< HCI Command: Reset (0x03|0x0003) plen 0             #5 [hci0] 12:35:01.843185
│                    │    │    │          │              │  │       │
│                    │    │    │          │              │  │       └─ Timestamp
│                    │    │    │          │              │  └─ Controller
│                    │    │    │          │              └─ Frame number
│                    │    │    │          └─ Parameter length (bytes)
│                    │    │    └─ Full opcode (16-bit)
│                    │    └─ OGF|OCF (Opcode Group / Command Field)
│                    └─ Command name (human-readable)
└─ Direction: < = Host to Controller (outgoing)

> HCI Event: Command Complete (0x0e) plen 4           #6 [hci0] 12:35:01.864922
│                              │      │                │  │       │
│                              │      │                │  │       └─ Timestamp
│                              │      │                │  └─ Controller
│                              │      │                └─ Frame number
│                              │      └─ Parameter length
│                              └─ Event code
│
└─ Direction: > = Controller to Host (incoming)

< HCI Command: LE Set Extende.. (0x08|0x0039) plen 2  #1 [hci0] 12:35:01.738352
        Extended advertising: Disabled (0x00)
        Number of sets: Disable all sets (0x00)

> HCI Event: Command Complete (0x0e) plen 4           #6 [hci0] 12:35:01.864922
      Reset (0x03|0x0003) ncmd 2
        Status: Success (0x00)

> HCI Event: LE Meta Event (0x3e) plen 31           #487 [hci0] 12:36:18.974201
      LE Enhanced Connection Complete (0x0a)
        Status: Success (0x00)
        Handle: 2048
        Role: Peripheral (0x01)
        Peer address type: Public (0x00)
        Peer address: AA:BB:CC:DD:EE:FF (OUI Company)
        Connection interval: 60.00 msec (0x0030)
        Connection latency: 0 (0x0000)
        Supervision timeout: 9600 msec (0x03c0)

< LE-ACL: Handle 2048 [66:B0:26:F1:D3:BC] [1/6] flags 0x00 dlen 16  #493 [hci0] 12:36:18.977915
│   │            │     │                   │          │         │    │    │     │
│   │            │     │                   │          │         │    │    │     └─ Timestamp
│   │            │     │                   │          │         │    │    └─ Controller
│   │            │     │                   │          │         │    └─ Frame number
│   │            │     │                   │          │         └─ Data length
│   │            │     │                   │          └─ flags
│   │            │     │                   └─ Buffer tracking (optional)
│   │            │     └─ Peer address (optional)
│   │            └─ Handle number
│   └─ Connection-type-aware label (e.g. BR-ACL, LE-ACL, BR-SCO, LE-ISO)
└─ Direction marker: '<' = host->controller (TX), '>' = controller->host (RX)

< LE-ACL: Handle 2048 [2/6] flags 0x00 dlen 7  #494 [hci0] 12:36:18.978488
      ATT: Exchange MTU Request (0x02) len 2
        Client RX MTU: 517
> LE-ACL: Handle 2048 flags 0x02 dlen 11       #497 [hci0] 12:36:19.000048
      SMP: Pairing Request (0x01) len 6
        IO capability: NoInputNoOutput (0x03)
        OOB data: Authentication data not present (0x00)
        Authentication requirement: Bonding, MITM, SC, No Keypresses, CT2 (0x2d)
        Max encryption key size: 16

@ MGMT Command: Set Powered (0x0005) plen 1     {0x0001} [hci0] 12:35:04.033564
│                            │        │           │        │       │
│                            │        │           │        │       └─ Timestamp
│                            │        │           │        └─ Controller
│                            │        │           └─ MGMT socket ID
│                            │        └─ Parameter length
│                            └─ MGMT opcode
└─ @ = Management channel

@ MGMT Open: bluetoothd (privileged) version 1.23      {0x0001} 12:34:49.881936
@ MGMT Close: bluetoothd                               {0x0001} 12:35:01.866256

@ MGMT Command: Set Powered (0x0005) plen 1     {0x0001} [hci0] 12:35:04.033564
        Powered: Enabled (0x01)

@ MGMT Event: Command Complete (0x0001) plen 7  {0x0001} [hci0] 12:35:04.114789
      Set Powered (0x0005) plen 4
        Status: Success (0x00)
        Current settings: 0x004e0ac1
          Powered
          Secure Simple Pairing

@ MGMT Command: Read Management Ver.. (0x0001) plen 0  {0x0001} 12:35:04.027771
@ MGMT Event: Command Complete (0x0001) plen 6         {0x0001} 12:35:04.027776

= Note: Linux version 6.16.0-rc6-0903 (x86_64)                  12:34:49.881926
= Note: Bluetooth subsystem version 2.22                        12:34:49.881930

= New Index: 00:11:22:33:44:55 (Primary,USB,hci0)        [hci0] 12:34:49.881932
= Open Index: 00:11:22:33:44:55                          [hci0] 12:34:49.881933
= Index Info: 00:11:22:33:44:55 (OUI Company)              [hci0] 12:34:49.881934
= Close Index: 00:11:22:33:44:55                         [hci0] 12:35:01.865125

= bluetoothd: src/adapter.c:connected_callback() hci0 devic..   12:36:18.975307
  │           │                                                  │
  │           │                                                  └─ Timestamp
  │           └─ Source file, function, and message (may be truncated)
  └─ Process name

= bluetoothd: [:1.21220:method_call] > org.freedesktop.DBus..   12:34:53.912508
= bluetoothd: [:1.21220:method_return] < [#5]                   12:34:53.912546
= bluetoothd: [signal] org.freedesktop.DBus.ObjectManager.I..   12:36:18.975691

┌─ Main content (left-aligned, variable width)
│                                        ┌─ Frame # ─┐ ┌Controller┐ ┌─ Timestamp ─┐
│                                        │            │ │          │ │              │
< HCI Command: Reset (0x03|0x0003) plen 0             #5 [hci0] 12:35:01.843185
> HCI Event: Command Complete (0x0e) plen 4           #6 [hci0] 12:35:01.864922
@ MGMT Command: Set Powered (0x0005) plen 1     {0x0001} [hci0] 12:35:04.033564
= Note: Linux version 6.16.0-rc6-0903 (x86_64)                  12:34:49.881926
= Open Index: 00:11:22:33:44:55                          [hci0] 12:34:49.881933

> ACL: Handle 2048 flags 0x02 dlen 11       #497 [hci0] 12:36:19.000048
      SMP: Pairing Request (0x01) len 6                          ← L2CAP/SMP layer
        IO capability: NoInputNoOutput (0x03)                    ← SMP fields
        OOB data: Authentication data not present (0x00)
        Authentication requirement: Bonding, MITM, SC (0x2d)
        Max encryption key size: 16

< HCI Command: Read BD ADDR (0x04|0x0009) plen 0     #13 [hci0] 12:35:04.057866
> HCI Event: Command Complete (0x0e) plen 10         #14 [hci0] 12:35:04.058750
      Read BD ADDR (0x04|0x0009) ncmd 1
        Status: Success (0x00)
        Address: 00:11:22:33:44:55 (OUI Company)

@ MGMT Command: Set Powered (0x0005) plen 1     {0x0001} [hci0] 12:35:04.033564
        Powered: Enabled (0x01)
< HCI Command: Reset (0x03|0x0003) plen 0             #7 [hci0] 12:35:04.033907
> HCI Event: Command Complete (0x0e) plen 4           #8 [hci0] 12:35:04.055753
      Reset (0x03|0x0003) ncmd 2
        Status: Success (0x00)
  ... (more HCI commands to configure the controller) ...
@ MGMT Event: Command Complete (0x0001) plen 7  {0x0001} [hci0] 12:35:04.114789
      Set Powered (0x0005) plen 4
        Status: Success (0x00)

> HCI Event: LE Meta Event (0x3e) plen 31           #487 [hci0] 12:36:18.974201
      LE Enhanced Connection Complete (0x0a)
        Status: Success (0x00)
        Handle: 2048
        Role: Peripheral (0x01)
        Peer address: AA:BB:CC:DD:EE:FF (OUI Company)
@ MGMT Event: Device Connec.. (0x000b) plen 13  {0x0001} [hci0] 12:36:18.974319
= bluetoothd: src/adapter.c:connected_callback() hci0 devic..   12:36:18.975307
< ACL: Handle 2048 [1.. flags 0x00 dlen 16  #493 [hci0] 12:36:18.977915
      LE L2CAP: Connection Parameter Update Request (0x12) ident 1 len 8
< ACL: Handle 2048 [2/6] flags 0x00 dlen 7  #494 [hci0] 12:36:18.978488
      ATT: Exchange MTU Request (0x02) len 2
        Client RX MTU: 517

$ btmon -a hcidump.log

• نوع اتصال (BR-ACL, LE-ACL, BR-SCO, BR-ESCO, LE-ISO)
• آدرس دستگاه
• تعداد بسته‌های TX و RX و تعداد تکمیل‌ها
• آمار تاخیر زمانی (حداقل، حداکثر، میانه) به میلی‌ثانیه
• آمار اندازه بسته (حداقل، حداکثر، میانگین) به بایت (اکتت)
• تخمین پهنای باند (Throughput) بر حسب کیلوبیت بر ثانیه (Kb/s)

نمودارهای تاخیر زمانی (Latency plots): اگر gnuplot نصب باشد، نمودارهای توزیع تاخیر زمانی با هنر اسکی (ASCII-art) در ترمینال رسم می‌شوند.

grep -n "Error Response" output.txt

grep -n "Authentication Insufficient\|Insufficient Encryption\|Insufficient Security\|security block" output.txt

grep -n "Connection refused" output.txt

hci_power_on_sync
  └─ hci_dev_open_sync
       └─ hci_dev_init_sync
            ├─ hci_dev_setup_sync     (driver setup + quirks)
            └─ hci_init_sync
                 ├─ Stage 1: Reset + identity
                 ├─ Stage 2: Capabilities + buffer sizes
                 ├─ Stage 3: Event masks + policy
                 └─ Stage 4: Final configuration

< HCI Command: Reset
> HCI Event: Command Complete (Reset)
< HCI Command: Read Local Supported Features
> HCI Event: Command Complete (Read Local Supported Features)
< HCI Command: Read Local Version Information
> HCI Event: Command Complete (Read Local Version Information)
< HCI Command: Read BD ADDR
> HCI Event: Command Complete (Read BD ADDR)
... [Stage 2-4 commands follow]

< ACL: Handle 2048 [1/6] flags 0x00 dlen 16

< ACL Data TX: Handle 2048 flags 0x00 dlen 11       #516 [hci0] 0.124726
      ATT: Read By Group Type Request (0x10) len 6
        Handle range: 0x0001-0xffff
        Attribute group type: Primary Service (0x2800)

> ACL Data RX: Handle 2048 flags 0x02 dlen 42       #523 [hci0] 0.240151
      ATT: Read By Group Type Response (0x11) len 37
        Attribute data length: 6
        Attribute group list: 6 entries
        Handle range: 0x0001-0x0009
        UUID: Generic Access Profile (0x1800)
        Handle range: 0x000a-0x0011
        UUID: Generic Attribute Profile (0x1801)
        Handle range: 0x0012-0x0014
        UUID: Device Information (0x180a)
        Handle range: 0x0015-0x0039
        UUID: Generic Telephony Bearer (0x184c)
        Handle range: 0x003a-0x0059
        UUID: Generic Media Control (0x1849)
        Handle range: 0x005a-0x005c
        UUID: Telephony and Media Audio (0x1855)

< ACL Data TX: Handle 2048 flags 0x00 dlen 11       #525 [hci0] 0.240641
      ATT: Read By Group Type Request (0x10) len 6
        Handle range: 0x005d-0xffff
        Attribute group type: Primary Service (0x2800)

> ACL Data RX: Handle 2048 flags 0x02 dlen 9        #532 [hci0] 0.360069
      ATT: Error Response (0x01) len 4
        Read By Group Type Request (0x10)
        Handle: 0x005d
        Error: Attribute Not Found (0x0a)

فیلد Attribute data length اندازه هر مدخل را در پاسخ مشخص می‌کند. مقدار ۶ به معنی شناسه‌های ۱۶ بیتی UUID است (۲ بایت هندل شروع + ۲ بایت هندل پایان + ۲ بایت UUID). مقدار ۲۰ به معنی شناسه‌های ۱۲۸ بیتی UUID است (۲ + ۲ + ۱۶). اگر سرور دارای هر دو نوع شناسه ۱۶ بیتی و ۱۲۸ بیتی برای سرویس‌ها باشد، آن‌ها در پاسخ‌های جداگانه‌ای بازگردانده می‌شوند زیرا تمام مدخل‌ها در یک پاسخ واحد باید طول یکسانی داشته باشند.

< ACL Data TX: Handle 2048 flags 0x00 dlen 11       #534 [hci0] 0.360752
      ATT: Read By Group Type Request (0x10) len 6
        Handle range: 0x0001-0xffff
        Attribute group type: Secondary Service (0x2801)

< ACL Data TX: Handle 2048 flags 0x00 dlen 11       #540 [hci0] 0.480731
      ATT: Read By Type Request (0x08) len 6
        Handle range: 0x0001-0x005c
        Attribute type: Include (0x2802)

> ACL Data RX: Handle 2048 flags 0x02 dlen 11       #531 [hci0] 0.360063
      ATT: Read By Type Request (0x08) len 6
        Handle range: 0x0008-0x0011
        Attribute type: Characteristic (0x2803)

< ACL Data TX: Handle 2048 flags 0x00 dlen 27       #533 [hci0] 0.360714
      ATT: Read By Type Response (0x09) len 22
        Attribute data length: 7
        Attribute data list: 3 entries
        Handle: 0x0009
        Value[5]: 200a00052a
            Properties: 0x20
              Indicate (0x20)
            Value Handle: 0x000a
            Value UUID: Service Changed (0x2a05)
        Handle: 0x000c
        Value[5]: 0a0d00292b
            Properties: 0x0a
              Read (0x02)
              Write (0x08)
            Value Handle: 0x000d
            Value UUID: Client Supported Features (0x2b29)
        Handle: 0x000e
        Value[5]: 020f002a2b
            Properties: 0x02
              Read (0x02)
            Value Handle: 0x000f
            Value UUID: Database Hash (0x2b2a)

> ACL Data RX: Handle 2048 flags 0x02 dlen 9        #572 [hci0] 1.200228
      ATT: Error Response (0x01) len 4
        Read By Type Request (0x08)
        Handle: 0x005c
        Error: Attribute Not Found (0x0a)

> ACL Data RX: Handle 2048 flags 0x02 dlen 9        #556 [hci0] 0.959965
      ATT: Find Information Request (0x04) len 4
        Handle range: 0x000b-0x000b

< ACL Data TX: Handle 2048 flags 0x00 dlen 10       #561 [hci0] 0.961049
      ATT: Find Information Response (0x05) len 5
        Format: UUID-16 (0x01)
        Handle: 0x000b
        UUID: Client Characteristic Configuration (0x2902)

> ACL Data RX: Handle 2048 flags 0x02 dlen 7        #577 [hci0] 1.380203
      ATT: Read Request (0x0a) len 2
        Handle: 0x000f
< ACL Data TX: Handle 2048 flags 0x00 dlen 21       #579 [hci0] 1.380774
      ATT: Read Response (0x0b) len 16
        Value[16]: a470d508da8751a2a50b79da0250bfda

> ACL Data RX: Handle 2048 flags 0x02 dlen 13       #513 [hci0] 0.124195
      ATT: Find By Type Value Request (0x06) len 8
        Handle range: 0x0001-0xffff
        Attribute type: Primary Service (0x2800)
          UUID: Generic Attribute Profile (0x1801)
< ACL Data TX: Handle 2048 flags 0x00 dlen 9        #515 [hci0] 0.124684
      ATT: Find By Type Value Response (0x07) len 4
        Handle range: 0x0008-0x0011

< ACL Data TX: Handle 2048 flags 0x00 dlen 9        #524 [hci0] 0.240607
      ATT: Error Response (0x01) len 4
        Find By Type Value Request (0x06)
        Handle: 0x0012
        Error: Attribute Not Found (0x0a)

> ACL Data RX: Handle 2048 flags 0x02 dlen 11       #584 [hci0] 1.512006
      ATT: Read By Group Type Request (0x10) len 6
        Handle range: 0x0001-0xffff
        Attribute group type: Primary Service (0x2800)
< ACL Data TX: Handle 2048 flags 0x00 dlen 66       #586 [hci0] 1.518778
      ATT: Read By Group Type Response (0x11) len 61
        Attribute data length: 6
        Attribute group list: 10 entries
        Handle range: 0x0001-0x0007
        UUID: Generic Access Profile (0x1800)
        Handle range: 0x0008-0x0011
        UUID: Generic Attribute Profile (0x1801)
        Handle range: 0x0012-0x0014
        UUID: Device Information (0x180a)
        Handle range: 0x0015-0x001e
        UUID: Coordinated Set Identification (0x1846)
        Handle range: 0x001f-0x0020
        UUID: Common Audio (0x1853)
        Handle range: 0x0021-0x0024
        UUID: Microphone Control (0x184d)
        Handle range: 0x0041-0x004b
        UUID: Volume Control (0x1844)
        Handle range: 0x006b-0x0073
        UUID: Broadcast Audio Scan (0x184f)
        Handle range: 0x0074-0x0086
        UUID: Published Audio Capabilities (0x1850)
        Handle range: 0x0087-0x0096
        UUID: Audio Stream Control (0x184e)

Handle Range    UUID                            Service Name
──────────────  ──────────────────────────────  ────────────────────────────
0x0001-0x0009   0x1800                          Generic Access Profile
0x000a-0x0011   0x1801                          Generic Attribute Profile
0x0012-0x0014   0x180a                          Device Information
0x0015-0x0039   0x184c                          Generic Telephony Bearer
0x003a-0x0059   0x1849                          Generic Media Control
0x005a-0x005c   0x1855                          Telephony and Media Audio

Handle  Value Handle  Properties  UUID    Name
──────  ────────────  ──────────  ──────  ────────────────────────────────
0x0002  0x0003        Read        0x2a00  Device Name
0x0004  0x0005        Read        0x2a01  Appearance
0x0006  0x0007        Read        0x2a04  Peripheral Preferred Conn Params
0x0008  0x0009        Read        0x2aa6  Central Address Resolution

Handle  Value Handle  Properties       UUID    Name
──────  ────────────  ───────────────  ──────  ────────────────────────────
0x000b  0x000c        Indicate         0x2a05  Service Changed
0x000e  0x000f        Read, Write      0x2b29  Client Supported Features
0x0010  0x0011        Read             0x2b2a  Database Hash

Handle  UUID    Name
──────  ──────  ────────────────────────────────────
0x000d  0x2902  Client Characteristic Configuration

> ACL Data RX: Handle 2048 flags 0x02 dlen 11       #497 [hci0] 0.026107
      SMP: Pairing Request (0x01) len 6
        IO capability: NoInputNoOutput (0x03)
        OOB data: Authentication data not present (0x00)
        Authentication requirement: Bonding, MITM, SC, CT2 (0x2d)
        Max encryption key size: 16
        Initiator key distribution: IdKey Sign (0x06)
        Responder key distribution: IdKey Sign (0x06)
< ACL Data TX: Handle 2048 flags 0x00 dlen 11       #499 [hci0] 0.026894
      SMP: Pairing Response (0x02) len 6
        IO capability: KeyboardDisplay (0x04)
        OOB data: Authentication data not present (0x00)
        Authentication requirement: Bonding, SC, CT2 (0x29)
        Max encryption key size: 16
        Initiator key distribution: IdKey (0x02)
        Responder key distribution: IdKey (0x02)

> ACL Data RX: Handle 2048 flags 0x02 dlen 69       #501 [hci0] 0.098224
      SMP: Pairing Public Key (0x0c) len 64
        X: 1a2b3c4d...
        Y: 5e6f7a8b...
< ACL Data TX: Handle 2048 flags 0x00 dlen 69       #503 [hci0] 0.148556
      SMP: Pairing Public Key (0x0c) len 64
        X: 9c8d7e6f...
        Y: 0a1b2c3d...
< ACL Data TX: Handle 2048 flags 0x00 dlen 21       #505 [hci0] 0.149003
      SMP: Pairing Confirm (0x03) len 16
        Confirm value: a1b2c3d4e5f6...
> ACL Data RX: Handle 2048 flags 0x02 dlen 21       #507 [hci0] 0.212884
      SMP: Pairing Random (0x04) len 16
        Random value: 1122334455...
< ACL Data TX: Handle 2048 flags 0x00 dlen 21       #509 [hci0] 0.213100
      SMP: Pairing Random (0x04) len 16
        Random value: 6677889900...
> ACL Data RX: Handle 2048 flags 0x02 dlen 21       #511 [hci0] 0.278003
      SMP: Pairing DHKey Check (0x0d) len 16
        E: aabbccddee...
< ACL Data TX: Handle 2048 flags 0x00 dlen 21       #513 [hci0] 0.278450
      SMP: Pairing DHKey Check (0x0d) len 16
        E: ffeeddccbb...

< HCI Command: LE Start Encryption (0x08|0x0019) plen 28  #515 [hci0] 0.279002
> HCI Event: Encryption Change (0x08) plen 4              #517 [hci0] 0.342556
      Status: Success (0x00)
      Handle: 2048
      Encryption: Enabled with AES-CCM (0x01)

< ACL Data TX: Handle 2048 flags 0x00 dlen 21       #501 [hci0] 0.098224
      SMP: Pairing Confirm (0x03) len 16
        Confirm value: ...
> ACL Data RX: Handle 2048 flags 0x02 dlen 21       #503 [hci0] 0.162556
      SMP: Pairing Confirm (0x03) len 16
        Confirm value: ...
< ACL Data TX: Handle 2048 flags 0x00 dlen 21       #505 [hci0] 0.163003
      SMP: Pairing Random (0x04) len 16
        Random value: ...
> ACL Data RX: Handle 2048 flags 0x02 dlen 21       #507 [hci0] 0.228884
      SMP: Pairing Random (0x04) len 16
        Random value: ...

> ACL Data RX: Handle 2048 flags 0x02 dlen 21       #519 [hci0] 0.343002
      SMP: Identity Information (0x08) len 16
        Identity resolving key: 00112233445566778899aabbccddeeff
> ACL Data RX: Handle 2048 flags 0x02 dlen 12       #521 [hci0] 0.343556
      SMP: Identity Address Information (0x09) len 7
        Address type: Public (0x00)
        Address: 00:11:22:33:44:55

> ACL Data RX: Handle 2048 flags 0x02 dlen 21       #519 [hci0] 0.343002
      SMP: Encryption Information (0x06) len 16
        Long term key: 00112233...
> ACL Data RX: Handle 2048 flags 0x02 dlen 15       #521 [hci0] 0.343556
      SMP: Central Identification (0x07) len 10
        EDIV: 0x1234
        Rand: 0x0123456789abcdef

> ACL Data RX: Handle 2048 flags 0x02 dlen 6        #505 [hci0] 0.213002
      SMP: Pairing Failed (0x05) len 1
        Reason: Authentication requirements (0x03)

grep -n "Pairing Request\|Pairing Response\|Pairing Failed\|Pairing Public Key\|DHKey Check" output.txt

grep -n "Pairing Failed" output.txt

grep -n "Encryption Change\|Encryption:" output.txt

< ACL Data TX: Handle 2048 flags 0x00 dlen 7    #494 [hci0] 0.004488
      ATT: Exchange MTU Request (0x02) len 2
        Client RX MTU: 517

> ACL Data RX: Handle 256 flags 0x02 dlen 16    #142 [hci0] 2.034556
      L2CAP: Connection Request (0x02) ident 3 len 4
        PSM: 25 (0x0019)
        Source CID: 0x0040
< ACL Data TX: Handle 256 flags 0x00 dlen 20    #144 [hci0] 2.035002
      L2CAP: Connection Response (0x03) ident 3 len 8
        Destination CID: 0x0041
        Source CID: 0x0040
        Result: Connection successful (0x0000)
        Status: No further information available (0x0000)

> ACL Data RX: Handle 256 flags 0x02 dlen 20    #146 [hci0] 2.035556
      L2CAP: Configure Request (0x04) ident 4 len 8
        Destination CID: 0x0041
        Flags: 0x0000
        Option: MTU (0x01) [2]
          MTU: 1024
< ACL Data TX: Handle 256 flags 0x00 dlen 18    #148 [hci0] 2.036003
      L2CAP: Configure Response (0x05) ident 4 len 6
        Source CID: 0x0040
        Flags: 0x0000
        Result: Success (0x0000)

< ACL Data TX: Handle 2048 flags 0x00 dlen 18   #600 [hci0] 1.824003
      LE L2CAP: LE Connection Request (0x14) ident 1 len 10
        PSM: 39 (0x0027)
        Source CID: 0x0040
        MTU: 517
        MPS: 251
        Credits: 10
> ACL Data RX: Handle 2048 flags 0x02 dlen 18   #602 [hci0] 1.886556
      LE L2CAP: LE Connection Response (0x15) ident 1 len 10
        Destination CID: 0x0041
        MTU: 517
        MPS: 251
        Credits: 10
        Result: Connection successful (0x0000)

< ACL Data TX: Handle 2048 flags 0x00 dlen 16   #493 [hci0] 0.003915
      LE L2CAP: Connection Parameter Update Request (0x12) ident 1 len 8
        Min interval: 24
        Max interval: 40
        Peripheral latency: 0
        Timeout multiplier: 256
> ACL Data RX: Handle 2048 flags 0x02 dlen 10   #495 [hci0] 0.066003
      LE L2CAP: Connection Parameter Update Response (0x13) ident 1 len 2
        Result: Connection Parameters accepted (0x0000)

grep -n "Connection Request\|Connection Response\|LE Connection Request\|LE Connection Response" output.txt

grep -n "PSM:" output.txt

grep -n "Parameter Update Request\|Parameter Update Response\|Parameters rejected" output.txt

grep -n "PSM: 39\|Enhanced Credit" output.txt

Found TX L2CAP channel with CID 64
      PSM 128 (0x0080)
      Mode: LE Credit
      MTU: 672
      MPS: 490
      TX packets: 29120/29114
      TX Latency: 1-79 msec (~29 msec)
      TX size: 494-494 octets (~494 octets)
      TX speed: ~571 Kb/s

btmon -a trace.btsnoop 2>/dev/null | grep -E "speed:|Mode:|MTU:|MPS:|PSM"

< ACL Data TX: Handle 2048 flags 0x00 dlen 7    #550 [hci0] 0.824003
      ATT: Read Request (0x0a) len 2
        Handle: 0x0075
> ACL Data RX: Handle 2048 flags 0x02 dlen 30   #552 [hci0] 0.886556
      ATT: Read Response (0x0b) len 25
        Handle: 0x0075
          Number of PAC(s): 1
          Codec: LC3 (0x06)
          Codec Specific Capabilities: #0
            Sampling Frequency: 8000 Hz 16000 Hz 24000 Hz 32000 Hz 48000 Hz
            Frame Duration: 7.5 ms 10 ms
            Audio Channel Counts: 1
            Frame Length: 26 - 240

> ACL Data RX: Handle 2048 flags 0x02 dlen 9    #554 [hci0] 0.948003
      ATT: Read Response (0x0b) len 4
        Handle: 0x0077
          Location: Front Left

> ACL Data RX: Handle 2048 flags 0x02 dlen 9    #558 [hci0] 1.012556
      ATT: Read Response (0x0b) len 4
        Handle: 0x007b
          Sink Context: Media Conversational
          Source Context: Unspecified

Idle ──► Codec Configured ──► QoS Configured ──► Enabling ──► Streaming
                                                                  │
Idle ◄── Releasing ◄──────── Disabling ◄─────────────────────────┘

> ACL Data RX: Handle 2048 flags 0x02 dlen 20   #580 [hci0] 1.456003
      ATT: Handle Value Notification (0x1b) len 15
        Handle: 0x0088
          ASE ID: 0x01
          State: Codec Configured (0x01)
            Framing: Unframed PDUs supported (0x00)
            PHY: 0x02
              LE 2M PHY (0x02)
            RTN: 2
            Max Transport Latency: 10
            Presentation Delay Min: 20000 us
            Presentation Delay Max: 40000 us
            Preferred Presentation Delay Min: 20000 us
            Preferred Presentation Delay Max: 40000 us
            Codec: LC3 (0x06)
              Sampling Frequency: 48000 Hz
              Frame Duration: 10 ms
              Audio Channel Allocation: Front Left
              Frame Length: 120

< ACL Data TX: Handle 2048 flags 0x00 dlen 25   #582 [hci0] 1.518003
      ATT: Write Request (0x12) len 20
        Handle: 0x008b
          ASE Control Point: Config Codec (0x01)
            ASE ID: 0x01
            Target Latency: Low Latency (0x01)
            PHY: LE 2M PHY
            Codec: LC3 (0x06)
              Sampling Frequency: 48000 Hz
              Frame Duration: 10 ms
              Audio Channel Allocation: Front Left
              Frame Length: 120

Config Codec  ASE ID=1 (Sink)    → Codec Configured
Config Codec  ASE ID=3 (Source)  → Codec Configured
Config QoS    ASE ID=1           → QoS Configured (CIG=X, CIS=Y)
Config QoS    ASE ID=3           → QoS Configured (CIG=X, CIS=Y)
Enable        ASE ID=1           → Enabling → Streaming (immediate)
Enable        ASE ID=3           → Enabling
CIS Established (Success)
Setup ISO Data Path  Input  (Host→Controller, for Sink)
Setup ISO Data Path  Output (Controller→Host, for Source)
Receiver Start Ready ASE ID=3   → Streaming

این یک رفتار عادی است. مشاهده یک ASE از نوع Source و یک ASE از نوع Sink روی یک اتصال، پیکربندی استاندارد دوطرفه (مکالمه‌ای) است. این وضعیت یک خطا یا پیکربندی نادرست نیست. اشتراک‌گذاری یک CIS واحد میان هر دو جهت، بهینه و مورد انتظار است.

< HCI Command: LE Set CIG Parameters (0x08|0x0062) plen 26  #590 [hci0] 1.624003
      CIG ID: 0x00
      Central to Peripheral SDU Interval: 10000 us
      Peripheral to Central SDU Interval: 10000 us
      SCA: 0x00
      Packing: Sequential (0x00)
      Framing: Unframed (0x00)
      Central to Peripheral Max Latency: 10 ms
      Peripheral to Central Max Latency: 10 ms
      Number of CIS: 1
      CIS ID: 0x00
      Central to Peripheral Max SDU: 120
      Peripheral to Central Max SDU: 0
      Central to Peripheral PHY: LE 2M PHY
      Peripheral to Central PHY: LE 2M PHY
      Central to Peripheral RTN: 2
      Peripheral to Central RTN: 2
> HCI Event: Command Complete (0x0e) plen 8              #592 [hci0] 1.624556
      LE Set CIG Parameters (0x08|0x0062) ncmd 1
        Status: Success (0x00)
        CIG ID: 0x00
        Number of Handles: 1
        Connection Handle: 2064

< HCI Command: LE Create CIS (0x08|0x0064) plen 9       #594 [hci0] 1.688003
      Number of CIS: 1
      CIS Handle: 2064
      ACL Handle: 2048
> HCI Event: LE Meta Event (0x3e) plen 29                #596 [hci0] 1.756556
      LE CIS Established (0x19)
        Status: Success (0x00)
        Connection Handle: 2064
        CIG Sync Delay: 5000 us
        CIS Sync Delay: 5000 us
        Central to Peripheral Latency: 10000 us
        Peripheral to Central Latency: 10000 us
        Central to Peripheral PHY: LE 2M PHY
        Peripheral to Central PHY: LE 2M PHY
        NSE: 3
        Central to Peripheral BN: 1
        Peripheral to Central BN: 0
        Central to Peripheral FT: 2
        Peripheral to Central FT: 2
        Max PDU C to P: 120
        Max PDU P to C: 0
        ISO Interval: 10.00 msec (0x0008)

< HCI Command: LE Setup ISO Data Path (0x08|0x006e) plen 13  #598 [hci0] 1.820003
      Handle: 2064
      Data Path Direction: Input (Host to Controller) (0x00)
      Data Path ID: HCI (0x00)
      Coding Format: LC3 (0x06)
      Company ID: 0x0000
      Vendor Codec ID: 0x0000
      Controller Delay: 0 us

< ISO Data TS: Handle 2064 flags 0x02 dlen 124  #600 [hci0] 1.884003

> HCI Event: LE Meta Event (0x3e) plen 80                #200 [hci0] 0.500003
      LE Periodic Advertising Report (0x0f)
        ...
        Service Data: Basic Audio Announcement (0x1851)
          Presentation Delay: 40000 us
          Number of Subgroups: 1
            Number of BIS: 2
            Codec: LC3 (0x06)
              Sampling Frequency: 48000 Hz
              Frame Duration: 10 ms
              Frame Length: 120
            BIS #1
              Audio Channel Allocation: Front Left
            BIS #2
              Audio Channel Allocation: Front Right

< HCI Command: LE Create BIG (0x08|0x0068) plen 31      #210 [hci0] 0.600003
      BIG Handle: 0x00
      Advertising Handle: 0x01
      Number of BIS: 2
      SDU Interval: 10000 us
      Max SDU: 120
      Max Latency: 10 ms
      RTN: 2
      PHY: LE 2M PHY
      Packing: Sequential (0x00)
      Framing: Unframed (0x00)
      Encryption: Unencrypted (0x00)

< HCI Command: LE BIG Create Sync (0x08|0x006b) plen 15  #220 [hci0] 0.700003
      BIG Handle: 0x00
      Sync Handle: 0x0001
      Encryption: Unencrypted (0x00)
      Number of BIS: 2
      BIS: 0x01
      BIS: 0x02

< HCI Command: LE Periodic Advertising Create Sync (0x08|0x0044) plen 14  #100 [hci0] 0.100003
      Options: 0x0000
      SID: 0x01
      Adv Address Type: Public (0x00)
      Adv Address: XX:XX:XX:XX:XX:XX
      Skip: 0x0000
      Sync Timeout: 2000 msec (0x00c8)
      Sync CTE Type: 0x0000

> HCI Event: LE Meta Event (0x3e) plen 16                 #105 [hci0] 0.150003
      LE Periodic Advertising Sync Established (0x0e)
        Status: Success (0x00)
        Sync Handle: 0x0001
        Advertising SID: 0x01
        Advertiser Address Type: Public (0x00)
        Advertiser Address: XX:XX:XX:XX:XX:XX
        Advertiser PHY: LE 2M PHY (0x02)
        Periodic Advertising Interval: 10.000 msec (0x0008)
        Advertiser Clock Accuracy: 0x05

> HCI Event: LE Meta Event (0x3e) plen 80                 #110 [hci0] 0.200003
      LE Periodic Advertising Report (0x0f)
        Sync Handle: 0x0001
        ...
        Service Data: Basic Audio Announcement (0x1851)

> HCI Event: LE Meta Event (0x3e) plen 24                 #120 [hci0] 0.300003
      LE BIG Info Advertising Report (0x22)
        Sync Handle: 0x0001
        Number BIS: 2
        NSE: 4
        ISO Interval: 10.000 msec (0x0008)
        BN: 2
        PTO: 1
        IRC: 2
        Maximum PDU: 120
        SDU Interval: 10000 us
        Maximum SDU: 120
        PHY: LE 2M PHY (0x02)
        Framing: Unframed (0x00)
        Encryption: 0x00

< HCI Command: LE BIG Create Sync (0x08|0x006b) plen 15  #130 [hci0] 0.400003
      BIG Handle: 0x00
      BIG Sync Handle: 0x0001
      Encryption: Unencrypted (0x00)
      Broadcast Code: 00000000000000000000000000000000
      Maximum Number Subevents: 0x00
      Timeout: 2000 ms (0x00c8)
      Number of BIS: 2
      BIS: 0x01
      BIS: 0x02

> HCI Event: LE Meta Event (0x3e) plen 20                 #135 [hci0] 0.450003
      LE BIG Sync Established (0x1d)
        Status: Success (0x00)
        BIG Handle: 0x00
        Transport Latency: 10000 us
        NSE: 4
        BN: 2
        PTO: 1
        IRC: 2
        Maximum PDU: 120
        ISO Interval: 10.000 msec (0x0008)
        Connection Handle: 0x0010
        Connection Handle: 0x0011

< HCI Command: LE Setup ISO Data Path (0x08|0x006e) plen 13  #140 [hci0] 0.500003
      Connection Handle: 0x0010
      Data Path Direction: Output (Controller to Host) (0x01)
      Data Path ID: HCI (0x00)
< HCI Command: LE Setup ISO Data Path (0x08|0x006e) plen 13  #145 [hci0] 0.550003
      Connection Handle: 0x0011
      Data Path Direction: Output (Controller to Host) (0x01)
      Data Path ID: HCI (0x00)

> ISO Data: Handle 0x0010 flags 0x02 dlen 124             #150 [hci0] 0.600003
> ISO Data: Handle 0x0011 flags 0x02 dlen 124             #151 [hci0] 0.600003

< ACL Data TX: Handle 64 flags 0x00 dlen 27               #300 [hci0] 1.000003
      ATT: Write Command (0x52) len 22
        Handle: 0x0025
          Data: 04...
          Opcode: Add Source (0x04)
            Advertiser Address Type: Public (0x00)
            Advertiser Address: XX:XX:XX:XX:XX:XX
            Advertising SID: 0x01
            PA Sync: Synchronize to PA - PAST (0x01)
            PA Interval: 0x0008
            Number of Subgroups: 1
              BIS Sync: 0x00000003
              Metadata Length: 0

< HCI Command: LE Periodic Advertising Sync Transfer Parameters (0x08|0x005c) plen 8  #310 [hci0] 1.100003
      Connection handle: 64
      Mode: Enabled with report events enabled (0x02)
      Skip: 0x00
      Sync timeout: 2000 msec (0x00c8)
      Sync CTE Type: 0x0000

< HCI Command: LE Periodic Advertising Sync Transfer (0x08|0x005a) plen 6  #320 [hci0] 1.200003
      Connection handle: 64
      Service data: 0x0001
      Sync handle: 1

> HCI Event: LE Meta Event (0x3e) plen 19                 #325 [hci0] 1.250003
      LE Periodic Advertising Sync Transfer Received (0x18)
        Status: Success (0x00)
        Handle: 64
        Connection handle: 64
        Service data: 0x0001
        Sync handle: 1
        SID: 0x01
        Address type: Public (0x00)
        Address: XX:XX:XX:XX:XX:XX
        PHY: LE 2M PHY (0x02)
        Periodic advertising Interval: 10.000
        Clock Accuracy: 0x05

شرایط رقابتی (Race condition): دستور PAST Parameters باید پیش از ارسال PAST Transfer توسط دستیار فرستاده شود. در BlueZ، وضعیت همگام‌سازی PA در BASS پس از تکمیل کاوش تنظیم می‌شود تا از ارسال PAST توسط دستگاه راه دور پیش از آنکه هسته پارامترهای PAST را در سطح HCI فعال کند، جلوگیری شود.

< HCI Command: LE BIG Terminate Sync (0x08|0x006c) plen 1  #500 [hci0] 5.000003
      BIG Handle: 0x00
> HCI Event: Command Complete (0x0e) plen 5               #501 [hci0] 5.001003
      LE BIG Terminate Sync (0x08|0x006c) ncmd 1
        Status: Success (0x00)
        BIG Handle: 0x00

> HCI Event: LE Meta Event (0x3e) plen 2                  #510 [hci0] 6.000003
      LE BIG Sync Lost (0x1e)
        BIG Handle: 0x00
        Reason: Connection Terminated By Local Host (0x16)

< HCI Command: LE Terminate BIG (0x08|0x006a) plen 2      #520 [hci0] 7.000003
      BIG Handle: 0x00
      Reason: Connection Terminated By Local Host (0x16)
> HCI Event: LE Meta Event (0x3e) plen 2                  #521 [hci0] 7.001003
      LE BIG Terminate (0x1c)
        BIG Handle: 0x00
        Reason: Connection Terminated By Local Host (0x16)

grep -n "ASE Control Point\|ASE ID\|State:.*Codec Configured\|State:.*QoS Configured\|State:.*Enabling\|State:.*Streaming\|State:.*Releasing" output.txt

grep -n "ASE ID:" output.txt

grep -n "Codec: LC3\|Sampling Frequency:\|Frame Duration:\|Frame Length:\|Audio Channel" output.txt

grep -n "Set CIG Parameters\|Create CIS\|CIS Established\|Setup ISO Data Path" output.txt

grep -n "CIS Established" output.txt

grep -n "Basic Audio Announcement\|Create BIG\|BIG Complete\|BIG Create Sync\|BIG Sync\|BIG Info\|BIG Terminate\|BIG Sync Lost" output.txt

grep -n "Periodic Advertising Create Sync\|Periodic Advertising Sync Established\|BIG Info Advertising Report\|BIG Create Sync\|BIG Sync Established\|BIG Sync Lost\|BIG Terminate" output.txt

grep -n "Sync Transfer Parameters\|Sync Transfer (0x08\|PAST Received\|PA Sync:.*PAST\|Add Source" output.txt

grep -n "BIG Info Advertising Report" output.txt

< HCI Command: LE CS Read Local Supported Capabilities (0x08|0x0089) plen 0  #100 [hci0]
> HCI Event: Command Complete (0x0e) plen 42                 #101 [hci0]
      LE CS Read Local Supported Capabilities (0x08|0x0089) ncmd 1
        Status: Success (0x00)
        Num Config Supported: 4
        Max Consecutive Procedures Supported: 255
        Num Antennas Supported: 2
        Max Antenna Paths Supported: 4
        Roles Supported: 0x03
          Initiator
          Reflector
        Modes Supported: 0x03
        RTT Capability: 0x03
        RTT AA Only N: 10
        RTT Sounding N: 10
        RTT Random Payload N: 10
        CS Sync PHYs Supported: 0x02
          LE 2M
        T_IP1 Times Supported: 0x0005
          10 us
          30 us
        T_IP2 Times Supported: 0x0005
          10 us
          30 us
        T_FCS Times Supported: 0x0009
          15 us
          50 us
        T_PM Times Supported: 0x0003
          10 us
          20 us

< HCI Command: LE CS Read Remote Supported Capabilities (0x08|0x008a) plen 2  #110 [hci0]
      Handle: 2048
> HCI Event: Command Status (0x0f) plen 4                   #111 [hci0]
      LE CS Read Remote Supported Capabilities (0x08|0x008a) ncmd 1
        Status: Success (0x00)
> HCI Event: LE Meta Event (0x3e) plen 42                   #115 [hci0]
      LE CS Read Remote Supported Capabilities Complete (0x2c)
        Status: Success (0x00)
        Handle: 2048
        Num Config Supported: 4
        Max Consecutive Procedures Supported: 128
        Num Antennas Supported: 1
        Max Antenna Paths Supported: 1
        Roles Supported: 0x03
          Initiator
          Reflector
        Modes Supported: 0x03
        ...

< HCI Command: LE CS Security Enable (0x08|0x008c) plen 2   #120 [hci0]
      Handle: 2048
> HCI Event: Command Status (0x0f) plen 4                   #121 [hci0]
      LE CS Security Enable (0x08|0x008c) ncmd 1
        Status: Success (0x00)
> HCI Event: LE Meta Event (0x3e) plen 3                    #125 [hci0]
      LE CS Security Enable Complete (0x2e)
        Status: Success (0x00)
        Handle: 2048

< HCI Command: LE CS Set Default Settings (0x08|0x008d) plen 5  #130 [hci0]
      Handle: 2048
      Role Enable: 0x03
        Initiator
        Reflector
      CS Sync Antenna Selection: 0x01
      Max TX Power: 20
> HCI Event: Command Complete (0x0e) plen 5                 #131 [hci0]
      LE CS Set Default Settings (0x08|0x008d) ncmd 1
        Status: Success (0x00)
        Handle: 2048

< HCI Command: LE CS Read Remote FAE Table (0x08|0x008e) plen 2  #135 [hci0]
      Handle: 2048
> HCI Event: Command Status (0x0f) plen 4                   #136 [hci0]
      LE CS Read Remote FAE Table (0x08|0x008e) ncmd 1
        Status: Success (0x00)
> HCI Event: LE Meta Event (0x3e) plen 75                   #140 [hci0]
      LE CS Read Remote FAE Table Complete (0x2d)
        Status: Success (0x00)
        Handle: 2048

< HCI Command: LE CS Create Config (0x08|0x0090) plen 20    #150 [hci0]
      Handle: 2048
      Config ID: 0
      Create Context: 0x00
      Main Mode Type: 0x01
      Sub Mode Type: 0xff
      Min Main Mode Steps: 2
      Max Main Mode Steps: 5
      Main Mode Repetition: 0
      Mode 0 Steps: 3
      Role: Initiator (0x00)
      RTT Type: 0x01
      CS Sync PHY: LE 2M (0x01)
      Channel Map: ffffffffff7f0000000000000000
      Channel Map Repetition: 1
      Channel Selection Type: 0x00
      Ch3c Shape: 0x00
      Ch3c Jump: 0x00
> HCI Event: Command Status (0x0f) plen 4                   #151 [hci0]
      LE CS Create Config (0x08|0x0090) ncmd 1
        Status: Success (0x00)
> HCI Event: LE Meta Event (0x3e) plen 30                   #155 [hci0]
      LE CS Config Complete (0x2f)
        Status: Success (0x00)
        Handle: 2048
        Config ID: 0
        Action: 0x00
        Main Mode Type: 0x01
        Sub Mode Type: 0xff
        Min Main Mode Steps: 2
        Max Main Mode Steps: 5
        Main Mode Repetition: 0
        Mode 0 Steps: 3
        Role: Initiator (0x00)
        RTT Type: 0x01
        CS Sync PHY: LE 2M (0x01)
        Channel Map: ffffffffff7f0000000000000000
        Channel Map Repetition: 1
        Channel Selection Type: 0x00
        Ch3c Shape: 0x00
        Ch3c Jump: 0x00
        T_IP1 Time: 30 us
        T_IP2 Time: 30 us
        T_FCS Time: 50 us
        T_PM Time: 10 us

< HCI Command: LE CS Remove Config (0x08|0x0091) plen 3     #160 [hci0]
      Handle: 2048
      Config ID: 0
> HCI Event: Command Status (0x0f) plen 4                   #161 [hci0]
      LE CS Remove Config (0x08|0x0091) ncmd 1
        Status: Success (0x00)

< HCI Command: LE CS Set Procedure Parameters (0x08|0x0093) plen 16  #170 [hci0]
      Handle: 2048
      Config ID: 0
      Max Procedure Len: 200
      Min Procedure Interval: 10
      Max Procedure Interval: 20
      Max Procedure Count: 0
      Min Subevent Len: 5000 us
      Max Subevent Len: 10000 us
      Tone Antenna Config Selection: 0x01
      PHY: LE 2M (0x02)
      TX Power Delta: 0
      Preferred Peer Antenna: 0x01
      SNR Control Initiator: 0x00
      SNR Control Reflector: 0x00
> HCI Event: Command Complete (0x0e) plen 5                 #171 [hci0]
      LE CS Set Procedure Parameters (0x08|0x0093) ncmd 1
        Status: Success (0x00)
        Handle: 2048

< HCI Command: LE CS Procedure Enable (0x08|0x0094) plen 4  #180 [hci0]
      Handle: 2048
      Config ID: 0
      Enable: 0x01
> HCI Event: Command Status (0x0f) plen 4                   #181 [hci0]
      LE CS Procedure Enable (0x08|0x0094) ncmd 1
        Status: Success (0x00)
> HCI Event: LE Meta Event (0x3e) plen 20                   #185 [hci0]
      LE CS Procedure Enable Complete (0x30)
        Status: Success (0x00)
        Handle: 2048
        Config ID: 0
        State: 0x01
        Tone Antenna Config Selection: 0x01
        Selected TX Power: 12
        Subevent Len: 5000 us
        Subevents Per Event: 2
        Subevent Interval: 3750
        Event Interval: 10
        Procedure Interval: 10
        Procedure Count: 100
        Max Procedure Len: 200

< HCI Command: LE CS Procedure Enable (0x08|0x0094) plen 4  #300 [hci0]
      Handle: 2048
      Config ID: 0
      Enable: 0x00
> HCI Event: Command Status (0x0f) plen 4                   #301 [hci0]
      LE CS Procedure Enable (0x08|0x0094) ncmd 1
        Status: Success (0x00)
> HCI Event: LE Meta Event (0x3e) plen 20                   #305 [hci0]
      LE CS Procedure Enable Complete (0x30)
        Status: Success (0x00)
        Handle: 2048
        Config ID: 0
        State: 0x00
        ...

< HCI Command: LE CS Set Channel Classification (0x08|0x0092) plen 10  #145 [hci0]
      Channel Map: ffffffffff7f0000000000
> HCI Event: Command Complete (0x0e) plen 1                 #146 [hci0]
      LE CS Set Channel Classification (0x08|0x0092) ncmd 1
        Status: Success (0x00)

> HCI Event: LE Meta Event (0x3e) plen 50                   #200 [hci0]
      LE CS Subevent Result (0x31)
        Handle: 2048
        Config ID: 0
        Start ACL Conn Event Counter: 1200
        Procedure Counter: 0
        Frequency Compensation: 0x0000
        Reference Power Level: -20
        Procedure Done Status: Partial results (0x01)
        Subevent Done Status: All results complete (0x00)
        Abort Reason: 0x00
        Num Antenna Paths: 1
        Num Steps Reported: 8
        Step Data:
          Mode: 0  Channel: 10  Length: 5
            Packet Quality: 0x00
            Packet RSSI: -45
            Packet Antenna: 0
            Measured Freq Offset: 150
          Mode: 1  Channel: 20  Length: 6
            Packet Quality: 0x00
            Packet NADM: Attack is extremely unlikely (0x00)
            Packet RSSI: -42
            ToA/ToD: 1234
            Packet Antenna: 0
          Mode: 2  Channel: 30  Length: 5
            Antenna Permutation Index: 0
              PCT[0]: I=1024, Q=-512
              Tone Quality: High (0x00)
          ...

> HCI Event: LE Meta Event (0x3e) plen 40                   #202 [hci0]
      LE CS Subevent Result Continue (0x32)
        Handle: 2048
        Config ID: 0
        Procedure Done Status: Partial results (0x01)
        Subevent Done Status: All results complete (0x00)
        Abort Reason: 0x00
        Num Antenna Paths: 1
        Num Steps Reported: 4
        Step Data:
          ...

• 0x00 = حمله به‌شدت غیرمحتمل است
• 0x01 = حمله بسیار نامحتمل است
• 0x02 = حمله غیرمحتمل است
• 0x03 = احتمال وقوع حمله وجود دارد
• 0x04 = حمله محتمل است
• 0x05 = حمله بسیار محتمل است
• 0x06 = حمله به‌شدت محتمل است
• 0xff = نامشخص

• 0x00 = کیفیت بالا
• 0x01 = کیفیت متوسط
• 0x02 = کیفیت پایین
• 0x03 = در دسترس نیست

• 0x00 = شکاف افزونه تن نیست
• 0x01 = شکاف افزونه تن است، تنی مورد انتظار نیست
• 0x02 = شکاف افزونه تن است، تن مورد انتظار است

┌──────────┐
│   IDLE   │
└────┬─────┘
     │ LE CS Read Local/Remote Supported Capabilities
     │ LE CS Security Enable Complete
     │ LE CS Set Default Settings
     ▼
┌──────────────────┐
│ CAPABILITIES     │  Both devices' CS parameters are known.
│ EXCHANGED        │  Security is established.
└────┬─────────────┘
     │ LE CS Create Config
     │ ──► LE CS Config Complete (status=0x00)
     ▼
┌──────────────────┐
│ CONFIGURED       │  Config ID N exists with negotiated params.
│ (config_id=N)    │  Can create up to 4 configs simultaneously.
└────┬─────────────┘
     │ LE CS Set Procedure Parameters
     ▼
┌──────────────────┐
│ PARAMETERS SET   │  Scheduling and antenna params are locked.
│ (config_id=N)    │
└────┬─────────────┘
     │ LE CS Procedure Enable (enable=1)
     │ ──► LE CS Procedure Enable Complete (state=1)
     ▼
┌──────────────────┐
│ PROCEDURE        │  Controller is actively measuring.
│ RUNNING          │  Subevent Result events stream in.
│ (config_id=N)    │
└────┬─────────────┘
     │ LE CS Procedure Enable (enable=0)
     │ ──► LE CS Procedure Enable Complete (state=0)
     ▼
┌──────────────────┐
│ CONFIGURED       │  Config still exists, can re-enable.
│ (config_id=N)    │
└────┬─────────────┘
     │ LE CS Remove Config
     ▼
┌──────────┐
│   IDLE   │
└──────────┘

 Host ──► Controller                            State
═══════════════════════════════════════════════════════════════
 LE CS Read Local Supported Capabilities        IDLE
   ◄── Command Complete (capabilities)
                                                │
 LE CS Read Remote Supported Capabilities       │
   ◄── Command Status                           │
   ◄── LE CS Read Remote Supp. Cap. Complete    │
                                                │
 LE CS Security Enable                          │
   ◄── Command Status                           │
   ◄── LE CS Security Enable Complete           │
                                                │
 LE CS Set Default Settings                     │
   ◄── Command Complete                         ▼
                                                CAPABILITIES EXCHANGED
 LE CS Read Remote FAE Table        (optional)  │
   ◄── LE CS Read Remote FAE Complete           │
                                                │
 LE CS Set Channel Classification   (optional)  │
   ◄── Command Complete                         │
                                                │
 LE CS Create Config (config_id=0)              │
   ◄── Command Status                           │
   ◄── LE CS Config Complete                    ▼
                                                CONFIGURED (id=0)
 LE CS Set Procedure Parameters (config_id=0)   │
   ◄── Command Complete                         ▼
                                                PARAMETERS SET (id=0)
 LE CS Procedure Enable (id=0, enable=1)        │
   ◄── Command Status                           │
   ◄── LE CS Procedure Enable Complete (state=1)▼
                                                PROCEDURE RUNNING (id=0)
   ◄── LE CS Subevent Result        ┐           │
   ◄── LE CS Subevent Result Cont.  │(repeated) │
   ◄── LE CS Subevent Result        ┘           │
                                                │
 LE CS Procedure Enable (id=0, enable=0)        │
   ◄── Command Status                           │
   ◄── LE CS Procedure Enable Complete (state=0)▼
                                                CONFIGURED (id=0)
 LE CS Remove Config (id=0)         (optional)  │
   ◄── Command Status                           ▼
                                                IDLE

< HCI Command: LE CS Test (0x08|0x0095) plen 34             #400 [hci0]
      Main Mode Type: 0x01
      Sub Mode Type: 0xff
      Main Mode Repetition: 0
      Mode 0 Steps: 3
      Role: Initiator (0x00)
      RTT Type: 0x01
      CS Sync PHY: LE 2M (0x01)
      CS Sync Antenna Selection: 0x01
      Subevent Len: 5000 us
      Subevent Interval: 0
      Max Num Subevents: 1
      Transmit Power Level: 10
      T_IP1 Time: 30 us
      T_IP2 Time: 30 us
      T_FCS Time: 50 us
      T_PM Time: 10 us
      T_SW Time: 0 us
      Tone Antenna Config Selection: 0x01
      SNR Control Initiator: 0x00
      SNR Control Reflector: 0x00
      DRBG Nonce: 0x0000
      Channel Map Repetition: 1
      Override Config: 0x0000
> HCI Event: Command Complete (0x0e) plen 5                 #401 [hci0]
      LE CS Test (0x08|0x0095) ncmd 1
        Status: Success (0x00)

< HCI Command: LE CS Test End (0x08|0x0096) plen 0          #450 [hci0]
> HCI Event: LE Meta Event (0x3e) plen 1                    #451 [hci0]
      LE CS Test End Complete (0x33)
        Status: Success (0x00)

> ACL Data RX: Handle 2048 flags 0x02 dlen 11               #200 [hci0]
      ATT: Read Response (0x0b) len 4
        Handle: 0x0003
          Features: 0x0000000f
            Real-time Ranging Data (0x00000001)
            Retrieve Lost Ranging Data Segments (0x00000002)
            Abort Operation (0x00000004)
            Filter Ranging Data (0x00000008)

> ACL Data RX: Handle 2048 flags 0x02 dlen 9                #250 [hci0]
      ATT: Handle Value Notification (0x1b) len 2
        Handle: 0x000e
          Counter: 42

> ACL Data RX: Handle 2048 flags 0x02 dlen 9                #260 [hci0]
      ATT: Handle Value Notification (0x1b) len 2
        Handle: 0x0011
          Overwritten Count: 38

< ACL Data TX: Handle 2048 flags 0x00 dlen 10               #270 [hci0]
      ATT: Write Command (0x52) len 3
        Handle: 0x000b
          Opcode: Get Ranging Data (0x00)
          Ranging Counter: 0x002a

< ACL Data TX: Handle 2048 flags 0x00 dlen 10               #290 [hci0]
      ATT: Write Command (0x52) len 3
        Handle: 0x000b
          Opcode: ACK Ranging Data (0x01)
          Ranging Counter: 0x002a

< ACL Data TX: Handle 2048 flags 0x00 dlen 12               #295 [hci0]
      ATT: Write Command (0x52) len 5
        Handle: 0x000b
          Opcode: Retrieve Lost Ranging Data Segments (0x02)
          Ranging Counter: 0x002a
          First Segment Index: 3
          Last Segment Index: 5

< ACL Data TX: Handle 2048 flags 0x00 dlen 8                #298 [hci0]
      ATT: Write Command (0x52) len 1
        Handle: 0x000b
          Opcode: Abort Operation (0x03)

< ACL Data TX: Handle 2048 flags 0x00 dlen 10               #265 [hci0]
      ATT: Write Command (0x52) len 3
        Handle: 0x000b
          Opcode: Set Filter (0x04)
          Filter Configuration: 0x0001
            Mode: 1
            Filter Bit Mask: 0x0000

> ACL Data RX: Handle 2048 flags 0x02 dlen 30               #275 [hci0]
      ATT: Handle Value Notification (0x1b) len 25
        Handle: 0x0005
          Segmentation Header: 0x01
            First Segment: True
            Last Segment: False
            Segment Index: 0
          Ranging Data Body:
            Ranging Counter: 0x02a
            Configuration ID: 0
            Selected TX Power: 12 dBm
            Antenna Paths Mask: 0x03
              Antenna Path 1 (0x01)
              Antenna Path 2 (0x02)
            Subevent #0:
              Start ACL Connection Event: 1200
              Frequency Compensation: 150 (0.01 ppm)
              Ranging Done Status: Partial results (0x1)
              Subevent Done Status: All results complete (0x0)
              Ranging Abort Reason: No abort (0x0)
              Subevent Abort Reason: No abort (0x0)
              Reference Power Level: -20 dBm
              Number of Steps Reported: 8
          Remaining Ranging Data Segment: ...

┌───────────────┐
│  IDLE         │  No active data transfer.
└─────┬─────────┘
      │ Server: CS procedure completes (HCI level)
      │ Server: notifies Ranging Data Ready (counter=N)
      ▼
┌───────────────┐
│  DATA READY   │  Dataset N is buffered on server.
│  (counter=N)  │  Client has been notified.
└─────┬─────────┘
      │ Client writes: Get Ranging Data (counter=N)
      │ ── OR ── (real-time mode: automatic push)
      ▼
┌───────────────┐
│  TRANSFERRING  │  Server sends segmented notifications.
│  (counter=N)   │  Segment Index increments: 0, 1, 2, ...
└─────┬──────┬──┘
      │      │ Segment lost? Client writes:
      │      │   Retrieve Lost Segments (counter=N, first, last)
      │      │ Server re-sends missing segments.
      │      │ (loops back to TRANSFERRING)
      │      │
      │      │ Client writes: Abort Operation
      │      └──────────────────────┐
      │ Last Segment received       │
      ▼                             ▼
┌───────────────┐           ┌───────────────┐
│  COMPLETE     │           │  ABORTED      │
│  (counter=N)  │           └───────┬───────┘
└─────┬─────────┘                   │
      │ Client writes:              │
      │   ACK Ranging Data          │
      │   (counter=N)               │
      ▼                             ▼
┌───────────────┐
│  IDLE         │  Server may free buffer for counter=N.
└───────────────┘

1. Client discovers RAS (UUID 0x185B) via GATT primary service discovery
2. Client reads RAS Features (0x2C14) to learn capabilities
3. Client enables CCC notifications on:
     - RAS Ranging Data Ready (0x2C18)
     - RAS Ranging Data Overwritten (0x2C19)
     - RAS On-demand Ranging Data (0x2C16) or
       RAS Real-time Ranging Data (0x2C15)
4. CS procedure runs (HCI level)
5. Server notifies Ranging Data Ready with counter=N
6. Client writes Control Point: Get Ranging Data (counter=N)
7. Server sends On-demand Ranging Data notifications (segmented)
8. Client writes Control Point: ACK Ranging Data (counter=N)

 HCI (CS)                        GATT (RAS)                  State
══════════════════════════════════════════════════════════════════════════
--- One-time connection setup ---
 < LE CS Read Local Supp. Cap.                                IDLE
 > Command Complete                                           │
 < LE CS Read Remote Supp. Cap.                               │
 > Command Status                                             │
 > LE CS Read Remote Supp.                                    │
   Cap. Complete                                              │
 < LE CS Security Enable                                      │
 > Command Status                                             │
 > LE CS Security Enable                                      │
   Complete                                                   │
 < LE CS Set Default Settings                                 │
 > Command Complete                                           ▼
                                                              CAPS EXCHANGED
                                 < ATT: Find By Type Value    │
                                   (RAS UUID 0x185B)          │
                                 > ATT: Find By Type Value    │
                                   Response                   │
                                 < ATT: Read Request           │
                                   (RAS Features 0x2C14)      │
                                 > ATT: Read Response          │
                                   Features: 0x0000000f       │
                                 < ATT: Write Request          │
                                   (CCC: Ready 0x2C18)        │
                                 > ATT: Write Response         │
                                 < ATT: Write Request          │
                                   (CCC: On-demand 0x2C16)    │
                                 > ATT: Write Response         ▼
                                                              RAS READY
--- Per-measurement cycle (repeatable) ---
 < LE CS Create Config (id=0)                                 │
 > Command Status                                             │
 > LE CS Config Complete                                      ▼
                                                              CONFIGURED (id=0)
 < LE CS Set Proc. Params (id=0)                              │
 > Command Complete                                           ▼
                                                              PARAMS SET (id=0)
 < LE CS Proc. Enable                                         │
   (id=0, enable=1)                                           │
 > Command Status                                             │
 > LE CS Proc. Enable                                         │
   Complete (state=1)                                         ▼
                                                              PROCEDURE RUNNING
 > LE CS Subevent Result  ─┐                                  │
 > LE CS Subevent Result   │ (measurement data                │
   Continue                │  streams from                    │
 > LE CS Subevent Result   │  controller)                     │
 > LE CS Subevent Result  ─┘                                  │
                                                              │
 > LE CS Subevent Result                                      │
   (Procedure Done=0x00)                                      ▼
                                                              PROCEDURE COMPLETE
                                 > ATT: Notification           │
                                   (Data Ready 0x2C18)        │
                                   Counter: N                  ▼
                                                              DATA READY (N)
                                 < ATT: Write Command          │
                                   (Control Point 0x2C17)     │
                                   Get Ranging Data            │
                                   Counter: N                  ▼
                                                              TRANSFERRING (N)
                                 > ATT: Notification           │
                                   (On-demand 0x2C16)          │
                                   Seg[0]: First=T Last=F     │
                                   Ranging Header + data       │
                                 > ATT: Notification           │
                                   (On-demand 0x2C16)          │
                                   Seg[1]: First=F Last=F     │
                                 > ATT: Notification           │
                                   (On-demand 0x2C16)          │
                                   Seg[2]: First=F Last=T     ▼
                                                              TRANSFER COMPLETE (N)
                                 < ATT: Write Command          │
                                   (Control Point 0x2C17)     │
                                   ACK Ranging Data            │
                                   Counter: N                  ▼
                                                              IDLE (buffer freed)
--- Cleanup (optional) ---
 < LE CS Remove Config (id=0)
 > Command Status                                             IDLE

 HCI (CS)                        GATT (RAS)                  State
══════════════════════════════════════════════════════════════════════════
 < LE CS Proc. Enable                                         PARAMS SET
   (id=0, enable=1)
 > LE CS Proc. Enable Complete                                ▼
                                                              PROCEDURE RUNNING
 > LE CS Subevent Result ──┐
                           │     > ATT: Notification
                           │       (Real-time 0x2C15)
                           │       Seg[0]: First=T Last=T
                           │       Ranging Header +
                           │       subevent data
 > LE CS Subevent Result ──┤
                           │     > ATT: Notification
                           │       (Real-time 0x2C15)
                           │       Seg[0]: First=T Last=F
                           │     > ATT: Notification
                           │       (Real-time 0x2C15)
                           │       Seg[1]: First=F Last=T
 > LE CS Subevent Result ──┘
                                 > ATT: Notification
                                   (Real-time 0x2C15)
                                   ...
 > LE CS Subevent Result                                      │
   (Procedure Done=0x00)                                      ▼
                                                              PROCEDURE COMPLETE
                                 < ATT: Write Command
                                   ACK Ranging Data
                                   Counter: N                  ▼
                                                              IDLE

 GATT (RAS)                                      State
══════════════════════════════════════════════════════════════
 > ATT: Notification (On-demand 0x2C16)           TRANSFERRING
   Seg[0]: First=T Last=F  ── received
 > ATT: Notification (On-demand 0x2C16)
   Seg[1]: First=F Last=F  ── received
                                                  │
   Seg[2] ── LOST (not received)                  │
                                                  │
 > ATT: Notification (On-demand 0x2C16)           │
   Seg[3]: First=F Last=T  ── received            │
                                                  │
 (Client detects gap: Seg[2] missing)             ▼
                                                  INCOMPLETE
 < ATT: Write Command (Control Point 0x2C17)
   Retrieve Lost Ranging Data Segments
   Counter: N
   First Segment Index: 2
   Last Segment Index: 2                          ▼
                                                  RECOVERING
 > ATT: Notification (On-demand 0x2C16)
   Seg[2]: First=F Last=F  ── re-sent             ▼
                                                  TRANSFER COMPLETE
 < ATT: Write Command (Control Point 0x2C17)
   ACK Ranging Data
   Counter: N                                     ▼
                                                  IDLE

< ACL Data TX: Handle 1 flags 0x00 dlen 12
      L2CAP: Connection Request (0x02) ident 1 len 4
        PSM: 25 (0x0019)
        Source CID: 64
> ACL Data RX: Handle 1 flags 0x02 dlen 16
      L2CAP: Connection Response (0x03) ident 1 len 8
        Destination CID: 64
        Source CID: 64
        Result: Connection successful (0x0000)
        Status: No further information available (0x0000)

< ACL Data TX: Handle 1 flags 0x00 dlen 6
      Channel: 64 len 2 [PSM 25 mode Basic (0x00)] {chan 0}
        AVDTP: Discover (0x01) Command (0x00) type 0x00 label 0 nosp 0
> ACL Data RX: Handle 1 flags 0x02 dlen 10
      Channel: 64 len 6 [PSM 25 mode Basic (0x00)] {chan 0}
        AVDTP: Discover (0x01) Response Accept (0x02) type 0x00 label 0 nosp 0
          ACP SEID: 1
            Media Type: Audio (0x00)
            SEP Type: SNK (0x01)
            In use: No

< ACL Data TX: Handle 1 flags 0x00 dlen 7
      Channel: 64 len 3 [PSM 25 mode Basic (0x00)] {chan 0}
        AVDTP: Get All Capabilities (0x0c) Command (0x00) type 0x00 label 1 nosp 0
          ACP SEID: 1
> ACL Data RX: Handle 1 flags 0x02 dlen 30
      Channel: 64 len 26 [PSM 25 mode Basic (0x00)] {chan 0}
        AVDTP: Get All Capabilities (0x0c) Response Accept (0x02) type 0x00 label 1 nosp 0
          Service Category: Media Transport (0x01)
          Service Category: Media Codec (0x07)
            Media Type: Audio (0x00)
            Media Codec: SBC (0x00)
              Frequency: 0xf0
                16000
                32000
                44100
                48000
              Channel Mode: 0x0f
                Mono
                Dual Channel
                Stereo
                Joint Stereo
              Block Length: 0xf0
                4
                8
                12
                16
              Subbands: 0x0c
                4
                8
              Allocation Method: 0x03
                SNR
                Loudness
              Minimum Bitpool: 2
              Maximum Bitpool: 53
          Service Category: Content Protection (0x04)
            Content Protection Type: SCMS-T (0x0002)
          Service Category: Delay Reporting (0x08)

Media Codec: SBC (0x00)
  Frequency: 44100 (0x20)
  Channel Mode: Joint Stereo (0x01)
  Block Length: 16 (0x10)
  Subbands: 8 (0x04)
  Allocation Method: Loudness (0x01)
  Minimum Bitpool: 2
  Maximum Bitpool: 53

Media Codec: MPEG-2,4 AAC (0x02)
  Object Type: MPEG-4 AAC LC (0x40)
  Frequency: 44100 (0x0100)
  Channels: 2 (0x04)
  Bitrate: 256000bps
  VBR: No

Media Codec: Non-A2DP (0xff)
  Vendor ID: Qualcomm Technologies International, Ltd. (APT) (0x0000004f)
  Vendor Specific Codec ID: aptX (0x0001)
    Frequency: 44100 (0x20)
    Channel Mode: Stereo (0x02)

Media Codec: Non-A2DP (0xff)
  Vendor ID: Qualcomm Technologies, Inc. (0x000000d7)
  Vendor Specific Codec ID: aptX HD (0x0024)
    Frequency: 44100 (0x20)
    Channel Mode: Stereo (0x02)

Media Codec: Non-A2DP (0xff)
  Vendor ID: Sony Corporation (0x0000012d)
  Vendor Specific Codec ID: LDAC (0x00aa)

< ACL Data TX: Handle 1 flags 0x00 dlen 20
      Channel: 64 len 16 [PSM 25 mode Basic (0x00)] {chan 0}
        AVDTP: Set Configuration (0x03) Command (0x00) type 0x00 label 2 nosp 0
          ACP SEID: 1
          INT SEID: 1
          Service Category: Media Transport (0x01)
          Service Category: Media Codec (0x07)
            Media Type: Audio (0x00)
            Media Codec: SBC (0x00)
              Frequency: 44100 (0x20)
              Channel Mode: Joint Stereo (0x01)
              Block Length: 16 (0x10)
              Subbands: 8 (0x04)
              Allocation Method: Loudness (0x01)
              Minimum Bitpool: 2
              Maximum Bitpool: 53
> ACL Data RX: Handle 1 flags 0x02 dlen 6
      Channel: 64 len 2 [PSM 25 mode Basic (0x00)] {chan 0}
        AVDTP: Set Configuration (0x03) Response Accept (0x02) type 0x00 label 2 nosp 0

> ACL Data RX: Handle 1 flags 0x02 dlen 8
      Channel: 64 len 4 [PSM 25 mode Basic (0x00)] {chan 0}
        AVDTP: Set Configuration (0x03) Response Reject (0x03) type 0x00 label 2 nosp 0
          Service Category: Media Codec (0x07)
          Error code: Unsupported Configuration (0x29)

< ACL Data TX: Handle 1 flags 0x00 dlen 7
      Channel: 64 len 3 [PSM 25 mode Basic (0x00)] {chan 0}
        AVDTP: Open (0x06) Command (0x00) type 0x00 label 3 nosp 0
          ACP SEID: 1
> ACL Data RX: Handle 1 flags 0x02 dlen 6
      Channel: 64 len 2 [PSM 25 mode Basic (0x00)] {chan 0}
        AVDTP: Open (0x06) Response Accept (0x02) type 0x00 label 3 nosp 0

< ACL Data TX: Handle 1 flags 0x00 dlen 7
      Channel: 64 len 3 [PSM 25 mode Basic (0x00)] {chan 0}
        AVDTP: Start (0x07) Command (0x00) type 0x00 label 4 nosp 0
          ACP SEID: 1
> ACL Data RX: Handle 1 flags 0x02 dlen 6
      Channel: 64 len 2 [PSM 25 mode Basic (0x00)] {chan 0}
        AVDTP: Start (0x07) Response Accept (0x02) type 0x00 label 4 nosp 0

AVDTP: Suspend (0x09) Command (0x00) type 0x00 label 5 nosp 0
  ACP SEID: 1
AVDTP: Suspend (0x09) Response Accept (0x02) type 0x00 label 5 nosp 0

AVDTP: Close (0x08) Command (0x00) type 0x00 label 6 nosp 0
  ACP SEID: 1
AVDTP: Close (0x08) Response Accept (0x02) type 0x00 label 6 nosp 0

AVDTP: Abort (0x0a) Command (0x00) type 0x00 label 7 nosp 0
  ACP SEID: 1
AVDTP: Abort (0x0a) Response Accept (0x02) type 0x00 label 7 nosp 0

AVDTP: Delay Report (0x0d) Command (0x00) type 0x00 label 8 nosp 0
  ACP SEID: 1
  Delay: 15.0ms
AVDTP: Delay Report (0x0d) Response Accept (0x02) type 0x00 label 8 nosp 0

< ACL Data TX: Handle 1 flags 0x00 dlen 17
      Channel: 66 len 13 [PSM 23 mode Basic (0x00)] {chan 2}
        AVCTP Control: Response: type 0x00 label 0 PID 0x110e
          AV/C: Accepted: address 0x48 opcode 0x00
            Subunit: Panel
            Opcode: Vendor Dependent
            Company ID: 0x001958
              AVRCP: SetAbsoluteVolume pt Single len 0x0001
                Volume: 50.39% (64/127)

AVRCP: GetPlayStatus pt Single len 0x0009
  SongLength: 0x00038270 (230000 milliseconds)
  SongPosition: 0x00000000 (0 milliseconds)
  PlayStatus: 0x01 (PLAYING)

AVRCP: GetElementAttributes pt Single len 0x0050
  AttributeCount: 0x02
  Attribute: 0x00000001 (Title)
  CharsetID: 0x006a (UTF-8)
  AttributeValueLength: 0x000c
  AttributeValue: My Song Name
  Attribute: 0x00000002 (Artist)
  CharsetID: 0x006a (UTF-8)
  AttributeValueLength: 0x000b
  AttributeValue: The Artist

AVCTP Control: Command: type 0x00 label 1 PID 0x110e
  AV/C: Control: address 0x48 opcode 0x7c
    Subunit: Panel
    Opcode: Passthrough
    Operation: 0x44 (PLAY Pressed)
    Length: 0x00

AVRCP: RegisterNotification pt Single len 0x0005
  EventID: 0x0d (EVENT_VOLUME_CHANGED)
  Volume: 50.39% (64/127)

grep -n "AVDTP:\|Media Codec:" output.txt

grep -n "AVDTP:.*Command\|AVDTP:.*Response" output.txt

grep -n "Set Configuration\|Media Codec:" output.txt

grep -n "AVDTP: Start\|PSM 25.*chan 1" output.txt

grep -n "Response Reject\|Error code:" output.txt

grep -n "SetAbsoluteVolume\|Volume:\|GetPlayStatus\|PlayStatus:" output.txt

< ACL Data TX: Handle 1 flags 0x00 dlen 25
      Channel: 64 len 21 [PSM 1 mode Basic (0x00)] {chan 0}
        SDP: Service Search Attribute Request (0x06) tid 1 len 16
          Search pattern: [len 5]
            Sequence (6) with 3 byte(s) [8 extra bits] len 5
              UUID (3) with 2 byte(s) [0 extra bits] len 3
                Handsfree Audio Gateway (0x111f)
          Max record count: 65535
          Attribute list: [len 5]
            Sequence (6) with 3 byte(s) [8 extra bits] len 5
              Unsigned Integer (1) with 4 byte(s) [0 extra bits] len 5
                0x0000ffff
          Continuation state: 0

> ACL Data RX: Handle 1 flags 0x02 dlen 89
      Channel: 64 len 85 [PSM 1 mode Basic (0x00)] {chan 0}
        SDP: Service Search Attribute Response (0x07) tid 1 len 80
          Attribute bytes: 77
            Attribute list: [len 75] {position 0}
              Attribute: Service Class ID List (0x0001) [len 2]
                Handsfree Audio Gateway (0x111f)
              Attribute: Protocol Descriptor List (0x0004) [len 2]
                L2CAP (0x0100)
                RFCOMM (0x0003)
                  Channel: 1
              Attribute: Bluetooth Profile Descriptor List (0x0009) [len 2]
                Handsfree (0x111e)
                  Version: 0x0108
          Continuation state: 0

< ACL Data TX: Handle 1 flags 0x00 dlen 12
      L2CAP: Connection Request (0x02) ident 2 len 4
        PSM: 3 (0x0003)
        Source CID: 65
> ACL Data RX: Handle 1 flags 0x02 dlen 16
      L2CAP: Connection Response (0x03) ident 2 len 8
        Destination CID: 65
        Source CID: 65
        Result: Connection successful (0x0000)
        Status: No further information available (0x0000)

< ACL Data TX: Handle 1 flags 0x00 dlen 12
      Channel: 65 len 4 [PSM 3 mode Basic (0x00)] {chan 1}
        RFCOMM: Set Async Balance Mode (SABM) (0x2f)
         Address: 0x03 cr 1 dlci 0x00
         Control: 0x3f poll/final 1
         Length: 0
         FCS: 0x1c
> ACL Data RX: Handle 1 flags 0x02 dlen 12
      Channel: 65 len 4 [PSM 3 mode Basic (0x00)] {chan 1}
        RFCOMM: Unnumbered Ack (UA) (0x63)
         Address: 0x03 cr 1 dlci 0x00
         Control: 0x73 poll/final 1
         Length: 0
         FCS: 0xd7

Channel: 65 len 14 [PSM 3 mode Basic (0x00)] {chan 1}
  RFCOMM: Unnumbered Info with Header Check (UIH) (0xef)
   Address: 0x03 cr 1 dlci 0x00
   Control: 0xef poll/final 0
   Length: 10
   FCS: 0x70
   MCC Message type: DLC Parameter Negotiation CMD (0x20)
     Length: 8
     dlci 2 frame_type 0 credit_flow 15 pri 7
     ack_timer 0 frame_size 127 max_retrans 0 credits 7

Channel: 65 len 4 [PSM 3 mode Basic (0x00)] {chan 1}
  RFCOMM: Set Async Balance Mode (SABM) (0x2f)
   Address: 0x0b cr 1 dlci 0x02
   Control: 0x3f poll/final 1
   Length: 0
   FCS: 0x59
Channel: 65 len 4 [PSM 3 mode Basic (0x00)] {chan 1}
  RFCOMM: Unnumbered Ack (UA) (0x63)
   Address: 0x0b cr 1 dlci 0x02
   Control: 0x73 poll/final 1
   Length: 0
   FCS: 0x92

Channel: 65 len 8 [PSM 3 mode Basic (0x00)] {chan 1}
  RFCOMM: Unnumbered Info with Header Check (UIH) (0xef)
   Address: 0x03 cr 1 dlci 0x00
   Control: 0xef poll/final 0
   Length: 4
   FCS: 0x70
   MCC Message type: Modem Status Command CMD (0x38)
     Length: 2
     dlci 2
     fc 0 rtc 1 rtr 1 ic 0 dv 1

Channel: 65 len 21 [PSM 3 mode Basic (0x00)] {chan 1}
  RFCOMM: Unnumbered Info with Header Check (UIH) (0xef)
   Address: 0x09 cr 0 dlci 0x02
   Control: 0xff poll/final 1
   Length: 14
   FCS: 0x86
   Credits: 1
    41 54 2b 42 52 53 46 3d 32 30 35 35 0d         AT+BRSF=2055.

AG -> HF:  +BCS:2      (select mSBC)
HF -> AG:  AT+BCS=2    (confirm mSBC)
AG -> HF:  OK

< HCI Command: Write Voice Setting (0x0c|0x0026) plen 2
      Setting: 0x0063
        Input Coding: Linear
        Input Data Format: 2's complement
        Input Sample Size: 16-bit
        # of bits padding at MSB: 0
        Air Coding Format: Transparent Data

< HCI Command: Write Voice Setting (0x0c|0x0026) plen 2
      Setting: 0x0060
        Input Coding: Linear
        Input Data Format: 2's complement
        Input Sample Size: 16-bit
        # of bits padding at MSB: 0
        Air Coding Format: CVSD

< HCI Command: Setup Synchronous Connection (0x01|0x0028) plen 17
      Handle: 1
      Transmit bandwidth: 8000
      Receive bandwidth: 8000
      Max latency: 13
      Setting: 0x0063
        Input Coding: Linear
        Input Data Format: 2's complement
        Input Sample Size: 16-bit
        # of bits padding at MSB: 0
        Air Coding Format: Transparent Data
      Retransmission effort: Optimize for link quality (0x02)
      Packet type: 0x0008
        EV3 may be used

< HCI Command: Enhanced Setup Synchronous Connection (0x01|0x003d) plen 59
      Handle: 1
      Transmit bandwidth: 8000
      Receive bandwidth: 8000
      Transmit Coding Format:
        Codec: mSBC (0x05)
      Receive Coding Format:
        Codec: mSBC (0x05)
      Transmit Codec Frame Size: 60
      Receive Codec Frame Size: 60
      Input Coding Format:
        Codec: mSBC (0x05)
      Output Coding Format:
        Codec: mSBC (0x05)
      Input Coded Data Size: 16
      Output Coded Data Size: 16
      Input PCM Data Format: 2's complement
      Output PCM Data Format: 2's complement
      Input PCM Sample Payload MSB Position: 0
      Output PCM Sample Payload MSB Position: 0
      Input Data Path: HCI
      Output Data Path: HCI
      Input Transport Unit Size: 60
      Output Transport Unit Size: 60
      Max latency: 13
      Packet type: 0x0008
        EV3 may be used
      Retransmission effort: Optimize for link quality (0x02)

> HCI Event: Synchronous Connection Complete (0x2c) plen 17
      Status: Success (0x00)
      Handle: 257
      Address: 11:22:33:44:55:66 (OUI 11-22-33)
      Link type: eSCO (0x02)
      Transmission interval: 0x0c
      Retransmission window: 0x06
      RX packet length: 60
      TX packet length: 60
      Air mode: Transparent (0x03)

> BR-ESCO: Handle 257 flags 0x00 dlen 60
< BR-ESCO: Handle 257 flags 0x00 dlen 60

grep -n "PSM: 3\|RFCOMM:" output.txt

grep -n "AT+B\|AT+C\|+BRSF\|+CIND\|+CHLD\|+BCS" output.txt

grep -n "+BCS\|AT+BAC\|AT+BCS" output.txt

grep -n "Setup Synchronous\|Enhanced Setup Synchronous\|Synchronous Connection Complete\|Write Voice Setting" output.txt

grep -n "Air mode:\|Air Coding Format:\|Codec:" output.txt

grep -n "Synchronous Connection Complete" output.txt

grep -n "+CIEV\|AT+CHUP\|ATD\|ATA\|AT+CLCC\|RING" output.txt

> HCI Event: LE Meta Event (0x3e) plen 43              #120 [hci0] 0.500003
      LE Extended Advertising Report (0x0d)
        Event type: 0x0013
          Props: 0x0013
            Connectable
            Scannable
            Complete
        Address type: Random (0x01)
        Address: 00:11:22:33:44:55
        Primary PHY: LE 1M
        Secondary PHY: LE 2M
        SID: 0x01
        TX power: 0 dBm
        RSSI: -55 dBm (0xc9)
        Data length: 18

> HCI Event: LE Meta Event (0x3e) plen 38              #120 [hci0] 0.500003
      LE Extended Advertising Report (0x0d)
        Address: 00:11:22:33:44:55
        RSSI: -62 dBm (0xc2)
        Flags: 0x06
          LE General Discoverable Mode
          BR/EDR Not Supported
        Name (complete): LE-Audio-Left
        16-bit Service UUIDs (complete): 3 entries
          Published Audio Capabilities (0x1850)
          Audio Stream Control (0x184e)
          Common Audio (0x1853)
        Service Data (UUID 0x1852): 01a2b3
        Appearance: Earbud (0x0941)

< HCI Command: LE Set Extended Adv Parameters (0x08|0x0036) plen 25  #50 [hci0] 0.100003
      Handle: 0x01
      Properties: 0x0000
      Min advertising interval: 160.000 msec (0x0100)
      Max advertising interval: 160.000 msec (0x0100)
      Channel map: 37, 38, 39 (0x07)
      Own address type: Random (0x01)
      Peer address type: Public (0x00)
      PHY: LE 1M, LE 2M
      SID: 0x01
      TX power: 7 dBm
< HCI Command: LE Set Extended Adv Data (0x08|0x0037) plen 35  #52 [hci0] 0.101003
      Handle: 0x01
      Operation: Complete extended advertising data (0x01)
      Fragment preference: No fragmentation (0x01)

> HCI Event: LE Meta Event (0x3e) plen 80              #200 [hci0] 0.500003
      LE Periodic Advertising Report (0x0f)
        Sync handle: 0x0001
        TX power: 0 dBm
        RSSI: -45 dBm
        CTE Type: No CTE (0xff)
        Data status: Complete (0x00)
        Data length: 60
        Service Data: Basic Audio Announcement (0x1851)
          Presentation Delay: 40000 us
          Number of Subgroups: 1
            Codec: LC3 (0x06)
              Sampling Frequency: 48000 Hz
              Frame Duration: 10 ms
              Frame Length: 120

grep -n "Advertising Report\|Address:.*RSSI:" output.txt

grep -n "Name (complete):\|Name (short):" output.txt

grep -n "Audio Stream Control\|Published Audio Capabilities\|Common Audio\|Basic Audio Announcement\|Broadcast Audio" output.txt

grep -n "Set Extended Adv\|Set Advertising\|Set Scan Response\|Adv Enable" output.txt

grep -n "Periodic Advertising\|PA Sync\|PA Report\|Basic Audio Announcement\|Broadcast.*Announcement" output.txt

grep -n "Appearance:" output.txt

@ MGMT Open: bluetoothd (privileged) version 1.23      {0x0001} 12:34:49.881936
@ MGMT Command: Read Management Ver.. (0x0001) plen 0  {0x0001} 12:34:49.882003
@ MGMT Event: Command Complete (0x0001) plen 6         {0x0001} 12:34:49.882010
      Read Management Version Information (0x0001) plen 3
        Status: Success (0x00)
        Version: 1.23
@ MGMT Command: Read Management Sup.. (0x0002) plen 0  {0x0001} 12:34:49.882050
@ MGMT Event: Command Complete (0x0001) plen 58        {0x0001} 12:34:49.882055
      Read Supported Commands (0x0002) plen 55
        Status: Success (0x00)
        Num of commands: 120
        Num of events: 38

@ MGMT Command: Read Controller Index List (0x0003) plen 0  {0x0001} 12:34:49.882100
@ MGMT Event: Command Complete (0x0001) plen 7              {0x0001} 12:34:49.882105
      Read Controller Index List (0x0003) plen 4
        Status: Success (0x00)
        Num controllers: 1
        Controller: hci0
@ MGMT Command: Read Controller Inf.. (0x0004) plen 0  {0x0001} [hci0] 12:34:49.882200
@ MGMT Event: Command Complete (0x0001) plen 283       {0x0001} [hci0] 12:34:49.882210
      Read Controller Information (0x0004) plen 280
        Status: Success (0x00)
        Address: 00:11:22:33:44:55
        Bluetooth version: 5.4
        Manufacturer: Intel (2)
        Supported settings: 0x003effff
        Current settings: 0x00000080

@ MGMT Command: Load Link Keys (0x0012) plen 3  {0x0001} [hci0] 12:34:50.001200
      Debug keys: Disabled (0x00)
      Key count: 0
@ MGMT Event: Command Complete (0x0001) plen 4   {0x0001} [hci0] 12:34:50.001220
      Load Link Keys (0x0012) plen 1
        Status: Success (0x00)
@ MGMT Command: Load Long Term Keys (0x0013) plen 2  {0x0001} [hci0] 12:34:50.001300
      Key count: 0
@ MGMT Event: Command Complete (0x0001) plen 4        {0x0001} [hci0] 12:34:50.001315
      Load Long Term Keys (0x0013) plen 1
        Status: Success (0x00)
@ MGMT Command: Load Identity Resolving Keys (0x0030) plen 2  {0x0001} [hci0] 12:34:50.001400
      Key count: 0
@ MGMT Event: Command Complete (0x0001) plen 4                {0x0001} [hci0] 12:34:50.001415
      Load Identity Resolving Keys (0x0030) plen 1
        Status: Success (0x00)

@ MGMT Command: Set Secure Connections (0x002d) plen 1  {0x0001} [hci0] 12:34:50.002100
      Secure connections: Enabled (0x01)
@ MGMT Event: Command Complete (0x0001) plen 7          {0x0001} [hci0] 12:34:50.002120
      Set Secure Connections (0x002d) plen 4
        Status: Success (0x00)
        Current settings: 0x004e0a81
@ MGMT Command: Set Bondable (0x0009) plen 1            {0x0001} [hci0] 12:34:50.002200
      Bondable: Enabled (0x01)
@ MGMT Event: Command Complete (0x0001) plen 7          {0x0001} [hci0] 12:34:50.002220
      Set Bondable (0x0009) plen 4
        Status: Success (0x00)
        Current settings: 0x004e0a91

@ MGMT Command: Set Powered (0x0005) plen 1     {0x0001} [hci0] 12:35:04.033564
      Powered: Enabled (0x01)
@ MGMT Event: Command Complete (0x0001) plen 7   {0x0001} [hci0] 12:35:04.114789
      Set Powered (0x0005) plen 4
        Status: Success (0x00)
        Current settings: 0x004e0ac1

@ MGMT Command: Start Discovery (0x0023) plen 1  {0x0001} [hci0] 12:36:00.100200
      Address type: 0x07
        BR/EDR
        LE Public
        LE Random
@ MGMT Event: Command Complete (0x0001) plen 5   {0x0001} [hci0] 12:36:00.100500
      Start Discovery (0x0023) plen 2
        Status: Success (0x00)
        Address type: 0x07

@ MGMT Event: Device Found (0x0012) plen 38      {0x0001} [hci0] 12:36:00.250003
      LE Address: AA:BB:CC:DD:EE:FF (Random)
      RSSI: -62
      Flags: 0x0000
      EIR Data:
        Name (complete): My Device
        TX power: 0

@ MGMT Command: Start Service Discovery (0x003a) plen 19  {0x0001} [hci0] 12:36:10.100200
      Address type: 0x06
        LE Public
        LE Random
      RSSI threshold: -127
      UUIDs: 1
        UUID: Heart Rate (0x180d)
@ MGMT Event: Command Complete (0x0001) plen 5            {0x0001} [hci0] 12:36:10.100500
      Start Service Discovery (0x003a) plen 2
        Status: Success (0x00)

@ MGMT Command: Stop Discovery (0x0024) plen 1   {0x0001} [hci0] 12:36:15.200100
      Address type: 0x07
@ MGMT Event: Command Complete (0x0001) plen 5    {0x0001} [hci0] 12:36:15.200400
      Stop Discovery (0x0024) plen 2
        Status: Success (0x00)
@ MGMT Event: Discovering (0x0013) plen 2         {0x0001} [hci0] 12:36:15.200500
      Address type: 0x07
      Discovery: Disabled (0x00)

@ MGMT Command: Pair Device (0x0019) plen 8      {0x0001} [hci0] 12:37:00.500200
      LE Address: AA:BB:CC:DD:EE:FF (Random)
      Capability: KeyboardDisplay (0x04)

@ MGMT Event: User Confirmation Request (0x000f) plen 12  {0x0001} [hci0] 12:37:01.200100
      LE Address: AA:BB:CC:DD:EE:FF (Random)
      Value: 123456
@ MGMT Command: User Confirmation Reply (0x001e) plen 6   {0x0001} [hci0] 12:37:03.800200
      LE Address: AA:BB:CC:DD:EE:FF (Random)
@ MGMT Event: Command Complete (0x0001) plen 10            {0x0001} [hci0] 12:37:03.800350
      User Confirmation Reply (0x001e) plen 7
        Status: Success (0x00)

@ MGMT Event: User Passkey Request (0x0010) plen 6        {0x0001} [hci0] 12:37:01.200100
      LE Address: AA:BB:CC:DD:EE:FF (Random)
@ MGMT Command: User Passkey Reply (0x0020) plen 10       {0x0001} [hci0] 12:37:05.100200
      LE Address: AA:BB:CC:DD:EE:FF (Random)
      Passkey: 123456

@ MGMT Event: New Long Term Key (0x000a) plen 37   {0x0001} [hci0] 12:37:06.100200
      Store hint: Yes (0x01)
      LE Address: AA:BB:CC:DD:EE:FF (Random)
      Key type: Authenticated P-256 (0x03)
      Central: 0x00
      Encryption size: 16
@ MGMT Event: New Identity Resolving Key (0x0018) plen 30  {0x0001} [hci0] 12:37:06.100300
      Store hint: Yes (0x01)
      Random address: AA:BB:CC:DD:EE:FF
      LE Address: 11:22:33:44:55:66 (Public)
      Key: 00112233445566778899aabbccddeeff
@ MGMT Event: Command Complete (0x0001) plen 10   {0x0001} [hci0] 12:37:06.100500
      Pair Device (0x0019) plen 7
        Status: Success (0x00)
        LE Address: AA:BB:CC:DD:EE:FF (Random)

@ MGMT Event: Command Complete (0x0001) plen 10   {0x0001} [hci0] 12:37:06.100500
      Pair Device (0x0019) plen 7
        Status: Authentication Failed (0x05)
        LE Address: AA:BB:CC:DD:EE:FF (Random)

@ MGMT Event: Device Connected (0x000b) plen 13   {0x0001} [hci0] 12:36:18.974319
      LE Address: AA:BB:CC:DD:EE:FF (Random)
      Flags: 0x0000
      EIR Data Length: 0

@ MGMT Event: Device Disconnected (0x000c) plen 8  {0x0001} [hci0] 12:38:20.500200
      LE Address: AA:BB:CC:DD:EE:FF (Random)
      Reason: Connection timeout (0x01)

@ MGMT Command: Unpair Device (0x001a) plen 7     {0x0001} [hci0] 12:39:00.100200
      LE Address: AA:BB:CC:DD:EE:FF (Random)
      Disconnect: Enabled (0x01)
@ MGMT Event: Command Complete (0x0001) plen 10    {0x0001} [hci0] 12:39:00.100500
      Unpair Device (0x001a) plen 7
        Status: Success (0x00)

@ MGMT Command: Add Advertising (0x003e) plen 22   {0x0001} [hci0] 12:40:00.100200
      Instance: 1
      Flags: 0x0006
        The connectable flag will be managed
        The limited discoverable flag will be managed
      Duration: 0
      Timeout: 0
      Advertising data length: 6
      Scan response length: 0
@ MGMT Event: Command Complete (0x0001) plen 5      {0x0001} [hci0] 12:40:00.100500
      Add Advertising (0x003e) plen 2
        Status: Success (0x00)
        Instance: 1

@ MGMT Command: Remove Advertising (0x003f) plen 1  {0x0001} [hci0] 12:41:00.100200
      Instance: 1
@ MGMT Event: Command Complete (0x0001) plen 5       {0x0001} [hci0] 12:41:00.100500
      Remove Advertising (0x003f) plen 2
        Status: Success (0x00)
        Instance: 1

@ MGMT Event: Command Complete (0x0001) plen 4    {0x0001} [hci0] 12:42:00.100200
      Set Powered (0x0005) plen 1
        Status: RFKilled (0x12)

@ MGMT Event: Command Status (0x0002) plen 3     {0x0001} [hci0] 12:42:01.100200
      Start Discovery (0x0023) plen 0
        Status: Busy (0x0a)

grep -n "@ MGMT" output.txt

grep -n "@ MGMT" output.txt | grep -v "Status: Success"

grep -n "Set Powered\|RFKilled\|Not Powered" output.txt

grep -n "Start Discovery\|Stop Discovery\|Device Found\|Discovering" output.txt

grep -n "Pair Device\|User Confirmation\|User Passkey\|New Long Term Key\|New Identity Resolving Key\|Authentication Failed" output.txt

grep -n "Device Connected\|Device Disconnected\|Unpair Device" output.txt

grep -n "@ MGMT Open\|@ MGMT Close" output.txt

$ btmon -i hci0 -w hcidump.log

$ btmon -r hcidump.log

$ btmon -t -r hcidump.log

$ btmon -T -r hcidump.log