Skip to main content

AetherSense: Volumetric 3D WiFi Occpancy Radar & Triangulation

Engineering Log | Volumetric WiFi Thermal Radar & Triangulation

Whitepaper: Building an Apple-Style 3D Volumetric WiFi Heatmap & Triangulation Radar

Principal Architect: sudonishant Version: 2.0.0 (Release)

1. Executive Abstract & Mission Statement

In modern telecommunications, radio frequency (RF) mapping has traditionally been limited to static 2D floor plans. Waves scatter, reflect off metallic objects, and attenuate heavily when passing through concrete slabs. This leaves engineers blind to structural multipath bottlenecks.

Our mission with the sudonishant Spatial Mapper & Radar was to create a hardware-accelerated, cross-platform volumetric analysis tool. By taking raw signal metrics from standard network interfaces, combining them with log-distance path loss calibration constants, and rendering them in an Apple Space Gray styled WebGL environment, we make RF fields tangible in 3D space.

2. Detailed 3-Tier Pipeline Flow

To support high-frequency polling (10Hz sweeps) without blocking the client browser thread, the architecture separates responsibilities into three distinct sandboxed modules:

Layer A: Low-Overhead C++ Daemon (wifi_scanner_cli)

Written in native C++17, this daemon bypasses bulky user-space CLI programs by querying kernel structures directly:

  • Linux (proc/net/wireless): Opens descriptor nodes to read real-time link quality, raw RSSI, and noise floors directly from the sysfs subsystem.
  • macOS (CoreWLAN): Links against Apple's private native frameworks to sweep Channels, RSSI, and BSSIDs at millisecond frequencies.
  • Windows (Wlanapi): Initiates client handles on the wireless interfaces to retrieve structured network information frames.
The daemon parses raw telemetry buffers and prints line-separated JSON data directly to the stdout console.

Layer B: Node.js IPC & WebSocket Bridge (server.js)

The backend Node server executes the C++ scanner as a child subprocess, capturing stdout buffers on-the-fly.

  • Memory Guard: Prunes the loaded scan history on startup to a maximum of 1,500 points, preventing browser GPU overflow.
  • Debounced Persistence: Performs asynchronous disk writes to scan_history.json using a 2-second debounce timer to prevent hardware write flooding.
  • Broadcaster Channel: Manages real-time WebSocket connection pools to sync scanning points across multiple client sessions simultaneously.

Layer C: WebGL 3D Visualization Port (app.js)

The client interface uses hardware-accelerated WebGL through Three.js:

  • Voxel Point Cloud Grid: Dynamically maps volumetric data points colored via custom thermal palette lookup tables (Ironbow, Rainbow, White/Black Hot).
  • Multipath Reflection Rays: Calculates ray paths bouncing between walker nodes and the transmitter.
  • Doppler Waterfall: Displays spectrograms of subcarrier CSI metrics to alert engineers to human breathing rates (12-18 BPM).

3. Distance Physics & Calibration Sliders

To convert logarithmic received signal power (RSSI in dBm) into geometric distance (meters), we implement the Log-Distance Path Loss Model, a standard RF propagation equation:

RSSI = A - 10 · N · log10(d)
Log-distance path loss representation

Solving this mathematically for distance d yields:

d = 10(A - RSSI) / (10 · N)
Transformed propagation formula

Because every building material blocks RF waves differently, we integrated interactive calibration sliders on-screen in the HUD sidebar:

  • Reference RSSI (A): The reference signal strength logged at exactly 1 meter from the router. Typically ranges from -35 dBm (high gain) to -55 dBm (low gain).
  • Path Loss Exponent (N): Dictates how fast the signal decays. Adjusted by material densities:

Environment Material Typical Exponent (N) Signal Decay Rate
💨 Open Air / Free Space 2.0 Standard spherical decay
🚪 Residential Drywall / Wood partitions 2.8 to 3.2 Moderate attenuation
🧱 Thick Concrete / Brick walls 3.8 to 4.2 Severe attenuation
🛡️ Faraday Cage / Metal enclosures > 4.5 Near-complete blockage

Code Integration: Sliders directly adjust pathLossN and refSignalA in app.js, updating calculations in real-time:

function estimateDistance(rssi) { const distance = Math.pow(10, (refSignalA - rssi) / (10 * pathLossN)); // Clamp boundaries to prevent walker from flying off grid return Math.max(1.0, Math.min(12.5, distance)); }

4. Mathematical Centroid Triangulation Algorithm

Tracking the location of an unknown transmitter requires gathering coordinates from multiple directions. To solve this, our locator predictor runs a Weighted Centroid Algorithm.

Since decibel scales are logarithmic, we convert RSSI values back into a linear power scale ratio to act as geometric weights W:

Wi = 10(RSSIi + 100) / 10
RSSI logarithm-to-linear conversion

The estimated transmitter coordinates \((X_{est}, Z_{est})\) are computed as the weighted averages of all logged coordinates \((X_i, Z_i)\):

Xest = Σ(Wi · Xi) / ΣWi   |   Zest = Σ(Wi · Zi) / ΣWi
Weighted centroid calculations

This centroid calculation updates in real-time as you walk, moving the glowing blue wireframe target mesh closer to the physical transmitter coordinates.

5. Proximity Geiger Sound (Web Audio API)

To facilitate blind search patterns, we mapped RSSI decibels to oscillator rate clicks using the HTML5 **Web Audio API**:

  • An AudioContext is initialized upon user activation.
  • An OscillatorNode generates raw sine waves at a base pitch of \(500\text{ Hz}\), scaling up to \(1200\text{ Hz}\) (higher pitch) as signal improves.
  • A GainNode decays the volume exponentially over \(45\text{ ms}\) to create a crisp Geiger click.
  • Beep delays are adjusted from \(80\text{ ms}\) (strong signal) to \(1000\text{ ms}\) (weak signal) in a recursive loop.

6. Three.js Raycast Obstruction Calculations

The mapper monitors signal attenuation caused by wall obstruction:

  • A virtual ray is cast from the walker coordinate directly to the estimated router coordinate.
  • We check for intersections against wall objects: raycaster.intersectObjects(collisionWalls).
  • If intersections are found, we estimate wall thicknesses and attenuate the baseline signal by \(12\text{ dBm}\) per partition wall.
  • When attenuation exceeds safe thresholds, a red-vignette **Haptic Alert** flashes around the screen.

7. Installation & Deployment Guide

The workspace includes a one-command initialization script `setup.sh` that automates C++ compilation and Node packages installation:

# 1. Give execution permission to setup script chmod +x setup.sh # 2. Run the initialization script ./setup.sh # 3. Open the browser to load the dashboard xdg-open http://localhost:8080

Toggle **Virtual Emu** mode in the HUD sidebar if running on systems without a physical wireless card, or select **Real Card** to start parsing hardware streams!

Whitepaper registered under sudonishant. MIT License.

Popular posts from this blog

CBSE OnMark Portal Hack 2026

CBSE OnMark Portal Hack 2026 .        How a 19-Year-Old Hacker Exposed India's Biggest Education Data Breach: The CBSE OnMark Portal Hack 2026By Neeshant | June 19, 2026Imagine a system responsible for the future of millions of students, built with vulnerabilities so glaring that a 19-year-old could bypass them using just a web browser. This isn't the plot of a cyberpunk thriller; it's exactly what happened with the CBSE OnMark Portal in early 2026.In this deep dive, we will explore how Nisarga Adhikary, a teenager from Siliguri, uncovered critical security flaws in the Central Board of Secondary Education's (CBSE) digital answer sheet checking system, exposing the data of over 2 million students.The Setup: A Flawed FoundationThe story begins in 2025 when CBSE decided to digitize its evaluation process through an On-Screen Marking (OSM) system. The tendering process itself was fraught with red flags. After two failed attempts where major playe...

Re-NEET 2026 Data Leak: A Complete Technical report

2026 mein educational technology aur cybersecurity ki duniya ko hila dene wali sabse badi incidents mein se ek tha alleged Re-NEET data leak controversy. Reports aur online discussions ke mutabik millions of students ki personally identifiable information (PII) jaise naam, registration details, phone numbers, addresses aur examination-related records potentially expose ho gaye. Chahe exact technical details public domain mein puri tarah available na hon, is incident ne ek bahut important sawal uthaya: agar ek national-scale examination portal compromise ho jaye to attackers aakhir weakness kaise identify karte hain aur developers un weaknesses ko pehle se kaise eliminate kar sakte hain? Cybersecurity incidents aksar ek hi din mein nahi hote. Kisi bhi major breach ke peeche reconnaissance, enumeration, vulnerability discovery, privilege escalation, unauthorized access aur data exposure jaise multiple stages hote hain. Isi process ko samajhna defenders ke liye zaroori hai. Is article mei...

Security Audit & System Architecture: A Complete Guide to the TraceXnumber

By neeshant    Understanding how a web platform works under the hood—and more importantly, how to secure it—is crucial for any developer. Today, we are breaking down the architecture of the TraceX Console. This post will explain how data is retrieved, how a security bypass occurred, the associated risks, and the exact steps to secure the website against future attacks. *(Note: All sensitive tokens, URLs, and database connection strings have been partially masked to maintain system security while keeping the technical layout realistic.)* ## 1. The Architectural Layout The system is divided into four main components that communicate with each other:  * **Frontend Screen (TUI):** Hosted on [https://tracexnumber.web.app/](https://tracexnumber.web.app/), this is the main interface where users execute searches and interact with identity caches. It features decoupled, lightweight styling using a high-performance terminal emulator theme that runs entirely client-side without heav...