[RR Bluetooth] list dbus services (buses), path, interfaces, methods, and properties

Though I am working on bluetooth/bluez/python, it is still a lot stuff I have to catch up with dbus because dbus is a major path to communicate with bluez.

It's interesting to check what kind of dbus service (bus name actually) currently provided in the system.

from A list of available DBus services we know that command

dbus-send --system            \
  --dest=org.freedesktop.DBus \
  --type=method_call          \
  --print-reply               \
  /org/freedesktop/DBus       \
  org.freedesktop.DBus.ListNames

can do and the result at my env is (18 items)

method return time=1464797917.554108 sender=org.freedesktop.DBus -> destination=:1.104 serial=3 reply_serial=2
   array [
      string "org.freedesktop.DBus"
      string ":1.7"
      string "org.freedesktop.systemd1"
      string "org.freedesktop.ModemManager1"
      string "org.freedesktop.NetworkManager"
      string "org.freedesktop.Accounts"
      string "org.freedesktop.RealtimeKit1"
      string ":1.80"
      string ":1.81"
      string ":1.82"
      string ":1.60"
      string ":1.83"
      string ":1.61"
      string ":1.84"
      string ":1.62"
      string ":1.85"
      string ":1.86"
      string ":1.64"
      string "org.freedesktop.PolicyKit1"
      string ":1.20"
      string ":1.87"
      string ":1.65"
      string "org.bluez"
      string ":1.21"
      string ":1.88"
      string ":1.66"
      string ":1.22"
      string ":1.89"
      string ":1.67"
      string ":1.68"
      string ":1.46"
      string ":1.24"
      string ":1.69"
      string ":1.47"
      string "fi.epitest.hostap.WPASupplicant"
      string "org.freedesktop.Avahi"
      string "org.freedesktop.UDisks2"
      string ":1.90"
      string "fi.w1.wpa_supplicant1"
      string ":1.91"
      string ":1.70"
      string "org.freedesktop.login1"
      string ":1.71"
      string ":1.94"
      string "org.freedesktop.ColorManager"
      string ":1.50"
      string ":1.95"
      string "org.freedesktop.DisplayManager"
      string ":1.96"
      string ":1.74"
      string "org.freedesktop.NetworkManager.dnsmasq"
      string "org.freedesktop.thermald"
      string ":1.98"
      string ":1.10"
      string ":1.99"
      string ":1.55"
      string ":1.11"
      string ":1.78"
      string "org.freedesktop.UPower"
      string ":1.12"
      string ":1.0"
      string ":1.13"
      string ":1.100"
      string ":1.58"
      string ":1.1"
      string ":1.2"
      string ":1.59"
      string ":1.3"
      string ":1.4"
      string ":1.17"
      string ":1.39"
      string ":1.104"
      string ":1.18"
      string ":1.6"
      string ":1.19"
   ]

the equivalent python is (How to list all object paths under a dbus service? ) which has the same result.

import dbus
for service in dbus.SystemBus().list_names(): print(service)

Similar method is ListActivatableNames but returns more bus names (Maybe those are candidates to be actually got connected to systembus on demand)

the result on my pc are listed below (31 items):

org.freedesktop.DBus
org.freedesktop.login1
com.ubuntu.LanguageSelector
com.ubuntu.USBCreator
com.hp.hplip
org.freedesktop.ColorManager
com.ubuntu.SoftwareProperties
org.freedesktop.systemd1
org.freedesktop.thermald
org.freedesktop.PolicyKit1
org.freedesktop.Avahi
org.freedesktop.ModemManager1
org.debian.apt
org.bluez
org.freedesktop.hostname1
org.freedesktop.PackageKit
org.freedesktop.UPower
org.freedesktop.UDisks2
org.freedesktop.network1
com.ubuntu.SystemService
org.freedesktop.resolve1
org.debian.AptXapianIndex
fi.epitest.hostap.WPASupplicant
fi.w1.wpa_supplicant1
org.freedesktop.Accounts
com.ubuntu.WhoopsiePreferences
org.freedesktop.RealtimeKit1
org.freedesktop.timedate1
org.freedesktop.nm_dispatcher
org.opensuse.CupsPkHelper.Mechanism
org.freedesktop.locale1

PATH and interface

by slightly modifying the code from here, we can show path with corresponding interfaces:

import dbus

from xml.etree import ElementTree

def rec_intro(bus, service, object_path):
    print(object_path)
    obj = bus.get_object(service, object_path)
    iface = dbus.Interface(obj, 'org.freedesktop.DBus.Introspectable')
    xml_string = iface.Introspect()
    for child in ElementTree.fromstring(xml_string):
        if child.tag == 'interface':
            print 'interface: ' + child.attrib['name']
        if child.tag == 'node':
            if object_path == '/':
                object_path = ''
            new_path = '/'.join((object_path, child.attrib['name']))
            print '\n'
            rec_intro(bus, service, new_path)
bus = dbus.SystemBus()
rec_intro(bus, 'org.bluez', '/org/bluez')

and the result 

/org/bluez
interface: org.freedesktop.DBus.Introspectable
interface: org.bluez.AgentManager1
interface: org.bluez.ProfileManager1
interface: org.bluez.Alert1
interface: org.bluez.HealthManager1

/org/bluez/hci0
interface: org.freedesktop.DBus.Introspectable
interface: org.bluez.Adapter1
interface: org.freedesktop.DBus.Properties
interface: org.bluez.Media1
interface: org.bluez.CyclingSpeedManager1
interface: org.bluez.HeartRateManager1
interface: org.bluez.ThermometerManager1
interface: org.bluez.NetworkServer1

/org/bluez/hci0/dev_00_02_72_C0_3F_D7
interface: org.freedesktop.DBus.Introspectable
interface: org.bluez.Device1
interface: org.freedesktop.DBus.Properties

/org/bluez/hci0/dev_00_07_61_EB_E9_35
interface: org.freedesktop.DBus.Introspectable
interface: org.bluez.Device1
interface: org.freedesktop.DBus.Properties
interface: org.bluez.Input1

/org/bluez/hci0/dev_34_B1_F7_D5_59_64
interface: org.freedesktop.DBus.Introspectable
interface: org.bluez.Device1
interface: org.freedesktop.DBus.Properties
interface: org.bluez.ProximityReporter1

/org/bluez/hci0/dev_88_18_56_68_98_EB
interface: org.freedesktop.DBus.Introspectable
interface: org.bluez.Device1
interface: org.freedesktop.DBus.Properties

/org/bluez/hci0/dev_90_59_AF_09_EB_93
interface: org.freedesktop.DBus.Introspectable
interface: org.bluez.Device1
interface: org.freedesktop.DBus.Properties

To list interface, method, and property, the simple code is 

import dbus
from xml.etree import ElementTree
def rec_intro(bus, service, object_path):
    print(object_path)
    obj = bus.get_object(service, object_path)
# get props
    iface = dbus.Interface(obj, 'org.freedesktop.DBus.Introspectable')
    xml_string = iface.Introspect()
    for child in ElementTree.fromstring(xml_string):
        if child.tag == 'interface':
            print 'interface: ' + child.attrib['name']
            for c in child.getchildren():
              if c.tag == 'property':
                print 'property: ' + c.attrib['name'] + ' ' + c.attrib['type'] + ' ' + c.attrib['access']
              if c.tag == 'method':
                print 'metohd: ' + c.attrib['name']
        print '\n'
        if child.tag == 'node':
            if object_path == '/':
                object_path = ''
            new_path = '/'.join((object_path, child.attrib['name']))
            print '\n'
            rec_intro(bus, service, new_path)
bus = dbus.SystemBus()
rec_intro(bus, 'org.bluez', '/org/bluez')

[RR Bluetooth] installing dbus-python

In order to use bluez in python, dbus-python has to be installed

Although many said that it cannot be installed by pip, however, I am using virtualenv, it's worth to give it a try.

$ pip install dbus-python

The first error is:

checking for DBUS_GLIB... no
configure: error: Package requirements (dbus-glib-1 >= 0.70) were not met:
No package 'dbus-glib-1' found

Apparently dbus-gdb-1-dev is missing, so I installed "libdbus-glib-1-dev"

and surprisingly, 

Successfully installed dbus-python

dbus-python-1.2.4 is installed by pip !!!

[RR Bluetooth] gatttool - What HCI Commands are Sent by gatttool (6) char-read-hnd, char-read-uuid

According to BT Spec Core 4.2, "4.9 CHARACTERISTIC VALUE WRITE"

There are five sub-procedures that can be used to write a Characteristic Value: Write Without Response, Signed Write Without Response, Write Characteristic Value, Write Long Characteristic Values and Reliable Writes.

char-write-cmd  <handle> <new value>           Characteristic Value Write (No response)

Write Command

< ACL Data TX: Handle 71 flags 0x00 dlen 8                     [hci0] 20.201215      ATT: Write Command (0x52) len 3        Handle: 0x0029          Data: 01

< 02 47 00 08 00 04 00 04 00 52 29 00 01 

> HCI Event: Number of Completed Packets (0x13) plen 5         [hci0] 20.779127        Num handles: 1        Handle: 71        Count: 1

> 04 13 05 01 47 00 01 00 

char-write-req  <handle> <new value>           Characteristic Value Write (Write Request)

Write Request

< ACL Data TX: Handle 71 flags 0x00 dlen 8                     [hci0] 61.390350
      ATT: Write Request (0x12) len 3
        Handle: 0x0029
          Data: 00

< 02 47 00 08 00 04 00 04 00 12 29 00 00 

> HCI Event: Number of Completed Packets (0x13) plen 5         [hci0] 61.524557
        Num handles: 1
        Handle: 71
        Count: 1

> 04 13 05 01 47 00 01 00 

Write Response

> ACL Data RX: Handle 71 flags 0x02 dlen 5                     [hci0] 61.587358
      ATT: Write Response (0x13) len 0

> 02 47 20 05 00 01 00 04 00 13 

[RR Bluetooth] gatttool - What HCI Commands are Sent by gatttool (5) char-read-hnd, char-read-uuid

According to BT Spec Core 4.2, 4.8 CHARACTERISTIC VALUE READ

There are four sub-procedures that can be used to read a Characteristic Value: Read Characteristic Value, Read Using Characteristic UUID, Read Long Characteristic Values, and Read Multiple Characteristic Values.

it looks like gatttool only support the first two.

char-read-hnd   <handle>                       Characteristics Value/Descriptor Read by handle

This sub-procedure is used to read a Characteristic Value from a server when the client knows the Characteristic Value Handle

Read Request

< ACL Data TX: Handle 71 flags 0x00 dlen 7                      [hci0] 3.380041
      ATT: Read Request (0x0a) len 2
        Handle: 0x0001

< 02 47 00 07 00 03 00 04 00 0A 01 00 

> HCI Event: Number of Completed Packets (0x13) plen 5          [hci0] 4.003567
        Num handles: 1
        Handle: 71
        Count: 1

 > 04 13 05 01 47 00 01 00 

Read Response

> ACL Data RX: Handle 71 flags 0x02 dlen 7                      [hci0] 4.072557
      ATT: Read Response (0x0b) len 2
        Value: 0018

> 02 47 20 07 00 03 00 04 00 0B 00 18 

char-read-uuid  <UUID> [start hnd] [end hnd]   Characteristics Value/Descriptor Read by UUID

This sub-procedure is used to read a Characteristic Value from a server when the client only knows the characteristic UUID and does not know the handle of the characteristic. （4.8.2 Read Using Characteristic UUID @ Core 4.2) This is typically the handle range for the service in which the characteristic belongs.

Read By Type Request

< ACL Data TX: Handle 71 flags 0x00 dlen 11                     [hci0] 7.468811
      ATT: Read By Type Request (0x08) len 6
        Handle range: 0x0001-0x000b
        Attribute type: Characteristic (0x2803)

< 02 47 00 0B 00 07 00 04 00 08 01 00 0B 00 03 28 

> HCI Event: Number of Completed Packets (0x13) plen 5          [hci0] 7.513950
        Num handles: 1
        Handle: 71
        Count: 1

> 04 13 05 01 47 00 01 00 

Read By Type Response

> ACL Data RX: Handle 71 flags 0x02 dlen 27                     [hci0] 7.583487
      ATT: Read By Type Response (0x09) len 22
        Attribute data length: 7
        Attribute data list: 3 entries
        Handle: 0x0002
        Value: 020300002a
        Handle: 0x0004
        Value: 020500012a
        Handle: 0x0006
        Value: 020700022a

> 02 47 20 1B 00 17 00 04 00 09 07 02 00 02 03 00 00 2A 04 00
  02 05 00 01 2A 06 00 02 07 00 02 2A 

Note: the Read Blob Request would be used to read the remaining octets of a

long attribute value.

[RR Bluetooth] gatttool - What HCI Commands are Sent by gatttool (4) char-desc

char-desc       [start hnd] [end hnd]          Characteristics Descriptor Discovery

It is defined in "4.7 CHARACTERISTIC DESCRIPTOR DISCOVERY" in Bluetooth Specification Core 4.2.

This sub-procedure is used by a client to find all the characteristic descriptor’s
Attribute Handles and Attribute Types within a characteristic definition when
only the characteristic handle range is known

Find Information Request:

< ACL Data TX: Handle 71 flags 0x00 dlen 9                      [hci0] 5.648413
      ATT: Find Information Request (0x04) len 4
        Handle range: 0x0001-0x0002

< 02 47 00 09 00 05 00 04 00 04 01 00 02 00 

> HCI Event: Number of Completed Packets (0x13) plen 5          [hci0] 5.803482
        Num handles: 1
        Handle: 71
        Count: 1

> 04 13 05 01 47 00 01 00 

Find Information Response

> ACL Data RX: Handle 71 flags 0x02 dlen 14                     [hci0] 5.873329
      ATT: Find Information Response (0x05) len 9
        Format: UUID-16 (0x01)
        Handle: 0x0001
        UUID: Primary Service (0x2800)
        Handle: 0x0002
        UUID: Characteristic (0x2803)

> 02 47 20 0E 00 0A 00 04 00 05 01 01 00 00 28 02 00 03 28 

Note: The sub-procedure is complete when the Error Response is received and the Error Code is set to Attribute Not Found or the Find Information Response has an Attribute Handle that is equal to the Ending Handle of the request. (4.7.1 Discover All Characteristic Descriptors@ BT Spec Core 4.2)

[RR Bluetooth] gatttool - What HCI Commands are Sent by gatttool (3) characteristics

characteristics [start hnd [end hnd [UUID]]]   Characteristics Discovery

It follows 4.6 CHARACTERISTIC DISCOVERY at Bluetooth Specification Core 4.2

"There are two sub-procedures that can be used for characteristic discovery: Discover All Characteristics of a Service and Discover Characteristics by UUID."

Discover All Characteristics of a Service: 用來查已知service handle範圍内, 

Attribute Handle for the characteristic declaration

Attribute Value for the Characteristic Properties

Characteristic Value Handle

Characteristic UUID

[34:B1:F7:D5:59:64][LE]> characteristics 2 3 handle: 0x0002, char properties: 0x02, char value handle: 0x0003, uuid: 00002a00-0000-1000-8000-00805f9b34fb

Read By Type Request

it actually sends "Read by Type Request" with UUID 0x2803 (<<Characteristic>>)

< ACL Data TX: Handle 70 flags 0x00 dlen 11                   [hci0] 713.100301
      ATT: Read By Type Request (0x08) len 6
        Handle range: 0x0002-0x0003
        Attribute type: Characteristic (0x2803)

< 02 46 00 0B 00 07 00 04 00 08 02 00 03 00 03 28 

> HCI Event: Number of Completed Packets (0x13) plen 5        [hci0] 713.265526
        Num handles: 1
        Handle: 70
        Count: 1

> 04 13 05 01 46 00 01 00 

Read By Type Response

> ACL Data RX: Handle 70 flags 0x02 dlen 13                   [hci0] 713.328138
      ATT: Read By Type Response (0x09) len 8
        Attribute data length: 7
        Attribute data list: 1 entry
        Handle: 0x0002
        Value: 020300002a

The Attribute Data List (handle and value pair(s))

> 02 46 20 0D 00 09 00 04 00 09 07 02 00 02 03 00 00 2A 

[RR Bluetooth] gatttool - What HCI Commands are Sent by gatttool (2) primary

First of all, the packets below are all HCI ACL Data Packet (with indicator 0x02)

for example, ATT Command - Read By Group Type Request
0000: 02 47 00 0b 00 07 00 04  00 10 01 00 ff ff 00 28

0x02 is HCI ACL Data Packet (Table 2.1 HCI Packet Indicator)
0x47 is Handle
0x00 means PB Flag and BC Flag is 0
0x000b is Data Total Length

then follows the L2CAP packet

0x0007 is length
0x0004 is CID (Attribute Protocol PDU)

and then Attribute Protocol PDU

primary         [UUID]                         Primary Service Discover

the UUID means "Discover Primary Services By Service UUID"

If left UUID blank:

Read by Group Type Request

< ACL Data TX: Handle 71 flags 0x00 dlen 11            
      ATT: Read By Group Type Request (0x10) len 6
        Handle range: 0x0001-0xffff
        Attribute group type: Primary Service (0x2800)

0000: 02 47 00 0b 00 07 00 04  00 10 01 00 ff ff 00 28

Number of Completed Packets Event

> HCI Event: Number of Completed Packets (0x13) plen 5   [hci0] 22:57:39.703757
        Num handles: 1
        Handle: 71
        Count: 1

> 0000: 04 13 05 01 47 00 01 00     

Read by Group Type Response

> ACL Data RX: Handle 71 flags 0x02 dlen 24            
      ATT: Read By Group Type Response (0x11) len 19
        Attribute data length: 6
        Attribute group list: 3 entries
        Handle range: 0x0001-0x000b
        UUID: Generic Access Profile (0x1800)
        Handle range: 0x000c-0x000f
        UUID: Generic Attribute Profile (0x1801)
        Handle range: 0x0010-0x0022
        UUID: Device Information (0x180a)

> 0000: 02 47 20 18 00 14 00 04  00 11 06 01 00 0b 00 00  0010: 18 0c 00 0f 00 01 18 10  00 22 00 0a 18           

It looks like that one response delivers a group a time, so successive request/response continues until handle reaches 0xffff

< ACL Data TX: Handle 71 flags 0x00 dlen 11              [hci0] 22:57:39.844179
      ATT: Read By Group Type Request (0x10) len 6
        Handle range: 0x0023-0xffff
        Attribute group type: Primary Service (0x2800)
> HCI Event: Number of Completed Packets (0x13) plen 5   [hci0] 22:57:39.913884
        Num handles: 1
        Handle: 71
        Count: 1
> ACL Data RX: Handle 71 flags 0x02 dlen 26              [hci0] 22:57:39.983445
      ATT: Read By Group Type Response (0x11) len 21
        Attribute data length: 20
        Attribute group list: 1 entry
        Handle range: 0x0023-0x002d
        UUID: Unknown (f000aa00-0451-4000-b000-000000000000)
< ACL Data TX: Handle 71 flags 0x00 dlen 11              [hci0] 22:57:39.983995
      ATT: Read By Group Type Request (0x10) len 6
        Handle range: 0x002e-0xffff
        Attribute group type: Primary Service (0x2800)
> HCI Event: Number of Completed Packets (0x13) plen 5   [hci0] 22:57:40.060765
        Num handles: 1
        Handle: 71
        Count: 1
> ACL Data RX: Handle 71 flags 0x02 dlen 26              [hci0] 22:57:40.123327
      ATT: Read By Group Type Response (0x11) len 21
        Attribute data length: 20
        Attribute group list: 1 entry
        Handle range: 0x002e-0x0038
        UUID: Unknown (f000aa10-0451-4000-b000-000000000000)
< ACL Data TX: Handle 71 flags 0x00 dlen 11              [hci0] 22:57:40.123544
      ATT: Read By Group Type Request (0x10) len 6
        Handle range: 0x0039-0xffff
        Attribute group type: Primary Service (0x2800)
> HCI Event: Number of Completed Packets (0x13) plen 5   [hci0] 22:57:40.193685
        Num handles: 1
        Handle: 71
        Count: 1
> ACL Data RX: Handle 71 flags 0x02 dlen 26              [hci0] 22:57:40.263413
      ATT: Read By Group Type Response (0x11) len 21
        Attribute data length: 20
        Attribute group list: 1 entry
        Handle range: 0x0039-0x0043
        UUID: Unknown (f000aa20-0451-4000-b000-000000000000)
< ACL Data TX: Handle 71 flags 0x00 dlen 11              [hci0] 22:57:40.263720
      ATT: Read By Group Type Request (0x10) len 6
        Handle range: 0x0044-0xffff
        Attribute group type: Primary Service (0x2800)
> HCI Event: Number of Completed Packets (0x13) plen 5   [hci0] 22:57:40.403808
        Num handles: 1
        Handle: 71
        Count: 1
> ACL Data RX: Handle 71 flags 0x02 dlen 26              [hci0] 22:57:40.404839
      ATT: Read By Group Type Response (0x11) len 21
        Attribute data length: 20
        Attribute group list: 1 entry
        Handle range: 0x0044-0x004e
        UUID: Unknown (f000aa30-0451-4000-b000-000000000000)
< ACL Data TX: Handle 71 flags 0x00 dlen 11              [hci0] 22:57:40.405062
      ATT: Read By Group Type Request (0x10) len 6
        Handle range: 0x004f-0xffff
        Attribute group type: Primary Service (0x2800)
> HCI Event: Number of Completed Packets (0x13) plen 5   [hci0] 22:57:40.473655
        Num handles: 1
        Handle: 71
        Count: 1
> ACL Data RX: Handle 71 flags 0x02 dlen 26              [hci0] 22:57:40.549909
      ATT: Read By Group Type Response (0x11) len 21
        Attribute data length: 20
        Attribute group list: 1 entry
        Handle range: 0x004f-0x005d
        UUID: Unknown (f000aa40-0451-4000-b000-000000000000)
< ACL Data TX: Handle 71 flags 0x00 dlen 11              [hci0] 22:57:40.550199
      ATT: Read By Group Type Request (0x10) len 6
        Handle range: 0x005e-0xffff
        Attribute group type: Primary Service (0x2800)
> HCI Event: Number of Completed Packets (0x13) plen 5   [hci0] 22:57:40.613695
        Num handles: 1
        Handle: 71
        Count: 1
> ACL Data RX: Handle 71 flags 0x02 dlen 26              [hci0] 22:57:40.683447
      ATT: Read By Group Type Response (0x11) len 21
        Attribute data length: 20
        Attribute group list: 1 entry
        Handle range: 0x005e-0x0068
        UUID: Unknown (f000aa50-0451-4000-b000-000000000000)
< ACL Data TX: Handle 71 flags 0x00 dlen 11              [hci0] 22:57:40.683942
      ATT: Read By Group Type Request (0x10) len 6
        Handle range: 0x0069-0xffff
        Attribute group type: Primary Service (0x2800)
> HCI Event: Number of Completed Packets (0x13) plen 5   [hci0] 22:57:40.753660
        Num handles: 1
        Handle: 71
        Count: 1
> ACL Data RX: Handle 71 flags 0x02 dlen 12              [hci0] 22:57:40.823257
      ATT: Read By Group Type Response (0x11) len 7
        Attribute data length: 6
        Attribute group list: 1 entry
        Handle range: 0x0069-0x006d
        UUID: Unknown (0xffe0)
< ACL Data TX: Handle 71 flags 0x00 dlen 11              [hci0] 22:57:40.823554
      ATT: Read By Group Type Request (0x10) len 6
        Handle range: 0x006e-0xffff
        Attribute group type: Primary Service (0x2800)
> HCI Event: Number of Completed Packets (0x13) plen 5   [hci0] 22:57:40.893657
        Num handles: 1
        Handle: 71
        Count: 1
> ACL Data RX: Handle 71 flags 0x02 dlen 26              [hci0] 22:57:40.970015
      ATT: Read By Group Type Response (0x11) len 21
        Attribute data length: 20
        Attribute group list: 1 entry
        Handle range: 0x006e-0x0074
        UUID: Unknown (f000aa60-0451-4000-b000-000000000000)
< ACL Data TX: Handle 71 flags 0x00 dlen 11              [hci0] 22:57:40.970332
      ATT: Read By Group Type Request (0x10) len 6
        Handle range: 0x0075-0xffff
        Attribute group type: Primary Service (0x2800)
> HCI Event: Number of Completed Packets (0x13) plen 5   [hci0] 22:57:41.033661
        Num handles: 1
        Handle: 71
        Count: 1
> ACL Data RX: Handle 71 flags 0x02 dlen 26              [hci0] 22:57:41.103462
      ATT: Read By Group Type Response (0x11) len 21
        Attribute data length: 20
        Attribute group list: 1 entry
        Handle range: 0x0075-0x007f
        UUID: Unknown (f000ccc0-0451-4000-b000-000000000000)
< ACL Data TX: Handle 71 flags 0x00 dlen 11              [hci0] 22:57:41.103968
      ATT: Read By Group Type Request (0x10) len 6
        Handle range: 0x0080-0xffff
        Attribute group type: Primary Service (0x2800)
> HCI Event: Number of Completed Packets (0x13) plen 5   [hci0] 22:57:41.173666
        Num handles: 1
        Handle: 71
        Count: 1
> ACL Data RX: Handle 71 flags 0x02 dlen 26              [hci0] 22:57:41.243343
      ATT: Read By Group Type Response (0x11) len 21
        Attribute data length: 20
        Attribute group list: 1 entry
        Handle range: 0x0080-0xffff
        UUID: Unknown (f000ffc0-0451-4000-b000-000000000000)

If UUID is used (0x1801 for example):

Find By Type Value Request

< ACL Data TX: Handle 71 flags 0x00 dlen 13              [hci0] 01:01:43.451403
      ATT: Find By Type Value Request (0x06) len 8
        Handle range: 0x0001-0xffff
        Attribute type: Primary Service (0x2800)
          UUID: Generic Attribute Profile (0x1801)

< 0000: 02 47 00 0d 00 09 00 04  00 06 01 00 ff ff 00 28
  0010: 01 18  

> HCI Event: Number of Completed Packets (0x13) plen 5   [hci0] 01:01:44.241679
        Num handles: 1
        Handle: 71
        Count: 1

Find By Type Value Response

Note: The Group End Handle may be greater than the Ending Handle in the Find By Type Value Request.

> ACL Data RX: Handle 71 flags 0x02 dlen 9               [hci0] 01:01:44.311128
      ATT: Find By Type Value Response (0x07) len 4
        Handle range: 0x000c-0x000f

> 0000: 02 47 20 09 00 05 00 04  00 07 0c 00 0f 00 

Then another Find By Type Value Request is sent with the rest of handle replied by the response above

< ACL Data TX: Handle 71 flags 0x00 dlen 13              [hci0] 01:01:44.311737
      ATT: Find By Type Value Request (0x06) len 8
        Handle range: 0x0010-0xffff
        Attribute type: Primary Service (0x2800)
          UUID: Generic Attribute Profile (0x1801)
> HCI Event: Number of Completed Packets (0x13) plen 5   [hci0] 01:01:44.381585
        Num handles: 1
        Handle: 71
        Count: 1

 Error Response

> ACL Data RX: Handle 71 flags 0x02 dlen 9               [hci0] 01:01:44.450990
      ATT: Error Response (0x01) len 4
        Find By Type Value Request (0x06)
        Handle: 0x0010
        Error: Attribute Not Found (0x0a)

> 0000: 02 47 20 09 00 05 00 04  00 01 06 10 00 0a