Skip to content

Connecting to Bombay

The test device for this project is aliased “Bombay” at MAC address C8:7B:23:55:68:E8.

On this test system the Bluetooth adapter is hci1, not the default hci0. Commands that accept an adapter flag need to be pointed at the correct interface. For example:

Terminal window
hcitool -i hci1 scan

bluetoothctl typically selects the correct adapter automatically once it has been set as default, but verify with list if connections fail unexpectedly.

Put the headphones into pairing mode (slide the power switch up and hold until the LED blinks blue), then:

Terminal window
bluetoothctl
[bluetooth]# power on
[bluetooth]# scan on
# Wait for "C8:7B:23:55:68:E8 Bombay" to appear
[bluetooth]# scan off
[bluetooth]# pair C8:7B:23:55:68:E8
[bluetooth]# trust C8:7B:23:55:68:E8
[bluetooth]# connect C8:7B:23:55:68:E8

Once paired and trusted, the headphones will reconnect automatically on subsequent power-on cycles.

Connecting the NCH700 to USB for charging shuts down the Bluetooth radio entirely. Any attempt to connect while the cable is attached will fail with “Host is down” errors. After unplugging, the headphones need to be powered on manually before they become discoverable again.

The headphones accept RFCOMM connections on multiple channels simultaneously. Nine channels were found open during initial probing (8, 9, 14, 20, 21, 25, 27, 29, 30). You can connect using rfcomm from BlueZ or via Python sockets.

A minimal Python example using PyBluez to connect to channel 8 (QC35 legacy protocol):

import bluetooth
sock = bluetooth.BluetoothSocket(bluetooth.RFCOMM)
sock.connect(("C8:7B:23:55:68:E8", 8))
# Send a QC35-style query (get firmware version)
sock.send(bytes([0x00, 0x05, 0x01, 0x00]))
response = sock.recv(1024)
print(response.hex(" "))
sock.close()

Channels 8 and 9 carry the QC35-compatible command protocol. Channel 27 broadcasts an fe03 status beacon immediately on connection. Channel 14 uses the ff55 framing protocol specific to the NCH700.

Channel 14 has a unique restriction: it only accepts a connection immediately after the headphones are powered on. The first RFCOMM connection to channel 14 after a power cycle succeeds and receives data framed with the ff55 magic header. All subsequent connection attempts to that channel are refused until the headphones are power-cycled again.

The grab_ch14.py script in the tools/ directory is built specifically for this scenario. It connects as quickly as possible after power-on to catch the brief acceptance window.