DIGI Detection Node 2.4GHz WiFi/BLE Firmware

News & Links:

• 2026 January - Featured in Best 20 XIAO Projects in 2025
• 2026 April - Undercode Testing: AntiHunter Unleashed: Mesh IDS

• Optional integration with AntiHunter Command Center Pro
• Beta channel has new features in development. Potential stability issues and unexpected behavior may occur.

Table of Contents

1. Overview
2. Features
3. Detection Modes
4. Secure Data Destruction
5. RF Configuration
6. System Architecture
7. Hardware
   • Assembling the PCB
8. Getting Started
9. Mesh Commands
10. API Reference
11. Acknowledgments
12. Legal

Overview

• Open-source wireless sensor node for perimeter defense and spectrum awareness.
• ESP32-S3 with WiFi/BLE scanning, GPS, SD logging, vibration sensing and LoRa mesh networking.
• Deploy one node or a distributed network- each scans independently and coordinates over mesh.

Features

Use Cases

• Perimeter security and intrusion detection
• Penetration testing and wireless security auditing
• Counter-UAV operations and airspace monitoring
• Surveillance detection and OPSEC audits
• Device fingerprinting across MAC randomization
• Probe analysis and rogue device detection
• Event security and monitoring

Detection Modes

1. Target Scan

Maintain a watchlist of MAC addresses (full or OUI prefix), SSIDs, or identity IDs (T-XXXX). Scans WiFi channels and BLE frequencies, alerting on detection via web UI, mesh, and command center.

• WiFi-only, BLE-only, or combined scanning
• Global allowlist filters out known devices
• Logs RSSI, channel, GPS, and device names to SD
• Real-time alerts over mesh network

2. Triangulation (Experimental)

Multiple nodes scan for a target simultaneously. Each records RSSI and GPS coordinates. Data is aggregated over mesh for weighted trilateration with Kalman filtering.

[!TIP] Target RSSI above -80 produces better results for BLE devices

• Outputs: GPS coordinates, confidence, estimated uncertainty (m), average HDOP
• Google Maps link sent over mesh
• Per-target distance tuning multipliers (0.1x - 5.0x)

Heltec v3 recommended. T114's small buffer causes latency.

3. Detection Sniffers

A. Device Scanner

Captures all WiFi and BLE devices in range. Records MACs, SSIDs, signal strength, names, and channels.

• Check Capture Probes to piggyback probe request collection onto the device scan. When enabled, probe requests are captured alongside normal scanning and fed into the probe database (MAC, vendor, RSSI, SSIDs, randomization status):

B. Baseline Anomaly Detection

Two-phase scan: establish a baseline of known devices, then monitor for anomalies -- new devices, disappearances, reappearances, and significant RSSI changes. Persistent storage survives reboots.

• RAM cache: 200-500 devices, SD overflow: 1K-100K devices (default 1500 without SD)
• Automatic tiering between RAM and SD

[!TIP] A longer initial scan produces more reliable baselines.

C. Deauth Attack Detection

WiFi deauth/disassoc frame sniffer with real-time detection. Integrates with randomization tracking for source identification.

D. Drone RID Detection

Detects drones broadcasting Remote ID per FAA/EASA standards. Supports ODID/ASTM F3411 (NAN action frames, beacon frames) and French drone ID (OUI 0x6a5c35). Extracts UAV ID, pilot location, and flight telemetry. Mesh alerts and SD logging.

E. MAC Randomization Correlation (Experimental)

[!TIP] Use the Privacy button to redact MACs, GPS, and SSIDs before sharing screenshots. SSIDs are hashed as net#XXXX for correlation without exposure.

Links randomized MAC addresses to persistent device identities using behavioral signatures: IE fingerprinting, channel sequencing, timing, RSSI patterns, and sequence number correlation. Assigns identity IDs (T-XXXX) with SD persistence.

• Up to 256 simultaneous identities, 128 linked MACs each (LRU eviction of oldest identity at cap; stale tracks pruned every 60s)
• Dual signature support (full and minimal IE patterns)
• Confidence-based linking with adaptive thresholds
• Detects global MAC leaks and WiFi-BLE correlation

F. Probe Request Scanner

Goes beyond probe request capture: correlates all three 802.11 address fields to detect ghost SSIDs (networks that exist only in the device's history), identify which APs responded, and catch silent devices via destination address matching.

• Three-field correlation: Probe requests (addr2=source), probe responses (addr1=client, addr2=AP, addr3=BSSID), and destination address matching all feed into a single per-device record
• Destination address (addr1) matching: Detects when probe requests are addressed TO a target MAC -- catches silent or sleeping devices that never transmit their own identity
• Ghost SSID detection: Cross-references probe requests against probe responses to flag SSIDs with no responding AP nearby. Ghost SSIDs appear prefixed with ~ (e.g., ~"HomeNetwork" vs "CoffeeShop") and reveal networks the device connected to elsewhere -- location history, home/work networks, travel patterns
• SSID watchlist: add SSIDs to the target list alongside MACs and OUIs
• OUI vendor identification (68-vendor table)
• MAC randomization detection (locally-administered bit check)
• Mesh alerting for watchlist hits (60s dedup cooldown)
• RSSI min/max/current tracking, up to 4 probed SSIDs per device

G. Sentinel — Counterintel Engine

Passive WiFi monitoring that flags attacker-tool activity by frame signatures plus behavioral fallbacks

Tuned and tested against both popular consumer ESP32 attack firmware and professional Linux tooling, so detection isn't tied to one tool's byte templates.

Verified against: airgeddon, aireplay-ng, bettercap, wifite, mdk4, angryoxide, eaphammer, hostapd-mana, wifipumpkin3, hcxdumptool, purpose-built test scripts, and common consumer ESP32 attack firmware.

Detectors are organized into toggleable groups. Each detection logs to serial + SD and broadcasts to mesh peers.

Field-verified on hardware (confirmed firing against the live tools above): deauth (flood/forge/AP-targeted), beacon flood, auth flood, assoc-sleep, SAE DoS, karma, evil-twin, probe flood, handshake capture.

Experimental (implemented + signature-grounded, hardware field-test pending): OWE abuse, PMKID harvest, FragAttacks, TSF multi-channel twin, WiFi interference, mesh disruption.

Behavioral fallbacks (survive template changes): SSID-rotate forge, behavioral probe-flood, EAPOL-capture bait, broadcast-deauth-while-beaconing.

Outputs: [DETECT] serial lines + per-detector SD .jsonl + mesh broadcast to peer nodes for quorum confirmation.

Control & boot: Start/stop from the Sentinel tab. Off at boot by default; opt into a persistent Start-on-Boot setting via the Web Flasher / Configurator / SENTINEL_BOOT mesh command — when enabled it auto-starts at power-on and survives reboot.

Secure Data Destruction

Tamper detection and emergency data wiping.

• Auto-erase on tampering: Vibration-triggered destruction (disabled by default)
• Setup delay: Grace period after enabling for deployment
• Manual secure wipe: Via web interface
• Remote force erase: Mesh-commanded with token auth (5-min expiry, device-specific)
• Obfuscation: Plants a dummy IoT weather config after wipe

Warning: Data destruction is permanent and irreversible.

RF Configuration

Scan Presets

Configure via web interface at http://192.168.4.1 or API. All settings persist to NVS and SD.

System Architecture

Nodes function independently and coordinate via Meshtastic mesh networking.

Workflow: Detection -> Data collection (RSSI, GPS, timestamp) -> Mesh broadcast -> Command center aggregation

AntiHunter Command Center: Aggregates data from all nodes with real-time mapping and visualization.

Hardware

[!IMPORTANT] Requires regulated 5V power supply. Unregulated battery sources cause voltage instability.

Assembling the PCB

• Welcome Letter - Intro to DIGINODE PCB
• Assembly Manual: DIGINODE PCB
• BOM - Links

Core Components

• Seeed XIAO ESP32-S3 (minimum 8MB flash)
• Meshtastic board: Heltec v3.2 (recommended) or T114. Alternatives in discussions.
• GPS, SDHC, vibration, and RTC modules

Getting Started

Web Flasher & Configurator (Recommended)

Flash and configure directly from your browser -- no tools to install. Requires Chrome or Edge on desktop.

1. Open Web Flasher -- select Full or Headless, plug in your ESP32-S3, and click Connect & Flash.

• Choose "Erase Device" during process if upgrading from pre v0.9.2 firmware or to clear saved settings from flash memory.

  Preferences are also saved and synced to/from SD storage. If corrupted, the settings will self-heal.

2. Optional: After flashing, set the configuration choices and press send to device.

   • Use it to change settings without using the device (especially useful for headless FW).

CLI Flash

curl -fsSL -o flashAntihunter.sh https://raw.githubusercontent.com/lukeswitz/AntiHunter/main/Dist/flashAntihunter.sh
chmod +x flashAntihunter.sh
./flashAntihunter.sh

The script first asks for a release channel (Stable or Beta), then Full or Headless. Stable pulls from main, Beta from beta.

Use -c to configure device parameters during flash, -e to erase flash first, -l to list available firmware.

Post-flash:

• Full firmware: Connect to Antihunter WiFi AP (password: antihunt3r123), open http://192.168.4.1. Configure RF settings, detection modes, and change the AP credentials in RF Settings.
• Headless firmware: Serial monitor or mesh commands only.

Build from Source

Prerequisites: PlatformIO, Git, USB cable. Optional: VS Code with PlatformIO extension.

git clone https://github.com/lukeswitz/AntiHunter.git
cd AntiHunter

pio device list                                    # List connected devices
pio run -e AntiHunter-full -t upload               # Flash full firmware (web UI)
pio run -e AntiHunter-headless -t upload           # Flash headless firmware
pio device monitor -e AntiHunter-full              # Serial monitor
pio run -e AntiHunter-full -t erase -t upload      # Clean flash (erase + upload)

Build environments:

• AntiHunter-full -- Web server (ESPAsyncWebServer, AsyncTCP) with AP dashboard
• AntiHunter-headless -- Minimal dependencies, no web UI, mesh/serial only

Mesh Network Integration

Meshtastic LoRa mesh via UART for long-range distributed sensing.

• Connection: TEXTMSG mode, 115200 baud. Pins: 10 RX / 9 TX (T114), 19 RX / 20 TX (Heltec V3)
• Protocol: Standard Meshtastic serial, public and encrypted channels
• Rate limiting: 3s intervals (configurable)
• Addressing: @ALL COMMAND for broadcast, @AH01 COMMAND for a specific node. Node IDs: 2-5 alphanumeric chars.

Mesh Commands

All timestamps UTC. Node IDs: 2-5 alphanumeric characters (A-Z, 0-9), no spaces.

[!TIP] @ALL broadcasts to all nodes. Replace with a node ID for targeted commands.

Core

Configuration

Scanning

The +PROBE flag on DEVICE_SCAN_START enables probe request capture during device scans, populating the probe database alongside normal device discovery.

NODE_ID: HEARTBEAT: Temp:XXC GPS:lat,lon Battery:SAVER

API Reference

[!NOTE] All timestamps UTC. Full firmware only.

Core

Scanning

Results

Probe Database

Data Explorer

The Data tab in the web UI provides a searchable, sortable view of all SD-logged scan data. Select a dataset from the dropdown, search across any column, click column headers to sort, and page through results.

Available datasets: Probe Devices, Probe Events, Deauth Attacks, Drone Detections, Vibration Events, Baseline Stats, and System Log. All datasets support export (download the raw file) and clear (with confirmation). The headless firmware logs the same data to SD without the web UI.

Acknowledgments

Original concept and hardware design by @TheRealSirHaXalot. Get involved -- PRs, issues, and docs contributions welcome.

This project includes code from opendroneid-core-c, licensed under the Apache License 2.0. Copyright (C) Intel Corporation and OpenDroneID contributors

Legal Disclaimer

AntiHunter (AH) is provided for lawful, authorized use only -- such as research,
training, and security operations on systems and radio spectrum you own or have
explicit written permission to assess. You are solely responsible for compliance
with all applicable laws and policies, including privacy/data-protection (e.g.,
GDPR), radio/telecom regulations (LoRa ISM band limits, duty cycle), and export
controls. Do not use AH to track, surveil, or target individuals, or to collect
personal data without a valid legal basis and consent where required.

Authors and contributors are not liable for misuse, damages, or legal
consequences arising from use of this project.

By using AH, you accept full responsibility for your actions and agree to
indemnify the authors and contributors against any claims related to your use.

These tools are designed for ethical blue team use, such as securing events,
auditing networks, or training exercises.

THE SOFTWARE IS PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTY OF ANY
KIND, EXPRESS OR IMPLIED. TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT
SHALL THE DEVELOPERS, MAINTAINERS, OR CONTRIBUTORS BE LIABLE FOR ANY CLAIM,
DAMAGES, OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT, STRICT
LIABILITY, OR OTHERWISE, ARISING FROM OR IN CONNECTION WITH THE SOFTWARE,
INCLUDING ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY,
OR PUNITIVE DAMAGES.

BY ACCESSING, DOWNLOADING, INSTALLING, COMPILING, EXECUTING, OR OTHERWISE USING
THE SOFTWARE, YOU ACCEPT THIS DISCLAIMER AND THESE LIMITATIONS OF LIABILITY.