-
Notifications
You must be signed in to change notification settings - Fork 8
Drone
CYM has two drone-related features accessible from WiFi → Drone Stuff:
| Feature | Mode | Description |
|---|---|---|
| Drone Detector | Passive | ASTM F3411 Remote ID scanner — detects drones via BLE and WiFi |
| Drone Spoof | Active TX | Broadcasts a synthetic Remote ID beacon over BLE or WiFi |
Legal notice: Drone Spoof transmits RF signals. Broadcasting a false Remote ID that represents a drone you do not operate may be illegal under your local aviation authority regulations. Always ensure explicit authorization before operating outside a shielded lab environment.
Drone Detector is a passive Remote ID scanner. It alternates between a WiFi promiscuous phase and a BLE scan phase, looking for the operator ID, UAS serial number, GPS location, altitude, and speed that regulations in most jurisdictions now require drones to broadcast in real time.
No transmissions are made — the detector is entirely passive.
| Phase | Duration | What it captures |
|---|---|---|
| WiFi promiscuous | 10 s | Beacon/management frames on 2.4 GHz ch 1/6/11 + 5 GHz UNII-1 (36/40/44/48) + UNII-3 (149/153/157/161/165) |
| BLE extended scan | 5 s | BLE 5.0 extended advertising on 1M + Coded PHY (legacy 1M-only fallback when ext adv is unavailable) |
| Signal | Standard / Source | Decodes |
|---|---|---|
BLE service UUID 0xFFFA service-data AD |
ASTM F3411 (DJI, Autel, Parrot, Skydio, Holy Stone, ...) | Full Remote ID: operator ID, UAS serial, location, altitude, speed, timestamp |
BLE manufacturer data, company 0x0E00, code 0x0D
|
Legacy OpenDroneID alternate form | Same as above |
BLE OUI 48:1C:B9 or service UUID 0xFFF0
|
DJI presence beacon | Labels "DJI drone (BLE)"; RID payload parsed if included |
WiFi beacon ODID management IE 0xFA 0x0B 0xBC
|
ASTM F3411 over WiFi | Full Remote ID message |
WiFi NAN SDF frame, service 50:6F:9A
|
NAN-based Remote ID | Full Remote ID message |
WiFi vendor IE 0xDD, OUI 26:37:12
|
DJI proprietary DroneID | Presence + 16-byte ASCII serial; lat/lon best-effort |
The DJI Mini 4 Pro (and other recent DJI models using OcuSync 4) do not broadcast standard OpenDroneID in flight. Their Remote ID is embedded in the encrypted OcuSync 4 link, which is not decodable by the ESP32 or commodity hardware. CYM will detect these drones on the ground via their BLE pairing/presence beacon. A drone with a standards-compliant Remote ID (required by ASTM F3411 / EU 2019/945) will be detected at range in both phases.
Tap any row in the drone list to open a detail screen showing all decoded fields:
- UAS ID / operator ID / serial number
- Location (lat, lon), altitude (m), speed (m/s), heading
- ID type, category, classification
- Source (BLE / WiFi), RSSI, packet count, last seen
Saved to /sdcard/lab/dronedetect/:
-
drone_YYYYMMDD_HHMMSS.pcap— raw BLE advertising packets (Kismet PCAPNG format) -
drone_YYYYMMDD_HHMMSS.json— parsed Remote ID records for all detected drones
Counter-UAS detection at events
Set up CYM at a venue perimeter. Any F3411-compliant drone approaching within BLE range (~100 m line-of-sight for extended advertising) or WiFi promiscuous range appears in the list with its declared identity — operator ID, UAS serial, GPS coordinates, and altitude. Tap the row for a full detail view. Logs persist to SD for post-event review.
Drone inventory at an authorized facility
During a physical security assessment, map all drones operating on site. Cross-reference operator IDs against the facility's approved drone operator list. Any drone whose operator ID doesn't match the authorized list is flagged. The log timestamps let you reconstruct each drone's presence window.
Remote ID receiver testing
Verify that a Remote ID receiver (display app, FAA-approved receiver, ground station) correctly receives and parses ASTM F3411 data from multiple simultaneous sources. Run Drone Detector on CYM alongside the receiver under test — CYM's decoded output is the reference you compare against.
Drone Spoof broadcasts a synthetic ASTM F3411 Remote ID beacon, making receivers see a drone that does not physically exist. The transmission uses the same protocol as a real ASTM F3411-compliant drone.
For authorized RF research, receiver testing, and counter-UAS regulation compliance validation only. Do not transmit outside a shielded environment without explicit regulatory authorization.
| Field | What it controls |
|---|---|
| UAS ID | 20-byte drone serial / operator identifier broadcast in the beacon |
| Operator ID | 20-byte operator identification string |
| Latitude | Spoofed GPS latitude of the "drone" position |
| Longitude | Spoofed GPS longitude |
| Altitude | Barometric/GPS altitude in meters |
| Speed | Ground speed in m/s |
| Heading | Horizontal heading in degrees |
BLE mode — Broadcasts an ASTM F3411 Remote ID message as a BLE extended advertising packet with service UUID 0xFFFA in the service-data AD. Received by any standards-compliant Remote ID app or receiver within BLE range.
WiFi mode — Broadcasts a management frame beacon containing an ODID IE (0xFA 0x0B 0xBC type tag). Covers receivers monitoring WiFi channel 6 (the standard Remote ID channel).
Remote ID receiver compliance testing
Set up a spoofed Remote ID beacon with known field values and verify that a receiver app or ground station correctly parses every field — UAS ID, operator ID, coordinates, altitude, speed, and heading. Compare parsed output against the configured values. This validates the receiver before deploying it in an operational context.
Counter-UAS response testing
Inject a synthetic drone into a counter-UAS system's detection envelope. Observe how the system responds: does it trigger an alert? Does it correctly classify the threat level? Does the alert clear when the beacon stops? Authorized counter-UAS operators use this to validate their detection thresholds without flying a real drone.
Regulation research and compliance gap analysis
Broadcast Remote ID beacons with edge-case field values (operator ID with special characters, altitude below ground level, coordinates outside the test area's geofence) and observe how enforcement tools handle them. Identifies parsing gaps in deployed receiver software.