Wavey

ESP32 WiFi CSI system for spatial perception and RF privacy auditing.

ESP32
WiFi CSI
Python
RF Privacy
C

Wavey

Occupancy, motion, and presence from the WiFi environment. The same CSI stack also audits whether someone else is sensing the room without consent.

Overview

Wavey is an open-source WiFi CSI sensing system. ESP32 nodes capture Channel State Information from ambient traffic. A Python pipeline turns those subcarrier shifts into occupancy, motion, and presence events. No cameras, no wearables, nothing on the person.

CSI is a vector of amplitude and phase across OFDM subcarriers, not a single RSSI number. Bodies perturb multipath. Wavey reads that perturbation on hardware you control.

The other half of the project is RF privacy. The same physics that detects occupancy also lets an attacker observe a room from a monitor-mode NIC or plaintext beamforming feedback. Wavey treats that as an audit problem: inventory emitters, flag CSI anomalies, and degrade unauthorized sensing without breaking legitimate WiFi.

Site at waveyhq.dev. Live CSI in the console. Source at github.com/waveyhq.

Architecture

ESP32 CSI nodes -> Python pipeline -> console / automations
capture CSI        preprocess + infer   visualize + emit events

Nodes: any CSI-capable ESP32 family chip (ESP32, S2, S3, C3, C5, C6, and related). Single RX chain, 52 to 56 subcarriers, packet-limited sampling.
Pipeline: outlier rejection, amplitude features (primary on ESP32), phase sanitization for micro-motion, per-site empty-room baseline, inference.
Console: live visualization and events for automations.

Spatial perception

Detection is a ladder. Wavey ships the lower rungs and is honest about the rest.

Occupancy: change-point detection against an empty-room CSI fingerprint
Motion: variance and spectral energy in the 1 to 5 Hz band
Presence: micro-Doppler in the respiration band (0.1 to 0.5 Hz), still-person awareness, not clinical vitals
HAR: coarse activity classes where labeled data exists
Out of scope on ESP32: pose, identity, exact headcount, centimeter through-wall mapping

Every deployment needs its own baseline. Cross-site transfer without calibration is still an open problem on commodity hardware.

RF privacy auditing

WiFi sensing works both ways. Research such as LeakyBeam (NDSS 2025) showed occupancy through walls from plaintext BFI. IEEE 802.11bf standardizes sensing without a mandatory privacy floor.

Wavey maps five detection layers for unauthorized sensing:

RF inventory: unknown BSSIDs, hidden SSIDs, new MACs, CSI-extraction signatures
RF fingerprinting: hardware-intrinsic traits when MACs are spoofed
Environmental anomaly: CSI variance and multipath drift that do not match known occupancy
Distributed mesh: triangulation and confidence across nodes
Behavioral baseline: RF timeline and alerts on new sources

Layers 1 and 5 are shippable on ESP32 mesh today. Pure passive sniffers outside the building remain an open research problem.

Technology Stack

ESP32 firmware (ESP-IDF / C) for CSI capture
Python analysis pipeline
WiFi CSI over OFDM subcarriers
RF privacy inventory, anomaly detection, and defenses