Modulation is the process of combining two signals into one transmittable signal. You have to understand two types of signal involved:

Why do you need a carrier? You cannot just broadcast a 1 MHz data signal directly — it would require an enormous antenna and would interfere with everything else. High-frequency carrier waves are much easier to transmit efficiently with small antennas and are regulated into specific bands so different technologies do not collide. The modulation process mixes the data signal onto the carrier so the combined signal can be sent over the air.

A carrier signal has three properties that can be varied to encode data. Each one gives a different modulation scheme with different advantages and disadvantages:

FSK (Frequency Shift Keying) is the digital version of frequency modulation. Instead of a continuous range of frequencies, it uses just two distinct frequency levels — one to represent binary 1 and another to represent binary 0.

In BLE specifically:

• A binary 1 is encoded as a positive frequency deviation from the carrier centre frequency — the carrier shifts upward.
• A binary 0 is encoded as a negative frequency deviation — the carrier shifts downward.

The receiver on the other end continuously monitors the incoming carrier frequency. When it detects the frequency has risen above the centre, it records a 1. When it drops below the centre, it records a 0. In this way, an entire packet of bits can be reconstructed from the frequency variations in the received signal.

Why is FSK better than AM for BLE? Radio noise in the 2.4 GHz band primarily affects the amplitude of signals — microwave ovens, Wi-Fi transmissions, and other interference all add power on top of the received signal. An AM receiver watching for amplitude changes would mistake this noise for data. An FSK receiver watching for frequency changes ignores amplitude completely — it only cares which frequency it is receiving, making it much more robust in a noisy environment.

Plain FSK has a problem. Every time a bit changes — from 1 to 0 or 0 to 1 — the carrier frequency must jump abruptly between two levels. In practice, an abrupt frequency jump creates a burst of high-frequency energy that spills outside the intended 2 MHz channel and interferes with neighbouring channels. This is called spectral leakage or spectral spreading.

GFSK (Gaussian Frequency Shift Keying) fixes this by passing the data signal through a Gaussian filter before it modulates the carrier. The Gaussian filter smooths the sharp edges of the digital signal — instead of abrupt step changes, the transitions become gradual curves. The modulating signal is now a rounded waveform rather than a square wave.

This smoothing process is called pulse shaping. It is essential for BLE to co-exist with neighbouring channels. Without it, each BLE transmission would bleed power into the channels on either side, interfering with other devices and exceeding spectrum regulations.

The trade-off is minor — the Gaussian filter introduces a small amount of inter-symbol interference (the current bit’s shape influences the next bit slightly). The BT product of 0.5 in the BLE specification is chosen to balance spectral compactness against receiver complexity.

/* BLE uses GFSK at 1 Mbps. BlueZ exposes PHY info via HCI */
/* From BlueZ hci.h — LE Set PHY command (Bluetooth 5.0+) */

/* PHY options for BLE connections */
#define HCI_LE_PHY_1M        0x01  /* 1 Mbps GFSK (original BLE PHY) */
#define HCI_LE_PHY_2M        0x02  /* 2 Mbps GFSK (BT 5.0, faster)   */
#define HCI_LE_PHY_CODED     0x04  /* Coded PHY (BT 5.0, longer range)*/

/* To check which PHY is being used on a connection: */
/* hcitool cmd 0x08 0x0030     */
/* (LE Read PHY command)                              */

/* Sniffer output showing GFSK demodulation data:    */
/* wireshark with BTLE plugin shows per-packet:       */
/* - Channel index (0-39)                            */
/* - RSSI (signal strength in dBm)                   */
/* - Demodulated payload bytes                       */

A Bluetooth sniffer captures every radio packet transmitted over the air and records its timing. Looking at a timeline of BLE activity reveals the “mostly off” nature of BLE in a concrete and striking way. An air capture taken during a GATT profile session shows an LE device advertising, followed by a dual-mode device discovering and connecting to it. Four important patterns emerge from this capture:

Why do advertising packets always come in sets of 3? An advertising device transmits once on channel 37, then immediately again on channel 38, then immediately on channel 39. This three-channel burst gives any scanner in the area the best chance of picking up the advertisement regardless of which channel it is currently listening on. After all three transmissions, the device waits for the advertising interval (typically 100 ms to several seconds) before repeating the three-channel burst.

/* Capturing BLE advertising with BlueZ hcitool and btmon */

/* Start BLE scan to see advertising packets: */
/* sudo hcitool lescan --duplicates */

/* Or use btmon for a detailed HCI-level trace: */
/* sudo btmon | grep -A5 "LE Advertising Report" */

/* btmon output shows per-advertising-event: */
/* > HCI Event: LE Meta Event (0x3e) plen 42          */
/*   LE Advertising Report (0x02)                     */
/*   Num reports: 1                                   */
/*   Event type: ADV_IND (connectable undirected) (0) */
/*   Address type: Public (0x00)                      */
/*   Address: 00:1A:7D:DA:71:13 (Polar)               */
/*   Data length: 25                                  */
/*   Flags: 0x06 (LE General Discoverable)            */
/*   Complete name: Polar H7                          */
/*   RSSI: -62 dBm                                    */

Chapter 8 moves one layer up in the stack — the Link Layer. This layer uses the Physical Layer’s radio channel to implement the state machine (Standby, Advertising, Scanning, Initiating, Connected), manage device addresses, and implement adaptive frequency hopping across the 37 data channels.