Active Scanning

Active Scanning

Advertising">Active scanning is a BLE scanning mode in which the central device not only listens for advertising packets but also sends SCAN_REQ packets to advertisers to request additional data via scan response. This provides more information about a peripheral before a connection is established, at the cost of slightly higher power consumption and radio activity.

How Active Scanning Works

During active scanning, the central's radio alternates between a scan window (radio on, listening) and a scan interval (total cycle time). When the central receives an ADV_IND or ADV_SCAN_IND packet from a peripheral, it sends a SCAN_REQ on the same advertising channel. The peripheral responds with a SCAN_RSP packet containing up to 31 bytes of additional advertising data.

The three-packet exchange (ADV, SCAN_REQ, SCAN_RSP) occurs within a single advertising event window, typically completing in under 2 ms. The central's BLE stack delivers both the advertising data and the scan response data to the application together, providing up to 62 bytes of pre-connection information.

Active vs. Passive Scanning

In passive scanning, the central only listens and never transmits. This difference has two important implications:

• Privacy: Active scanning reveals the central's presence to the advertiser and to any eavesdropper monitoring the channel, because the SCAN_REQ contains the central's device address. Passive scanning is invisible to the network.
• Data availability: Active scanning provides up to 62 bytes of data (31 advertising + 31 scan response), while passive scanning is limited to the 31 bytes in the advertising packet alone.

When to Use Active Scanning

Active scanning is the default mode for most BLE central applications, including smartphone operating systems. Both iOS and Android use active scanning by default when applications request BLE device discovery. It is preferred when the application needs the peripheral's complete local name, additional service UUIDs, or manufacturer-specific data that does not fit in the primary advertising packet.

Privacy Considerations

Because SCAN_REQ packets contain the central's address, active scanning can be used to track central devices. To mitigate this, BLE supports LE Privacy with Resolvable Private Addresses (RPAs) that change periodically, preventing long-term tracking of the scanning device across different locations and time periods.