Discovery Overview
The NCH700 exposes a dual-protocol architecture over Bluetooth SPP (Serial Port Profile). Rather than a single command channel like the QC35, the headphones present nine RFCOMM channels with at least three distinct protocol variants.
Protocol variants
Section titled “Protocol variants”QC35-compatible protocol (channels 8 and 9)
Section titled “QC35-compatible protocol (channels 8 and 9)”Channels 8 and 9 use the same [fn1][fn2][sub][len][data...] message format documented by the based-connect project for QC35. Commands like device name query, firmware version, and NC level read all work as expected. Channels 8 and 9 appear functionally identical — the same commands produce the same responses on both.
ff55 protocol (channel 14)
Section titled “ff55 protocol (channel 14)”Channel 14 uses a distinct framing format with ff 55 as a magic header. This protocol is NCH700-specific and has no equivalent in the QC35 documentation. On connection, the device immediately sends ff 55 02 00 ee 10.
A critical behavioral difference: channel 14 only accepts the first RFCOMM connection after a power cycle. Subsequent connection attempts are refused until the headphones are powered off and back on. This session-limited behavior suggests a handshake or pairing-level protocol.
fe03 status beacon (channel 27)
Section titled “fe03 status beacon (channel 27)”Channel 27 broadcasts a 20-byte status message on connection using fe 03 as its magic header. It responds to any input with a fixed 12-byte response regardless of the data sent. The UUID 0xFE03 is assigned to Amazon in the Bluetooth SIG registry, suggesting a possible connection to Alexa integration.
Silent channels
Section titled “Silent channels”Channels 20, 21, 25, 29, and 30 accept RFCOMM connections but don’t send initial data and don’t respond to QC35-format or ff55-format probes. Their purpose is unknown.
AT command observation
Section titled “AT command observation”The AT command AT+XEVENT=Bose SoundLink,158 was observed in system logs during HFP (Handsfree Profile) connection. This is a vendor-specific AT extension — the +XEVENT command is not part of the standard HFP specification. The “SoundLink” identifier in an NCH700 context is noteworthy and may indicate shared firmware heritage.
Protocol comparison
Section titled “Protocol comparison”| Aspect | QC35 (based-connect) | NCH700 ff55 | NCH700 fe03 |
|---|---|---|---|
| Magic bytes | 05 (per based-connect) | ff 55 | fe 03 |
| Channels | Likely 1 | 14 | 27 |
| Format | [fn1][fn2][sub][len][data] | TBD | Fixed responses |
| Checksum | None | Unknown (ee 10 unclear) | None observed |
| Availability | Always | First connection after power cycle | Always |
The QC35-compatible layer provides read access to device state, while the ff55 protocol likely handles NCH700-specific write operations such as 11-level noise cancellation control. Confirming this hypothesis requires capturing Bose Music app traffic during an NC level change.