-
Notifications
You must be signed in to change notification settings - Fork 241
CSI Radar
CSI Radar uses WiFi Channel State Information to detect human presence and motion without cameras. The ESP32-S3 captures CSI data from WiFi frames and analyzes subcarrier amplitude variations caused by human body reflections.
Based on the ESPectre algorithm and Espressif's esp-csi reference implementation.
WiFi signals travel between a transmitter and receiver. When a person stands or moves between them, their body reflects and absorbs the signal, changing the Channel State Information (amplitude and phase of each OFDM subcarrier). The CSI Radar detects these changes in real-time.
The Cardputer connects to a CSI-Beacon ESP32 access point and captures CSI from the direct link.
- Best signal quality (dedicated link, no noise)
- Requires 1 external ESP32 (C3 recommended) flashed with CSI-Beacon firmware
- Place the beacon 2-5 meters from the Cardputer
Uses ESP-NOW to receive packets from multiple CSI-Beacon devices simultaneously via promiscuous mode.
- Better coverage with multiple beacons around a room
- Requires 2+ ESP32 devices with CSI-Beacon firmware
- Each beacon must have a unique ID (
beacon id Nvia serial)
A standalone firmware for any ESP32 (C3, C6, S3, classic). Located at:
Available in the CSI-Beacon repository or in the CSI-Beacon/ folder of the project.
Flash with Arduino IDE or arduino-cli:
arduino-cli compile --fqbn esp32:esp32:esp32c3 CSI-Beacon.ino
arduino-cli upload --fqbn esp32:esp32:esp32c3 --port COMXX CSI-Beacon.ino
Replace esp32c3 with esp32c6, esp32s3, etc. for other chips.
beacon id N Set beacon ID (1-8), changes MAC to 1A:00:00:00:00:N
beacon channel N WiFi channel (1-13, default 11)
beacon status Show current config
beacon restart Restart
beacon help Show commands
- Runs in APSTA mode: creates AP "CSI-Beacon-N" AND sends ESP-NOW broadcasts
- Fixed MAC per Espressif convention:
1A:00:00:00:00:ID - ESP-NOW broadcast at 100Hz with HT40 bandwidth, MCS0 rate
- Compatible with both Single and Multi mode on the Cardputer
ESP32-C3 is the best beacon. The ESP32-C6 has a confirmed CSI bug (missing L-LTF data, wrong subcarrier order). Use C3 for reliable CSI.
The CSI Radar implements the full ESPectre pipeline:
-
NBVI Subcarrier Selection: Only 12 of 64 subcarriers are used (
{12,14,16,18,20,24,28,36,40,44,48,52}), selected for stability (guard bands and DC excluded) -
CV-Normalized Turbulence:
stddev / meanof amplitudes across selected subcarriers (gain-invariant) - Hampel Filter: MAD-based outlier removal (window=7, threshold=5.0, scale=1.4826)
- Butterworth Lowpass IIR: 1st-order, 11Hz cutoff at 100Hz sample rate
- Moving Variance: Sliding window of 50 samples (~0.5s)
- Adaptive Threshold: P95 percentile of calibration values x 1.1
| State | Meaning |
|---|---|
| CALIBRATING | Collecting baseline (200 frames, ~2s). Stay still. |
| IDLE | No presence detected |
| MOTION | Movement detected (variance > threshold) |
| PRESENCE | Strong presence (variance > 3x threshold) |
When the subject is stationary for ~5 seconds, the CSI Radar can detect breathing rate:
- Bandpass filter: 2nd-order Butterworth IIR, 0.1-0.5 Hz (6-30 BPM range)
- Autocorrelation: Finds the dominant periodic signal in the filtered data
- Display: BPM value in cyan + mini waveform in top-right corner
Requirements:
- Subject must be still (sitting/lying) at 1-3 meters from the beacon link
- Works best with Single Beacon mode (cleaner signal)
- Accuracy: ~85-90% vs medical sensors in optimal conditions
Oscilloscope-style display on the Cardputer's 240x135 screen:
- Left: Scrolling turbulence waveform (green = normal, yellow = motion, red = presence)
- Right: Vertical bar meter (green-yellow-red gradient)
- Top: Mode label, frame count, breathing waveform (when active)
- Bottom: Status (IDLE/MOTION/PRESENCE), turbulence value, sensitivity, BPM
- Red dotted line: Detection threshold
| Key | Action |
|---|---|
+ / -
|
Adjust sensitivity (debounce 200ms) |
R |
Recalibrate baseline |
Backspace |
Exit to menu |
[CSI-Beacon] ←— 2-5m —→ [Cardputer]
↑
person here
↓
detection zone
- Place beacon and Cardputer 2-5 meters apart
- The detection zone is the area between the two devices
- Height: table level works best (not on the floor)
- Avoid metal obstacles directly between devices
- Calibrate with empty room (don't move during "CALIBRATING")
- Adjust sensitivity with +/- until false positives stop
- Installation
- Slave
- ESP32 RIG Tutorial
- Scan WiFi
- Select WiFi
- Clone & Details
- Captive Portal Management
- Admin WebUI
- Check Credential
- Probes Attack
- Sniffing Probes
- Karma Attack
- Automated Karma Attack
- Karma Spear
- Bluetooth Serial Control
- Wardriving
- Wardriving Master
- Beacon Spam
- Deauther
- Auto Deauther
- Evil Twin
- Handshake Master
- WiFi Raw Sniffing
- Sniff Raw Client
- WiFi Channel Visualizer
- Client Sniff And Deauth
- Handshakes/Deauth sniffing
- Wall Of Flipper
- Send Tesla Code with RFunit
- SSH Shell
- Scan Network and Port
- Full Network Scan
- Web Crawler
- PwnGridSpam
- Skimmer Detector
- Mouse Jiggler
- BadUSB
- Bluetooth Keyboard
- Reverse TCP Tunnel
- DHCP Starvation Attack
- Rogue DHCP Server
- Switch DNS
- Network Hijacking
- Printer Attack
- Web Siphoning Cookie
- Honeypot
- LLM Chat Stream
- EvilChatMesh
- Responder
- WPAD Abuse
- Crack NTLMv2
- FileManager
- UART Shell
- SIP toolkit
- CCTV toolkit
- SSDP poisoning
- SkyJack
- Wifi Dead Drop
- BLENameFlood
- Wall Of Airtag
- FindMyEvil
- UPnP Mapping
- UPnP NAT
- LDAPDump
- IMSI Catcher
- Open Wifi Checker
- CIW ZeroClick
- TagTinker ESL
- CSI Radar
- Settings
- Customing Theming