Anyone know how Bluetooth actually works on NordicTrack treadmills?

Has anyone tried sniffing the BLE traffic with something like nRF Connect to see if the console is advertising A2DP support for bluetooth audio streaming? Would be a fun weekend project.

Someone on the iFit reddit did this a couple years back. It's only advertising the iFit service and the heart rate sensor service (on newer models). No A2DP support in the firmware. It can only control the treadmill via BLE.
 
Someone on the iFit reddit did this a couple years back. It's only advertising the iFit service and the heart rate sensor service (on newer models). No A2DP support in the firmware. It can only control the treadmill via BLE.

interesting. So you'd be able MITM the ifit protocol and impersonate the app but no audio would be unlocked. That tracks with what you said above. Thanks.
 
the app tells the treadmill what speed/incline to be at and the treadmill reports stats like speed/incline/HR back. That's basically it.

and thats why ifit can automatically adjust the incline of your treadmill during a workout. The trainer 'controls' the treadmill via bluetooth.