How WiFi CSI Through-Wall Detection Works: A Technical Primer

Every WiFi router in every building is constantly broadcasting radio waves that bounce off walls, furniture, and human bodies. Those signals carry hidden information about the physical environment. Information that, with the right processing, can reveal whether someone is standing behind a wall. This is the premise behind WiFi Channel State Information (CSI) sensing, a technology that is reshaping how defense and law enforcement think about through-wall detection.

This article explains the physics, the signal processing, and the real-world tradeoffs of WiFi CSI through-wall detection. It is written for operators and program managers who need to evaluate the technology, not just read about it.

What Is WiFi Channel State Information (CSI)?

Channel State Information is a fine-grained descriptor of how a wireless signal travels from transmitter to receiver. Unlike Received Signal Strength Indicator (RSSI), which is a single number representing overall signal power, CSI captures the amplitude and phase of the signal across every subcarrier in an OFDM (Orthogonal Frequency-Division Multiplexing) channel.

In practical terms: a standard 20 MHz WiFi channel using 802.11n contains 56 subcarriers. CSI reports amplitude and phase for each one, producing a 56-dimensional snapshot of the wireless channel roughly every millisecond. If you use a 3-antenna receiver, that becomes 168 data streams updated a thousand times per second.

Why does this matter? Because each subcarrier responds differently to objects in the environment. A human body, composed mostly of water and highly reflective at 2.4 and 5 GHz, creates a distinct, frequency-dependent distortion pattern. CSI captures that pattern. RSSI does not.

How WiFi CSI Detects Humans Through Walls

WiFi signals at 2.4 GHz penetrate most common building materials (drywall, wood framing, concrete block, brick) with varying degrees of attenuation. When a signal passes through a wall and encounters a person on the other side, several things happen simultaneously:

• Reflection: The human body reflects a portion of the signal energy back. At 2.4 GHz, the human body has a reflection coefficient of roughly 0.5–0.7, making people strong reflectors relative to furniture or building materials.
• Multipath modification: The reflected signal combines with the direct-path signal and other reflections. When a person moves, even breathing or shifting weight, the multipath profile changes in a measurable way.
• Fresnel zone disturbance: When a body crosses or occupies the Fresnel zones between transmitter and receiver, it causes predictable amplitude and phase fluctuations across subcarriers.

The key insight is that a static, empty room produces a stable CSI signature over time. When a human enters that space, the CSI pattern becomes dynamic. The variance, temporal correlation, and spectral characteristics of that dynamic pattern are what allow detection algorithms to distinguish "person present" from "empty room," even through intervening walls.

This approach works because the sensing system does not need to see the person. It needs only to observe the disturbance the person creates in an existing electromagnetic field.

The Signal Processing Pipeline

Raw CSI data is noisy. Converting it into actionable presence detection requires a multi-stage pipeline:

1. Capture

CSI data is extracted from commodity WiFi chipsets (most commonly Intel 5300, Atheros, or Broadcom/Nexmon-patched devices) at rates of 100–1,000 packets per second. The receiver passively monitors existing WiFi traffic or beacons from access points in the environment. No modifications to the transmitting infrastructure are required.

2. Signal Conditioning

Raw CSI contains hardware-induced phase offsets, sampling frequency offsets (SFO), and carrier frequency offsets (CFO) that must be removed before the data is useful. Standard techniques include linear phase correction across subcarriers, Hampel filtering for outlier removal, and bandpass filtering to isolate the frequency band associated with human motion (typically 0.1–2 Hz for breathing, 1–10 Hz for walking).

3. Feature Extraction

Conditioned CSI streams are converted into features that characterize human presence. Common approaches include:

• Statistical features: Variance, kurtosis, and entropy of amplitude across subcarriers and time windows
• Spectral features: Power spectral density in motion-correlated frequency bands
• Spatial features: Cross-antenna correlation patterns that encode angle-of-arrival information
• Temporal features: Autocorrelation decay rates that distinguish periodic human motion (breathing, walking) from environmental noise (HVAC, machinery)

4. Classification

Features are fed into a classifier (historically support vector machines or random forests, increasingly lightweight neural networks) that outputs a presence/absence determination. More advanced systems can estimate occupant count, coarse location, or activity type. Edge deployment typically uses models small enough to run on ARM-class processors in real time.

Passive vs. Active Sensing: Why Zero Emissions Matters

This is where WiFi CSI sensing diverges fundamentally from radar-based through-wall systems. Radar systems, whether UWB, stepped-frequency, or Doppler, is an active technology. It emits RF energy, and that energy can be detected, located, and exploited by an adversary with basic electronic warfare (EW) equipment.

WiFi CSI sensing in its passive configuration emits nothing. The receiver monitors existing WiFi signals that are already present in the environment. From an electromagnetic signature perspective, the sensing system is indistinguishable from any other WiFi client device, or from no device at all, if operating in monitor mode without association.

This distinction has operational implications in several scenarios:

• Denied-emission environments: Special operations forces (SOF) operating under EMCON (emissions control) restrictions cannot use active radar. A passive WiFi CSI receiver does not violate EMCON.
• Covert surveillance: Law enforcement conducting pre-raid reconnaissance cannot afford to alert occupants. Active radar emissions can be detected with inexpensive SDR equipment. Passive WiFi monitoring cannot.
• Counter-detection resistance: In peer/near-peer conflict scenarios, adversary SIGINT systems actively scan for non-standard RF emissions. WiFi CSI sensing produces no detectable signature.

What WiFi CSI Can and Cannot Do

Intellectual honesty about limitations is essential for any technology evaluator. Here is a candid assessment:

Comparison with Radar-Based Through-Wall Systems

WiFi CSI sensing does not replace radar. It occupies a different niche. Understanding the tradeoffs helps determine when each technology is appropriate.

The practical implication: radar excels at short-duration, high-resolution tactical queries ("show me exactly where the hostage is"). WiFi CSI excels at persistent, covert, wide-area monitoring ("tell me if anyone enters this building tonight"). The two technologies are complementary, not competitive.

Operational Applications

Special Operations Forces

Pre-assault reconnaissance in urban environments where EMCON discipline is critical. A small, passive device can confirm or deny occupancy of a target building without emitting detectable signals. Particularly valuable in denied areas where active radar use would compromise the operation.

SWAT / Law Enforcement

Pre-raid intelligence gathering for hostage rescue, barricade situations, and warrant service. Knowing whether a building is occupied, and roughly where occupants are located, before entry reduces risk to both officers and civilians.

Search and Rescue

Post-disaster building scanning where existing WiFi infrastructure may still be partially operational. A passive sensor could sweep collapsed structures for signs of trapped survivors without generating additional RF interference for other rescue communications.

Perimeter Security

Persistent monitoring of buildings, facilities, or restricted areas using existing WiFi infrastructure. Unlike camera systems, WiFi CSI sensing is unaffected by lighting conditions, visual obstructions, or privacy concerns related to video surveillance.

The Future of WiFi Sensing

The field is advancing rapidly across several fronts:

• Pose estimation: Research groups have demonstrated coarse skeletal tracking using WiFi signals alone, reconstructing body pose through walls with deep learning models trained on synchronized WiFi CSI and camera ground truth data (Geng et al., 2022).
• Behavioral analysis: Beyond presence detection, emerging systems can classify activities such as sitting, walking, falling, and gesturing, enabling applications like elder care monitoring and occupant behavior profiling.
• WiFi 6/6E and WiFi 7: Newer standards provide wider channels (up to 320 MHz in WiFi 7), more subcarriers, and MIMO configurations that dramatically increase the spatial and temporal resolution available to CSI-based sensing.
• Mesh network sensing: Using multiple transmitter-receiver pairs in a mesh topology enables tomographic reconstruction of occupancy across an entire building, not just along a single link.
• IEEE 802.11bf (WLAN Sensing): The IEEE is actively developing a standard specifically for WiFi sensing, expected to be ratified by 2028. This will standardize CSI reporting formats and enable sensing as a native WiFi capability in commercial hardware.

Ceradon’s Take

Ceradon Systems is building Vantage, a passive WiFi CSI sensing platform designed to bring this technology from the lab to the field. Vantage implements the capture → condition → extract → classify pipeline described above on ruggedized, edge-deployable hardware that operates with zero RF emissions.

We are currently at TRL 4, validated in a laboratory environment with controlled testing. Our roadmap prioritizes operational reliability over feature expansion: accurate, trustworthy presence detection in real-world building environments is the foundation that everything else builds on. We are transparent about where the technology stands today, because the operators and program managers evaluating it deserve honest assessments, not marketing claims.

If you are evaluating through-wall sensing capabilities for defense or law enforcement applications, we welcome the conversation. Get in touch to learn more about Vantage and how passive WiFi sensing fits into your operational architecture.

References

1. Ma, Y., Zhou, G., & Wang, S. (2019). “WiFi Sensing with Channel State Information: A Survey.” ACM Computing Surveys, 52(3), 1–36. doi:10.1145/3310194
2. Wang, W., Liu, A. X., Shahzad, M., Ling, K., & Lu, S. (2017). “Understanding and Modeling of WiFi Signal Based Human Activity Recognition.” Proceedings of the 21st Annual International Conference on Mobile Computing and Networking (MobiCom). doi:10.1145/2789168.2790093
3. Geng, J., Huang, D., & De la Torre, F. (2022). “DensePose From WiFi.” arXiv preprint, arXiv:2301.00250.
4. Halperin, D., Hu, W., Sheth, A., & Wetherall, D. (2011). “Tool Release: Gathering 802.11n Traces with Channel State Information.” ACM SIGCOMM Computer Communication Review, 41(1), 53. doi:10.1145/1925861.1925870
5. Wu, D., Zhang, D., Xu, C., Wang, H., & Li, X. (2017). “Device-Free WiFi Human Sensing: From Pattern-Based to Model-Based Approaches.” IEEE Communications Magazine, 55(10), 91–97. doi:10.1109/MCOM.2017.1700143