Bluetooth packet sniffer vs. scanner: what's the difference?
Search for a "Bluetooth packet sniffer" and you'll get a mix of $10 phone apps and $100+ hardware dongles, all claiming to do the same thing. They don't. Under the umbrella term "Bluetooth sniffing" are two genuinely different capabilities, and buying (or downloading) the wrong one is the most common mistake people make.
This guide draws the line clearly so you can pick the right tool the first time.
The one distinction that matters
Bluetooth Low Energy traffic comes in two flavors, and capturing each requires different tools:
| Advertisement scanning | Connection packet capture | |
|---|---|---|
| What it captures | Broadcast advertisement packets | Data exchanged inside a live connection |
| Channels | 3 fixed advertising channels | 37 hopping data channels |
| Hardware needed | Any phone or laptop | Dedicated sniffer radio |
| Timing | Capture anytime | Must capture from before the connection starts |
| Typical user | Anyone identifying/locating devices | Reverse engineers, firmware devs |
Advertisement scanning (what a "BLE scanner" does)
BLE devices that want to be found broadcast small advertisement packets on three fixed channels. These are public — it's how discovery works. A scanner just listens on those channels and reports what it hears:
- Device name (when broadcast)
- Bluetooth address
- Signal strength (RSSI)
- Manufacturer data
- Advertised service UUIDs
This needs no special hardware. Your phone's Bluetooth radio already listens on the advertising channels every time it looks for a device to pair with. A scanner app simply shows you the raw results instead of hiding them.
When this is what you want: identifying an unknown device, checking whether something is broadcasting, gauging how close a device is, auditing the BLE devices in a space, or debugging your own device's advertisements.
Connection packet capture (what a "packet sniffer" does)
Once two devices connect, they stop using the advertising channels and start frequency hopping across 37 data channels, changing channel many times per second according to a pattern negotiated at connection time. To capture that traffic, a sniffer has to:
- Detect the connection request,
- Learn the hopping pattern from it, and
- Follow the two devices across all 37 channels in lock-step.
That's why you need dedicated hardware (like an nRF52840 dongle or an Ubertooth One) and why you usually have to start the capture before the two devices connect — miss the connection request and you've missed the hopping parameters.
Even then, if the connection is encrypted, you capture ciphertext. Getting plaintext requires capturing the pairing exchange and, depending on the security mode, may not be feasible at all.
When this is what you want: reverse engineering a proprietary protocol, debugging your own firmware's GATT traffic, or security-testing a device you're authorized to assess.
Why your phone can do one but not the other
A phone's Bluetooth stack is built to use Bluetooth, not to spy on it. The operating system gives apps access to the scanning API — the same one used for discovery — so any app can read advertisements. But phones deliberately don't expose the low-level radio control needed to follow arbitrary connections across hopping channels. That's a hardware-and-driver capability, and it's why full packet capture lives on dedicated dongles.
This isn't a limitation to work around; it's the right tool for each job. For the vast majority of tasks — "what's this device," "is it nearby," "is my beacon advertising correctly" — advertisement scanning on a phone is faster and more convenient than any dongle.
Picking your tool
Start with a phone app if you want to identify devices, measure proximity, audit a space, or verify your own advertisements. BLE Sniffer for Android scans nearby devices, logs every session offline, exports to CSV, and includes an RSSI proximity radar — no ads, no telemetry, data stays on-device.
Reach for dedicated hardware if you need to capture the traffic inside live connections. See our BLE sniffer hardware guide for the nRF52840, Ubertooth One, and other options, and our Bluetooth protocol analyzer guide for the software that decodes what they capture.
Bottom line
A "scanner" reads the public advertisements every discoverable device broadcasts — your phone can do it today. A "packet sniffer" follows the private, channel-hopping traffic inside connections — that needs dedicated hardware. Match the tool to the job and you'll save yourself both money and frustration.