GATT (Generic Attribute Profile)
Definition
The protocol framework used by BLE for data exchange. A GATT server exposes data as Services and Characteristics; a GATT client reads or subscribes to them. Fitness trackers, heart rate monitors, and smart locks use GATT. Packet captures of BLE traffic contain GATT read/write/notify operations that reveal the data exchanged.
- Used by
- Bluetooth Low Energy (BLE) for data exchange
- Server role
- Exposes data as Services and Characteristics
- Client role
- Reads or subscribes to server data
- Example devices
- Fitness trackers, heart rate monitors, smart locks
Common questions
What forensic value do GATT operations in a packet capture provide?+
Captured read, write, and notify operations reveal the actual data a BLE device exchanged, such as heart rate readings, lock state changes, or step counts, which can corroborate or contradict a device owner's account of their activity or location at a given time.
How does GATT differ from the pairing and connection layer of BLE?+
Pairing and connection establish and secure the radio link between two devices, while GATT operates above that layer to define how application data, such as a specific sensor reading, is structured and accessed once the connection exists.
Can GATT traffic be read if the BLE link is encrypted?+
Encrypted GATT traffic requires the session or long-term keys to decode; without them an examiner can see that communication occurred and its timing and characteristic identifiers, but not the plaintext data values themselves.
Related terms
- BD_ADDR (Bluetooth Device Address)
- The 48-bit hardware address assigned to each classic Bluetooth device by its manufacturer. Analogous to a MAC address on Ethernet. Unlike BLE...
- Link Key / Long-Term Key (LTK)
- The cryptographic secret negotiated during Bluetooth pairing that is stored on both devices and used to authenticate and encrypt subsequent connections. In...
- Resolvable Private Address (RPA)
- A BLE address type that rotates on a timer (typically every 15 minutes) but can be resolved back to the device's true...
- RFCOMM
- Radio Frequency Communication, the Bluetooth protocol that emulates a serial RS-232 connection over an L2CAP channel. Used by profiles including Serial Port...
- Ubertooth One
- An open-source USB Bluetooth sniffing platform developed by Michael Ossmann that can capture raw Bluetooth BR/EDR and BLE frames from the air....