Hello,

I'm trying to use some Brute Force attack like Redfang and btscanner to find the BT_ADDR of a Bluetooth equipment that is in non-discoverable mode.

I read that a full scan can take 11hours but I want to know is someone have Test this tool

Because paging sequence for a bluetooth equipment is like 1 to 5 seconde

so I don't understand how is possible to scan the entire range of BT_ADDR in only 11hours.

Thanks for your attention