RFCOMM Channel Map
The NCH700 exposes nine RFCOMM channels that accept connections. Channels 1-7 and 10-13 refuse connections outright — only the channels listed below are reachable.
Discovered channels
Section titled “Discovered channels”| Channel | Status | Initial Data | Protocol | Notes |
|---|---|---|---|---|
| 8 | Open | None | QC35-compatible | Device name, firmware, NC queries work |
| 9 | Open | None | QC35-compatible | Appears identical to channel 8 |
| 14 | Open* | ff 55 02 00 ee 10 | ff55 (NCH700-specific) | Only first connection after power cycle |
| 20 | Open | None | Unknown | Accepts connection, silent |
| 21 | Open | None | Unknown | Accepts connection, silent |
| 25 | Open | None | Unknown | Accepts connection, silent |
| 27 | Open | fe 03 01 00... (20 bytes) | fe03 status beacon | Fixed response to any input |
| 29 | Open | None | Unknown | Accepts connection, silent |
| 30 | Open | None | Unknown | Accepts connection, silent |
*Channel 14 only accepts connections on the first RFCOMM session after a power cycle. Subsequent attempts return “Connection refused.”
Channel behavior categories
Section titled “Channel behavior categories”Active channels (8, 9, 14, 27)
Section titled “Active channels (8, 9, 14, 27)”These channels respond to connections with either initial data or by accepting and processing commands. Channels 8 and 9 process QC35-format commands. Channel 14 sends its ff55 greeting. Channel 27 sends its fe03 status beacon.
Silent channels (20, 21, 25, 29, 30)
Section titled “Silent channels (20, 21, 25, 29, 30)”These channels accept RFCOMM connections successfully but don’t send initial data and don’t respond to any probing with QC35-format commands, ff55-format commands, or raw data. Several possibilities exist for their function:
- AT command channels for HFP or other Bluetooth profiles
- Bose Music app-specific channels that require a particular handshake
- Future protocol extensions reserved but not yet active in firmware 2.0.4
- Profile-specific data channels activated only during certain operational modes (e.g., Bose AR head tracking, firmware update)
Refused channels (1-7, 10-13)
Section titled “Refused channels (1-7, 10-13)”These channels actively refuse RFCOMM connections. They are not exposed in the device’s SDP records for SPP.
Discovery method
Section titled “Discovery method”Channel discovery was performed by iterating through RFCOMM channels 1-30 using Python’s bluetooth module with socket.connect_ex(). Each channel was tested with a 5-second timeout. The results were consistent across multiple power cycles, with the exception of channel 14’s single-session behavior.
See the SPP Probe tool documentation for the scanning script used.