I have tried to use wireshark to sniff airdrop function in OS X, I found that there is a element call phash.
TXT: phash=upHAXlRUnb0ICgY2uDUpw6cv5fI=
When using the AirDrop, the appearance icon will be your user icon if you have set it. I have tried to change the icon a lot of time , open the airdrop and using wireshark to capture the phash value, because the phash value is generated by OS X itself, it is correct, so I can use scapy to change the phash value which from my record and resend it, it will appear the icon on the AirDrop. I think the OS X have its method to generate the value, I want to know it so that I don't need to repeat to change icon and capture it.