RF Census: DEF CON 34

For DEF CON 34 this year I carried an ESP32 badge around and counted the 2.4 GHz traffic I could sense with it. The result is a 55.6-hour census and here’s the permanent public archive for your enjoyment.

Holding the ESP32 badge at DEF CON with the radar screen showing live Wi-Fi and BLE counts

How it worked

The badge ran a passive BLE scan continuously while sweeping every Wi-Fi channel about once every five seconds. It counted unique devices, channel use, signal strength, open networks, hidden networks, and named SSIDs.

ESP32 C code for passive BLE scanning and continuous Wi-Fi sweeps

I set it up so raw MAC addresses and BSSIDs never left the badge, wanted to be somewhat privacy conscious of the attendees since I knew I would be publishing this. It salted IDs each boot, discarded any BLE names, and uploaded only aggregates plus the six strongest SSIDs in each sample.

Every 30 seconds, the badge wrote a snapshot to a SPIFFS ring journal. When my phone hotspot was available, it connected to m phone and used that to send small HTTPS batches and deleted them only after the server acknowledged them.

ESP32 C code for offline journaling and acknowledged batch uploads

Setup

Hardware itself was a Waveshare ESP32-S3-Touch-LCD-1.69: ESP32-S3R8, 8 MB PSRAM, 16 MB flash, and a 240×280 display. Firmware used ESP-IDF 5.5.5. Shoutout Steve Ruiz from X for putting everyone on the wave of cheap ESP32 dev devices.

I flashed it with my custom firmware, ran the hardware self-test, then provisioned an uplink over USB:

./dev flash
./dev selftest
net url https://d34-rf-census.pages.dev/api/ingest
net token <shared secret>
net set <hotspot-ssid> <password>
net auto on

The backend was actually pretty cool, it was a Cloudflare Pages Worker writing to D1 directly. The React site (statically compiled) read fixed aggregate endpoints.

ESP32-S3 → phone hotspot → Worker → D1 → archive

I got lucky in not needing a battery, once at the con I discovered I could power it from the COM port of my Laser Tag badge, so I didn’t have to add one or carry one around. It hung off the badge and ran all day without issues (until saturday when I forgot to turn it on lol).