Nexmon CSI in practice: 80 MHz / 256 subcarriers on Raspberry Pi, Pi 5 compatibility and safe rollback

By Wu Jun · Updated 2026-10-29 · 7 min read

Nexmon CSI is maintained by SEEMOO Lab at TU Darmstadt ^[1]. It is not an ordinary userspace packet sniffer: it patches Broadcom Wi-Fi firmware so the radio emits per-frame CSI to a UDP socket. A peer-reviewed paper describes the platform and its extraction model ^[2].

That gives useful high-bandwidth measurements, with an equally clear cost: the chip, firmware and OS must match; the patch changes the network interface; and a failed installation can temporarily remove Wi-Fi. Use a dedicated experiment SD card and test machine, not the only Raspberry Pi that carries your home network.

0. Bottom line

1. Supported chips and Raspberry Pi models

The official matrix lists four primary chips ^[1]:

"Raspberry Pi 5" does not mean "any Raspberry Pi OS image compiles unchanged." The maintainer's recent guide says:

• Pi 5 must switch to a non-16K-page kernel or the Nexmon build fails;
• the new path uses Makefile.rpi and no longer needs a modified brcmfmac;
• nexutil must be built with USE_VENDOR_CMD=1, otherwise the driver rejects the ioctls ^[3].

Record these before touching the system:

cat /proc/device-tree/model
uname -a
getconf PAGESIZE
iw dev
sudo dmesg | grep -i -E 'brcmfmac|cyfmac|firmware'

If getconf PAGESIZE returns 16384 on a Pi 5, switch to kernel=kernel8.img as required by the upstream guide. Do not make that change on the only card without understanding how to recover it.

2. Prerequisites

1. A dedicated SD card: image the whole card first and keep a second bootable card;
2. Ethernet or a serial console: Makefile.rpi unmanage disconnects wlan0 from NetworkManager;
3. Stable power: compilation and long captures need a reliable supply;
4. A transmitter on the same channel: a phone, ESP32 or second Wi-Fi interface;
5. A pinned 5 GHz channel: disable automatic selection and avoid DFS/congested primary channels;
6. A local experiment log: chip, firmware directory, OS, kernel, page size, channel, bandwidth, spatial streams and capture time.

The upstream Pi 5 path installs historical compatibility packages and may temporarily use an archived Debian source ^[3]. That is not a hardened production-server recipe. Treat the card as a short-lived experiment: do not keep SSH private keys, password stores, family photos or the only copy of any data on it. Restore the official firmware after the experiment.

3. Two installation paths

Path A: older Raspberry Pi OS / legacy upstream flow

The official README documents modified brcmfmac drivers and patch builds for Pi 3B+/4B on kernels 4.19, 5.4 and 5.10. It depends heavily on those kernel versions. Do not copy those commands onto a Pi 5 or a current OS.

Path B: current Raspberry Pi OS / Pi 5

For current Raspberry Pi OS and Pi 5, use the maintainer's Makefile.rpi guide ^[3]. The core sequence is below. Do not treat the block as a complete one-command installer: Pi 5 armhf compatibility packages and the Python 2.7 build dependency must be installed according to the linked guide.

# Raspberry Pi 5 only: switch to a non-16K-page kernel, then reboot
grep -qxF 'kernel=kernel8.img' /boot/firmware/config.txt || \
  echo 'kernel=kernel8.img' | sudo tee -a /boot/firmware/config.txt
sudo reboot

sudo apt update
sudo apt full-upgrade
sudo apt install git libgmp3-dev gawk qpdf bison flex make \
  autoconf libtool texinfo xxd libnl-3-dev libnl-genl-3-dev \
  bc libssl-dev tcpdump

git clone --depth=1 https://github.com/seemoo-lab/nexmon.git
cd nexmon
source setup_env.sh
make

# The modern driver path requires vendor commands
cd "$NEXMON_ROOT/utilities/nexutil"
sudo -E make install USE_VENDOR_CMD=1
sudo setcap cap_net_admin+ep /usr/bin/nexutil

cd "$NEXMON_ROOT/patches/bcm43455c0/7_45_189"
git clone --depth=1 https://github.com/seemoo-lab/nexmon_csi.git
cd nexmon_csi
make -f Makefile.rpi install-firmware
make -f Makefile.rpi unmanage
make -f Makefile.rpi reload-full

After unmanage, do not expect wlan0 to keep SSH alive. Generate extractor parameters with the upstream makecsiparams, then configure CSI and monitor mode:

# The fields are illustrative; replace MAC, frame type and channel for your test
SENDER_MAC="${SENDER_MAC:?set the test transmitter MAC first}"
CSI_PARAMS="$(makecsiparams -c 44/80 -C 1 -N 1 -m "$SENDER_MAC" -b 0x88)"
sudo nexutil -Iwlan0 -s500 -b -l34 -v"$CSI_PARAMS"
sudo nexutil -m1
sudo tcpdump -i wlan0 dst port 5500 -w csi-10s.pcap

The command has no built-in example MAC; it fails immediately unless SENDER_MAC is set. Always copy the current parameter syntax from the upstream README. The repository has introduced backward-incompatible changes; magic values and configuration strings in old blog posts can be stale.

4. UDP packet and CSI format

The current README says each matching Wi-Fi frame produces one UDP packet per configured core/spatial stream, normally on port 5500. The payload layout is:

uint16  magic = 0x1111
uint8   source_mac[6]
uint16  wifi_sequence
uint16  core_and_spatial_stream
uint16  chanspec
uint16  chip_version
...     CSI samples

For bcm43455c0 and bcm4339, CSI is interleaved int16 I / int16 Q. The bcm4358 and bcm4366c0 use different packed floating-point formats. A 20 / 40 / 80 MHz extraction contains 64 / 128 / 256 complex slots respectively, at four bytes per slot. Those slots include guard, null and pilot positions; do not treat all 256 as useful information subcarriers.

An 80 MHz receiver can also receive a frame transmitted in a 20 MHz-wide portion of the channel. Most of the CSI slots being empty does not necessarily mean capture is broken; check the transmitter's actual bandwidth and frame type. Remove guard/null positions and report the ratio of usable subcarriers.

5. Capture settings and data budget

• Pin the channel and bandwidth; scan the channel before capturing;
• use MAC and frame-type filters to reject irrelevant frames;
• keep a compliant transmitter busy with UDP/TCP traffic;
• capture 10 seconds and parse it before extending to 10 minutes;
• record the makecsiparams arguments and the nexutil -k chanspec.

A rough budget: at about 100 matching frames/s, one 80 MHz stream carries about 100 × 256 × 4 = 102.4 KB/s of CSI before Ethernet/IP/UDP and pcapng overhead. Actual size depends on matched frame rate, cores and spatial streams. This project's MT6000 capture is 58 MB for 10 minutes and eight-chain records, which is a useful order-of-magnitude reference.

6. Parsing and quality checks

After a capture, verify:

7. Failure guide

8. Safe rollback

Restore the normal firmware when the experiment ends:

make -f Makefile.rpi restore-wifi

If rollback fails, boot from the spare SD card or restore the card image with a reader. Never combine experiment, remote administration and the only copy of important data on one card.

9. Nexmon vs ESP32 vs MT6000

Continue with the Raspberry Pi role guide, ESP32 CSI introduction, MT6000 reproduction guide or the project's 10-minute dataset.