Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

ATT is the protocol that addresses and transports data to and from a Bluetooth Low Energy device; GATT is the framework that organizes that data into services, characteristics, and descriptors. A BLE device acting as a GATT server exposes a logical attribute database. “Stored” data may be a RAM value, nonvolatile setting, sensor reading generated on demand, or firmware-calculated result—it is not necessarily a permanent record in flash memory.

Think of ATT as addressing and transport and GATT as the schema and API. GATT procedures such as discovery, reads, writes, notifications, and indications use ATT messages underneath. See the Bluetooth Core GATT specification and ATT specification.

ATT and GATT in one mental model

Layer Role Analogy
ATT Defines attributes, handles, UUID-based types, permissions, and protocol messages Addressing and transport
GATT Groups attributes into services, characteristics, and descriptors and defines access procedures Schema and API
Service or profile specification Defines what the bytes mean and how they are encoded Application contract

GATT depends on ATT; it does not replace it. The GATT server exposes data, while the GATT client—often a phone, computer, or gateway—discovers and accesses it. These are connection roles, not permanent device identities: one product can be a server in one connection and a client in another.

Bluetooth advertising is separate. Advertising is connectionless broadcast data; GATT is structured, connection-oriented access after a connection.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
#1 Best Overall
Acxico 1Pcs USB CC2531 Sniffer Board Bluetooth 4.0 Wireless Zigbee Analyzer Module with External Antenna
  • Lead Out 8 Doors of IO, of Debug Pins.Firmware To Reach Matching Analyzer Function.
  • Operating frequency: 2.405-2.485 GHz
  • The Wireless Transmission Rate: 250 Kbaud
  • Energy consumption: <20mA (reception); <25mA (transmission)
  • Size: 4.1 * 1.6 centimeters,Panel thickness: 1.6 mm

What an ATT attribute contains

Each server-side attribute is logically represented by four parts:

  • Handle: a server-assigned 16-bit local address.
  • Type: a UUID identifying what the attribute is.
  • Value: bytes or protocol metadata.
  • Permissions: rules governing reads, writes, authentication, authorization, and required link security.

Handles are local addresses

ATT requests use handles to identify entries in one server’s table. The same UUID can have different handles on different devices, and handles can change after firmware changes. Discover them instead of hard-coding values across products or firmware versions. A handle is not a globally unique identifier.

Details of the attribute data model and access rules are defined in the Bluetooth ATT specification.

UUIDs identify types, not complete encodings

Bluetooth SIG-assigned services and characteristics commonly use 16-bit UUIDs; vendor-specific definitions generally use 128-bit UUIDs. A 16-bit value is shorthand for the Bluetooth Base UUID when applicable. A UUID tells you what an attribute represents, but the applicable service, profile, or vendor specification must still define field order, widths, endianness, units, scaling, flags, optional fields, and valid ranges.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #2
SparkFun Thing Plus-Artemis Machine Learning Dev Board Feather Footprint
  • FCC/IC/CE Certification 8/16/2019 (ID Number 2ASW8-ART3MIS) on the world’s first open-source, US manufactured, BLE module
  • 1M Flash / 384k RAM gives you plenty of room for your sketches. 48MHz / 96MHz turbo available
  • Includes 21 GPIO pins - all interrupt capable. 21 PWM channels. Built in technology compatible with Bluetooth low energy 4.0 radio
  • Features 8 ADC channels with 14-bit precision, 2 I2C buses, 1 SPI bus, PDM Digital Microphone
  • Exposed JTAG pin holes for more advanced users to use the power and speed of professional tools

Values may be live or persistent

A value can be a temperature sampled when a read arrives, a RAM-backed state variable, a setting loaded from flash, or a calculated result. GATT exposes a logical value through the attribute database; it does not require a conventional permanent database on the device.

How GATT turns attributes into usable data

Services group related functionality

A service groups related characteristics, such as Heart Rate, Battery, Device Information, or a manufacturer’s custom service. A device can expose standardized and vendor-specific services at the same time. Services and their procedures are described by the GATT specification.

Characteristics contain the application payload

A characteristic is more than one raw value. In the underlying table it normally includes:

  • A characteristic declaration, containing properties and the value handle.
  • A characteristic value attribute, which normally contains application data.
  • Optional descriptors that add metadata or configuration.
Service
└── Characteristic
    ├── Declaration
    ├── Value attribute
    └── Optional descriptors

For example, a Battery Service can contain a Battery Level characteristic whose value represents 0–100 percent. A custom UART-like service might have an RX characteristic that accepts phone writes and a TX characteristic that sends device notifications. The service specification—not GATT alone—defines the byte format.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #3
AITRIP 2 Sets ESP-WROOM-32 ESP32 ESP-32S Type-C USB Development Board Type-C USB CH340C WiFi+Bluetooth Ultra-Low Power Dual Core ESP32-DevKitC-32 ESP-WROOM-32 Expansion Board for Arduino
  • ESP32 is a safe, reliable, and scalable to a variety of applications
  • ESP32 development board support lua program, easy to develop, support LWIP protocol, Freertos, three modes : AP, STA and AP + STA.
  • Integrated 520-kBSRAM, 448-kBROM16-kBSRAMinRTC
  • USB driver chip: CH340C, with good system compatibility, higher download speed, and more stability.
  • You will get 2PCS PCS ESP32 Development Board TYPE-C USB CH340C WiFi+Bluetooth Ultra-Low Power Consumption Dual Core ESP32-DevKitC-32 ESP-WROOM and 2PCS ESP32-DevKitC-32 ESP-WROOM-32 Expansion Board

Descriptors add metadata and control

Descriptors can describe a value, specify units or presentation, or configure behavior. The Client Characteristic Configuration Descriptor (CCCD) is commonly used to enable notifications or indications. A documented convention is 0x0000 for both disabled, 0x0001 for notifications enabled, and 0x0002 for indications enabled; the characteristic must support the selected operation.

How a client finds and accesses data

  1. Connect to the peripheral.
  2. Discover primary services.
  3. Discover characteristics and record UUIDs, handles, and properties.
  4. Discover descriptors where needed, especially the CCCD.
  5. Read a readable value, write to a writable value, or subscribe to Notify or Indicate.
  6. Decode returned bytes using the adopted service specification or vendor protocol.

A temperature read may work like this: firmware exposes a Temperature Measurement characteristic; the phone discovers it; the phone sends an ATT read request; firmware samples or retrieves the latest temperature; the server returns encoded bytes; and the phone decodes them according to the specification. The returned number may have been generated at step five rather than stored permanently.

ATT and GATT operations compared

Operation Direction and response Typical use Important limitation
Read Client requests; server returns a value Current state, settings, device information Large values may require long-read procedures
Write with response Client sends; server acknowledges or returns an error Configuration, setpoints, commands requiring confirmation ATT acceptance does not prove application execution
Write without response Client sends without an ATT response Command streams and higher-throughput transfers No per-write confirmation; flow control and loss handling are application concerns
Notification Server sends an update without client confirmation Sensor readings, events, streaming status Not individually acknowledged at the ATT/GATT level
Indication Server sends an update and client confirms Updates requiring protocol-level receipt confirmation Extra exchange reduces potential throughput

Properties advertise supported capabilities, but permissions and application logic can still restrict access. Therefore, discoverable does not mean readable, a writable property does not guarantee a successful write, and notification-capable does not mean currently subscribed.

What “stored” means in a BLE device

Physical implementation What the client experiences
Flash, EEPROM, or filesystem A persistent setting or record returned through a characteristic
RAM variable Current state exposed until reset or power loss
Sensor or peripheral register A fresh measurement returned on demand
Firmware callback or calculation A value generated when read or notification processing occurs

GATT does not reveal which implementation is underneath. To determine persistence, you need firmware documentation or controlled tests such as writing a value, power-cycling, and reading it again—provided the protocol is documented and safe to test.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #4
MDBT50Q-P512K Nordic nRF52833 Solution PCB ANT 42 GPIO Bluetooth Module BT5.2 FCC IC CE Telec KC SRRC (3pcs Pak)
  • Nordic nRF52833 PCB Antenna Module / MDBT50Q-P512K
  • Supports multiprotocol for Bluetooth Low Energy, ANT+, Zigbee, Thread (802.15.4)
  • BT5.2, FCC, IC, CE, Telec (MIC), KC, SRRC, NCC, RCM, WPC Pre-Certified
  • 42 GPIO / 10.5 x 15.5 x 2 mm / 512 KB Flash Memory / 128 KB RAM
  • Interface: QSPI & USB & I2C & SPI & UART & I2S & PDM & PWM & NFC

MTU, packet size, and long values

The default ATT_MTU is 23 octets, which leaves the familiar 20-octet payload for many basic characteristic writes or notifications. That is not a universal 20-byte maximum. Devices can negotiate a larger MTU, and long values can use long reads, prepared and executed writes, or application-level fragmentation. Effective throughput also depends on link-layer data length, connection interval, controller buffers, operating-system APIs, and flow control. Consult the ATT procedures and GATT procedures when implementing larger transfers.

Advertising is not the GATT database

Advertising GATT
Connectionless broadcast Connection-oriented client/server access
Small payload Structured services, characteristics, and descriptors
Device name, service UUIDs, manufacturer or service data Reads, writes, notifications, indications, and discovery
Visible while scanning Usually inspected after connecting

An advertised service UUID does not prove that the complete service is present after connection, and a service can be exposed without being listed in the advertising packet. Advertising data and characteristic values should be analyzed separately. See the Generic Access Profile specification.

Security, caching, and common surprises

Access can be protected

Reads and writes may require encryption, pairing, bonding, authentication, authorization, an application challenge, a particular firmware state, or a vendor-specific command sequence. A generic browser may discover a characteristic and still receive an ATT error when accessing it.

GATT caches can become stale

Operating systems may cache discovered services and handles. After a firmware database change, symptoms can include missing characteristics, writes sent to an unexpected handle, or failed notification subscriptions. Bluetooth defines mechanisms including the Service Changed characteristic and Database Hash. A client receiving a “Database Out Of Sync” error must invalidate cached information and rediscover. Useful references are the GATT specification and Bluetooth attribute-database overview.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Best Value
Arduino Nano 33 BLE Rev2 [ABX00071] - nRF52840 Microcontroller, Bluetooth Low Energy (BLE), MicroPython Support, Small Form Factor, 3.3V for IoT & Wireless Projects
  • Powerful nRF52840 Chip: The Arduino Nano 33 BLE Rev2 is powered by the nRF52840 microcontroller, which integrates a Cortex-M4 processor running at 64 MHz. This gives you efficient, high-performance computing power with support for advanced Bluetooth Low Energy (BLE) communication and low-power applications.
  • Bluetooth Low Energy (BLE): Designed for wireless applications, the Nano 33 BLE Rev2 offers Bluetooth Low Energy (BLE), enabling efficient and reliable wireless communication with a wide range of BLE-enabled devices. Whether you're building smart home products, health monitors, or remote control systems, this board ensures low-latency and energy-efficient wireless connectivity.
  • MicroPython Support: For rapid prototyping and easier programming, the Nano 33 BLE Rev2 supports MicroPython, a powerful and easy-to-learn language for embedded systems. With MicroPython, you can write and test code interactively, simplifying development and reducing time to market for your projects.
  • Compact & Versatile Design: With its small form factor, the Nano 33 BLE Rev2 is perfect for space-constrained applications like wearables, sensors, or portable devices. Despite its size, it offers a full suite of I/O capabilities, including digital/analog pins, PWM, I2C, and SPI for easy integration with external sensors, actuators, and other devices.
  • 3.3V Operating Voltage: The board operates at a 3.3V voltage level, making it ideal for low-power, energy-efficient designs. This voltage range ensures compatibility with a wide variety of sensors and modules, while reducing power consumption for extended battery life in portable and wireless applications.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Hands-on inspection workflow

  1. Install a BLE inspector such as nRF Connect for Mobile or LightBlue.
  2. Scan and determine whether the device is advertising and connectable.
  3. Connect, then expand services and characteristics.
  4. Record UUIDs, handles, properties, and descriptors.
  5. Read readable characteristics.
  6. Subscribe to Notify or Indicate and trigger a physical event.
  7. Record incoming bytes, timing, and device state.
  8. Decode bytes from the relevant standard or vendor documentation.
  9. Write only when the purpose and encoding are known; record both ATT errors and device behavior.

Keep a record of the device name, advertised and connected service UUIDs, characteristic UUID and handle, properties, descriptors, read result, write format, notification format, security requirements, and observed errors. A UUID alone cannot reverse-engineer an undocumented protocol.

Failure modes and recovery

The device does not appear

  • Wake or reset it and confirm that it is connectable rather than broadcast-only.
  • Close another app that may hold the only connection.
  • Check Bluetooth, nearby-device, and platform-specific permissions.
  • Toggle Bluetooth, move closer, and try a second scanner.

A service or characteristic is missing

  • Disconnect and reconnect, then force rediscovery where supported.
  • Power-cycle the peripheral.
  • Consider firmware variants, conditional exposure, authentication state, or stale cache data.
  • Compare the connected database with advertised service UUIDs.

A read fails

  • Verify the Read property and security requirements.
  • Pair or encrypt if required.
  • Rediscover services and confirm the device state.
  • Use notifications when the characteristic is designed for streaming.

Notifications do not arrive

  • Confirm Notify or Indicate is advertised.
  • Write the correct CCCD value.
  • Trigger a known event and check connection and subscription callbacks.
  • Try indications when Notify is unavailable.

A write succeeds but nothing happens

The wrong characteristic, byte order, command framing, checksum, sequence number, write mode, or device state may be involved. An ATT-level successful write proves only that the server accepted the protocol operation; firmware may still reject the command at the application layer.

When packet capture is worthwhile

Use a sniffer when an inspector shows symptoms but not the sequence causing them—for example, failed MTU exchange, suspected fragmentation, inconsistent discovery, unexpected notification behavior, or pairing and encryption problems. Nordic’s nRF Sniffer for Bluetooth LE displays BLE packets in near real time through Wireshark and requires compatible Nordic hardware such as an nRF52840 Dongle or supported development kit. It is unnecessary for simply browsing services.

Choosing an inspection tool

Tool Best for Qualification
nRF Connect for Mobile Free first inspection: advertisements, discovery, reads, writes, subscriptions, and logs Does not decode undocumented proprietary semantics; mobile OS access varies
LightBlue General-purpose inspection and peripheral simulation Platform availability and feature depth vary; listing showed Free in August 2026
nRF Connect for Desktop Nordic firmware development, programming, and monitoring Centered on Nordic hardware; no current paid-plan price stated
nRF Sniffer Near-real-time packet debugging Needs compatible Nordic capture hardware; encrypted traffic may require additional context

Start with a free mobile GATT browser. Add a development dongle or kit when you need firmware development, packet capture, or repeatable lab testing.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Quick Recap

Bestseller No. 1
Acxico 1Pcs USB CC2531 Sniffer Board Bluetooth 4.0 Wireless Zigbee Analyzer Module with External Antenna
Acxico 1Pcs USB CC2531 Sniffer Board Bluetooth 4.0 Wireless Zigbee Analyzer Module with External Antenna
Lead Out 8 Doors of IO, of Debug Pins.Firmware To Reach Matching Analyzer Function.; Operating frequency: 2.405-2.485 GHz
$9.69
Bestseller No. 3
AITRIP 2 Sets ESP-WROOM-32 ESP32 ESP-32S Type-C USB Development Board Type-C USB CH340C WiFi+Bluetooth Ultra-Low Power Dual Core ESP32-DevKitC-32 ESP-WROOM-32 Expansion Board for Arduino
AITRIP 2 Sets ESP-WROOM-32 ESP32 ESP-32S Type-C USB Development Board Type-C USB CH340C WiFi+Bluetooth Ultra-Low Power Dual Core ESP32-DevKitC-32 ESP-WROOM-32 Expansion Board for Arduino
ESP32 is a safe, reliable, and scalable to a variety of applications; Integrated 520-kBSRAM, 448-kBROM16-kBSRAMinRTC
$15.99
Bestseller No. 4
MDBT50Q-P512K Nordic nRF52833 Solution PCB ANT 42 GPIO Bluetooth Module BT5.2 FCC IC CE Telec KC SRRC (3pcs Pak)
MDBT50Q-P512K Nordic nRF52833 Solution PCB ANT 42 GPIO Bluetooth Module BT5.2 FCC IC CE Telec KC SRRC (3pcs Pak)
Nordic nRF52833 PCB Antenna Module / MDBT50Q-P512K; Supports multiprotocol for Bluetooth Low Energy, ANT+, Zigbee, Thread (802.15.4)
$25.20

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.