How the Wi-Fi signal reveals what happens in a room

Multipath: the room is written into the signal

Indoors, the signal from an access point does not reach the receiver along a single path. Part of it goes straight; part bounces off walls, floor, ceiling and objects; part is absorbed. The receiver gets the sum of these copies, each with its own delay, attenuation and phase. For communication, multipath is a classic problem that OFDM and equalization were designed to work around.

For sensing, it is the source of information. The human body is mostly water and interacts strongly with signals at 2.4, 5 and 6 GHz. When a person walks in, moves around or simply breathes, some of those paths change. The channel changes, and the receiver notices.

RSSI and CSI: two ways to measure the channel

RSSI (Received Signal Strength Indicator) is a single number per received frame: total power. It is available on virtually any device and is enough to notice large movements near the link, but it is coarse and noisy.

CSI (Channel State Information) is the estimate the receiver itself computes to demodulate the OFDM signal. For each subcarrier, it reports how the channel changed amplitude and phase. A 20 MHz Wi-Fi 4 channel has 56 subcarriers; a 160 MHz Wi-Fi 6 channel has more than nineteen hundred. Each received frame yields a detailed snapshot of the channel, and a sequence of frames becomes a movie.

A third source is on the rise: beamforming reports (BFI, Beamforming Feedback Information). Since Wi-Fi 5, clients send the access point a compressed version of the channel matrix so it can steer its beam. Recent research shows these reports work for sensing and can be captured in monitor mode, without firmware access. That opens the door to new applications and to new privacy concerns alike.

From raw signal to information

1. Capture. Frames are collected at a steady rate, from tens to hundreds per second. They can be regular network traffic or frames generated only for measurement.
2. Cleaning. CSI phase arrives contaminated by frequency and clock offsets between transmitter and receiver. It must be corrected, or the analysis must rely on amplitude alone. Outliers are filtered.
3. Feature extraction. Variance over time, correlation across subcarriers and the Doppler spectrum, which reveals movement speed.
4. Decision. From a simple threshold (motion or no motion) to machine learning models trained for each type of event.
5. Application. Alert, automation, occupancy statistics. What matters to the customer is the event, not the raw data.

Device-free or device-based

In device-free sensing, the person carries nothing: the system detects the body through the disturbance it causes in the channel. This is what the motion detection services sold by operators do.

In device-based sensing, the system observes the devices people carry. In monitor mode, a passive receiver logs probe requests and other frames to estimate how many devices are present and for how long. MAC address randomization, adopted by mobile operating systems, makes counting harder. It is also a reminder that this data is personal.

The two approaches complement each other, and this project's lab works with both.

Who can read CSI

For years, access to CSI depended on research tools tied to specific chipsets: the Intel 5300 CSI Tool, the Atheros CSI Tool and Nexmon for Broadcom chips. Espressif's ESP32 made the technique popular by exposing CSI on boards that cost a few dollars. In commercial equipment, CSI exists inside the chip but is rarely exposed by the vendor firmware. That is where the standard comes in.

IEEE 802.11bf: sensing enters the standard

IEEE 802.11bf was approved on May 28, 2025 and published on September 26, 2025 as an amendment to IEEE 802.11. It modifies the MAC layer, the service interface of the HE (Wi-Fi 6) and EHT (Wi-Fi 7) physical layers, and the DMG and EDMG millimeter-wave physical layers to support sensing in license-exempt bands between 1 and 7.125 GHz and above 45 GHz.

In practice, the standard defines a procedure: devices advertise their sensing capability, set up a measurement session, measure the channel and report results. One device can ask another to measure and report the channel. The standard also provides sensing by proxy, where a client asks the access point to run measurements on its behalf.

For the ISP, the consequence is direct. Sensing no longer depends on proprietary deals with each chipset maker and becomes a capability negotiated between devices. Adoption in products is still early, and following that transition is one of the goals of this site.

Limitations worth knowing

• Environment dependence. A model trained in one room does not always work in another, and moving furniture shifts the baseline.
• Traffic and interference. Sensing needs regular frames. A congested or noisy channel degrades the measurement.
• Geometry. The sensitive area lies between transmitter and receiver. Device placement matters.
• False positives. Fans, pets, curtains and neighbors on the other side of a shared wall.
• Data access. Without CSI exposed by the firmware, only RSSI remains, which severely limits what can be offered.