A distributed WiFi reconnaissance system using ESP32-S3 nodes and an Orange Pi as coordinator. The goal is passive RF awareness — mapping what is happening in the surrounding WiFi environment without transmitting or interacting with any networks.
Each ESP32 node scans the WiFi environment, builds structured events (not raw data), and ships them over UDP to a coordinator. The coordinator stores events to SQLite. A separate web dashboard reads the database and displays everything in real time via SSE.
The system is designed around a clear separation of concerns: nodes are dumb sensors, the Orange Pi does all storage and analysis, the browser does all rendering. No logic lives on the nodes beyond capturing and formatting events.
Practical use cases this has already demonstrated:
- Mapping every network and client device in a city-center apartment building
Both node types share the same UDP ingestor and database. They are distinguished by event `type` field. BLE nodes send `ble_adv` and `heartbeat` events; WiFi nodes send `beacon`, `probe`, `deauth`, `assoc`, and `heartbeat` events.
The two coordinator processes are intentionally separate. The ingestor has one job: receive UDP, write to DB. The dashboard has one job: read DB, serve UI. They communicate only through the database. Each is independently restartable without affecting the other.
---
## Development workflow
**All coding is done on this PC.** The Orange Pi only runs the deployed files — never edit directly on it.
- Events are buffered in FreeRTOS queues and flushed once per scan cycle when back on the home channel
- If a deauth with reason code 2 is seen at RSSI ≥ -60 dBm, an alert flag triggers an immediate flush on the home channel without waiting for the next scan
-`probe_drops`, `deauth_drops`, `assoc_drops` count events lost due to queue overflow since boot. Non-zero values indicate the node is seeing more traffic than the queue sizes can absorb.
-`imp`: `high` if RSSI >= -50, `low` if <= -80, else `normal`
-`ssid` in probe events is the network the device is searching for — empty means wildcard (any network)
- Probe dedup: same MAC+SSID suppressed for 30 seconds to avoid flooding
-`wifi_rssi` in heartbeat is the node's own signal to the `sandbox` AP (not a scanned network)
- A node is considered **online** if a heartbeat arrived within the last 30 seconds; falls back to beacon within 60 seconds if no heartbeat has been received yet
### Flashing a node
Requirements: Arduino CLI v1.4.1, ESP32 core v3.3.7, FQBN `esp32:esp32:esp32s3`, user in `dialout` group.
BLE nodes run `firmware/ble_node/`. Same hardware (ESP32-S3), same transport (UDP JSON to coordinator), different job.
### What BLE nodes do
- Connect to WiFi `sandbox` for UDP transport only (no WiFi scanning)
- Run a passive BLE scan continuously (5-second windows, auto-restart)
- Parse each advertisement: MAC, address type, device name, manufacturer specific data (company ID + payload)
- Dedup by MAC within a 30-second window to avoid flooding the coordinator
- Buffer events in a FreeRTOS queue, flush every 5 seconds
- Send a heartbeat every 10 seconds (same format as WiFi nodes, adds `ble_drops` field)
The ESP32 radio is shared between WiFi and BLE via the hardware coexistence controller. WiFi only transmits briefly during UDP flushes, so BLE scan coverage is near-continuous.
### BLE event format
```json
{
"node_id":"A1D700C4",
"ts":12345,
"type":"ble_adv",
"mac":"AA:BB:CC:DD:EE:FF",
"addr_type":1,
"name":"DeviceName",
"rssi":-65,
"mfr_id":76,
"mfr_data":"1201..."
}
```
-`addr_type`: `0` = public (real, stable MAC), `1` = random (rotates periodically)
-`mfr_id`: 16-bit little-endian Bluetooth company ID, `-1` if the advertisement has no manufacturer data
-`mfr_data`: hex string of the manufacturer payload **after** the 2-byte company ID, up to 16 bytes
### Known company IDs
| ID (hex) | Vendor |
|----------|--------|
| 0x004C | Apple (AirTags, AirPods, iBeacon, FindMy, HomeKit) |
| 0x0075 | Samsung (SmartTag, Galaxy devices) |
| 0x0006 | Microsoft (Swift Pair) |
| 0x00E0 | Google |
| 0x0059 | Nordic Semiconductor (common in IoT devices) |
| 0x0138 | Garmin |
| 0x0499 | Ruuvi Innovations |
| 0x0157 | Polar Electro |
| 0x00BD | Fitbit |
| 0x0171 | Amazon |
Apple type byte (first byte of `mfr_data` when `mfr_id` = 76):
| Byte | Device |
|------|--------|
| `02` | iBeacon |
| `05` | AirDrop |
| `07` | HomeKit |
| `09` | AirPods |
| `0a` | AirPods Pro |
| `0f` | AirPods 3rd gen |
| `12` | FindMy / AirTag |
| `15` | Proximity Pair |
### Flashing a BLE node
Same requirements as WiFi nodes. Flash `firmware/ble_node/` instead of `firmware/node/`:
Service files are in `coordinator/` and deployed to `/etc/systemd/system/` on the Orange Pi.
The coordinator files live at `/opt/esp32_cluster/coordinator/` on the Orange Pi.
---
## Dashboard
Open `http://192.168.1.133:8080` in your browser.
### Views
- **Feed** — live beacon event stream across all nodes, capped at 100 rows, newest on top
- **Networks** — deduplicated AP table (by BSSID): times seen, best/avg RSSI, channel, encryption, node count. Sortable by any column. Each row has a ▶ button to open the RSSI history chart for that network.
- **RSSI history chart** — opens from any Networks row. Shows signal strength over time per node (1h / 2h / 6h / 24h selectable). Each node gets its own coloured line. Useful for spotting interference patterns, seeing how signal fluctuates by time of day, and comparing which node consistently hears a given AP better. Updates live as new scans arrive.
- **Cross-node** — side-by-side per-node RSSI for every AP. Shows which node is physically closer to each network. Filter to multi-node only to focus on confirmed cross-node observations.
- **Clients** — probe request data: unique MACs, vendor (OUI lookup), what SSIDs they're searching for, signal, which nodes saw them.
- **Alerts** — deauth/disassoc frame detection with four sections:
- *1h Summary strip* — total frames, deauth vs disassoc counts, unique BSSIDs and sources in the last hour
- *Most Impersonated Networks* — APs whose BSSID is being spoofed as the deauth source, ranked by frame count
- *Most Targeted Devices* — actual victim devices (by `dst` MAC), ranked by frames received across all impersonated APs
- *Detected Bursts* — fires when ≥10 frames for the same BSSID within 5 minutes. Highlighted red when confirmed by 2+ nodes. Reason code 2 at volume is the primary attack indicator.
- *Raw Feed* — last 100 deauth/disassoc events with full src/dst/BSSID/reason/RSSI detail.
- **Search** — cross-table lookup by any identifier. Supports MAC address, SSID, BSSID, and vendor name (e.g. "Raspberry", "Tuya", "Intel"). Returns all matching data across beacon, probe, and deauth tables in labelled sections. Vendor name search works by matching against the OUI database and finding all devices with those MAC prefixes.
- **Node detail** — click a node in the sidebar for stats: total events, unique SSIDs/BSSIDs, RSSI range, first/last seen, uptime, free heap, AP signal, last 100 events.
Click any node in the sidebar to open the detail view. Ten stat cards arranged in a 2×5 grid show: status, total events, unique SSIDs, unique BSSIDs, avg RSSI, first seen, last seen, uptime, free heap, and AP signal. Below the cards is a table of the last 100 events for that node.
Always visible: node list with online/offline status dot, last seen time, event count, and a compact heartbeat line (uptime · free heap · AP signal). Nodes are sorted alphabetically by node ID so the order stays fixed as more nodes are added.
A node is considered **online** if a heartbeat was received within the last 30 seconds. Falls back to beacon timestamp (60s threshold) if no heartbeat has been received yet.
Font: Roboto (Google Fonts). Chosen for readability at small sizes — the previous monospace font felt too thin at the smaller label sizes used throughout the dashboard.
SSE stream pushes new beacon events as they arrive. The feed updates immediately. All other views (sidebar, networks, chart, cross-node, presence, alerts) refresh on a 2-second debounce so a single scan burst doesn't flood the server with requests.
Networks with a blank SSID but valid BSSID, signal, and channel are **hidden networks** — APs configured not to broadcast their name. They are not hidden from passive scanners. The encryption showing as `OPEN` is a firmware parsing artifact; the network itself may be encrypted. The BSSID OUI still identifies the manufacturer.
### Probe requests and MAC randomization
Modern phones and laptops (iOS since ~2020, Android since ~2021) randomize their MAC address for probe requests. A randomized MAC has bit 1 of the first byte set — the dashboard detects this and labels it "Randomized MAC" instead of doing a meaningless OUI lookup.
What probe data tells you:
- **Directed probes** (with SSID): the device has connected to that network in the past
- **Wildcard probes** (empty SSID): the device is searching for any available network
- Probe data maps **client devices**, not infrastructure — complementary to beacon scan data
The raw deauth feed in the Alerts tab will fill up constantly — deauth and disassoc frames are a normal part of WiFi operation (devices disconnecting, APs doing band steering, power saving). This is expected and not cause for concern.
The **Bursts** section is the anomaly detector. A single unique source MAC generating 10+ deauth frames for the same BSSID within 5 minutes is not normal operation — it indicates a deauth flood, the standard precursor to a WPA2 handshake capture attack. The attacker forces connected clients to disconnect, captures the 4-way handshake when they reconnect, and then cracks it offline.
Multi-node confirmation (`node_count > 1`, highlighted red) significantly raises confidence — it means the source is physically close and strong, not a distant weak signal.
### Node dropout — AP overwhelm on simultaneous reconnect
Observed 2026-04-06: three of four nodes dropped off the dashboard after being power cycled individually at different times. Symptoms included reason-15 deauth floods (`4-way handshake timeout`) from the affected nodes captured by the surviving node, and nodes getting stuck in a reconnect loop without ever successfully sending data to the coordinator.
**Root cause:** the sandbox AP was overwhelmed by multiple nodes power cycling at slightly different times and hammering it with simultaneous association requests. Each node hops channels every ~4 seconds, briefly dropping and reconnecting to sandbox on every cycle. When several nodes do this at the same time after a staggered power cycle, the AP's association table fills with stale entries and stops completing WPA2 handshakes for new clients.
**Confirmed not a firmware issue:** all four nodes ran for 21 hours continuously without a single drop when power cycled simultaneously (clean start, all connect at once). Heap stayed stable across all nodes throughout (234K–247K, no drift).
**Mitigation:** power cycle all nodes at the same time rather than individually, so they all connect fresh together rather than in a staggered loop. Long-term fix is a dedicated AP for the nodes only, so their reconnect churn is isolated from regular network traffic and the AP is never competing with other clients.
| `sandbox` | 2.4GHz | Main network, nodes connect here|
| `botnet` | 2.4GHz | IoT devices |
| `pronet` | 5GHz | Main 5GHz network |
| `mango` | 2.4GHz | Secondary network |
`sandbox` BSSID `1C:3B:F3:9C:AC:30` appearing in deauth/impersonation data is expected — our own nodes briefly deauth from it during channel hopping and reconnect.
The `oui.txt` file is the IEEE public OUI database (39,171 entries as of download). It maps the first 3 bytes of a real MAC to a manufacturer name. Used in the Clients tab. Refresh it occasionally by re-running `deploy.sh` after downloading a fresh copy from `https://standards-oui.ieee.org/oui/oui.txt`.
~~A persistent automated deauth flood has been running since **2026-04-03**~~
**Status as of 2026-04-25: attack has wound down.** Down from hundreds of frames/day to 1–7 frames/day. The direct target `38:2C:E5:7E:77:1D` is no longer being hit. Two of the four attacker MACs (`82:4E:66:47:09:C1`, `62:87:CB:38:2C:20`) have gone silent. `42:8C:46:6E:12:9C` and `62:D9:AA:E8:B4:09` still appear occasionally at very low volume. Conclusion: whoever was running the tool either captured the WPA2 handshake they needed or moved away. Keep in watch list for re-activation.
SSID: `Living Room speaker.n078` · BSSID: `FA:8F:CA:76:06:B2` · ch 6 · OPEN · RSSI -54 dBm (bathroom, same apartment).
Broadcasting an open unauthenticated hotspot. Next step: connect via Parrot laptop + Alfa adapter, nmap the provisioning interface, document what is exposed. Not yet started.
BLE nodes floor out at **109–127K free heap** vs 222K+ for WiFi nodes. The ~100K difference is the BLE stack overhead (BLEDevice + BLEScan + coexistence controller). This is expected and stable — no downward drift observed after 21 hours. The WiFi-only queue flush model keeps heap use predictable.
### MAC randomization and device counting
BLE unique MAC counts are misleading without context:
- **Apple FindMy / AirTag** rotates MAC on every advertisement interval (seconds). One physical AirTag generates hundreds of apparent "unique" MACs per day. The `mfr_data` payload is more useful for identity than the MAC.
- **Sony WH-1000XM5** rotates MAC every ~15 minutes. One device appears as ~28 different MACs over a day. Identify by device name (`LE_WH-1000XM5`) rather than MAC.
- **Public MACs** (addr_type = public) are stable and reliably trackable (B&W PX5, ELK-BLEDOM, ATH-M50xBT2).
- **Apple Proximity Pair / Nearby Info** are iPhones advertising presence — high volume, all randomized.
### Apple type byte reference (first byte of mfr_data when mfr_id = 76)
Most common types seen in practice:
| Byte | Type | Notes |
|------|------|-------|
| `10` | Proximity Pair | iPhone/Watch advertising nearby — very common |
| `12` | FindMy / AirTag | MAC rotates every advertisement; best RSSI seen: −38 dBm |
| `16` | Nearby Info | iPhone battery/status broadcast |
| `0c` | AirPods case / Watch | Seen when case lid is open or Watch is unlocked |
### Identified permanent BLE neighbours (as of 2026-04-26)
| Device | MAC type | Pattern | Notes |
|--------|----------|---------|-------|
| Sony WH-1000XM5 | Random (rotates ~15min) | All day + late night | Likely 1 device; user wears them most of the day, leaves connected overnight |
| B&W PX5 headphones | Public — stable | Weekday afternoons ~12:00–18:00 | Consistent with WFH office hours |
| ELK-BLEDOM LED strip | Public — stable | Evenings | BLE-controlled RGB LED strip, cheap Chinese controller |
| Audio-Technica ATH-M50xBT2 | Public — stable | Afternoon sessions | Professional wireless headphones |
| `0x5148` device (c2:fe:68:e8:01:a6) | Public — stable | Persistent all day | Unknown company ID, payload ASCII "364656", best RSSI −56 dBm — very close, identity unknown |
| "net" (80:3e:4f:1b:4f:e3) | Public — stable | 07:00–20:00 | Short device name, likely a smart home hub or IoT device |
### Parking structure BLE
The same parking structure that generates hundreds of 70mai dashcam WiFi beacons also contains AirTags. The FindMy/AirTag type (`0x12`) consistently hits −38 dBm best RSSI — some are close enough to be in vehicles parked right outside. At least one is persistent across multiple scans, suggesting a parked vehicle with an AirTag rather than a passing pedestrian.
### WiFi-derived context: notable open networks
For reference during future BLE correlation work, the known open networks in range:
| SSID | Device | Notes |
|------|--------|-------|
| `Living Room speaker.n078` | Unknown speaker | Unauthenticated provisioning hotspot, RSSI −38 dBm, same building. **Pending active investigation.** |
| `yeelink-light-strip2_miap7AB7` | Xiaomi Yeelight LED strip | Stuck in setup mode for 8+ days, open |
| `xiaomi-fryer-maf65_mibt962C` | Xiaomi smart air fryer | Open setup AP |
| `zhimi-airp-mb5_mibt5FF0` | Xiaomi Mi Air Purifier MB5 | Open setup AP |
| `REOLINK-HHRYzJCESD-2.4G` | Reolink IP camera | Permanent neighbour's camera, 8 days uptime |
- [x] Alerts tab — dominant reason code added to Most Impersonated Networks and Most Targeted Devices tables
- [x] Sessions tab — dominant reason code + description shown per session row and in expanded detail panel
- [x] SSE reconnect bug fix — multiple stale EventSource instances were accumulating on reconnect, flooding /api/nodes on tab re-open; fixed with proper close-before-reconnect and in-flight guard
- [x] WAL corruption fix — recurring DB corruption under sustained write load; fixed with RESTART checkpointing every 30 minutes and reduced retention to 7 days (see below)
Tab switches took up to a minute to load. The Networks tab failed to load entirely. The SSE live feed would stall during tab switches. The root cause was three compounding issues:
**1. Blocking the async event loop.**
FastAPI routes are `async def`, but the SQLite calls (`sqlite3` module) are fully synchronous. When called directly inside `async def`, they block uvicorn's entire event loop — meaning while one slow query runs, the server cannot serve any other request, including the SSE stream. This is why everything froze together.
**2. Expensive endpoints had no caching.**
`/api/alerts`, `/api/sessions`, `/api/presence`, and `/api/cross-node` ran full database queries on every single request, with no result caching. The 2-second debounce on the frontend meant these were being called repeatedly.
`build_sessions()` was the worst: it pulled every deauth event from the last 30 days and grouped them into sessions in a Python loop — O(N) in Python on every call, with no cache. Under a sustained deauth flood (thousands of events/day), this was very slow.
`build_alerts()` ran several queries against the **entire**`deauth_events` table with no time cutoff — top targets, top targeted devices, reason breakdown, activity heatmap all scanned all-time data.
**3. Unbounded database growth.**
No pruning meant every query got slower every day as the tables grew. The database had also developed B-tree corruption (double-referenced pages, out-of-order rowids), likely from WAL journal not checkpointing cleanly under sustained write load. The database was rebuilt clean.
### Fixes applied
- **`asyncio.to_thread()`** — all `build_*` calls in every route are now dispatched to a thread pool executor. The event loop stays free to handle SSE and other requests while queries run in the background. The SSE generator's inline `query()` calls were also fixed the same way.
- **Caching added** — alerts (60s TTL), sessions (60s), presence (60s), cross-node (60s) now cache results in memory. The existing nodes/networks/clients caches were kept. Tab switches hit the cache on repeated loads rather than re-querying the DB.
- **Time bounds on alerts queries** — top targets, top targeted devices, reason breakdown, and activity heatmap are now scoped to the last 7 days instead of all-time. Still meaningful, no longer scanning the full table history.
- **Composite indexes added** — added `(bssid, received_at)` on `beacon_events` and `deauth_events`, and `(src_mac, received_at)` on `probe_events`. Queries that filter by time and aggregate by BSSID or MAC now use a single composite index instead of two separate ones.
- **Background pruning task** — at startup, a background coroutine runs every 6 hours and deletes rows older than `HOT_DAYS` from all event tables. `HOT_DAYS` was later reduced from 30 to 7 — see WAL corruption fix below.
---
## WAL corruption fix (2026-04-08)
### Problem
The SQLite database corrupted twice within 3 days of operation, both times producing `database disk image is malformed` errors. The dashboard would start returning partial or no results on some endpoints, and the SSE stream would crash. A full DB rebuild was required each time.
### Root cause
SQLite in WAL (Write-Ahead Log) mode works by writing all changes to a separate WAL file first, then periodically folding those changes back into the main database file — a process called checkpointing. The default checkpoint mode is **PASSIVE**, which only checkpoints what it can without blocking any active readers. It gives up immediately if a reader is present.
With 4 nodes generating hundreds of events per minute and the dashboard constantly reading (SSE polling every 2 seconds, plus user interactions), there is almost never a clean window for a passive checkpoint to complete. The WAL file accumulates uncommitted state indefinitely, grows too large, and eventually corrupts the main database file. The prune task added in the earlier performance overhaul also used PASSIVE mode, so it had the same problem.
A second contributing factor: `HOT_DAYS` was set to 30 days. At the observed data rate (~500k beacon events/day, ~115k probe events/day), the database would grow to several gigabytes before the first prune cycle deleted anything, making the WAL problem worse over time.
### Fixes applied
- **RESTART checkpointing** — replaced PASSIVE with `PRAGMA wal_checkpoint(RESTART)` in a new `checkpoint_wal()` function. RESTART waits for all current readers to finish, then checkpoints all WAL frames into the main DB file and resets the WAL back to the beginning. This guarantees the WAL is fully flushed rather than partially checkpointed.
- **Dedicated checkpoint task** — a new background coroutine runs `checkpoint_wal()` every 30 minutes, independent of the prune cycle. The prune task also calls it after deleting rows, so a large delete is always followed by a full WAL flush.
- **`wal_autocheckpoint=500`** — set on every connection so SQLite's own automatic checkpoint triggers at ~500 pages (~2MB) instead of the default 1000 pages (~4MB). This gives more frequent small opportunities to checkpoint between the 30-minute forced runs.
- **HOT_DAYS reduced from 30 to 7** — at current data rates, 7 days of retention keeps the database under ~200MB permanently. Queries stay fast, the WAL stays manageable, and 7 days of history is sufficient for all dashboard views and active investigations.
