"Connection timed out(100)" when trying to set up a bluetooth PAN

I'm trying to set up a Bluetooth PAN between two Linux systems. I've got it working between two Raspberry Pi 3s, both running BlueZ 5.23. However, when I try to connect a different Linux system running BlueZ 4.101, I get this error:

pand[27746]: Connect to B8:27:EB:6C:CE:26 failed. Connection timed out(110)

I have successfully gotten two BlueZ 4.101 systems to talk to each other, but it consistently fails with that error when I try to get it to talk to my Pi3 NAP. Unfortunately, the older version of BlueZ is running on a very small embedded system and I can't run hcidump on it easily. However, I do have the output of hcidump for the two different attempts to talk to the Pi3:

This was a successful attempt to connect from another Pi3:

HCI sniffer - Bluetooth packet analyzer ver 5.45 btsnoop version: 1 datalink type: 1002
> HCI Event: Connect Request (0x04) plen 10
    bdaddr B8:27:EB:99:1C:22 class 0x000000 type ACL < HCI Command: Accept Connection Request (0x01|0x0009) plen 7
    bdaddr B8:27:EB:99:1C:22 role 0x00
    Role: Master
> HCI Event: Command Status (0x0f) plen 4
    Accept Connection Request (0x01|0x0009) status 0x00 ncmd 1
> HCI Event: Role Change (0x12) plen 8
    status 0x00 bdaddr B8:27:EB:99:1C:22 role 0x00
    Role: Master
> HCI Event: Connect Complete (0x03) plen 11
    status 0x00 handle 12 bdaddr B8:27:EB:99:1C:22 type ACL encrypt 0x00 < HCI Command: Read Remote Supported Features (0x01|0x001b) plen 2
    handle 12
> HCI Event: Command Status (0x0f) plen 4
    Read Remote Supported Features (0x01|0x001b) status 0x00 ncmd 1
> HCI Event: Read Remote Supported Features (0x0b) plen 11
    status 0x00 handle 12
    Features: 0xbf 0xfe 0xcf 0xfe 0xdb 0xff 0x7b 0x87 < HCI Command: Read Remote Extended Features (0x01|0x001c) plen 3
    handle 12 page 1
> HCI Event: Command Status (0x0f) plen 4
    Read Remote Extended Features (0x01|0x001c) status 0x00 ncmd 1
> HCI Event: Read Remote Extended Features (0x23) plen 13
    status 0x00 handle 12 page 1 max 2
    Features: 0x03 0x00 0x00 0x00 0x00 0x00 0x00 0x00 < HCI Command: Remote Name Request (0x01|0x0019) plen 10
    bdaddr B8:27:EB:99:1C:22 mode 2 clkoffset 0x0000 < ACL data: handle 12 flags 0x00 dlen 10
    L2CAP(s): Info req: type 2
> HCI Event: Max Slots Change (0x1b) plen 3
    handle 12 slots 5
> HCI Event: Command Status (0x0f) plen 4
    Remote Name Request (0x01|0x0019) status 0x00 ncmd 1
> ACL data: handle 12 flags 0x02 dlen 10
    L2CAP(s): Info req: type 2 < ACL data: handle 12 flags 0x00 dlen 16
    L2CAP(s): Info rsp: type 2 result 0
      Extended feature mask 0x02b8
        Enhanced Retransmission mode
        Streaming mode
        FCS Option
        Fixed Channels
        Unicast Connectless Data Reception
> HCI Event: Remote Name Req Complete (0x07) plen 255
    status 0x00 bdaddr B8:27:EB:99:1C:22 name 'raspberrypi'
> ACL data: handle 12 flags 0x02 dlen 16
    L2CAP(s): Info rsp: type 2 result 0
      Extended feature mask 0x02b8
        Enhanced Retransmission mode
        Streaming mode
        FCS Option
        Fixed Channels
        Unicast Connectless Data Reception < ACL data: handle 12 flags 0x00 dlen 10
    L2CAP(s): Info req: type 3
> HCI Event: Number of Completed Packets (0x13) plen 5
    handle 12 packets 2
> ACL data: handle 12 flags 0x02 dlen 10
    L2CAP(s): Info req: type 3 < ACL data: handle 12 flags 0x00 dlen 20
    L2CAP(s): Info rsp: type 3 result 0
      Fixed channel list 0x00000006
        L2CAP Signalling Channel
        L2CAP Connless
> ACL data: handle 12 flags 0x02 dlen 20
    L2CAP(s): Info rsp: type 3 result 0
      Fixed channel list 0x00000006
        L2CAP Signalling Channel
        L2CAP Connless
> HCI Event: Number of Completed Packets (0x13) plen 5
    handle 12 packets 2
> ACL data: handle 12 flags 0x02 dlen 12
    L2CAP(s): Connect req: psm 1 scid 0x0040 < ACL data: handle 12 flags 0x00 dlen 16
    L2CAP(s): Connect rsp: dcid 0x0040 scid 0x0040 result 0 status 0
      Connection successful < ACL data: handle 12 flags 0x00 dlen 23
    L2CAP(s): Config req: dcid 0x0040 flags 0x00 clen 11
      RFC 0x00 (Basic)

And this is the unsuccessful attempt to connect from the system running BlueZ 4.101:

> HCI Event: Connect Request (0x04) plen 10
    bdaddr 00:07:80:C0:D8:73 class 0x000000 type ACL
< HCI Command: Accept Connection Request (0x01|0x0009) plen 7
    bdaddr 00:07:80:C0:D8:73 role 0x00
    Role: Master
> HCI Event: Command Status (0x0f) plen 4
    Accept Connection Request (0x01|0x0009) status 0x00 ncmd 1
> HCI Event: Role Change (0x12) plen 8
    status 0x00 bdaddr 00:07:80:C0:D8:73 role 0x00
    Role: Master
> HCI Event: Connect Complete (0x03) plen 11
    status 0x00 handle 11 bdaddr 00:07:80:C0:D8:73 type ACL encrypt 0x00
< HCI Command: Read Remote Supported Features (0x01|0x001b) plen 2
    handle 11
> HCI Event: Command Status (0x0f) plen 4
    Read Remote Supported Features (0x01|0x001b) status 0x00 ncmd 1
> HCI Event: Read Remote Supported Features (0x0b) plen 11
    status 0x00 handle 11
    Features: 0xff 0xff 0x8f 0xfe 0xdb 0xff 0x5b 0x87
< HCI Command: Read Remote Extended Features (0x01|0x001c) plen 3
    handle 11 page 1
> HCI Event: Command Status (0x0f) plen 4
    Read Remote Extended Features (0x01|0x001c) status 0x00 ncmd 1
> HCI Event: Read Remote Extended Features (0x23) plen 13
    status 0x00 handle 11 page 1 max 1
    Features: 0x01 0x00 0x00 0x00 0x00 0x00 0x00 0x00
< HCI Command: Remote Name Request (0x01|0x0019) plen 10
    bdaddr 00:07:80:C0:D8:73 mode 2 clkoffset 0x0000
< ACL data: handle 11 flags 0x00 dlen 10
    L2CAP(s): Info req: type 2
> HCI Event: Command Status (0x0f) plen 4
    Remote Name Request (0x01|0x0019) status 0x00 ncmd 1
> HCI Event: Max Slots Change (0x1b) plen 3
    handle 11 slots 5
> ACL data: handle 11 flags 0x02 dlen 16
    L2CAP(s): Info rsp: type 2 result 0
      Extended feature mask 0x00b8
        Enhanced Retransmission mode
        Streaming mode
        FCS Option
        Fixed Channels
< ACL data: handle 11 flags 0x00 dlen 10
    L2CAP(s): Info req: type 3
> HCI Event: Number of Completed Packets (0x13) plen 5
    handle 11 packets 2
> ACL data: handle 11 flags 0x02 dlen 20
    L2CAP(s): Info rsp: type 3 result 0
      Fixed channel list 0x00000002
        L2CAP Signalling Channel
> HCI Event: Remote Name Req Complete (0x07) plen 255
    status 0x00 bdaddr 00:07:80:C0:D8:73 name 'BT111'
> HCI Event: Disconn Complete (0x05) plen 4
    status 0x00 handle 11 reason 0x13
    Reason: Remote User Terminated Connection

There are no time stamps, but everything up to the Disconn Complete event at the very end happened pretty quickly, then it paused for about 30 seconds.

Clearly, the PANU on 4.101 is waiting for something, but I don't know what and I don't know where to look for what it could be. The only other differences I saw in the dumps were:

• The handle is 11 in one and 12 in the other.
• The Read Remote Extended Features event returns a different feature set. (0x03 followed by 7 0 bytes, instead of 0x01)
• The one that succeeded supported Unicast Connectless Data Reception in its L2CAP extended feature mask.

I assume that the handle being different is unimportant. I googled around for a decoder ring for the extended features, but couldn't find anything that seemed like it mapped to what I'm seeing. The difference there is 1 bit, though. Maybe that's the magic bit.

I also noticed that the pi-pi connection used SDP, and sdpd is not running on my little embedded system.

The only references I could find to Unicast Connectless Data Reception were in PTS submissions. I'm not interested in BT certification right now.

Anyway, it seems like I need a Bluetooth expert (which I am not) to explain what's going on and why my connection's not working.

As it turned out, the problem was that the two devices weren't paired. Pairing to the raspberry pi let everything run fine.

In order to get the embedded board to pair to the pi, I had to run bluetoothd on it with an appropriate configuration in /etc/bluetooth/hcid.conf, run hciconfig hci0 piscan, and run this in bluetoothctl from the pi:

scan on
scan off # after waiting until I saw the device's mac
pair <MAC address>
trust <MAC address>