一個BLE HCI ACLpacket的實例分析，原始數據如下
02 02 20 0f 00 0b 00 04 00 1b 2f 00 00 00 4f 00 00 00 00 00
1. 第1字節表示HCI packet的類型
Vol 4: Host Controller Interface [Transport Layer] -- Part A -- 2 protocol
// bluedroid\hci\src\hci_h4.c
/* HCI H4 message type definitions */
#define H4_TYPE_COMMAND 1
#define H4_TYPE_ACL_DATA 2
#define H4_TYPE_SCO_DATA 3
#define H4_TYPE_EVENT 4
02 表示這是一個HCI ACL Data packet
2. HCI ACL Data packet的第2、3字節代表Handle + PB Flag + BC Flag
小端模式的“02 20”實際值爲0x2002，對應上圖可知
Handle = 0x2002 & 0x0FFF = 0x0002
PB Flag = (0x20 >> 4) & 0x03 = 0x02，表示這是一個起始包
3. HCI ACL Data packet的第4、5字節代表該HCI ACL Data packet的Data Total Length
小端模式的“0f 00”實際值爲0x000f，Data部分的數據總長度是15。
4. 起始包的第6、7字節代表該PDU的長度，如果PDU的長度超過了Data Total Length，將要分包發送
“0b 00” = 0x000b， L2CAP PDU的長度爲11
5. 起始包的第8、9字節代表該L2CAP PDU的Channel ID
// bluedroid\stack\include\l2cdefs.h
/* L2CAP Predefined CIDs (0x0004-0x003E Reserved)
*/
#define L2CAP_SIGNALLING_CID 1
#define L2CAP_CONNECTIONLESS_CID 2
#define L2CAP_AMP_CID 3
#define L2CAP_ATT_CID 4
#define L2CAP_BLE_SIGNALLING_CID 5
#define L2CAP_SMP_CID 6
#define L2CAP_AMP_TEST_CID 0x003F
#define L2CAP_BASE_APPL_CID 0x0040
“04 00” = 0x0004，表示Attribute protocol
6. 第10字節代表Attribute protocol PDU的操作碼Opcode
// bluedroid\stack\include\gatt_api.h
#define GATT_RSP_ERROR 0x01
#define GATT_REQ_MTU 0x02
#define GATT_RSP_MTU 0x03
#define GATT_REQ_FIND_INFO 0x04
#define GATT_RSP_FIND_INFO 0x05
#define GATT_REQ_FIND_TYPE_VALUE 0x06
#define GATT_RSP_FIND_TYPE_VALUE 0x07
#define GATT_REQ_READ_BY_TYPE 0x08
#define GATT_RSP_READ_BY_TYPE 0x09
#define GATT_REQ_READ 0x0A
#define GATT_RSP_READ 0x0B
#define GATT_REQ_READ_BLOB 0x0C
#define GATT_RSP_READ_BLOB 0x0D
#define GATT_REQ_READ_MULTI 0x0E
#define GATT_RSP_READ_MULTI 0x0F
#define GATT_REQ_READ_BY_GRP_TYPE 0x10
#define GATT_RSP_READ_BY_GRP_TYPE 0x11
#define GATT_REQ_WRITE 0x12 /* 0001-0010 (write)*/
#define GATT_RSP_WRITE 0x13
#define GATT_CMD_WRITE 0x52 /* changed in V4.0 01001-0010(write cmd)*/
#define GATT_REQ_PREPARE_WRITE 0x16
#define GATT_RSP_PREPARE_WRITE 0x17
#define GATT_REQ_EXEC_WRITE 0x18
#define GATT_RSP_EXEC_WRITE 0x19
#define GATT_HANDLE_VALUE_NOTIF 0x1B
#define GATT_HANDLE_VALUE_IND 0x1D
#define GATT_HANDLE_VALUE_CONF 0x1E
#define GATT_SIGN_CMD_WRITE 0xD2 /* changed in V4.0 1101-0010 (signed write) see write cmd above*/
#define GATT_OP_CODE_MAX GATT_HANDLE_VALUE_CONF + 1 /* 0x1E = 30 + 1 = 31*/
”1b“ GATT_HANDLE_VALUE_NOTIF
“2f 00” = 0x002f -- the handle of the attribute
“00 00 4f 00 00 00 00 00” -- the current value of the attribute