MultiNav Pro+ BLE - passive sniffing / promiscuous mode at long range feasible?

@Edward Bond yeah your instinct about the one-way link budget is solid — passive scanning should theoretically give you better effective range than a bidirectional connection because you're only fighting the uplink path. The advertising node just needs enough TX power to reach the observer, no ACK required, no connection supervision timeout killing you.

 

The MultiNav Pro+ is built on the STM32WB07, so in observer/scanner role it's fully supported at the stack level — you're just running the GAP Observer role, no pairing, no connection. The firmware repo is public on GitHub (github.com/RFOXiA/MultiNav-Pro-Long-Range-BLE-Module-Firmware-STM32WB07) so you can dig into how the radio is configured and tune scan window/interval for your use case. For a base station that's just hoovering up advertisements, you'd want scan window close to or equal to scan interval so you're not missing packets during dead time.

 

One thing worth testing at range — advertisement channels are only 3 (37, 38, 39) and the module's receiver sensitivity is where the real magic happens on these, so extended advertising (BLE 5) with coded PHY would be your friend if you want to push the range envelope further. That gives you the link budget of a lower data rate without needing a connection. Worth checking if the current firmware exposes that config or if it needs a tweak.

 

What's the approximate node density and how spread out are we talking? That'll affect whether you need to worry about advertisement collision at the base station side.

Passive scanning works really well on the MultiNav Pro+ for exactly this use case - you just put the base station in observer role (HCI_LE_Set_Scan_Enable with no connection initiation) and it'll happily collect ADV_NONCONN_IND packets all day without any of the connection overhead. The one-way link budget advantage is real, though in my experience the practical range gains depend heavily on your advertising interval and TX power settings on the node side, so I'd experiment with bumping the interval up a bit if you're pushing distance. Also worth double-checking your scan window/interval ratio on the base station so you're not missing packets during blind periods.

Dawn covered the scanning side well - one thing I'd add is that if you're pushing range in an outdoor environment, ADV_NONCONN_IND on the 3 primary channels can get pretty lossy so consider whether your nodes can use extended advertising (if the firmware supports it) to get that longer payload and potentially better PHY options. Also double check the antenna orientation on your base station enclosure, I had a deployment where just rotating the module 90 degrees indoors got me an extra 15-20m because I was hitting a null in the pattern without realizing it.