OnAirIoT & sensors · Experimental
Decode Wi-Fi networks with an SDR
OnAir receives Wi-Fi networks. Wi-Fi access points on 2.4 GHz channels 1 - 13 from their beacons (802.11b DSSS, 1 Mbit/s): SSID, BSSID and vendor, channel, security (open, WEP, WPA, WPA2, WPA3), rates, beacon interval and level, like a phone's Wi-Fi list (passive: beacons only, never joins or transmits).
What Wi-Fi networks is
Wi-Fi access points announce themselves in beacon frames. OnAir lists the networks like a phone does, from the beacons alone.
Frequencies and where it is used
2.4 GHz access point beacons on channels 1 - 13 (802.11b DSSS, 1 Mbit/s DBPSK, Barker-11), one channel at a time or hopping, 20 Msps.
In OnAir the tuning shortcut is Beacons, 2.4 GHz; you can enter any frequency your radio reaches.
What OnAir shows for Wi-Fi networks
What a phone's Wi-Fi list shows: SSID (hidden networks as hidden), BSSID with the vendor, channel, security (open, WEP, WPA, WPA2, WPA3, enterprise), supported rates, beacon interval, level history and last seen, and a beacon log. Passive: only beacons and probe responses are read; data frames are counted, never decoded; it never transmits, probes or joins. Access points that beacon only at OFDM rates (802.11g / n only) are not heard.
This receiver is built from the published specification and checked end to end on simulated signals. It has had little or no testing on real transmissions yet, so reports and recordings on Discord are welcome.
Which radio you need
This mode sits at a high frequency, so check that your radio tunes it: a HackRF covers 1 MHz to 6 GHz, and RTL-SDR stops near 1.7 GHz. Some modes at these frequencies also need a fast radio (10 to 20 Msps) or a dish and an LNB.
Questions about Wi-Fi networks
Can I decode Wi-Fi networks with an RTL-SDR?
Probably not: an RTL-SDR tunes up to about 1.7 GHz. A HackRF (1 MHz to 6 GHz) or another wideband radio is the usual choice for this frequency range.
Is it legal to receive Wi-Fi networks?
This mode is passive. It only receives, never connects, pairs or joins networks, and never decrypts payloads. Check the rules where you live.
Can I try Wi-Fi networks in OnAir without a radio?
Yes. Most modes include a built-in synthetic test signal, so you can open the screen and try the controls before you own a radio.
Try it without a radio
OnAir includes built-in synthetic test signals for most modes, so you can open this screen, see the layout and try the controls before you own a radio. The Tour button walks you through the app.