[RR Bluetooth] gatttool - What HCI Commands are Sent by gatttool (4) char-desc

char-desc       [start hnd] [end hnd]          Characteristics Descriptor Discovery

It is defined in "4.7 CHARACTERISTIC DESCRIPTOR DISCOVERY" in Bluetooth Specification Core 4.2.

This sub-procedure is used by a client to find all the characteristic descriptor’s
Attribute Handles and Attribute Types within a characteristic definition when
only the characteristic handle range is known

Find Information Request:

< ACL Data TX: Handle 71 flags 0x00 dlen 9                      [hci0] 5.648413
      ATT: Find Information Request (0x04) len 4
        Handle range: 0x0001-0x0002

< 02 47 00 09 00 05 00 04 00 04 01 00 02 00 

> HCI Event: Number of Completed Packets (0x13) plen 5          [hci0] 5.803482
        Num handles: 1
        Handle: 71
        Count: 1

> 04 13 05 01 47 00 01 00 

Find Information Response

> ACL Data RX: Handle 71 flags 0x02 dlen 14                     [hci0] 5.873329
      ATT: Find Information Response (0x05) len 9
        Format: UUID-16 (0x01)
        Handle: 0x0001
        UUID: Primary Service (0x2800)
        Handle: 0x0002
        UUID: Characteristic (0x2803)

> 02 47 20 0E 00 0A 00 04 00 05 01 01 00 00 28 02 00 03 28 

Note: The sub-procedure is complete when the Error Response is received and the Error Code is set to Attribute Not Found or the Find Information Response has an Attribute Handle that is equal to the Ending Handle of the request. (4.7.1 Discover All Characteristic Descriptors@ BT Spec Core 4.2)

[RR Bluetooth] gatttool - What HCI Commands are Sent by gatttool (2) primary

First of all, the packets below are all HCI ACL Data Packet (with indicator 0x02)

for example, ATT Command - Read By Group Type Request
0000: 02 47 00 0b 00 07 00 04  00 10 01 00 ff ff 00 28

0x02 is HCI ACL Data Packet (Table 2.1 HCI Packet Indicator)
0x47 is Handle
0x00 means PB Flag and BC Flag is 0
0x000b is Data Total Length

then follows the L2CAP packet

0x0007 is length
0x0004 is CID (Attribute Protocol PDU)

and then Attribute Protocol PDU

primary         [UUID]                         Primary Service Discover

the UUID means "Discover Primary Services By Service UUID"

If left UUID blank:

Read by Group Type Request

< ACL Data TX: Handle 71 flags 0x00 dlen 11            
      ATT: Read By Group Type Request (0x10) len 6
        Handle range: 0x0001-0xffff
        Attribute group type: Primary Service (0x2800)

0000: 02 47 00 0b 00 07 00 04  00 10 01 00 ff ff 00 28

Number of Completed Packets Event

> HCI Event: Number of Completed Packets (0x13) plen 5   [hci0] 22:57:39.703757
        Num handles: 1
        Handle: 71
        Count: 1

> 0000: 04 13 05 01 47 00 01 00     

Read by Group Type Response

> ACL Data RX: Handle 71 flags 0x02 dlen 24            
      ATT: Read By Group Type Response (0x11) len 19
        Attribute data length: 6
        Attribute group list: 3 entries
        Handle range: 0x0001-0x000b
        UUID: Generic Access Profile (0x1800)
        Handle range: 0x000c-0x000f
        UUID: Generic Attribute Profile (0x1801)
        Handle range: 0x0010-0x0022
        UUID: Device Information (0x180a)

> 0000: 02 47 20 18 00 14 00 04  00 11 06 01 00 0b 00 00  0010: 18 0c 00 0f 00 01 18 10  00 22 00 0a 18           

It looks like that one response delivers a group a time, so successive request/response continues until handle reaches 0xffff

< ACL Data TX: Handle 71 flags 0x00 dlen 11              [hci0] 22:57:39.844179
      ATT: Read By Group Type Request (0x10) len 6
        Handle range: 0x0023-0xffff
        Attribute group type: Primary Service (0x2800)
> HCI Event: Number of Completed Packets (0x13) plen 5   [hci0] 22:57:39.913884
        Num handles: 1
        Handle: 71
        Count: 1
> ACL Data RX: Handle 71 flags 0x02 dlen 26              [hci0] 22:57:39.983445
      ATT: Read By Group Type Response (0x11) len 21
        Attribute data length: 20
        Attribute group list: 1 entry
        Handle range: 0x0023-0x002d
        UUID: Unknown (f000aa00-0451-4000-b000-000000000000)
< ACL Data TX: Handle 71 flags 0x00 dlen 11              [hci0] 22:57:39.983995
      ATT: Read By Group Type Request (0x10) len 6
        Handle range: 0x002e-0xffff
        Attribute group type: Primary Service (0x2800)
> HCI Event: Number of Completed Packets (0x13) plen 5   [hci0] 22:57:40.060765
        Num handles: 1
        Handle: 71
        Count: 1
> ACL Data RX: Handle 71 flags 0x02 dlen 26              [hci0] 22:57:40.123327
      ATT: Read By Group Type Response (0x11) len 21
        Attribute data length: 20
        Attribute group list: 1 entry
        Handle range: 0x002e-0x0038
        UUID: Unknown (f000aa10-0451-4000-b000-000000000000)
< ACL Data TX: Handle 71 flags 0x00 dlen 11              [hci0] 22:57:40.123544
      ATT: Read By Group Type Request (0x10) len 6
        Handle range: 0x0039-0xffff
        Attribute group type: Primary Service (0x2800)
> HCI Event: Number of Completed Packets (0x13) plen 5   [hci0] 22:57:40.193685
        Num handles: 1
        Handle: 71
        Count: 1
> ACL Data RX: Handle 71 flags 0x02 dlen 26              [hci0] 22:57:40.263413
      ATT: Read By Group Type Response (0x11) len 21
        Attribute data length: 20
        Attribute group list: 1 entry
        Handle range: 0x0039-0x0043
        UUID: Unknown (f000aa20-0451-4000-b000-000000000000)
< ACL Data TX: Handle 71 flags 0x00 dlen 11              [hci0] 22:57:40.263720
      ATT: Read By Group Type Request (0x10) len 6
        Handle range: 0x0044-0xffff
        Attribute group type: Primary Service (0x2800)
> HCI Event: Number of Completed Packets (0x13) plen 5   [hci0] 22:57:40.403808
        Num handles: 1
        Handle: 71
        Count: 1
> ACL Data RX: Handle 71 flags 0x02 dlen 26              [hci0] 22:57:40.404839
      ATT: Read By Group Type Response (0x11) len 21
        Attribute data length: 20
        Attribute group list: 1 entry
        Handle range: 0x0044-0x004e
        UUID: Unknown (f000aa30-0451-4000-b000-000000000000)
< ACL Data TX: Handle 71 flags 0x00 dlen 11              [hci0] 22:57:40.405062
      ATT: Read By Group Type Request (0x10) len 6
        Handle range: 0x004f-0xffff
        Attribute group type: Primary Service (0x2800)
> HCI Event: Number of Completed Packets (0x13) plen 5   [hci0] 22:57:40.473655
        Num handles: 1
        Handle: 71
        Count: 1
> ACL Data RX: Handle 71 flags 0x02 dlen 26              [hci0] 22:57:40.549909
      ATT: Read By Group Type Response (0x11) len 21
        Attribute data length: 20
        Attribute group list: 1 entry
        Handle range: 0x004f-0x005d
        UUID: Unknown (f000aa40-0451-4000-b000-000000000000)
< ACL Data TX: Handle 71 flags 0x00 dlen 11              [hci0] 22:57:40.550199
      ATT: Read By Group Type Request (0x10) len 6
        Handle range: 0x005e-0xffff
        Attribute group type: Primary Service (0x2800)
> HCI Event: Number of Completed Packets (0x13) plen 5   [hci0] 22:57:40.613695
        Num handles: 1
        Handle: 71
        Count: 1
> ACL Data RX: Handle 71 flags 0x02 dlen 26              [hci0] 22:57:40.683447
      ATT: Read By Group Type Response (0x11) len 21
        Attribute data length: 20
        Attribute group list: 1 entry
        Handle range: 0x005e-0x0068
        UUID: Unknown (f000aa50-0451-4000-b000-000000000000)
< ACL Data TX: Handle 71 flags 0x00 dlen 11              [hci0] 22:57:40.683942
      ATT: Read By Group Type Request (0x10) len 6
        Handle range: 0x0069-0xffff
        Attribute group type: Primary Service (0x2800)
> HCI Event: Number of Completed Packets (0x13) plen 5   [hci0] 22:57:40.753660
        Num handles: 1
        Handle: 71
        Count: 1
> ACL Data RX: Handle 71 flags 0x02 dlen 12              [hci0] 22:57:40.823257
      ATT: Read By Group Type Response (0x11) len 7
        Attribute data length: 6
        Attribute group list: 1 entry
        Handle range: 0x0069-0x006d
        UUID: Unknown (0xffe0)
< ACL Data TX: Handle 71 flags 0x00 dlen 11              [hci0] 22:57:40.823554
      ATT: Read By Group Type Request (0x10) len 6
        Handle range: 0x006e-0xffff
        Attribute group type: Primary Service (0x2800)
> HCI Event: Number of Completed Packets (0x13) plen 5   [hci0] 22:57:40.893657
        Num handles: 1
        Handle: 71
        Count: 1
> ACL Data RX: Handle 71 flags 0x02 dlen 26              [hci0] 22:57:40.970015
      ATT: Read By Group Type Response (0x11) len 21
        Attribute data length: 20
        Attribute group list: 1 entry
        Handle range: 0x006e-0x0074
        UUID: Unknown (f000aa60-0451-4000-b000-000000000000)
< ACL Data TX: Handle 71 flags 0x00 dlen 11              [hci0] 22:57:40.970332
      ATT: Read By Group Type Request (0x10) len 6
        Handle range: 0x0075-0xffff
        Attribute group type: Primary Service (0x2800)
> HCI Event: Number of Completed Packets (0x13) plen 5   [hci0] 22:57:41.033661
        Num handles: 1
        Handle: 71
        Count: 1
> ACL Data RX: Handle 71 flags 0x02 dlen 26              [hci0] 22:57:41.103462
      ATT: Read By Group Type Response (0x11) len 21
        Attribute data length: 20
        Attribute group list: 1 entry
        Handle range: 0x0075-0x007f
        UUID: Unknown (f000ccc0-0451-4000-b000-000000000000)
< ACL Data TX: Handle 71 flags 0x00 dlen 11              [hci0] 22:57:41.103968
      ATT: Read By Group Type Request (0x10) len 6
        Handle range: 0x0080-0xffff
        Attribute group type: Primary Service (0x2800)
> HCI Event: Number of Completed Packets (0x13) plen 5   [hci0] 22:57:41.173666
        Num handles: 1
        Handle: 71
        Count: 1
> ACL Data RX: Handle 71 flags 0x02 dlen 26              [hci0] 22:57:41.243343
      ATT: Read By Group Type Response (0x11) len 21
        Attribute data length: 20
        Attribute group list: 1 entry
        Handle range: 0x0080-0xffff
        UUID: Unknown (f000ffc0-0451-4000-b000-000000000000)

If UUID is used (0x1801 for example):

Find By Type Value Request

< ACL Data TX: Handle 71 flags 0x00 dlen 13              [hci0] 01:01:43.451403
      ATT: Find By Type Value Request (0x06) len 8
        Handle range: 0x0001-0xffff
        Attribute type: Primary Service (0x2800)
          UUID: Generic Attribute Profile (0x1801)

< 0000: 02 47 00 0d 00 09 00 04  00 06 01 00 ff ff 00 28
  0010: 01 18  

> HCI Event: Number of Completed Packets (0x13) plen 5   [hci0] 01:01:44.241679
        Num handles: 1
        Handle: 71
        Count: 1

Find By Type Value Response

Note: The Group End Handle may be greater than the Ending Handle in the Find By Type Value Request.

> ACL Data RX: Handle 71 flags 0x02 dlen 9               [hci0] 01:01:44.311128
      ATT: Find By Type Value Response (0x07) len 4
        Handle range: 0x000c-0x000f

> 0000: 02 47 20 09 00 05 00 04  00 07 0c 00 0f 00 

Then another Find By Type Value Request is sent with the rest of handle replied by the response above

< ACL Data TX: Handle 71 flags 0x00 dlen 13              [hci0] 01:01:44.311737
      ATT: Find By Type Value Request (0x06) len 8
        Handle range: 0x0010-0xffff
        Attribute type: Primary Service (0x2800)
          UUID: Generic Attribute Profile (0x1801)
> HCI Event: Number of Completed Packets (0x13) plen 5   [hci0] 01:01:44.381585
        Num handles: 1
        Handle: 71
        Count: 1

 Error Response

> ACL Data RX: Handle 71 flags 0x02 dlen 9               [hci0] 01:01:44.450990
      ATT: Error Response (0x01) len 4
        Find By Type Value Request (0x06)
        Handle: 0x0010
        Error: Attribute Not Found (0x0a)

> 0000: 02 47 20 09 00 05 00 04  00 01 06 10 00 0a