Setting up a Withings WS30 scale

The following information is not really of any use. I wrote it before I worked out that the setup process operates over Bluetooth rather than 802.11

Return to the more useful write-up if you want to get something done.

Nokia's documentation on how to set up the scales naturally starts from "install the app on your smartphone or tablet [which means giving it permission to access loads of private stuff there including your contacts list, SMS text messages, your calendar and your camera] and then use it to configure the scales".

How does it communicate with the scales to do this?

It turns out that the scales contain both wireless (802.11, 2.4GHz only) and Bluetooth interfaces, and when put into setup mode, it advertises a passwordless access point using the wireless interface (as well offering to pair its Bluetooth interface).

So, I thought it might be worth finding out how the app and the scales talk to each other for this setup process, in case it's possible to help anyone in future avoid having to install the app at all.

The SSID of the access point set up by the scales was in my case "Withings WS30 86" (this is also the device name which offers to pair by Bluetooth). The network range used is 192.168.250.0/24

So, I decided I could do one of three things:

1. Connect a client to the scales' access point and see whether they tried to talk to me
2. Turn off the scales, set up an access point of my own with the same SSID, and see if the smartphone app would try talking to that
3. Connect a client to the scales' access point, with a network route to pass any traffic to/from another access point I set up (a suitable distance away) with the required SSID, with the smartphone app talking to my access point

These would seem to have the following pros and cons:

1. I have no idea how to reply to the scales, so I might get an idea of the protocol they want to use, but probably not much more
2. I have no idea how to reply to the app, so I might get the same idea about the protocol, but again, having much of a conversation is unlikely
3. The last option is technically the most complicated (partly because I'd want to have physical separation between the two networks with the same SSID) but it would give me full visibility of how the scales and the app talk to each other

The first option is by far the simplest to try, however, so I decided to start there.

Connecting my laptop to the "Withings WS30 86" network and requesting an IP address by DHCP gave me 192.168.250.2, with the DHCP server being 192.168.250.1

Doing an nmap scan of 192.168.250.1 showed only a single TCP port open - port 80 (HTTP).

So, I connected a browser to 192.168.250.1 and got a blank page. Viewing the source code for the page also showed absolutely nothing.

Using lynx to fetch and view the source of whatever came back showed a rather unexpected result:

Alert!: HTTP/1.0 404 Not Found

This is not the normal way an HTTP error is reported by a server, so from this I concluded that the scales certainly aren't speaking standard HTTP, and that I was unlikely to get further using this line of investigation.

This is not quite as simple as I'd expected - the app insists on turning on Bluetooth, and is clearly searching for the scales by that means, rather than looking for either Bluetooth or wireless and using whichever works best / first, which is what I'd expected it to do.

Just on the off-chance, I tried putting the scales into setup mode, let the app detect the Bluetooth signal and identify the scales, then I powered the scales off and wondered whether the app would then talk to my access point - but no, it didn't. It clearly wants to do stuff over Bluetooth…

Continued…

Go up
Return to main index.