Bluetooth Mesh Networking: Architecture and Concepts
Understanding mesh topology, provisioning, and models
Bluetooth Mesh Overview
Bluetooth Mesh extends BLE from a star topology (one central, many peripherals) to a full many-to-many network. A single mesh can contain hundreds of nodes communicating across hundreds of meters — far beyond the direct range of any individual radio. The specification, maintained by the Bluetooth SIG, defines the complete stack from flooding protocol to application models.
Mesh Architecture
Bluetooth Mesh does not use ATT">GATT connections for data transport. Instead, it repurposes BLE advertising and scanning as a broadcast transport layer. Nodes receive messages on advertisement channels and re-broadcast them — a technique called managed flooding. Every transmission carries a TTL (Time to Live) field that decrements at each hop, preventing infinite loops.
The mesh stack layers:
| Layer | Role |
|---|---|
| Bearer | BLE advertising (ADV bearer) or GATT proxy (GATT bearer) |
| Network | Source/destination addressing, TTL, encryption, obfuscation |
| Lower Transport | Segmentation and reassembly of messages > 11 bytes |
| Upper Transport | Access message encryption and friend/low-power handshake |
| Access | Publish-Subscribe model, opcode dispatch |
| Foundation Models | Configuration, health |
| Application Models | Lighting, sensors, scenes, time, etc. |
Node Types
Not every mesh node has the same role:
| Node Type | Function |
|---|---|
| Relay Node | Re-broadcasts received messages, extends range |
| Friend Node | Stores messages for sleeping low-power nodes |
| Low-Power Node | Sleeps most of the time; polls Friend for queued messages |
| Proxy Node | Bridges GATT-connected phones/tablets to the advertising-based mesh |
| Provisioner | Adds new nodes to the network (assigns address, distributes keys) |
A node can combine multiple roles (e.g., a mains-powered sensor can be Relay + Friend simultaneously). Battery-powered nodes should typically be Low-Power Nodes to achieve multi-year battery life.
Provisioning
Provisioning is the secure onboarding process that transforms an unprovisioned device into a mesh node. The Provisioner (usually a smartphone app or a dedicated gateway) performs a five-step handshake:
- Beaconing: Unprovisioned device advertises its UUID
- Invitation: Provisioner sends capabilities request
- Exchanging Public Keys: ECDH key agreement (analogous to LESC pairing)
- Authentication: One of four methods (No OOB, Static OOB, Output OOB, Input OOB)
- Distribution: Provisioner sends Network Key, device address, and IV Index
After provisioning, the Configuration Client (running on the Provisioner or a separate controller) uses the Foundation Model to bind App Keys and configure publish/subscribe addresses.
Publish-Subscribe Model
Bluetooth Mesh uses a publish-subscribe model rather than point-to-point addressing. Each model instance publishes to a Group Address and subscribes to one or more Group Addresses. A light switch model publishes Generic OnOff Set to address 0xC000; all luminaires subscribed to 0xC000 respond simultaneously — no explicit addressing of individual nodes.
This decoupling makes the network topology independent of the application logic. Adding a new luminaire requires only subscribing it to the correct group address; no switch firmware changes.
Group address assignment is managed by the Provisioner and recorded in the mesh configuration database.
Frequently Asked Questions
Bluetooth Mesh uses managed flooding: nodes with the Relay feature enabled re-broadcast received messages across the network. Each message carries a TTL field (Time To Live) decremented by each relaying node; when TTL reaches 1 the node processes but does not relay further. A sequence number and source address cache prevent duplicate delivery even when multiple relay paths exist.
The specification supports up to 32,767 unicast addresses per subnet and up to 16,383 group addresses. In practice, network size is constrained by message propagation latency and relay density. Production deployments with thousands of nodes are common in commercial lighting, but each additional relay hop adds roughly 10-20 ms of end-to-end latency.
Provisioning is the secure onboarding process by which an unprovisioned device receives a unicast address, NetKey, and AppKey from a Provisioner (typically a smartphone or gateway). The exchange uses Elliptic Curve Diffie-Hellman key agreement and optionally Out-of-Band authentication to prevent interception. Once provisioned, the node can communicate securely on the mesh network.
Yes. The Mesh specification defines GATT Proxies — mesh nodes that expose the Mesh Proxy Service over a standard BLE GATT connection. This allows smartphones and devices without native mesh advertising support to inject and receive mesh messages via a GATT connection to a nearby proxy node, requiring no special hardware beyond a standard BLE chip.
Yes, our guides range from beginner introductions to advanced topics. Each guide indicates its difficulty level and prerequisites so you can find the right starting point.