Dexcom robustness: unique IDs and names

Dexcom CGM transmitters have 6-digit transmitter IDs, normally printed on the underside of the transmitter. So far the G5 transmitters have had IDs in the range 40xxxx – 42xxxx. G6 start with 8, and G6+ with 2.

Things would not be good if you had two transmitters with the same ID in the same location: our software wouldn’t know which to connect to. In general the IDs produced by Dexcom seem to increment contiguously, each being unique. So far so good.

Note that the range 410000-420000 does not cover ten thousand IDs. They would run out of IDs too quickly if they did that. Keep in mind that in their ideal world every customer will need at least four transmitters per year, and once the user base gets up into the millions this can chew up those unique IDs very quickly.

So they use letters as well as numbers. In fact they seem to use 22 uppercase letters: everything except I (which could be confused with 1), O (not to be confused with 0 or Q), V (confused with U?), or Z (confused with 2?). With 10 digits and 22 letters that’s 32 (2^5).

410000-420000 is actually a space of 33.5 million IDs. Eventually they might run out of IDs and have to invent some new system, but they’ve obviously decided this will do them for a while!

But there is still an issue

If you’ve ever looked at the list of Bluetooth devices paired to your phone, you will have seen at least one DexcomZZ device (where ZZ is a different 2-character code for each transmitter). Those two characters are the last two characters of the transmitter ID. So transmitter 42HAYW will be seen as DexcomYW.

One of the cleanups we can do after we’ve been using several transmitters is to go into the phone’s Bluetooth settings and “forget”/remove the names of the expired transmitters. But it’s not just to “keep things tidy”.

The underlying issue

Because of the way the IDs are allocated, we know that with only 2 identifying characters there can be (32 * 32) or 1024 possibilities. Keep in mind that all Dexcom transmitters (e.g. both G5 and G6) so far use the same name format.

In both the official Dexcom software and some of the third-party apps that connect to transmitters, having two Dexcom devices with the same “name” paired to the same phone will cause confusion for the software when trying to work out which device it’s sending commands to. The Dexcom software seems to use a token-based system which might avoid this problem, but the issue is deeper than that.

It’s hard to actually get a transmitter paired to the phone if there’s already another device with the same name in the device list. Or even if there are two unpaired devices out there with the same name.

When can this happen?

If every 1024th transmitter produced by Dexcom has the same DexcomZZ name, there is a chance that the next transmitter we buy will have the same name. Thus the common setup instructions to unpair the previous transmitter: Just In Case.

If we were in a crowd of Dexcom users (such as a huge conference, or even on public transport) there is a chance that someone else has a transmitter with the same name as ours. Once we get to 1025 transmitters, we are mathematically certain that at least two of them will share the same name. But it can happen with smaller group sizes. There’s a tiny chance that any two devices on their own will “collide”, but it increases with the group size.

I suppose physical/social distancing changes brought in to help deal with COVID-19 do make it less likely that we’ll be in large groups of people for a while. But the issue still exists.

Stochastic modelling can calculate the likelihood of this, but there’s an underlying random component to the maths. Obviously there could be more than 2 devices with the same name, it’s just that the likelihood is smaller.

How much of a problem is it?

So much for theories and modelling of probabilities. Is it actually a problem?

I’m occasionally donated expired transmitters (I pass them on and they get recycled with new batteries). With one batch of 54 transmitters (not including my own that were already in the house) there were already two pairs.

In a bag of expired transmitters, we initially only care about the ones that are still alive and talking. Unless the old name is still in our phone’s list of paired Bluetooth devices. But hopefully they’ll all come back to life.

By design, once a transmitter is paired with our phone (pump, etc) it should not matter if another device is out there with the same name. The pairing means that the transmitter will be found via its globally-unique 48-bit MAC (media access control) address. So we could sit next to someone else using the same DexcomZZ name and it shouldn’t matter.

But if we need to pair with a transmitter it can be a problem because that association between ID and MAC is not in place yet. Keep in mind that some problem-solving worklists include manually forgetting a device and getting the transmitter re-paired. And some software will automatically un-pair/re-pair with a transmitter to reset connection problems.

Understanding the risk

It’s not a risk we can directly eliminate, but I think it’s worthwhile being aware of it. Especially if we’re having trouble pairing with a transmitter.

If we’re having trouble pairing, things to do might include:

• If it’s a new transmitter, make sure our old paired transmitter name doesn’t conflict.
• Using BLE scanning software such as BLE Scanner (Android, iOS) to look for other transmitter names that might be conflicting. You can filter by name for “Dexcom”.
• If there is a conflicting transmitter, move away to a different location so that transmitter is too far away to interfere. The transmitters wake up every 5 minutes and you will see the signal strength indicator update in BLE Scanner.

Fairly straightforward, but if you didn’t understand about the possibility of conflicting DexcomZZ names you might not know to do that, and end up very frustrated!

Misunderstanding the solution

I have at times seen people in peer support forums say they were told to delete all Bluetooth devices from their phone. This seems overkill, and can in fact in some cases be wrong.

Sometimes the easiest thing for a support person on the other end of the phone is to ask you to delete all the Dexcom devices (knowing that will eliminate any possible conflicts from old IDs). So I can understand where that advice might come from.

But that’s not the same as unpairing all other Bluetooth devices. The app shouldn’t care about those devices. For example on my iPhone there are currently 5 different BG meters paired, along with a watch, 3 keyboards, 7 different audio devices (speakers, headphones, car), etc. None of them get in the way of my Dexcom communications.

In fact I am a bit of a special case in this. On my looping phone I have insulin pump, backup insulin pump, two watches (one gets mounted on my bike handlebars), and TWO Dexcom transmitters. Both transmitters are working at the same time, with no hiccups.

In my case deleting the pairing with the transmitter talking to the other app would not be productive. I do of course have to be using two transmitters with different DexcomZZ names. I know most other people are only going to use one though.

An associated security risk

The ID of each transmitter is printed on the underside for a reason. If a nefarious “bad actor” was to know your transmitter’s ID and they were near you, theoretically it would be possible for them to re-pair the transmitter with their own device.

The first impact of that could be denial-of-service: your system losing connection with the transmitter. Of course, in a situation with the allowed two devices (a phone and a pump for example) only one of the devices would lose their connection.

A subsequent risk might be if they issued Stop Sensor or calibration commands while they were connected, and thus corrupted the operation of your sensor. Even if you were able to re-establish your pairing with the transmitter, you might not immediately realise things had changed.

Presumably risks like this are considered in the design of the products and protocols, but keeping the transmitter ID private is a good start. The munging of the name into the broadcast DexcomZZ name is part of this but as we have seen above, it can still result in hiccups during setup.

If you’re ever posting screenshots of your CGM software, keep in mind that you don’t want to broadcast your transmitter ID. The DexcomZZ name is OK: the transmitter broadcasts that anyway.