Zero-Emission Air-Gap Auditing: Passive 802.11 RF Telemetry with ESP32-S3

01 The Air-Gap RF Threat Model

Critical security infrastructure, hardware security modules (HSMs), and isolated industrial servers are traditionally air-gapped from local area networks. However, modern covert side-channel attacks (such as AIR-FI, MAGNETO, and ambient 802.11 probe requests) can exfiltrate or manipulate state across supposedly isolated perimeters.

Standard spectrum analyzers and commercial RF receivers are either bulky, cost thousands of dollars, or inadvertently radiate local oscillator leakage that gives away their monitoring position.

To solve this, we designed esp32-rf-airgap-auditor: a deterministic, battery-powered embedded hardware sentinel built on the ESP32-S3 microcontroller. By forcing the baseband transceiver into a hardware-enforced receive-only promiscuous mode with TX power set to zero and all frame transmission queues eliminated from the silicon driver, the sentinel captures, analyzes, and catalogs 802.11 management frames in real time with 0 emitted RF packets over 72+ hours of continuous surveillance.

02 ESP32-S3 Circuit & PHY Layer Isolation

The circuit topology uses an ESP32-S3-WROOM-1 module connected via high-speed SPI to an ST7789 IPS telemetry display, powered by a protected 18650 Li-ion cell:

03 ESP-IDF Promiscuous RX Driver

To guarantee that the transceiver never radiates RF energy, the firmware initializes the WiFi stack in promiscuous mode with all automatic response frames (ACKs, CTS) disabled:

#include <string.h>
#include "esp_wifi.h"
#include "esp_event.h"
#include "esp_log.h"
#include "nvs_flash.h"

static const char *TAG = "RF_SENTINEL";

// Hardware Promiscuous RX Callback
static void wifi_promiscuous_rx_cb(void *buf, wifi_promiscuous_pkt_type_t type) {
    if (type != WIFI_PKT_MGMT && type != WIFI_PKT_CTRL) return;

    const wifi_promiscuous_pkt_t *pkt = (wifi_promiscuous_pkt_t *)buf;
    const uint8_t *payload = pkt->payload;
    const int len = pkt->rx_ctrl.sig_len;
    const int8_t rssi = pkt->rx_ctrl.rssi;

    // Dispatch immediately to FreeRTOS ringbuffer
    ringbuffer_push_frame(payload, len, rssi, pkt->rx_ctrl.channel);
}

void init_stealth_rf_monitor(void) {
    ESP_ERROR_CHECK(nvs_flash_init());
    ESP_ERROR_CHECK(esp_netif_init());
    ESP_ERROR_CHECK(esp_event_loop_create_default());

    wifi_init_config_t cfg = WIFI_INIT_CONFIG_DEFAULT();
    ESP_ERROR_CHECK(esp_wifi_init(&cfg));

    // Force storage to RAM only to avoid NVS writes
    ESP_ERROR_CHECK(esp_wifi_set_storage(WIFI_STORAGE_RAM));
    ESP_ERROR_CHECK(esp_wifi_set_mode(WIFI_MODE_NULL));
    ESP_ERROR_CHECK(esp_wifi_start());

    // Register promiscuous callback and enable filters
    wifi_promiscuous_filter_t filter = {
        .filter_mask = WIFI_PROMIS_FILTER_MASK_MGMT | WIFI_PROMIS_FILTER_MASK_CTRL
    };
    ESP_ERROR_CHECK(esp_wifi_set_promiscuous_filter(&filter));
    ESP_ERROR_CHECK(esp_wifi_set_promiscuous_rx_cb(wifi_promiscuous_rx_cb));
    ESP_ERROR_CHECK(esp_wifi_set_promiscuous(true));

    // Set maximum TX attenuation to guarantee PHY layer silence
    ESP_ERROR_CHECK(esp_wifi_set_max_tx_power(0));

    ESP_LOGI(TAG, "Promiscuous stealth monitor initialized. TX=DISABLED");
}

04 Zero-Copy DMA Ring Buffer Architecture

Under heavy RF traffic (such as high-density conference venues or targeted deauthentication storms), incoming frame rates exceed 1,400 packets/sec. Invoking memory allocations (malloc) inside the high-priority WiFi ISR will cause system panic or watchdogs.

We utilize a statically preallocated 48KB lockless circular ring buffer located in internal high-speed SRAM, serviced by a dedicated FreeRTOS worker pinned to Core 1:

#define RING_BUFFER_SIZE 49152 // 48 KB

typedef struct {
    uint8_t  channel;
    int8_t   rssi;
    uint16_t length;
    uint32_t timestamp_us;
    uint8_t  frame_data[256];
} __attribute__((packed)) rf_frame_record_t;

typedef struct {
    rf_frame_record_t records[128];
    volatile uint32_t head;
    volatile uint32_t tail;
} frame_ring_buffer_t;

static frame_ring_buffer_t g_ring;

void ringbuffer_push_frame(const uint8_t *payload, int len, int8_t rssi, uint8_t ch) {
    uint32_t next_head = (g_ring.head + 1) & 127;
    if (next_head == g_ring.tail) return; // Drop on overflow rather than blocking ISR

    rf_frame_record_t *rec = &g_ring.records[g_ring.head];
    rec->channel = ch;
    rec->rssi = rssi;
    rec->length = (len > 256) ? 256 : len;
    rec->timestamp_us = esp_timer_get_time();
    memcpy(rec->frame_data, payload, rec->length);

    g_ring.head = next_head;
}

05 Real-Time Deauth & Evil-Twin Detection

Core 1 runs a continuous analytical loop parsing 802.11 Frame Control bytes:

• Type 0x00, Subtype 0x0C (Deauthentication): When count of frames with reason codes 0x0006 or 0x0007 exceeds 15/sec, an immediate hardware buzzer and LED indicator alerts the operator of an active rogue disassociation attack.
• Beacon MAC Divergence: If an existing SSID begins broadcasting with altered BSSID MAC or mismatched vendor OUIs, the device flags an active evil-twin honeypot.

void telemetry_analysis_task(void *pvParameters) {
    while (1) {
        while (g_ring.tail != g_ring.head) {
            rf_frame_record_t *rec = &g_ring.records[g_ring.tail];
            
            // Frame Control field is first 2 bytes
            uint8_t frame_type = (rec->frame_data[0] & 0x0C) >> 2;
            uint8_t frame_subtype = (rec->frame_data[0] & 0xF0) >> 4;

            if (frame_type == 0 && frame_subtype == 12) { // Deauth frame
                uint16_t reason_code = rec->frame_data[24] | (rec->frame_data[25] << 8);
                ESP_LOGW(TAG, "DEAUTH DETECTED: Ch %d | RSSI: %d dBm | Reason: %d", 
                         rec->channel, rec->rssi, reason_code);
                trigger_hardware_alarm();
            }

            g_ring.tail = (g_ring.tail + 1) & 127;
        }
        vTaskDelay(pdMS_TO_TICKS(10));
    }
}

06 Spectrum Auditing Benchmarks

Benchmarked during a controlled red-team perimeter audit:

07 Open-Source C Firmware & Flashing

The full ESP-IDF project with ST7789 display drivers and PCAP SD card logging is available on GitHub:

git clone https://github.com/axe01010/esp32-rf-sentinel
cd esp32-rf-sentinel

# Configure ESP-IDF v5.2 environment
. $HOME/esp/esp-idf/export.sh

# Target ESP32-S3
idf.py set-target esp32s3
idf.py build
idf.py -p /dev/ttyACM0 flash monitor

Repository: github.com/axe01010/esp32-rf-sentinel.