Dissecting the hcitool command

Dissecting a oneliner that many blogs show when they talk about iBeacons on the Raspberry Pi 3, but nobody ever goes into excruciating detail.

November 27, 2016 - 3 minute read -
hci hcitool bluetooth ibeacon ios raspberrypi

I’m experimenting with setting up a Raspberry Pi to function as an iBeacon, as per Apple’s BLE (Bluetooth Low Energy) advertising standard. Going around the internet, there is no shortage of people telling you what command to copy-paste into your terminal, but nobody ever really explains what the hell is going on. If they do at all, it’s usually stuff you already kind of understood. I’ve scraped together some info from a bunch of different blogs here to put it all in one, consistent place.

If you’re feeling particularily mashochistic today, here’s the link to the man page. I think it’s completely illegible (as are most manpages, but I’m a Linux philistine) and conveys information in a spectacularily poor way.

The actual command

The command in itself quite interesting to behold:
sudo hcitool -i hci0 cmd 0x08 0x0008 1E 02 01 1A 1A FF 4C 00 02 15 E2 0A 39 F4 73 F5 4B C4 A1 2F 17 D1 AD 07 A9 61 00 00 00 00 C8 00
What the hell does that do exactly?

The first parts shouldn’t be too hard:
sudo hcitool
If I need to explain this you’re probably in over your head and should get comfortable with a command line interface first. Maybe you just need a refresher though, in which case:

  • sudo: or ‘super user do’, means that you wish to execute the subsequent command with root/admin/highsest possible privileges/
  • hcitool: the actual command that controls our Bluetooth hardware on the Raspberry. It is part of the BlueZ Bluetooth stack you probably installed on your Raspbery before starting this whole thing. If you didn’t, check out the Adafruit guide on this, or any other blogpost covering iBeacons on Raspberrys. The HCI part stands for Host Controller Interface, read more in the Wikipedia article here.

Moving on to:
-i hci0
The -i flag simply is a flag saying you wish to specify the Bluetooth interface on which you seek to run this command. Given there’s only one Bluetooth interface on the Raspberry (excluding the scenario where you have attached a USB one to it), we specify here the 0 interface, i.e. the first one, hence hci0.

cmd simply means that you’re about to execute a custom command. Here’s where things get interesting. The sequence of numbers you’re seeing here is hexacdecimal notation. If you don’t know what that is, it’s probably worth Googling, it is a notation that is used frequently in the IT space. At any rate, here’s how that breaks down specifically, part by part:

cmd # Pass an arbitrary command to the chip
	0x08 # OGF = Operation Group Field = Bluetooth Command Group = 0x08
	0x0008 # OCF = Operation Command Field = HCI_LE_Set_Advertising_Data = 0x0008
	# Apple's spec <IBEACONPREFIX>
	1E 02 01 1A 1A 
	FF # Manufacturer specific data AD type 
	4C 00 # Company identifier code (0x004C == Apple)
	02 # Byte 0 of iBeacon advertisement indicator
	15 # Byte 1 of iBeacon advertisement indicator
	E2 0A 39 F4 73 F5 4B C4 A1 2F 17 D1 AD 07 A9 61 # UUID of the beacon
	00 00 # Major
	00 00 # Minor
	C8 00 # Calibrated Tx power

If you wish to decode some of these entities, for example the calibrated transmission (Tx) power, you can use any online hex to decimal converter (such as this one). Don’t forget, this notation is in ‘big endian’, which means the following when we seek to convert from hex to decimal:

C8 00 # The original Tx code from the command
00 C8 # Flipping it around, because we are in big endian mode
200 # Putting it through the converter

As you see, we end up with the number 200 for our Tx power. This is of course an RSSI, and hence to make any sense should be noted as -200.

Apple’s spec

What’s perhaps interesting to note is the ‘Apple spec’ that’s part of the code above. This is mandated by Apple if you wish to conform to the iBeacon standard.
02 01 1a 1a ff 4c 00 02 15
‘Apple’s static prefix to the advertising data – this is always the same’ is the best I could find from the reverse engineering blog of iBeacon.

Sources

Based Stack Overflow