.

![Exporting HCI data in BTSnoop format](https://storage.ghost.io/c/86/70/8670d5a8-12b7-448c-b3db-a85bc1fcdea7/content/images/2025/07/btsnoop-1.jpg)

Exporting HCI data in BTSnoop format

**Step #8:** So, what do you do from here now that you have access to the HCI logs?  
At this point, you can view all the HCI traffic between the Bluetooth Host and Controller on your iOS device.

In order to understand the different HCI commands and events, I recommend referring to the **Bluetooth Core Specification document Vol 4, Part E, Section 7**. Here are examples of some common Bluetooth LE HCI Commands on the Central side (the most common role for a smartphone):

- LE Set Scan Parameters command
- LE Set Scan Enable command
- LE Create Connection command
- LE Enable Encryption command

## Capturing Bluetooth LE Security Keys (LTK)

One handy use case for the Packet Logger tool is to extract the LTK for a secure connection between two Bluetooth LE devices (utilizing the LE Secure Connections pairing method).

To demonstrate this, I am going to use the following:

- A [Nordic nRF52840 board](https://www.nordicsemi.com/Products/Development-hardware/nrf52840-dk?ref=novelbits.io) running the nRF Connect SDK (Zephyr-based) peripheral\_sc\_only example (this one runs in LE Secure Connections only mode)
- [nRF Connect mobile app](https://www.nordicsemi.com/Products/Development-tools/nrf-connect-for-mobile?ref=novelbits.io) on an iPhone 14 Pro Max (running iOS 17)
- [Ellisys Bluetooth Tracker](https://www.ellisys.com/products/btr1/index.php?ref=novelbits.io) (Bluetooth LE Sniffer tool)  
\[Used for sniffing over the air traffic and inputting the LTK for traffic decryption. Alternatively, you can use Wireshark in combination with nRF Sniffer on one of the Nordic dev boards\]

### Exercise Steps

Make sure the nRF DK is not bonded with the iOS device. If it already is, then remove it from the Bluetooth Settings menu by clicking on the **(i) icon** and then clicking "**Forget This Device**":

![Forget This Device to remove Bluetooth LE Bond](https://storage.ghost.io/c/86/70/8670d5a8-12b7-448c-b3db-a85bc1fcdea7/content/images/2025/07/sc-only-peripheral-scaled-1.jpg)

"Forget This Device" to remove Bluetooth LE Bond

Now navigate to the nRF Connect mobile app and discover the device:

![Discovering the Bluetooth LE Peripheral](https://storage.ghost.io/c/86/70/8670d5a8-12b7-448c-b3db-a85bc1fcdea7/content/images/2025/07/nrf-mobile-app-discovering-peripheral-scaled-1.jpg)

Discovering the Bluetooth LE Peripheral

**Note:** Make sure the Packet Logger Tool is running an iOS Trace before continuing with the next step.

Click "Connect." then, you'll be presented with a Passkey entry form:

![Pairing Passkey entry on the smartphone](https://storage.ghost.io/c/86/70/8670d5a8-12b7-448c-b3db-a85bc1fcdea7/content/images/2025/07/bluetooth-pairing-request-scaled-1.jpg)

Pairing Passkey entry on the smartphone

You'll find the passkey displayed in the serial terminal from the nRF DK:

![Passkey from the board shown in the serial terminal](https://storage.ghost.io/c/86/70/8670d5a8-12b7-448c-b3db-a85bc1fcdea7/content/images/2025/07/passkey-capture-in-serial-terminal-scaled-1.jpg)

Passkey from the board shown in the serial terminal

Make sure you enter the passkey reasonably quickly. Otherwise, the pairing process will time out. Once paired, the device serial terminal output will indicate a successful pairing:

![Pairing complete](https://storage.ghost.io/c/86/70/8670d5a8-12b7-448c-b3db-a85bc1fcdea7/content/images/2025/07/entering-passkey-on-nrf-board-scaled-1.jpg)

Pairing complete

Once this is completed, you can now stop the Packet Logger trace and filter for HCI Commands:

![Filtering for HCI Commands in Packet Logger](https://storage.ghost.io/c/86/70/8670d5a8-12b7-448c-b3db-a85bc1fcdea7/content/images/2025/07/packet-capture-1-1.jpg)

Filtering for HCI Commands in Packet Logger

Now, look for the HCI Command "LE Start Encryption" and expand the command for more information. In there, you will find the LTK for the bond. **Voila!**

![Capturing the LTK in Packet Logger during Pairing](https://storage.ghost.io/c/86/70/8670d5a8-12b7-448c-b3db-a85bc1fcdea7/content/images/2025/07/ltk-capture-1-1.jpg)

Capturing the LTK in Packet Logger during Pairing/Bonding

Even if you miss capturing the pairing process using the Packet Logger, you can disconnect the nRF DK (or any other device you're looking to capture) and capture the reconnection operation to the DK.

From there, you can again look for the same HCI command: "LE Start Encryption" (you can also verify this is the same LTK used when first establishing the pairing between the two devices):

![Capturing the LTK in Packet Logger upon reconnection](https://storage.ghost.io/c/86/70/8670d5a8-12b7-448c-b3db-a85bc1fcdea7/content/images/2025/07/ltk-capture-2-1-1.jpg)

Capturing the LTK in Packet Logger upon reconnection between bonded devices

After extracting the LTK from the Packet Logger tool, you can now fully decrypt the traffic between the two Bluetooth LE devices (the nRF DK and the iOS device)!

## If you would rather not run a GUI

Apple’s Packet Logger is a Mac app, which is fine when you are debugging by hand and awkward when you want this in a script. [idevicebtlogger](https://github.com/libimobiledevice/libimobiledevice/blob/master/tools/idevicebtlogger.c?ref=novelbits.io), part of the open source libimobiledevice project, talks to the same Bluetooth packet logger service on the device but from the command line. It writes straight to PCAP with `-f pcap`, runs on Linux and Windows as well as macOS, and exits cleanly when the device disconnects.

You still need the phone tethered and something driving the app, so it replaces the capture step rather than the whole workflow.

Free Download

iOS Bluetooth LE Debugging Guide

A complete PDF guide to iOS Bluetooth LE debugging: Console.app filters, packet-level inspection, common iOS-specific pitfalls, and the workflow I use on every iOS Bluetooth LE project.

Send Me the Guide 

Check your email! We sent the download link to .

No spam. Unsubscribe with one click.

💡

**Insider Tip:** Want to dive deeper into Bluetooth LE debugging and security? Take it hands-on with [Bluetooth LE Unplugged](https://novelbits.io/ble-unplugged-course/): two USB dongles ship with the course, and you build working Bluetooth LE devices without an SDK or a line of embedded C.

## Summary

In this post, we covered a very practical technique that we can use when debugging Bluetooth LE communication with a smartphone, whether that's from an app that you've developed or even any other app on your phone!

## Credits

- [A New Way to Debug iOS Bluetooth Applications](https://www.bluetooth.com/blog/a-new-way-to-debug-iosbluetooth-applications/?ref=novelbits.io)
- BTSnoop File Format
- [2019 WWDC Session](https://developer.apple.com/videos/play/wwdc2019/901/?ref=novelbits.io)