View source for Channel Sounding

'''Channel Sounding''' (also called the '''sounding loop''') is the transmit-feedback cycle built into modern [[IEEE 802.11]] Wi-Fi standards by which an access point (AP) and a client device cooperatively measure the wireless channel between them. The AP transmits a known reference signal — the [[Null Data Packet]] (NDP) — the client measures how that signal is distorted by the environment, and reports back a compressed description of the channel as [[Beamforming Feedback Information]] (BFI). The AP uses this feedback to compute a steering matrix that directs its antenna energy toward the client. As a side effect, because the NDP probes every subcarrier in the channel simultaneously, any physical change in the environment — a person walking, breathing, or even the subtle chest movement of a heartbeat — alters the measured [[Channel State Information]] (CSI), making the sounding loop a continuous, passive-radar-like sensing mechanism built into ordinary Wi-Fi infrastructure. Researchers and, allegedly, intelligence-linked organisations have recognised that this mechanism can be exploited for through-wall surveillance without any modification to consumer hardware.

[[File:Eero 6+ Image.jpg|thumb|right|Wi-Fi access point performing beamforming]]

== What Channel Sounding Is ==

Channel sounding is the process of probing a wireless medium with a known signal so that the receiver can estimate the [[Channel State Information|channel response]] at every frequency subcarrier. In the context of Wi-Fi, the purpose declared in the standard is to enable '''beamforming''': by knowing how the channel distorts a signal, the transmitter can pre-distort its output so that the signal arrives coherently at the intended receiver, improving throughput and range.

The "known signal" used is the [[Null Data Packet]] — a specially structured frame that carries no user data but whose preamble and pilot tones are defined exactly in the standard. Because the receiver knows precisely what was transmitted, it can compare the received waveform against the expected waveform and compute, for each OFDM subcarrier, the complex gain (amplitude and phase) that the channel applied. This per-subcarrier complex gain profile is the CSI.

CSI is not a single number. For a system with multiple transmit and receive antennas (MIMO), and typically 52 to 1000+ subcarriers depending on channel bandwidth and standard generation, CSI is a high-dimensional matrix updated every sounding cycle. This density of information is what makes it so powerful as a sensing signal: small environmental changes produce measurable, structured perturbations across many subcarriers simultaneously.

== The Sounding Loop in Detail ==

The sounding loop follows a defined sequence of frames:

=== 1. NDPA — Null Data Packet Announcement ===

The AP transmits a [[Null Data Packet Announcement]] (NDPA) frame. This is a management frame that names which client stations are being sounded and allocates a Sounding Dialog Token to correlate the upcoming NDP with the feedback report. The NDPA is transmitted at a low mandatory rate so that all devices in range can receive it. It is transmitted in plaintext and is capturable by any 802.11-capable device operating in monitor mode.

=== 2. NDP — Null Data Packet Transmission ===

Immediately after the NDPA (separated by a Short Inter-Frame Space, SIFS), the AP transmits the [[Null Data Packet]]. The NDP contains no data payload — it is composed entirely of preamble fields (the HT/VHT/HE Long Training Fields, or LTFs) that the client uses as the reference signal for channel estimation. One LTF column is transmitted per spatial stream. The NDP is also unencrypted, as it carries no user payload.

=== 3. Channel Measurement by the Client ===

The client device receives the NDP, uses its [[Channel Estimation]] algorithms to compute the channel matrix H for every subcarrier, and then applies singular value decomposition (SVD) or equivalent processing to extract the beamforming feedback angles (the V matrix of the channel). It compresses these angles into a [[Compressed Beamforming Matrix]] using a codebook-based or explicit feedback scheme.

=== 4. BFI Report — Beamforming Feedback Information ===

The client transmits the [[Beamforming Feedback Information]] frame back to the AP. This frame contains the compressed steering angles, SNR per spatial stream, and the Sounding Dialog Token linking it to the original NDPA. The AP now has enough information to compute the transmit steering (precoding) matrix.

=== 5. AP Applies the Steering Matrix ===

The AP computes the beamforming precoder from the BFI and applies it to subsequent data transmissions toward that client, focusing energy and improving link quality.

[[File:Amfm3-en-de.gif|thumb|right|OFDM subcarrier diagram]]

== Sounding Frame Types ==

{| class="wikitable"
|-
! Frame Type !! Direction !! Encrypted? !! Purpose
|-
| NDPA || AP → Client || No || Announces sounding, names targets
|-
| NDP || AP → Client || No (no payload) || Reference signal; probes all subcarriers
|-
| BFI Report || Client → AP || No || Returns compressed channel description
|}

All three frame types are [[IEEE 802.11]] management or control frames and are transmitted without encryption even on WPA3-protected networks. This is a structural feature of the standard, not a misconfiguration. Any 802.11 adapter placed in '''monitor mode''' can capture all three frames without association to the network.

== How the Sounding Cycle Is Exploited for Sensing ==

The NDP's design — a known signal spanning every OFDM subcarrier — makes it an ideal radar probe. When a person enters the environment between the AP and any reflective surface, or between the AP and the client, the multipath propagation profile changes. These changes appear in the CSI as phase shifts, amplitude variations, and Doppler-like frequency offsets across subcarriers.

Key phenomena detectable through CSI perturbation analysis include:

* '''Gross motion''' — walking or limb movement causes large, rapid CSI variation across many subcarriers simultaneously.
* '''Micro-motion (breathing)''' — the chest displacement of ~4–12 mm during respiration (~0.2–0.5 Hz) produces periodic, low-amplitude CSI variation detectable with bandpass filtering.
* '''Heartbeat''' — at ~1 Hz with sub-millimetre chest displacement, heartbeat detection requires higher-rate sounding and more sophisticated signal processing (often Doppler or [[Wavelet transform]]-based), but has been demonstrated in peer-reviewed literature.
* '''Gesture recognition''' — specific arm and hand movements produce characteristic CSI fingerprints, enabling gesture-based device control or behavioural profiling.
* '''Room occupancy''' — static presence (a person sitting still but breathing) alters the channel's power delay profile in ways detectable even without motion.

Because the sounding loop runs continuously as part of normal beamforming maintenance, no special trigger is required — the sensing data is a free by-product of every beamformed Wi-Fi connection. This is the foundation of the academic field of [[Wi-Fi Sensing]] and the alleged basis of intelligence applications described by researchers studying [[Through-Wall Surveillance]] capabilities.

== Sounding Frequency and Temporal Resolution ==

The rate at which a beamforming AP sounds the channel — the '''sounding interval''' — determines the temporal resolution of any sensing application. In 802.11ac (VHT) and 802.11ax (HE), sounding interval is configurable and link-condition dependent. Practical observations include:

* Consumer APs typically sound 10–100 times per second under active traffic.
* Some firmware configurations and dedicated sensing-mode implementations achieve 1000 Hz sounding rates.
* Breathing detection requires sustained measurement at ≥4 Hz (Nyquist for 0.5–0.5 Hz signal with margin).
* Heartbeat detection in practice requires ≥10 Hz with appropriate filtering.
* Human walking produces detectable CSI variation at any common sounding rate.

The temporal resolution is also a function of packet aggregation and channel contention — in a congested RF environment, sounding may be delayed by other traffic. In a dedicated sensing deployment, the sensing device can trigger sounding by injecting its own NDP probe frames or by controlling AP firmware directly.

== Passive vs Active Sounding ==

=== Active Sounding ===

In the standard beamforming use case, both the AP and the client participate knowingly. The client's Wi-Fi chipset implements the CSI measurement and BFI reporting as part of its normal driver operation. The CSI itself is rarely exposed to applications on consumer devices — most operating systems do not provide a public API for raw CSI. However, modified drivers (notably for Intel 5300, Atheros, and certain Broadcom chipsets) have been used by researchers to extract raw CSI for sensing experiments.

=== Passive Snooping of Sounding Frames ===

Because NDPA and NDP frames are unencrypted, a third-party device in monitor mode can capture them without any cooperation from either the AP or the client. By processing the received NDP against the known preamble structure, the passive observer can compute its own CSI estimate for the channel between the AP and its own position in space. This is called '''passive CSI extraction'''.

Critically:

* The target network need not be associated with the observer.
* The observer's device is invisible to the AP and client.
* The NDP is transmitted at high power on standard channels, making long-range passive capture feasible with directional antennas.
* Academic papers have demonstrated passive through-wall sensing of breathing and motion using only captured NDP frames from neighbouring Wi-Fi networks.

This capability is directly relevant to the concerns documented on the [[Through-Wall Surveillance]] and [[Surveillance Technology]] pages. The combination of ubiquitous Wi-Fi infrastructure with passive snooping of unencrypted sounding frames means that any occupied space within radio range of a Wi-Fi AP is potentially subject to continuous passive monitoring of occupant breathing, motion, and presence — without any software compromise of the AP or client.

[[File:Wireshark 3.6 screenshot.png|thumb|right|Passive wireless packet capture in monitor mode]]

== Standards Context ==

Channel sounding for beamforming feedback is defined in:

* '''IEEE 802.11n (HT)''' — introduced multi-antenna explicit beamforming feedback; NDP concept established.
* '''[[IEEE 802.11]]ac (VHT)''' — mandatory compressed beamforming feedback; NDPA-NDP-BFI sequence formalised; up to 8 spatial streams.
* '''IEEE 802.11ax (HE / Wi-Fi 6)''' — extended to OFDMA multi-user scenarios; trigger-based sounding; higher subcarrier count (up to ~1000 per 80 MHz channel).
* '''IEEE 802.11bf''' — a dedicated amendment under development (as of 2024) that formally standardises Wi-Fi sensing, building directly on the sounding infrastructure already present in 802.11ac/ax. This amendment acknowledges that sounding frames are a sensing mechanism, not merely a beamforming tool.

The [[5G]] NR standard includes analogous reference signal structures (CSI-RS, SRS) that serve the same dual-use beamforming/sensing function in cellular networks.

== Privacy Implications ==

The privacy implications of channel sounding are substantial and largely unaddressed by current regulation:

* '''Unencrypted by design''' — NDPA and NDP frames cannot be encrypted under existing 802.11 management frame protection schemes because they must be receivable by unassociated devices. IEEE 802.11w (Management Frame Protection) does not cover these frame types.
* '''No opt-out''' — occupants of a space cannot prevent a Wi-Fi AP in the same room, an adjacent flat, or a neighbouring office from sounding the channel through their walls.
* '''Device-free sensing''' — the occupant need not carry any device. Their body's interaction with the RF field is the sensing signal.
* '''Aggregation risk''' — CSI time series from multiple APs can be correlated to triangulate position, identify individuals by gait or breathing pattern, and track activity over time.
* '''No legal framework''' — as of 2024, no jurisdiction has enacted specific regulation governing the collection or use of CSI data obtained through passive snooping of sounding frames.

Some researchers and [[Targeted Individuals]] advocates have raised concerns that this infrastructure may already be exploited for covert surveillance, particularly given the [[DARPA Programs|DARPA]]-funded origins of much of the foundational Wi-Fi sensing research.

== See Also ==

* [[Channel State Information]]
* [[Null Data Packet]]
* [[Null Data Packet Announcement]]
* [[Beamforming Feedback Information]]
* [[Compressed Beamforming Matrix]]
* [[Channel Estimation]]
* [[Wi-Fi Sensing]]
* [[Through-Wall Surveillance]]
* [[IEEE 802.11]]
* [[5G]]
* [[Surveillance Technology]]
* [[Electronic Harassment]]
* [[Remote Neural Monitoring]]

== References ==

* IEEE Std 802.11ac-2013, Section 9.30 (VHT Beamforming)
* IEEE Std 802.11ax-2021, Section 9.47 (HE Beamforming)
* IEEE 802.11bf Task Group documents (Wi-Fi Sensing Amendment)
* Kotaru et al., "SpotFi: Decimeter Level Localization Using WiFi", ACM SIGCOMM 2015
* Wang et al., "Understanding and Modeling of WiFi Signal Based Human Activity Recognition", MobiCom 2015
* Zeng et al., "FarSense: Pushing the Range Limit of WiFi-based Respiration Sensing", IMWUT 2019

[[Category:Surveillance Technology]]
[[Category:Technology]]