-
Notifications
You must be signed in to change notification settings - Fork 241
CSI Radar
CSI Radar uses WiFi Channel State Information to detect human presence and motion without cameras. The ESP32-S3 captures CSI data from WiFi frames and analyzes subcarrier amplitude variations caused by human body reflections.
Based on the ESPectre algorithm and Espressif's esp-csi reference implementation.
WiFi signals travel between a transmitter and receiver. When a person stands or moves between them, their body reflects and absorbs the signal, changing the Channel State Information (amplitude and phase of each OFDM subcarrier). The CSI Radar detects these changes in real-time.
The Cardputer connects to a CSI-Beacon ESP32 access point and captures CSI from the direct link.
- Best signal quality (dedicated link, no noise)
- Requires 1 external ESP32 (C3 recommended) flashed with CSI-Beacon firmware
- Place the beacon 2-5 meters from the Cardputer
Uses ESP-NOW to receive packets from multiple CSI-Beacon devices simultaneously via promiscuous mode.
- Better coverage with multiple beacons around a room
- Requires 2+ ESP32 devices with CSI-Beacon firmware
- Each beacon must have a unique ID (
beacon id Nvia serial)
A standalone firmware for any ESP32 (C3, C6, S3, classic). Located at:
Available in the CSI-Beacon repository or in the CSI-Beacon/ folder of the project.
Flash with Arduino IDE or arduino-cli:
arduino-cli compile --fqbn esp32:esp32:esp32c3 CSI-Beacon.ino
arduino-cli upload --fqbn esp32:esp32:esp32c3 --port COMXX CSI-Beacon.ino
Replace esp32c3 with esp32c6, esp32s3, etc. for other chips.
beacon id N Set beacon ID (1-8), changes MAC to 1A:00:00:00:00:N
beacon channel N WiFi channel (1-13, default 11)
beacon status Show current config
beacon restart Restart
beacon help Show commands
- Runs in APSTA mode: creates AP "CSI-Beacon-N" AND sends ESP-NOW broadcasts
- Fixed MAC per Espressif convention:
1A:00:00:00:00:ID - ESP-NOW broadcast at 100Hz with HT40 bandwidth, MCS0 rate
- Compatible with both Single and Multi mode on the Cardputer
ESP32-C3 is the best beacon. The ESP32-C6 has a confirmed CSI bug (missing L-LTF data, wrong subcarrier order). Use C3 for reliable CSI.
The CSI Radar implements the full ESPectre pipeline:
-
NBVI Subcarrier Selection: Only 12 of 64 subcarriers are used (
{12,14,16,18,20,24,28,36,40,44,48,52}), selected for stability (guard bands and DC excluded) -
CV-Normalized Turbulence:
stddev / meanof amplitudes across selected subcarriers (gain-invariant) - Hampel Filter: MAD-based outlier removal (window=7, threshold=5.0, scale=1.4826)
- Butterworth Lowpass IIR: 1st-order, 11Hz cutoff at 100Hz sample rate
- Moving Variance: Sliding window of 50 samples (~0.5s)
- Adaptive Threshold: P95 percentile of calibration values x 1.1
| State | Meaning |
|---|---|
| CALIBRATING | Collecting baseline (200 frames, ~2s). Stay still. |
| IDLE | No presence detected |
| MOTION | Movement detected (variance > threshold) |
| PRESENCE | Strong presence (variance > 3x threshold) |
When the subject is stationary for ~5 seconds, the CSI Radar can detect breathing rate:
- Bandpass filter: 2nd-order Butterworth IIR, 0.1-0.5 Hz (6-30 BPM range)
- Autocorrelation: Finds the dominant periodic signal in the filtered data
- Display: BPM value in cyan + mini waveform in top-right corner
Requirements:
- Subject must be still (sitting/lying) at 1-3 meters from the beacon link
- Works best with Single Beacon mode (cleaner signal)
- Accuracy: ~85-90% vs medical sensors in optimal conditions
Oscilloscope-style display on the Cardputer's 240x135 screen:
- Left: Scrolling turbulence waveform (green = normal, yellow = motion, red = presence)
- Right: Vertical bar meter (green-yellow-red gradient)
- Top: Mode label, frame count, breathing waveform (when active)
- Bottom: Status (IDLE/MOTION/PRESENCE), turbulence value, sensitivity, BPM
- Red dotted line: Detection threshold
| Key | Action |
|---|---|
+ / -
|
Adjust sensitivity (debounce 200ms) |
R |
Recalibrate baseline |
Backspace |
Exit to menu |
2-5 meters
[Beacon] ======================== [Cardputer]
| detection |
| zone |
| _ _ _ _ _ |
| | person | |
| |_ _ _ _ _| |
Place the beacon and Cardputer facing each other, 2-5 meters apart. The detection zone is the space between them. A person walking through or standing in this zone disturbs the WiFi signal.
[Beacon 1]
|
|
[Beacon 2] ----.---- [Cardputer]
|
|
[Beacon 3]
Spread beacons around the area to cover more angles. Each beacon creates an independent detection link with the Cardputer.
- Height: table level (~80cm), not on the floor
- Line of sight: avoid large metal objects directly between devices
- Calibration: leave the room or stay still during "CALIBRATING" (~2s)
- Sensitivity: use +/- keys to find the right level for your environment
- Distance: too close (<1m) = oversaturated, too far (>5m) = weak signal
- Breathing detection: subject must be still, 1-3m from the beacon link
200 frames (defined as CSI_CAL_FRAMES). At 100Hz from a beacon, calibration takes about 2 seconds. Stay still during this phase so the baseline reflects an empty room.
12 out of 64 OFDM subcarriers are selected: {12, 14, 16, 18, 20, 24, 28, 36, 40, 44, 48, 52}. These are stable, non-adjacent subcarriers with guard bands and DC subcarrier excluded. This is the ESPectre NBVI default set.
6 to 30 BPM. Values outside this range are discarded as invalid. The bandpass filter isolates 0.1-0.5 Hz (matching normal human respiratory rate). The subject must remain still for at least 5 seconds for detection to activate.
WiFi signals pass through most walls, so CSI can detect presence in adjacent rooms. However, signal attenuation through walls reduces sensitivity. Best results are achieved with line-of-sight between beacon and Cardputer at 2-5 meters.
- Installation
- Slave
- ESP32 RIG Tutorial
- Scan WiFi
- Select WiFi
- Clone & Details
- Captive Portal Management
- Admin WebUI
- Check Credential
- Probes Attack
- Sniffing Probes
- Karma Attack
- Automated Karma Attack
- Karma Spear
- Bluetooth Serial Control
- Wardriving
- Wardriving Master
- Beacon Spam
- Deauther
- Auto Deauther
- Evil Twin
- Handshake Master
- WiFi Raw Sniffing
- Sniff Raw Client
- WiFi Channel Visualizer
- Client Sniff And Deauth
- Handshakes/Deauth sniffing
- Wall Of Flipper
- Send Tesla Code with RFunit
- SSH Shell
- Scan Network and Port
- Full Network Scan
- Web Crawler
- PwnGridSpam
- Skimmer Detector
- Mouse Jiggler
- BadUSB
- Bluetooth Keyboard
- Reverse TCP Tunnel
- DHCP Starvation Attack
- Rogue DHCP Server
- Switch DNS
- Network Hijacking
- Printer Attack
- Web Siphoning Cookie
- Honeypot
- LLM Chat Stream
- EvilChatMesh
- Responder
- WPAD Abuse
- Crack NTLMv2
- FileManager
- UART Shell
- SIP toolkit
- CCTV toolkit
- SSDP poisoning
- SkyJack
- Wifi Dead Drop
- BLENameFlood
- Wall Of Airtag
- FindMyEvil
- UPnP Mapping
- UPnP NAT
- LDAPDump
- IMSI Catcher
- Open Wifi Checker
- CIW ZeroClick
- TagTinker ESL
- CSI Radar
- Settings
- Customing Theming