Skip to content
Published On:
Jan 3, 2015
Last Updated:
Jun 25, 2026
The Bluetooth icon/logo.

Bluetooth is a collection of short range wireless communication protocols. The Bluetooth Special Interest Group (SIG) was founded in 1998 and oversees the development of Bluetooth standards.1 The original Bluetooth is known as Bluetooth Classic and was designed as a short-range wireless point-to-point communications protocol.

Child Pages

Piconet And Scatternets

A Piconet is the term used for a small Bluetooth network with 1 master device connected to up to 7 active slave devices. Up to 255 more slave devices may be connected to the master but in an inactive or “parked” state. Active slaves can be parked to bring parked devices into the active state.3

Both active and parked slaves in a Piconet are time-synchronized to the master so that RF contention does not occur (they implement a Time Division Multiple Access (TDMA) network).

A Scatternet is two or more independent Piconets which are connected together by one node in one Piconet (either the master or a slave) also acting as a slave in the second Piconet.4

Advanced Audio Distribution Profile (A2DP)

This is a bluetooth standard which supports the streaming of audio between bluetooth-enabled devices.

Bluetooth 4.0

In 2010, the Bluetooth Core Specification version 4.0 was released. This included Bluetooth Low Energy (BLE), which is now more commonly known as Bluetooth Smart. Bluetooth Smart specifies a hub-and-spoke connection model (with broadcast support), but no mesh topology.

An attribute is a piece of labelled and addressable data. A characteristic is a group of attributes, and a service is a group of characteristics.

attribute < characteristic < service

Bluetooth 4.0 uses the server/client paradigm.

L2CAP

L2CAP (Logical Link Control and Adaptation Protocol) is a protocol that provides connection-orientated and connectionless data services to the upper layer protocols. It sits above the HCI layer. It includes features such as multiplexing and data segmentation and reassembly (breaking data into smaller chunks and reassembling them at the other end).5 It is used by both Bluetooth Classic and Bluetooth Low Energy (BLE).

An L2CAP frame always contains a 4-byte header containing a 2-byte length and a 2-byte channel ID.6

Bluetooth Smart Mesh Working Group

In 2017, a set of three specifications were released by the Bluetooth SIG:

  • Mesh Profile
  • Mesh Model
  • Mesh Device Properties

These specifications allowed Bluetooth devices to form a mesh network. Mesh Profiles use Bluetooth LE for its underlying radio communications, and as such Mesh Profiles work with Bluetooth 4.2 and Bluetooth 5 devices.

Bluetooth Mesh data packets can be up to 384 bytes.

Packet Delivery

Packets are not routed in a Bluetooth mesh, but instead use flooding. Packets are not sent through a particular sequence of nodes to reach the destination, nor are routing tables kept by any of the nodes. Instead, nodes can be designated as relays which receive the message and re-broadcast it to everyone in range. Any relays receiving this will then re-broadcast it again, and so on. Nodes keep track of the packet ID so that they do not re-transmit a message they have already received and transmitted before. This method of flooding is intended to keep the network simple and resilient to node failure. If nodes acted as routers, their failure might have a significant impact on the network.7

Latencies

Bluetooth mesh latency depends on the payload size, number of nodes (incl. number of relays) and the connection topology. You can expect round-trip latencies of around 50ms for packets with an 8 byte payload that go through 3 hops.8 Silicon Labs has a great application note, AN1137: Bluetooth Mesh Network Performance which goes into mesh latencies in more detail.

Encryption

Two types of encryption keys:

  1. Network keys: Specific to a physical network.
  2. Application keys: Specific to the function of the data, e.g. reading sensor values vs. configuring the sensor.

Bridge ICs

CH9141/CH9143

The CH9141 is a serial-to-Bluetooth BLE bridge IC made by Nanjing Qinheng Microelectronics Co., Ltd. that allows for “transparent” serial communication over Bluetooth. It supports broadcast, host and slave mode.9 It looks like there are not many suppliers for this IC, and much of the information is not in English.

A typical application diagram from the CH9141 BLE bridge IC.9

Chipsets

Bluetooth chipsets are ICs that contain a Bluetooth transceiver and processor that are designed to be used in things such as Bluetooth USB dongles.

Broadcom BCM20702

The BCM20702 is a Bluetooth 4.0 processor made by Broadcom that is commonly found in Bluetooth USB dongles. Sometime on or before 2016, Cypress Semiconductor acquired the part number/IP and renamed it the CYW20702. There is not much information online about the original Broadcom BCM20702, but there is a datasheet for the Cypress part.

The block diagram below shows the internal architecture of the CYW20702 IC.

An internal block diagram of the CYW20702 Bluetooth transceiver and baseband processor.10

CSR8510

The CSR8510 is a Bluetooth 4.0 single-chip radio and baseband IC designed for PCs and other devices. It was originally designed by CSR (Cambridge Silicon Radio). CSR was acquired by Qualcomm in 2015.11 Qualcomm has kept the CSR part numbers. It appears the popular TP-Link UB400 Bluetooth dongle uses this chipset.12

Modules

HC-05/HC-06

The HC-05 and HC-06 are Bluetooth modules that are popular in the hobbyist space (e.g. commonly used with Arduinos). The are serial to Bluetooth modules which use the Bluetooth Classic SPP over RFCOMM protocol. The HC-05 is based of the CSR BC417143 IC.13

A photo of the HC-05 Bluetooth module.14

Serial Ports over Bluetooth

Traditionally, Bluetooth provides specific ways of accessing data in the form of profiles. There are two primary ways to provide a “serial port” over Bluetooth:

  • SPP over RFCOMM on Bluetooth Classic: Bluetooth Classic defines an emulated serial port standard called the SPP (Serial Port Profile) which uses RFCOMM. It emulates not just a TX and RX serial stream, but also the flow control lines as defined by the RS-232 standard. See below for more details.
  • BLE: The BLE specification does not define a serial port standard, but there are many proprietary implementations available. See below for more details.

SPP over RFCOMM

Bluetooth Classic defines an emulated serial port standard called the SPP (Serial Port Profile) which uses RFCOMM. RFCOMM in turn uses L2CAP. It emulates not just a TX and RX serial data lines (as streams), but also the flow control lines.15 It has good support by many Bluetooth-enabled microcontrollers, dongles and operating systems.

PinCircuit Name
102Signal Common
103Transmit Data (TD)
104Received Data (RD)
105Request to Send (RTS)
106Clear to Send (CTS)
107Data Set Ready (DSR)
108Data Terminal Ready (DTR)
109Data Carrier Detect (CD)
125Ring Indicator (RI)
RS-232 pin assignments for RFCOMM protocol implementation.

The screenshot below shows how Bluetooth devices that support SPP over RFCOMM can show up in Microsoft Windows. This screenshot was taken in NinjaTerm.

A screenshot of Microsoft “Standard Serial over Bluetooth link” ports in NinjaTerm.

The HC-05 and HC-06 Bluetooth modules which are popular in the hobbyist space use SPP over RFCOMM to implement the bi-directional data stream.

BLE Serial

Unfortunately, there is no standard specified by the Bluetooth SIG for implementing a virtual serial port over Bluetooth Low Energy (BLE). However, many vendors have implemented their own proprietary protocols for this, and a few of them have become somewhat “industry standard”. What this means is to pick a particular service UUID, and within that one characteristic UUID for TX data, and another characteristic UUID for RX data.

Hopefully, the device includes the service IDs in its advertisement packet. This way, a Bluetooth central device which is looking for serial capable peripherals can perform a Bluetooth scan and identify the compatible peripherals without having to connect to them.

One of the most popular implementations is the Nordic Semiconductor “Nordic UART Service” (NUS). The service and characteristic UUIDs are:16

  • Service UUID: 6e400001-b5a3-f393-e0a9-e50e24dcca9e (16-bit offset: 0x0001)
  • RX Characteristic UUID: 6e400002-b5a3-f393-e0a9-e50e24dcca9e (properties: “write”, “write without response”)
  • TX Characteristic UUID: 6e400003-b5a3-f393-e0a9-e50e24dcca9e (properties: “notify”)

The Microchip Transparent UART Service is a implementation by Microchip. It uses the following UUIDs:17

  • Service UUID: 49535343-fe7d-4ae5-8fa9-9fafd205e455
  • RX Characteristic UUID: 49535343-8841-43f4-a8d4-ecbe34729bb3 (properties: “write”, “write without response”)
  • TX Characteristic UUID: 49535343-1e4d-4bd9-ba61-23c647249616 (properties: “notify”, “write”, “write without response”)

Texas Instruments also has an implementation called the TI Serial Port Service (SPS). It uses the following UUIDs:18

  • Service UUID: f000c0e0-0451-4000-b000-000000000000
  • Data Characteristic UUID: f000c0e1-0451-4000-b000-000000000000 (properties: “notify”, “write”)
  • Status Characteristic UUID: f000c0e2-0451-4000-b000-000000000000
  • Config Characteristic UUID: f000c0e3-0451-4000-b000-000000000000

The TI SPS implementation is a little different from Nordics and Microchips in that there is a single data characteristic for both TX and RX data, and additional information is sent via the status and config characteristics. It is designed so that you can actually configure a real serial port (i.e. one needing settings like baud rate, parity, stop bits, etc.) on the BLE peripheral over BLE from a phone/computer (BLE central device). In this sense the peripheral can be considered a bridge.

The TI status characteristic provides the following information:18

  • Framing error count
  • Parity error count
  • RF link overrun
  • Number of RX bytes
  • Number of TX bytes

All of these data points are reset to 0 when the status characteristic is read.

u-blox has their own “u-connectXpress” Bluetooth serial port service which uses the following UUIDs:19

  • Service UUID: 2456e1b9-26e2-8f83-e744-f34f01e9d701
  • Data Characteristic (FIFO) UUID: 2456e1b9-26e2-8f83-e744-f34f01e9d703 (properties: “indicate”, “notify”, “write”, “write without response”)
  • Credits Characteristic UUID: 2456e1b9-26e2-8f83-e744-f34f01e9d704 (properties: “indicate”, “notify”, “write”, “write without response”)

Like TI, u-blox uses a single data characteristic for both TX and RX data. The credits characteristic is used for a form of flow control.

Silicon Labs also has their own implementation called “SPP over BLE”. It uses the following UUIDs:20

  • Service UUID: 4880c12c-fdcb-4077-8920-a450d7f9b907
  • Data Characteristic UUID: fec26ec4-6d71-4442-9f81-55bc21d658d6 (properties: “notify”, “write without response”)

Again, like TI, Silicon Labs uses a single data characteristic for both TX and RX data.

BLE v4 messages are limited to 20 bytes. BLE v5 was updated to allow for longer messages, but some software and devices listing themselves as v5 still impose the 20 byte limit.21

Libraries and Applications that use Bluetooth Serial

If you want to connect to this Bluetooth NUS shell peripheral from a computer, you can use the NinjaTerm terminal application. This supports Bluetooth LE as a connection type, and can auto-detect and listen to the popular Bluetooth serial service and characteristic UUIDs such as the Nordic UART Service (NUS).

A screenshot of a log message and shell prompt sent across the Bluetooth NUS shell in NinjaTerm.

The Android app “Serial Bluetooth Terminal” by Kai Morich provides a terminal for your phone to communicate over Bluetooth serial.

The Android app “Serial Bluetooth Terminal” available from the Google Play store.

The “Web-Bluetooth-Terminal” by loginov-rocks is a web app (PWA to be exact) that runs in your browser and provides a terminal that uses the Web Bluetooth API.

A image showing the loginov-rocks “Web-Bluetooth-Terminal” app on a phone. Also works on desktop browsers.22

There are a few Bluetooth-related node.js libraries that provide Bluetooth related functionality:

  • bluetooth-serial-port by eelcocramer: Provides serial port support for Bluetooth, however as of Sep 2025 it hasn’t been updated in 2 years and lists itself as being deprecated. Requires libbluetooth-dev on Linux. Requires Visual C++ and its command-line tools installed on Windows. Requires Python 2.x on all platforms. MacOS support was “temporarily” dropped in v3.0.0.
  • node-bluetooth by song940: Requires node-gyp to be installed on all platforms, and additionally libbluetooth-dev on Linux.

noble and abandonware/noble

noble provides general BLE support to node.js applications. It supports Windows, Linux, macOS, and FreeBSD.23 However, as of Sep 2025, it hasn’t been updated in 7 years! There is a fork called abandonware/noble that is more actively maintained (as of Sep 2025, last commit was 7 months ago).

Bluetooth Dongles

BleuIO

BleuIO produces a range of Bluetooth dongles specifically designed for engineering and development of Bluetooth applications.

A screenshot from the BleuIO website showing their products and pricing, as of Nov 2025.24

Instead of relying on the operating system’s Bluetooth API, they provide their own API for interacting with the Bluetooth hardware. This gives the user more features and a consistent interface across different operating systems. For example, Windows only allows for one Bluetooth radio to be active at a time (via the OS Bluetooth stack).25 Just having one Bluetooth radio is not an issue if you use BleuIO since the dongles don’t utilize the Windows Bluetooth stack. The Python library Bleak lets you specify an adapter, but this parameter is ignored on Windows. You can interface with the dongles via either AT commands (over a USB CDC serial port) or via provided Python/Javascript libraries (I presume the libraries utilize the AT commands also).

A screenshot of a Python script scanning for Bluetooth devices using a BleuIO dongle.

The BleuIO dongles are purchasable either from their website or through third party resellers such as DigiKey.

nRF52840 Dongle

The Nordic Semiconductor nRF52840 Dongle is a popular Bluetooth development dongle. It works well with the “Bluetooth Low Energy” GUI tool in the “nRF Connect for Desktop” application suite. With this tool, you can scan for Bluetooth devices, connect to them, read their GATT services and characteristics, and read/write/subscribe to them. You can also setup the dongle to have it advertise.

A photo of the Nordic Semiconductor nRF52840 Dongle.

OS Support for Bluetooth

Windows

Windows only allows for one Bluetooth radio (adapter) to be active at a time (via the OS Bluetooth stack).25 If you have multiple Bluetooth adapters (including built-in ones or dongles) and want to switch between them manually, you typically need to enable and disable Bluetooth devices from the Device Manager. Dongles that don’t use the Windows Bluetooth stack (e.g. BleuIO) are not affected by this limitation.

Windows supports AFH (adaptive frequency hopping) for Bluetooth devices, but is disabled by default. A registry key needs to be written to first to enable AFH. This enables a “shared spectrum model” in where Windows can tell Bluetooth adapters which channels to avoid as to prevent interference with Wi-Fi.25

Windows also allows Bluetooth mouse and keyboard devices to wake up Windows from sleep (S3) or hibernate (S4) system power states. For this to work, the Bluetooth device must be self-powered.25

Range Extenders

Nordic Semiconductor nRF21540

The nRF21540 is a range extender FEM (front-end module) IC for 2.4 GHz RF communications, specifically targeted towards Bluetooth.

Below is a picture of the contents of the nRF21540 DB (development bundle). It contains two boards:

  1. nRF21540 EK: An analogue nRF21540-only dev. board in which you can pass RF in and out.
  2. nRF21540 DK: A board with both a nRF52840 SoC and nRF21540 integrated together for fast single-board development.

The analogue board is good if you have your own custom 2.4 GHz signal you want to amplify, while the integrated dev. board is if you want an all-in-one rapid prototyping solution.

Nordic has added support for this board in the Nordic nRF SDK (which builds on the Zephyr SDK) as the target nrf21540dk/nrf52840 (nrf21540dk_nrf52840 on older NCS).

What’s in the box of the nRF21540 development bundle.

There is an “Bluetooth: Throughput” example which acts as a good starting point for development with the nRF21540 DK. When testing with two development kits you can configure one as Central and one as a Peripheral. Below is an example of the output you get from the Central shell:

==== Starting throughput test ====
PHY update pending
Connection parameters update pending
Connection parameters updated.
interval: 320, latency: 0, timeout: 1000
LE PHY updated: TX PHY LE 2M, RX PHY LE 2M
LE Data length update pending
Frame space update pending
LE data len updated: TX (len: 251 time: 2120) RX (len: 251 time: 2120)
The test is in progress and will require around 20 seconds to complete.
Frame space updated: frame space 150 us, PHYs 0x0000, spacing types 0x0000
Done
[local] sent 3256110 bytes (3179 KB) in 20002 ms at 1302 kbps
[peer] received 3256110 bytes (3179 KB) in 6578 GATT writes at 1319187 bps

The preferred PHY can be set via the shell with the config phy <preferred_phy> command:

Terminal window
uart:~$ config phy
phy - Configure connection interval
Subcommands:
1M : Set preferred PHY to 1Mbps
2M : Set preferred PHY to 2Mbps
coded_s2 : Set preferred PHY to Coded S2
coded_s8 : Set preferred PHY to Coded S8

For example, to test Coded S8 PHY run config phy coded_s8.

Regulations

The most crucial regulation that most engineers will find themselves concerned with is the transmit power of the Bluetooth signal. The transmit power is usually adjustable in firmware — not only to meet local regulations but also to optimize power and limit range on purpose (sometimes limiting range on purpose is useful — imagine if your credit card tap-to-pay worked from a kilometre away!).

In the EU, ETSI EN 300 328 limits Bluetooth transmission power to:26

  • 20 dBm EIRP if the device uses adaptive frequency hopping spread spectrum (adaptive FHSS) techniques
  • 10 dBm EIRP if it doesn’t

To implement adaptive FHSS, the device must:

  • Hop across at least 15 different channels
  • Detect and avoid channels in use by other devices

USA

In the USA the transmission power is more permissive, with the FCC limiting Bluetooth transmission power to +30 dBm but PSD (power spectral density) must be below 8 dBm / 3 kHz if no adaptive FHSS is implemented. There are two channels with exceptions:26

  • Bluetooth Channel 37 is limited to 18 dBm.
  • Bluetooth Channel 38 is limited to 15.3 dBm.

For 1 Mbps, 2 Mbps and 500 kbps Coded PHY, devices can use 30 dBm transmit power. 125 kbps coded PHY doesn’t meet the 8 dBm / 3 kHz PSD requirement, and TX power is capped at 14 dBm.27

If the device has adaptive FHSS, then the PSD restrictions go away.27

See the RF Spectrum Regulations page for more information.

Footnotes

  1. Wikipedia (2023, Apr 27). Bluetooth Special Interest Group. Retrieved 2023-05-24, from https://en.wikipedia.org/wiki/Bluetooth_Special_Interest_Group.

  2. Bluetooth SIG. About Us - Origin of the Bluetooth Name. Retrieved 2023-05-24, from https://www.bluetooth.com/about-us/bluetooth-origin/.

  3. Wikipedia (2021, May 16). Piconet. Retrieved 2023-05-24, from https://en.wikipedia.org/wiki/Piconet.

  4. Vijay K. Garg (2007). Wireless Personal Area Network — Bluetooth. Wireless Communications & Networking. Retrieved 2023-05-24, from https://www.sciencedirect.com/book/9780123735805/wireless-communications-and-networking.

  5. Bluetooth SIG. Part A. Logical Link Control and Adaptation Protocol Specification [specification]. Retrieved 2025-09-18, from https://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Core-54/out/en/host/logical-link-control-and-adaptation-protocol-specification.html.

  6. Stack Overflow (2022, May). BLE L2CAP layer - segmentation vs fragmentation [forum post]. Retrieved 2025-09-18, from https://stackoverflow.com/questions/71504272/ble-l2cap-layer-segmentation-vs-fragmentation.

  7. Martin Woolley (2017, Aug 1). BlueTooth Blog - An Intro to Bluetooth Mesh Part 2. BlueTooth SIG. Retrieved 2023-05-24, from https://www.bluetooth.com/blog/an-intro-to-bluetooth-mesh-part2/.

  8. Silicon Labs. AN1137: Bluetooth Mesh Network Performance. Retrieved 2023-05-24, from https://www.silabs.com/documents/public/application-notes/an1137-bluetooth-mesh-network-performance.pdf.

  9. Nanjing Qinheng Microelectronics Co., Ltd. Bluetooth serial port transparent chip: CH9141. Retrieved 2024-11-20, from https://www.wch-ic.com/products/CH9141.html. 2

  10. Cypress Semiconductor (2016, Nov 23). CYW20702 - Single-Chip Bluetooth Transceiver and Baseband Processor [datasheet]. Retrieved 2025-02-05, from https://www.alldatasheet.com/datasheet-pdf/download/902264/CYPRESS/BCM20702.html.

  11. Wikipedia (2024, Sep 12). CSR plc [wiki]. Retrieved 2025-02-05, from https://en.wikipedia.org/wiki/CSR_plc.

  12. Shenzhen SHSD Technology Co.,Ltd. HC-05 Data Sheet - Bluetooth to Serial Port Module [datasheet]. Retrieved 2025-09-19, from https://cdn.awsli.com.br/945/945993/arquivos/HC-05-BOARD.pdf.

  13. ElectronicWings. Bluetooth Module HC-05 Pinout, AT Commands & Arduino Programming. Retrieved 2025-09-19, from https://www.electronicwings.com/sensors-modules/bluetooth-module-hc-05-.

  14. Bluetooth SIG (2003, Jun 5). RFCOMM with TS 07.10 Serial Port Emulation - v1.1 [specification]. Retrieved 2025-09-18, from https://www.bluetooth.com/specifications/specs/html/?src=RFCOMM_v1.1/out/en/index-en.html#UUID-d6d80781-0c47-2246-5814-6a44e22f6c27.

  15. Nordic Semiconductor. Nordic UART Service (NUS) [website]. Retrieved 2025-09-16, from https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/libraries/bluetooth/services/nus.html.

  16. Microchip (2023, Nov 9). Transparent UART service for BM70/RN4870 [website]. Retrieved 2025-09-16, from https://developerhelp.microchip.com/xwiki/bin/view/applications/ble/android-development-for-bm70rn4870/transparent-uart-service-for-bm70rn4870/.

  17. Texas Instruments (2015). TI Serial Port Service (SPS) - Service and characteristic description [pdf]. Retrieved 2025-09-16, from https://www.ti.com/lit/ug/tidua63/tidua63.pdf. 2

  18. u-blox (2021, Nov 29). u-connectXpress - Bluetooth Low Energy Serial Port Service - Protocol specification [pdf]. Retrieved 2025-09-19, from https://content.u-blox.com/sites/default/files/u-connectXpress-LowEnergySerialPortService_ProtocolSpec_UBX-16011192.pdf.

  19. Silicon Labs. SPP (Serial Port Profile) over BLE [documentation]. Retrieved 2025-09-19, from https://docs.silabs.com/bluetooth/2.13/bluetooth-code-examples-applications/.

  20. Matthew Ford (2017, Nov 15). Bluetooth V4, Bluetooth V5 (BLE) Problems and Solutions for General Purpose Control [article]. Forward Computing and Control Pty. Ltd. Retrieved 2025-09-16, from https://www.forward.com.au/pfod/BLE/BLEProblems/index.html.

  21. loginov-rocks. loginov-rocks/Web-Bluetooth-Terminal [GitHub repository]. GitHub. Retrieved 2025-09-15, from https://github.com/loginov-rocks/Web-Bluetooth-Terminal.

  22. noble. noble/noble [GitHub repository]. GitHub. Retrieved 2025-09-19, from https://github.com/noble/noble.

  23. BleuIO. Homepage [website]. Retrieved 2025-11-11, from https://www.bleuio.com/.

  24. Microsoft. Learn > Windows > Windows Drivers > Bluetooth FAQ. Retrieved 2025-11-14, from https://learn.microsoft.com/en-us/windows-hardware/drivers/bluetooth/bluetooth-faq. 2 3 4

  25. Michael Spörk (2025, Feb 6). Boosting Bluetooth Range: Understanding TX Power Regulations in the EU & US. Dewine Labs. Retrieved 2026-05-22, from https://dewinelabs.com/boosting-bluetooth-range-understanding-tx-power-regulations-in-the-eu-us/. 2

  26. Silicon Labs. TX Power Limitations for Regulatory Compliance (ETSI, FCC) [documentation]. Retrieved 2026-05-25, from https://docs.silabs.com/bluetooth/5.0/bluetooth-general-system-and-performance/tx-power-limitations-for-regulatory-compliance-etsi-fcc. 2