Channel State Information

From Nano World Order - Wiki

Channel State Information (CSI) is a per-subcarrier measurement of how a wireless signal propagates between a transmitter and receiver across an IEEE 802.11 Wi-Fi link. Unlike coarse signal strength metrics, CSI captures both the amplitude and phase response of the wireless channel at every individual frequency subcarrier in an Orthogonal Frequency Division Multiplexing (OFDM) system — producing a high-dimensional, real-time fingerprint of the radio frequency environment. Because the physical environment between two Wi-Fi devices shapes that fingerprint, CSI has emerged as one of the most powerful passive sensing substrates available to researchers, intelligence agencies, and commercial surveillance actors. Every person, object, or breath that moves within a Wi-Fi signal's propagation path leaves a measurable trace in CSI data — a fact that has driven an explosion of academic and classified research into Wi-Fi Sensing, gesture recognition, occupancy detection, heartbeat monitoring, and Through-Wall Surveillance.

OFDM subcarrier structure underlying CSI measurement

What Is Channel State Information?

In any wireless communication system, the transmitted signal reaches the receiver via multiple paths simultaneously — bouncing off walls, furniture, people, and other objects. This multipath propagation means the receiver sees a sum of reflected, refracted, and diffracted copies of the original signal, each arriving at a slightly different time and with different phase and amplitude. The combined effect on the received signal is described by the channel transfer function, and CSI is the measured estimate of this function.

Specifically, in an OFDM-based system such as modern Wi-Fi, the channel is measured independently on each subcarrier. If a 20 MHz Wi-Fi channel has 56 active subcarriers (as in 802.11n), the CSI output is a vector of 56 complex numbers — each a (amplitude, phase) pair — representing how that particular frequency component was affected by the channel. Wider channels and newer standards push this further:

  • 802.11ac (Wi-Fi 5): up to 114 subcarriers per 80 MHz channel
  • 802.11ax (Wi-Fi 6): up to 242 subcarriers per 80 MHz channel, with additional spatial stream granularity
  • 802.11be (Wi-Fi 7): even greater subcarrier counts across 320 MHz channels

This multi-dimensional snapshot — refreshed potentially hundreds of times per second — gives a rich, temporally dense view of how the radio environment is changing moment by moment.

How CSI Is Generated: Channel Sounding

CSI is derived through a process called Channel Sounding, which is a standard part of normal Wi-Fi operation, not a special surveillance mode. The mechanism works as follows:

Pilot Subcarriers and Training Sequences

Every Wi-Fi data frame contains known reference symbols called pilot subcarriers embedded at fixed positions within the OFDM symbol. The receiver, which knows exactly what these pilots should look like, compares the received pilot values against the expected values to compute the channel distortion at those frequencies. This produces a Channel Estimation that the receiver uses to equalise and decode the data payload.

Null Data Packet Sounding

For beamforming purposes, a more deliberate sounding procedure exists. The transmitter sends a Null Data Packet (NDP) — a frame containing no payload, only training fields — after an announcement frame (NDPA). The receiver processes the NDP to generate a full CSI estimate, compresses it into a Compressed Beamforming Matrix, and feeds it back to the transmitter in a Beamforming Feedback Information (BFI) frame. This entire cycle — sounding, estimation, compression, feedback — is designed to optimise antenna steering, but the intermediate CSI it generates is a high-fidelity environmental snapshot.

Extraction on Commodity Hardware

Critically, CSI can be extracted from commodity Wi-Fi chipsets without any modification to the network or the devices being monitored. Research tools such as the Linux 802.11n CSI Tool (Intel 5300 adapter), PicoScenes, and Atheros CSI Tool allow researchers to read raw CSI from standard Wi-Fi cards. This means any device within passive sniffing range of a Wi-Fi network can, with appropriate software, continuously extract CSI from the wireless traffic flowing around it — without transmitting anything itself and without requiring any access to the network.

CSI vs RSSI: Why Granularity Matters

The traditional metric for assessing wireless signal quality is Received Signal Strength Indicator (RSSI) — a single number representing the total received power averaged across the entire channel. RSSI is simple, universal, and nearly useless for fine-grained sensing because:

  • It collapses an entire multipath channel into one scalar value
  • It saturates and fluctuates due to automatic gain control
  • It cannot distinguish where or how the environment has changed

CSI, by contrast, provides per-subcarrier amplitude and phase — hundreds of complex measurements per snapshot. This means:

  • Different multipath components (reflected from different surfaces) manifest at different subcarriers
  • A person moving in one part of the room will produce a different CSI signature than a person moving elsewhere
  • Breathing, which produces millimetre-scale chest displacement, modulates the phase of certain subcarriers in a rhythmic, detectable pattern
  • Even heartbeat-induced micro-vibrations have been detected in CSI phase data at close ranges

The information gain from CSI over RSSI is analogous to the difference between knowing that a room has some light in it versus having a high-resolution photograph of the room.

Indoor multipath propagation — each reflected path encodes environmental information in CSI

CSI's Dual Role: Communications and Sensing

CSI was designed entirely for communication optimisation — it allows beamforming systems to direct antenna energy precisely toward the receiver, increasing throughput and range. This is the stated purpose in every Wi-Fi standard. However, the same data serves a second, unstated role with profound surveillance implications.

Beamforming and Beam Steering

In a multiple-input multiple-output (MIMO) system, the transmitter uses CSI feedback to calculate optimal beamforming weights — effectively steering the transmitted signal toward the receiver and away from interference. The more accurate the CSI, the more precisely the beam can be directed. This is why NDP sounding happens regularly, and why CSI feedback frames are transmitted frequently in modern networks. The 802.11ax standard introduced multi-user OFDMA with even more aggressive channel sounding to manage multiple simultaneous beams.

Environmental Sensing

Because the multipath channel encodes information about the physical environment, any change to that environment — a person walking, a door opening, a phone vibrating on a table — alters the CSI. Researchers have demonstrated that by analysing CSI time series, it is possible to:

  • Detect the presence or absence of a person in a room (occupancy sensing)
  • Recognise specific gestures (hand wave, swipe, fist clench) with accuracy above 90%
  • Detect breathing rate through phase variations caused by chest movement
  • Detect heartbeat rhythm in controlled conditions
  • Identify individuals by their unique walking gait signatures in CSI
  • Localise a person's position through walls using signal time-of-arrival and multipath analysis

None of these sensing applications require any modification to the existing Wi-Fi infrastructure. They operate by analysing the CSI that the network is already generating as a routine byproduct of its communication functions.

Through-Wall Surveillance and Localisation

Through-Wall Surveillance using CSI is not theoretical — it is documented in peer-reviewed literature and has been the subject of funded research programs at major universities and defence research institutions including DARPA.

MIT's WiTrack and RF-Capture systems demonstrated 3D localisation of humans through walls using RF signals by exploiting multipath channel information. Subsequent systems operating on standard Wi-Fi hardware have achieved:

  • Room-level occupancy detection with near-100% accuracy
  • Sub-metre localisation through standard interior walls
  • Tracking of multiple simultaneous subjects
  • Identification of a subject's identity from gait with accuracy exceeding 95% in controlled tests

The implications for covert surveillance are significant. A Wi-Fi router on one side of a wall, and a passive sniffer on the other, can together function as a continuous human presence detector — without any cooperation from the monitored individuals and without any visible sensor in the monitored space.

This capability is directly relevant to the broader Targeted Individual phenomenon, where persons report being monitored in their homes without visible surveillance equipment. CSI-based through-wall sensing provides a technically validated mechanism by which such monitoring could occur using commercially available hardware.

The Privacy Problem: Unencrypted CSI Feedback

A particularly significant privacy concern arises from how CSI feedback is transmitted in Wi-Fi networks. The Beamforming Feedback Information frames that carry compressed CSI from receiver back to transmitter are transmitted as Wi-Fi management frames. In most network configurations, management frames are not encrypted.

This means that any device within radio range — whether associated with the network or not — can passively capture these beamforming feedback frames and extract the CSI data they contain. The CSI in these frames was generated by the receiver's channel estimation from the environment between the transmitter and receiver — which is precisely the environmental snapshot that enables sensing.

The 802.11w standard introduced Protected Management Frames (PMF), which can encrypt management frames, but adoption remains inconsistent, and many devices and access points operate with PMF disabled or optional. Even where PMF is enabled, CSI can still be extracted at the physical layer by devices with appropriate hardware access.

This creates a scenario in which:

  1. A standard home router conducts regular NDP sounding
  2. The responding device transmits unencrypted BFI frames containing compressed CSI
  3. A passive observer nearby captures these frames without associating with the network
  4. The observer extracts CSI and processes it to detect, track, and identify occupants of the home

This requires no hacking of any device. It exploits the normal operation of the Wi-Fi standard as designed.

CSI in the Broader Surveillance Ecosystem

CSI-based sensing does not exist in isolation. It sits within a growing ecosystem of RF sensing technologies that together represent a pervasive, infrastructure-embedded surveillance substrate:

Integration with Smart Infrastructure

Smart Cities deployments that blanket urban areas with Wi-Fi access points, combined with Smart Dust micro-sensor networks and Internet of Bodies connected devices, create overlapping coverage areas where CSI sensing could provide continuous occupancy and activity tracking across entire districts.

Relationship to 5G and 6G

5G millimetre-wave systems and the emerging 6G standard are being designed with integrated sensing and communication (ISAC) as an explicit design goal — not a side effect. Where CSI-based Wi-Fi sensing requires researchers to extract and repurpose channel estimation data, 6G systems are designed from the ground up to simultaneously communicate and sense. The lessons learned from Wi-Fi CSI research are directly informing these next-generation designs.

WBAN and Biometric Monitoring

Wireless Body Area Network (WBAN) devices generate their own CSI with surrounding infrastructure. Researchers have demonstrated that CSI from WBAN links can detect respiration, heart rate, and limb position — meaning medical devices worn by a person could inadvertently generate sensing data usable by third parties for biometric monitoring without the wearer's knowledge.

Potential Links to Remote Neural Monitoring

Some researchers in the Targeted Individual community and adjacent fields have raised the possibility that sufficiently sensitive CSI analysis, combined with knowledge of the Microwave Auditory Effect and neuroelectric signal coupling, could in principle contribute to Remote Neural Monitoring capabilities. While direct neural-resolution CSI sensing has not been publicly demonstrated, the theoretical pathway — from environmental RF sensing to biometric sensing to neural correlate detection — is a subject of ongoing investigation in both academic and defence research contexts. See also Neuroweapons and Bioelectromagnetics.

Wi-Fi router conducting MIMO beamforming — the same CSI used to steer the beam encodes a real-time environmental snapshot

Key Technical Concepts

Term Definition
OFDM Orthogonal Frequency Division Multiplexing — divides a channel into many parallel subcarriers
Subcarrier Individual frequency component within an OFDM channel; CSI is measured per subcarrier
Pilot Known reference symbol embedded in Wi-Fi frames to enable channel estimation
NDP Null Data Packet — a payload-free frame used for deliberate channel sounding
BFI Beamforming Feedback Information — compressed CSI fed back by receiver to transmitter
RSSI Received Signal Strength Indicator — coarse, single-value power measurement
MIMO Multiple Input Multiple Output — multiple antennas enabling spatial multiplexing and beamforming
Multipath Multiple signal paths from reflections; the basis of CSI's environmental sensitivity

See Also

References and Further Reading

  • Halperin, D. et al. (2011). Tool Release: Gathering 802.11n Traces with Channel State Information. ACM SIGCOMM Computer Communication Review.
  • Wang, W. et al. (2015). Understanding and Modeling of WiFi Signal Based Human Activity Recognition. ACM MobiCom.
  • Zhu, M. et al. (2020). Kalman Filter-Based CSI Sensing for Real-Time Human Respiration and Heartbeat Detection. IEEE Sensors Journal.
  • MIT CSAIL. (2015). RF-Capture: Capturing the Human Figure Through a Wall Using RF Signals. ACM SIGGRAPH Asia.
  • IEEE 802.11ax Standard (2021). Enhancements for High-Efficiency WLAN. IEEE Standards Association.
  • Academic Papers — internal index of relevant scientific literature
Retrieved from "https://nanoworldorder.com/wiki/index.php?title=Channel_State_Information&oldid=2377"