Apple Continuity Protocol

Apple Continuity uses Bluetooth LE advertisements to enable seamless integration between Apple devices. The Bluetooth Framework can capture and decode these advertisements, identifying messages like AirDrop, Handoff, Find My, AirPlay, HomeKit, and many others.

Apple Continuity is the proprietary Apple technology that allows Apple devices to work together. For communication, the Continuity protocol uses Bluetooth and Wi-Fi. The Bluetooth Framework allows capturing and decoding the Apple Continuity Bluetooth LE advertisement packets.

Continuity Messages

Each Continuity advertisement packet contains one or more continuity messages. To test the Apple Continuity protocol message decoding feature, use the Beacons sample application from the Bluetooth Framework package. The framework can decode the following continuity messages:

Message Description
AirDrop Message AirDrop is an Apple technology that allows users to share files with each other via Wi-Fi and Bluetooth, but without the need for both to be connected to a Wi-Fi network.
AirPlay Source Message AirPlay Source messages are sent when a user has entered the menu to select a device to play their media from when multiple media sources are available.
AirPlay Target Message AirPlay Target messages are sent by AirPlay-compatible devices to advertise their presence to Apple devices that are actively seeking to send media to them.
AirPrint Message AirPrint is an Apple technology designed to enable printing from iOS and macOS devices without needing to install additional software if the printer supports AirPrint.
Find My Message Find My messages are broadcast by Apple devices that are marked as lost by the user or that do not have internet connectivity. This message includes the x-coordinate of the currently active elliptic curve public key for the disconnected device. Because BLE advertisements are limited to 31 total bytes, some of which are used to encode the company identifier and other metadata, Apple encodes part of the key in the BLE advertising address, with the remaining public key included in the advertisement payload. When a nearby internet-connected Apple device sees this BLE message, it sends a location report using its own GPS to Apple servers. This location report is encrypted with the advertised public key so that only the device owner can decrypt the location report. The owner of the lost device will then see the lost device's location appear on their Find My app.
Handoff Message Handoff messages enable users to start tasks on one iOS or macOS device and finish them on another. Handoff is supported with the Apple Calendar, Contacts, Mail, Maps, Messages, Notes, Reminders, Safari, Pages, Numbers, Keynote applications, as well as certain third-party applications that are designed to support Handoff by their developers.
Hey Siri Message Hey Siri messages are emitted by a device when the voice assistant Siri is used. Of note, a perceptual hash of the voice command is included in the packet.
HomeKit Message HomeKit is Apple's smart home framework, and HomeKit messages are broadcast continuously by HomeKit-compatible devices.
Magic Switch Message Magic Switch messages are an Apple Watch-specific message sent when a user is wearing an Apple Watch that has lost its connection to its paired iPhone while its screen is on.
Nearby Action Message Nearby Action messages are sent in order to inform nearby devices of a change in device state, including joining a Wi-Fi network or initial setup of an iOS device.
Nearby Info Message Nearby Info messages broadcast the usage state of an iOS device to other nearby devices. Nearby Info messages are broadcast continuously in modern iOS versions regardless of user activity and can be used to determine general usage states (phone locked, active user, driving a vehicle) passively.
Proximity Pairing Message Proximity Pairing is an Apple technology that is used to pair AirPods and iOS devices. These messages carry unencrypted information detailing the status, model, and color of the audio device as well as the power and charging status.
Tethering Source Message Tethering Source messages are broadcast in response to a Tethering Target message generated by another device (typically a MacBook) linked to the same iCloud account as the iPhone or iPad that is to be used as a hotspot. The Tethering Source message contains information pertaining to the battery life and type and quality of cellular service the hotspot device has. Some of this information is listed in the "available Wi-Fi networks" listed on the Tethering Target device when searching for the hotspot.
Tethering Target Message Tethering Target messages are broadcast in order to elicit a response from a device to be used as a hotspot, which will reply with a Tethering Source message. In a typical usage example, a user clicks on the menu button that displays the list of available Wi-Fi networks on a MacBook. This action generates a stream of Tethering Target messages that continue for the duration of the period in which the available networks tab is opened. In response, a hotspot-capable device linked to the same iCloud account (an iPhone or an iPad with a cellular connection) responds with Tethering Source messages to advertise its presence and connection capabilities, including battery status, type of cellular connection, and strength of cellular signal.

Frequently Asked Questions

What is Apple Continuity?
Apple Continuity is a proprietary Apple technology that allows Apple devices to work together using Bluetooth and Wi-Fi.
Which Continuity messages can the Bluetooth Framework decode?
The Bluetooth Framework can decode AirDrop, AirPlay Source/Target, AirPrint, Find My, Handoff, Hey Siri, HomeKit, Magic Switch, Nearby Action, Nearby Info, Proximity Pairing, and Tethering Source/Target messages.
How to capture Apple Continuity BLE advertisements?
Use the Beacons sample application from the Bluetooth Framework package. It captures and decodes Apple Continuity BLE advertisement packets.