Noise Cancellation

Caution

This page documents ongoing research. NC level reading works, but the SET command for 11-level control has not been confirmed.

The NCH700 supports 11 noise cancellation levels (0 through 10), a significant upgrade from the QC35’s 3 levels (high, low, off). Level 10 is maximum noise cancellation, and level 0 is full transparency (all ambient sound passed through).

Reading the current NC level

The QC35-compatible command 01 06 01 00 on channel 8 returns the current NC level:

Send:  01 06 01 00
Recv:  01 06 04 01 0a

The final byte 0a (decimal 10) is the NC level. This command works reliably and returns the correct value as confirmed by cross-referencing with the Bose Music app display.

Response format: 01 06 04 01 <level> where <level> is 00 through 0a.

Setting the NC level (unconfirmed)

The QC35-compatible set command follows the expected pattern:

Send:  01 06 02 01 05          (attempt to set level 5)
Recv:  01 06 04 01 0a          (returns current level = 10, unchanged)

The device accepts the command without error and returns a response in the same format as the GET command. However, the NC level does not actually change — the response contains the pre-existing level value, and the headphones continue operating at the previous setting.

This was tested with multiple target levels (0, 3, 5, 7) on channel 8. None produced an actual change in noise cancellation behavior.

Why SET doesn’t work on channel 8

Three hypotheses:

1. ff55 protocol required. The QC35-compatible layer on channels 8/9 may provide read-only access to NC state on the NCH700. The actual NC control likely uses the ff55 protocol on channel 14, which is the NCH700-specific protocol layer.

2. Different command format. The NCH700’s 11-level system may use a different function code than the QC35’s 01 06 pair. The QC35 only needed to express 3 states; 11 levels may require a different command structure.

3. Authorization required. The Bose Music app may establish a session or authentication token before NC changes are accepted. The QC35 protocol had no such requirement, but the NCH700’s session-limited channel 14 behavior suggests more sophisticated connection management.

Next steps

To find the actual NC SET command, the following approaches are planned:

• Capture HCI snoop traffic during an NC level change via the Bose Music app. Android’s Bluetooth HCI snoop log (enabled in Developer Options) will record the exact bytes sent when the user adjusts the NC slider. This is the most direct path to the answer.

• Test ff55-framed NC commands on channel 14. Send NC level data using the ff 55 framing to see if channel 14 accepts write operations that channel 8 rejects.

• Determine if a session handshake on channel 14 is needed before NC control commands are accepted. The ff55 protocol’s session-limited behavior (one connection per power cycle) may be part of an initialization sequence.

• Analyze NC config data. The 01 07 01 00 command returns NC configuration data with f6 0a pattern groups. Decoding this structure may reveal the internal NC command mapping.

NC levels vs. QC35

Feature	QC35	NCH700
Levels	3 (high, low, off)	11 (0-10)
Read command	01 06 01 00	01 06 01 00 (same)
Set command	01 06 02 01 <level>	Unknown
Conversation mode	No	Yes (quick transparency toggle)
Per-level granularity	Fixed presets	Continuous slider

The read command is identical between the two devices, which makes the set command’s failure on the NCH700 noteworthy. Bose likely maintained backward-compatible reads while moving writes to the newer protocol layer.