What is Bluetooth Low Energy and how does it work?
Bluetooth is a short-range radio standard that lives in the 2.4 GHz ISM band, a license-free slice of spectrum shared with Wi-Fi, cordless phones and microwave ovens. It comes in two flavors that do not talk to each other directly. Classic Bluetooth moves continuous streams such as audio. Bluetooth Low Energy, or BLE, was designed for devices that sleep almost all the time and wake briefly to send a few bytes. Most modern sensors, door contacts, tags and phone-to-device links in security work use BLE because a small battery can last a very long time.
Both flavors use frequency hopping, jumping between channels many times a second so that one noisy channel spoils only a few packets. BLE divides the band into forty channels, three of them reserved for advertising, the broadcast messages devices use to announce themselves. The remaining channels carry data once two devices connect. The modulation is a simple frequency shift scheme, which keeps radios cheap and low power. A device can be a broadcaster that never connects, or a peripheral that accepts a connection from a central such as a phone or a gateway.
How do advertising, connections and GATT differ?
Advertising is one-way. A beacon or sensor transmits a small packet at a set interval, and any listener in range can read it. This is cheap and fast, and it is how proximity tags and environmental sensors report readings without ever pairing. A scanner only needs to listen, and many advertisers can be heard at once. The trade-off is that anyone nearby can read the packet too, so advertised data should be treated as public unless it is encoded in a way only the intended receiver can interpret.
A connection is two-way and scheduled. After a central initiates it, both sides agree on timing and the hop sequence, then exchange data through GATT, the Generic Attribute Profile. GATT organizes information as services containing characteristics, like labeled mailboxes holding a temperature, a battery level or a command. A client reads, writes, or subscribes to notifications when a value changes. Connections allow larger exchanges and configuration, but most devices accept only a few simultaneous links, so a gateway collecting from many sensors usually listens to advertisements or rotates through connections one at a time.
How far does Bluetooth reach, and what limits it?
Range depends on transmit power, receiver sensitivity, antenna design and what lies between the two ends, so quoting a single number is misleading. In everyday practice Bluetooth is a room-to-building-scale technology, and open-air line of sight can stretch much farther. Version 5 added coded physical layers that trade speed for sensitivity and so extend reach at lower data rates, while a faster mode does the reverse. Read the datasheet for the mode actually in use, and test on the real site instead of trusting a headline figure.
At 2.4 GHz, signals are absorbed by water, including people and wet foliage, and reflected or blocked by metal. A steel trailer, enclosure or fence can shadow a sensor completely or create strange reflections, and an antenna pressed against metal detunes. Wi-Fi shares the band, but hopping avoids busy channels, so interference more often causes retries and delay than outright failure, though a very crowded site can still suffer. Mounting height, antenna orientation and a clear path matter more than raw power. Allowed transmit power varies by country and region, so check local regulations.
What are the security weaknesses of Bluetooth?
Bluetooth security depends on how devices pair and what the manufacturer implements. Older legacy pairing in BLE used a weak key exchange that an eavesdropper who captured the pairing could crack offline. LE Secure Connections replaced it with elliptic curve key agreement, which resists passive listening. Yet a Just Works pairing, where no code is compared, gives no protection against an active man in the middle, because neither side verifies who it is talking to. Numeric comparison, passkey entry or an out-of-band exchange such as scanning a printed code provides that verification.
Other risks are practical. Unencrypted advertising can leak identifiers and readings, and fixed addresses let a stranger follow a device over time, which is why address privacy features rotate them. Relay attacks forward a genuine signal between two distant points so a proximity unlock believes the owner is near; distance bounding or requiring a second action, like a button press, helps. Weak default keys, shared factory secrets and unsigned firmware updates are common real-world failures. Sensible mitigations are secure pairing modes, application-layer encryption, disabling unused services, changing defaults and keeping firmware current.
Where does Bluetooth fit on remote or temporary sites?
Bluetooth shines for short hops. A technician can configure a device from a phone during installation, read a battery or tilt sensor, or pair to a lock or controller without running any cable. Because it needs no network infrastructure, it works at a bare construction site, a gate or a ballot drop box location where nothing else exists. Door and gate contacts, temperature probes and asset tags often use BLE to reach a nearby gateway, which forwards the data over cellular or Ethernet.
It is a poor choice for covering a large yard, or for reaching through metal enclosures and many obstructions. For wide-area sensor coverage, long-range low-power networks or point-to-point links suit better. Treat the Bluetooth link as a local last hop, secure it properly, and make the gateway the single path to the wider network. Plan battery replacement schedules too, since small cells in outdoor sensors lose capacity in cold weather, and keep a record of which devices are paired to which gateway so a lost or swapped device can be revoked.
Key terms
- BLE (Bluetooth Low Energy)
- A power-saving Bluetooth variant for devices that wake briefly, send small amounts of data, and sleep, so small batteries last a long time.
- Advertising
- One-way broadcast packets a device sends at intervals so scanners can find it and read small payloads without pairing.
- GATT
- The Generic Attribute Profile, which organizes data on a connected BLE device into services and characteristics that a client can read, write or subscribe to.
- Frequency hopping
- Rapidly switching among radio channels in a known sequence so interference on any one channel affects only a few packets.
- Pairing
- The process in which two devices authenticate each other and agree on encryption keys for later secure communication.
- Relay attack
- An attack that forwards a genuine signal between two distant points to fool a proximity-based device into thinking its owner is close.
- Coded PHY
- A Bluetooth 5 radio mode that adds redundancy to each bit, improving sensitivity and reach at the cost of lower data rate.
A site that uses Bluetooth devices usually treats them as a local last hop. Sensors or locks talk to a nearby gateway, and if a site needs it, that gateway's events can reach a monitoring platform over cellular. A trailer like this has a steel body and an enclosure on a mast, so antenna placement and test walks matter, and any Bluetooth pairing should use verified modes and be done before the unit is left unattended.
Common questions
Is Bluetooth secure enough for access control?
It can be, if the device uses modern secure pairing, encrypts data at the application level, and resists replay and relay attacks. Weak designs using Just Works pairing, static identifiers or default keys are not. Ask what pairing mode and encryption the product actually uses.
Why does Bluetooth struggle near metal?
Metal reflects and blocks 2.4 GHz signals, so a steel enclosure or fence can shadow a sensor or distort its pattern. An antenna pressed against metal also detunes. Mount the antenna clear of metal, raised, and test on the actual site.
What is the difference between Bluetooth and BLE?
Classic Bluetooth is built for continuous streams such as audio, while BLE is built for short, infrequent bursts of data and very low power. They use the same band but are different protocols, and a BLE-only device cannot talk to a classic-only one.