Skip to content

BD_ADDR (Bluetooth Device Address)

Definition

The 48-bit hardware address assigned to each classic Bluetooth device by its manufacturer. Analogous to a MAC address on Ethernet. Unlike BLE random addresses, a classic BD_ADDR is fixed and persistent, making it a reliable identifier across pairing records, logs, and packet captures.

Length
48 bits (6 bytes)
Format
Written as six colon-separated hex octets
Analogue
Ethernet MAC address
Persistence
Fixed, unlike BLE random resolvable addresses
OUI segment
Upper 24 bits identify the chipset manufacturer

Common questions

Why does BD_ADDR matter more than a BLE address in an investigation?+

Classic BD_ADDR does not rotate, so it can be correlated across an evidence timeline: pairing logs on a phone, packet captures from a sniffer, and access-point association records can all be tied to the same physical device with confidence.

Can a BD_ADDR be spoofed?+

Yes. Many Bluetooth chipsets let firmware or software set the address field, so a captured BD_ADDR should be corroborated with other identifiers, such as the device name, service UUIDs, or link key, rather than treated as unforgeable on its own.

Related terms

GATT (Generic Attribute Profile)
The protocol framework used by BLE for data exchange. A GATT server exposes data as Services and Characteristics; a GATT client reads...
Link Key / Long-Term Key (LTK)
The cryptographic secret negotiated during Bluetooth pairing that is stored on both devices and used to authenticate and encrypt subsequent connections. In...
Resolvable Private Address (RPA)
A BLE address type that rotates on a timer (typically every 15 minutes) but can be resolved back to the device's true...
RFCOMM
Radio Frequency Communication, the Bluetooth protocol that emulates a serial RS-232 connection over an L2CAP channel. Used by profiles including Serial Port...
Ubertooth One
An open-source USB Bluetooth sniffing platform developed by Michael Ossmann that can capture raw Bluetooth BR/EDR and BLE frames from the air....

Explained in

Your journey to becoming a forensic professional starts here.

Practice with mock tests, learn from structured notes, and get your questions answered by a global forensic community, all in one place.