SPP Probe

tools/spp_probe.py scans RFCOMM channels 1 through 30 to identify which ones the NCH700 accepts connections on.

Usage

python tools/spp_probe.py

What It Does

The tool attempts a Bluetooth RFCOMM connection to each channel with a 2-second timeout. For each channel it reports the connection status: CONNECTED, timeout, refused, or host down. If the channel sends any initial data on connect, the tool captures and displays it.

After scanning all channels, it prints a summary of all open channels.

Results

The NCH700 accepts connections on the following channels:

Channel	Notes
8	Open, no initial data
9	Open, no initial data
14	Open, sends initial ff55 data
20	Open, no initial data
21	Open, no initial data
25	Open, no initial data
27	Open, sends initial fe03 data
29	Open, no initial data
30	Open, no initial data

Channels 14 and 27 are the most interesting because they send unsolicited data on connection, indicating active protocol endpoints.

Notes

This was the first tool used in the research to discover which channels the NCH700 exposes. Run it immediately after pairing — channel 14 may only be available on the first connection after a power cycle.