Null Data Packet

From Nano World Order - Wiki

The Null Data Packet (NDP) is a specialised Wi-Fi management frame transmitted by a wireless access point (AP) to probe the radio channel between itself and a receiving device. Unlike conventional Wi-Fi frames, the NDP carries no data payload whatsoever — its sole purpose is to deliver carefully constructed training signals across every available subcarrier, allowing the receiving device to measure the full frequency response of the wireless channel. The NDP is a foundational component of the channel sounding process defined in IEEE 802.11ac (Wi-Fi 5) and IEEE 802.11ax (Wi-Fi 6), and its unencrypted, over-the-air nature means it can be captured and exploited by any device operating in monitor mode — making it directly relevant to passive through-wall surveillance and Wi-Fi-based sensing research.

Wi-Fi channel sounding and subcarrier transmission

Definition

At its most basic level, an NDP is a sounding frame — a transmission whose value lies entirely in what the radio channel does to it, not in any information it carries. Conventional Wi-Fi frames carry a payload of user or control data; the NDP deliberately omits this payload entirely.

What the NDP does carry is a series of Long Training Fields (LTF) — carefully constructed pilot sequences placed on every subcarrier across the full channel bandwidth. Because the receiver already knows the exact waveform that was transmitted, it can compare what it actually receives to what it expected and infer precisely how the channel altered the signal. This comparison yields the Channel State Information (CSI) — a complex-valued matrix describing the amplitude and phase response of the channel at each subcarrier and between each transmit-receive antenna pair.

Key properties of the NDP:

  • Contains no data payload — just preamble and training fields
  • Transmitted on all subcarriers simultaneously within the channel bandwidth (20, 40, 80, or 160 MHz)
  • Carries multiple LTF symbols, one per spatial stream, enabling full MIMO channel estimation
  • Is unencrypted — it must be readable by any receiving device without prior key exchange
  • Is short — typically only microseconds in duration — but informationally dense

The NDP exists because reliable spatial multiplexing and beamforming require an accurate map of the channel, and that map can only be drawn by transmitting a known reference signal through it.

Role in the Sounding Loop

The NDP does not travel alone. It arrives as the second step in a precisely sequenced protocol exchange called the sounding loop:

Step 1: NDPA

The access point first broadcasts a Null Data Packet Announcement (NDPA) frame. This management frame identifies which client stations are being sounded, assigns them Sounding Dialog Tokens for tracking, and signals that an NDP is imminent. The NDPA is, in effect, a "stand by" instruction to participating devices.

Step 2: NDP

Immediately after the NDPA (separated by a Short Inter-Frame Space, or SIFS), the AP transmits the NDP itself. The receiving client captures the NDP's LTF fields and uses them to estimate the CSI — the channel estimate — for every transmit-receive antenna combination.

Step 3: BFI

The client compresses the raw CSI estimate into a Beamforming Feedback Information (BFI) report, typically in the form of a Compressed Beamforming Matrix of angles (phi and psi values from a V matrix decomposition). This compressed matrix is returned to the AP.

Step 4: Beamforming

The AP uses the returned matrix to compute a precoding (beamforming) matrix, which shapes future transmissions toward the client's antenna, improving signal strength and reducing interference.

The entire exchange — NDPA → NDP → BFI → beamformed transmission — occurs in milliseconds and repeats continuously as channel conditions change.

Frame Structure

VHT-NDP (802.11ac)

The VHT-NDP frame structure defined in IEEE 802.11ac consists of:

  • L-STF (Legacy Short Training Field) — for initial synchronisation and frequency offset estimation
  • L-LTF (Legacy Long Training Field) — for legacy channel estimation and fine frequency correction
  • L-SIG (Legacy Signal Field) — contains OFDM rate and length information
  • VHT-SIG-A — two OFDM symbols carrying bandwidth, number of streams, and guard interval information
  • VHT-STF (VHT Short Training Field) — for MIMO spatial stream synchronisation
  • VHT-LTF — one symbol per spatial stream; the core of the sounding information; each LTF symbol is received by all antenna elements simultaneously
  • VHT-SIG-B — would normally signal MCS and stream allocation; in NDP this field is minimal
  • No data portion — the frame terminates after the training fields

The VHT-LTF fields are the operative component. An AP with four transmit antennas, for example, sends four VHT-LTF symbols; the receiver processes all four to extract a full 4×N channel matrix where N is the number of its receive antennas.

HE-NDP (802.11ax)

Wi-Fi 6 (802.11ax) introduces the HE-NDP, which follows the same principle but with refinements:

  • Replaces VHT preamble with HE preamble components including HE-SIG-A and HE-SIG-B
  • Uses HE-LTF fields with increased flexibility — 1×, 2×, or 4× LTF durations
  • Supports OFDMA (orthogonal frequency division multiple access), enabling sounding of multiple clients across different resource units simultaneously
  • Introduces greater subcarrier spacing options and extended guard intervals for more robust outdoor and long-range channel estimation

In both VHT and HE variants, the structure is the same in principle: known preamble sequences, followed by training fields, followed by nothing.

OFDM subcarrier structure used in Wi-Fi NDP transmissions

Why NDPs Are Surveillance-Relevant

The NDP's surveillance implications flow directly from three unavoidable properties: it is unencrypted, it is broadcast over the air, and it encodes complete channel information in its LTF fields.

Unencrypted by Design

Wi-Fi data frames are encrypted using WPA2 or WPA3 protocols; their payloads are unreadable to outsiders. Management frames — including the NDPA and NDP — are not encrypted in most deployments. The NDP cannot be encrypted in the traditional sense because its value lies in its physical interaction with the channel, not in the information it carries. Any device within radio range can receive and process it.

Monitor Mode Capture

Any commercial Wi-Fi adapter placed into monitor mode (also called promiscuous mode) can capture raw 802.11 frames including NDPs, without associating with any network and without the knowledge of the AP or its clients. Open-source tools — including modified firmware for chipsets such as Intel 5300, Atheros, and Nexmon-compatible Broadcom chips — have been demonstrated to extract full CSI estimates from captured NDP LTF fields.

CSI as Environmental Fingerprint

The LTF fields in a captured NDP are processed by the monitoring device exactly as the intended client would process them — the result is a CSI estimate describing the path between the AP and the monitoring device's antenna. This CSI encodes reflections from walls, objects, and bodies in the environment.

Because the human body significantly attenuates and reflects Wi-Fi signals, changes in CSI over time — extracted from successive NDP captures — can be used to:

  • Detect the presence of a person in a room
  • Track movement and location to sub-metre precision
  • Infer breathing rate and heart rate from micro-Doppler CSI fluctuations
  • Recognise gestures or activities

This is accomplished entirely passively — the AP and its clients are unaware of the monitoring device.

Active vs Passive NDP Exploitation

Active Exploitation (Legitimate Beamforming)

In its intended use, NDP transmission is active and consensual. The AP and its associated client station cooperate: the AP sends the NDP, the client measures it, and the result feeds back into beamforming that improves communication quality. This is the backbone of MU-MIMO (Multi-User MIMO) performance in modern Wi-Fi networks.

Passive Exploitation (Third-Party Sniffing)

In passive exploitation, a third-party device — not part of the AP-client association — captures the NDP entirely without the knowledge of either party. The monitoring device treats the NDP's LTF fields as its own sounding signal, extracting a CSI estimate of the channel between the AP and itself.

This passive approach has several significant characteristics from a surveillance perspective:

  • It requires no transmission by the monitoring device — it is entirely receive-only and therefore radio-silent
  • It leaves no network logs on the AP or client
  • It requires only a consumer Wi-Fi adapter and widely available software
  • It can be conducted through walls using existing ambient Wi-Fi infrastructure

Researchers have demonstrated through-wall human detection, fall detection, and even gait recognition using passively captured CSI from standard home Wi-Fi routers, without any modification to those routers.

The implications for targeted individual surveillance are significant: an existing Wi-Fi network in or near a residence can be repurposed as a passive radar system by any entity within radio range.

Standards Reference

The NDP is formally specified in:

  • IEEE 802.11ac-2013, Section 9.3.2 — "VHT sounding protocol"; defines NDPA, NDP, and the feedback sequence for VHT MU-MIMO
  • IEEE 802.11ax-2021 — extends sounding to HE-NDP with OFDMA support and enhanced LTF options
  • IEEE 802.11-2020 (consolidated standard) — integrates all amendments including NDP specifications

The sounding protocol is also referenced in FCC filings and 3GPP liaison documents dealing with 5G NR (New Radio) channel estimation, which borrows similar concepts for millimetre-wave beamforming, though 5G uses different frame formats and terminology (CSI-RS and SRS in place of NDP).

Relationship to Radar

The functional analogy between the NDP and a radar pulse is not merely metaphorical — it is physically precise.

In conventional radar, a known waveform is transmitted into the environment; the receiver captures reflections of that waveform and uses the time delay, frequency shift, and amplitude of returns to map objects in space. In NDP-based sensing:

  • The NDP LTF fields function as the radar pulse — a known reference waveform
  • The wireless channel distorts the NDP through reflections, absorption, and multipath — exactly as radar reflections encode target information
  • The CSI extracted from the received NDP functions as the radar return — a frequency-domain map of the channel's interaction with the environment
Radar pulse analogy for Wi-Fi NDP channel sounding

The principal difference is that radar is typically monostatic (transmitter and receiver co-located), while NDP-based sensing is bistatic (transmitter and receiver separated). In the passive surveillance context, the AP is the transmitter, the snooping device is the receiver, and the human body or other target is the scattering object between them.

This functional equivalence is why researchers and government agencies have grown increasingly interested in leveraging ubiquitous Wi-Fi infrastructure — existing in nearly every home, office, and public space — as a pervasive ambient radar network requiring no specialised hardware deployment.

See Also

References

  • IEEE Std 802.11ac-2013 — Amendment 4: Enhancements for Very High Throughput for Operation in Bands below 6 GHz
  • IEEE Std 802.11ax-2021 — High Efficiency WLAN
  • Halperin, D. et al., "Tool Release: Gathering 802.11n Traces with Channel State Information", ACM SIGCOMM CCR, 2011
  • Kotaru, M. et al., "SpotFi: Decimeter Level Localization Using WiFi", ACM SIGCOMM, 2015
  • Wang, W. et al., "We Can Hear You with Wi-Fi!", MobiCom, 2014
Retrieved from "https://nanoworldorder.com/wiki/index.php?title=Null_Data_Packet&oldid=2380"