I got myself an iBeacon that is supposed to include a temperature sensor in it (figure it's cheaper for one of these at $14USD than a RaspPI + DHT22 sensor).

Any, I've got it, and can see it's name and some accelerometer data when i scan it with LightBlue.

That lead me on to sticking a USB BT LE dongle on a raspberry pi and had a play with GATTTOOL.

From that I was able to figure out my Accelerometer was on UUID FFA3 x, FFA4 Y and FFA5 for Z axis.

Now in the characteristics I can see the Temperature sensor is FFB1 for enable, FFB2 for range and FFB3 for the data.  But I always get 0 for the data.  I've tried writing 0x01 to the enable (FFB1) but that hasn't made a difference.

So I tried another tack, and did a packet dump when scanning

Here's the scan data as I've been told that it's in the scan response (ADV_SCAN_RSP)

HCI Event: LE Meta Event (0x3e) plen 38 [hci0] 70.099952
LE Advertising Report (0x02)
Num reports: 1
Event type: Scan response - SCAN_RSP (0x04)
Address type: Random (0x01)
Address: DC:77:A6:75:F3:31 (Static)
Data length: 26
Service Data (UUID 0x356e): 310106c01300640000
Name (complete): WGX iBeacon
RSSI: -48 dBm (0xd0)

But the service data for me doesn't seem long enough - it's telling me there should be 26 bytes, but I only make out 9 in my response (in the picture if I add the length of AdvA and ScanRspData I get 18)...hmm i could get 26 is I add the Scan Reponse (04) of 1 Address Type (01) of 1, service data of 9, + WGX iBeacon plus 1 for RSSI  But just trying to match the numbers at this point.

Hopefully this is suitably geeky for someone to be interested.