The Tilt Hydrometer is a submersible bluetooth thermometer and hydrometer for monitoring fermentation. This post details how to get raw iBeacon messages on linux and analyses the Tilt Hydrometer message format.
Bluetooth support on linux is provided via bluez. Two bluez tools
hcidump are used to get bluetooth data for processing.
hcitool lescan initiates a scan for bluetooth LE devices, and
hcidump run simultaneously will give you detail on the messages being exhanged.
hcidump -R will dump raw bluetooth data as octets to stdout.
Before proceeding further, it’s probably a good idea to run
sudo hcitool lescan and see if your Tilt Hydrometer (named ‘Tilt’) shows up. If you can’t see it you may need to enable experimental mode in bluez to turn on bluetooth LE. Edit
/lib/systemd/system/bluetooth.service and append
--experimental to the
ExecStart line. Then run
sudo systemctl daemon-reload and
sudo systemctl restart bluetooth. See  for more info.
If you want to run
hcidump as a normal user, grant the appropriate capabilites to the executables. Note this may have security implications .
sudo setcap 'cap_net_raw,cap_net_admin+eip' `which hcitool` sudo setcap 'cap_net_raw,cap_net_admin+eip' `which hciconfig`
The Tilt Hydrometer is a Bluetooth LE device that reports data via the iBeacon protocol. As far as I can tell, the tilt transmits two data messages. The first type is in response to a scan initiated by a device, and doesn’t contain any sensor data. The second type is a message containing temperature and specific gravity.
Example tilt hydrometer sensor data message from
> 04 3E 27 02 01 00 00 5A 09 9B 16 A3 04 1B 1A FF 4C 00 02 15 A4 95 BB 10 C5 B1 4B 44 B5 12 13 70 F0 2D 74 DE 00 44 03 F8 C5 C7
Explanation (with help from the bluetooth core spec and stackoverflow   ):
04: HCI Packet Type HCI Event 3E: LE Meta event 27: Parameter total length (39 octets) 02: LE Advertising report sub-event 01: Number of reports (1) 00: Event type connectable and scannable undirected advertising 00: Public address type 5A: address 09: address 9B: address 16: address A3: address 04: address 1B: length of data field (27 octets) 1A: length of first advertising data (AD) structure (26) FF: type of first AD structure - manufacturer specific data 4C: manufacturer ID - Apple iBeacon 00: manufacturer ID - Apple iBeacon 02: type (constant, defined by iBeacon spec) 15: length (constant, defined by iBeacon spec) A4: device UUID 95: device UUID BB: device UUID 10: device UUID C5: device UUID B1: device UUID 4B: device UUID 44: device UUID B5: device UUID 12: device UUID 13: device UUID 70: device UUID F0: device UUID 2D: device UUID 74: device UUID DE: device UUID 00: major - temperature (in degrees fahrenheit) 44: major - temperature (in degress fahrenheit) 03: minor - specific gravity (x1000) F8: minor - specific gravity (x1000) C5: TX power in dBm C7: RSSI in dBm
The UUID of the Tilt Hydrometer is shared between devices of that colour. The list is as follows :
Red: A495BB10C5B14B44B5121370F02D74DE Green: A495BB20C5B14B44B5121370F02D74DE Black: A495BB30C5B14B44B5121370F02D74DE Purple: A495BB40C5B14B44B5121370F02D74DE Orange: A495BB50C5B14B44B5121370F02D74DE Blue: A495BB60C5B14B44B5121370F02D74DE Yellow: A495BB70C5B14B44B5121370F02D74DE Pink: A495BB80C5B14B44B5121370F02D74DE
The temperature in degrees fahrenheit (‘major’ field of iBeacon data) is a 16 bit unsigned integer, most significant bits first (big endian). For the message above the temperature is 68ºF.
The specific gravity x 1000 (‘minor’ field of iBeacon data) is a 16 bit unsigned integer, most significant bits first (big endian). Divide by 1000 to get the specific gravity. For the message above the gravity is 1.016.
The TX power in dBm is a signed 8 bit integer. (-59dBm above)