Wi-Fi CSI radar: what it really measures, and where the marketing stops

By Wu Jun · Updated 2026-10-29 · 6 min read

Search for "Wi-Fi CSI radar" and you will find both serious research and "see through walls" marketing. The radar analogy is useful because both radar and CSI infer targets from reflections and multipath. CSI, however, has no dedicated radar waveform and does not automatically produce a range-angle-velocity cube.

This page separates what is practical, what is possible only under controlled conditions, and what must not be claimed by default. The boundaries are grounded in our 10-minute GL-MT6000 capture.

1. Radar concepts mapped to CSI

The CSI sensing survey provides the broader capability map ^[1]. IEEE 802.11bf is standardising WLAN sensing measurements and procedures ^[2], but a standards project does not mean existing routers already implement a complete radar stack.

2. Where the radar analogy works

Classic radar transmits a known waveform and measures delay, Doppler and angle in the echo. Wi-Fi sensing normally uses existing frames and estimates the complex channel on each subcarrier. Both can infer motion from reflections, but CSI has four practical limits:

1. Opportunistic waveform: frame length, modulation, bandwidth and transmission times are not fully controlled by the sensing algorithm;
2. Strong indoor multipath: a target reflection is only one part of the measured channel;
3. Receiver-side measurement: a station must keep sending traffic; the router is not alone transmitting radar pulses;
4. Finite snapshot rate: chains from one measurement share a time instant and cannot be counted as extra time samples.

"Wi-Fi radar" is therefore a useful description of a sensing paradigm, not evidence of FMCW or millimetre-wave radar resolution in range, angle and velocity.

3. Why 95.5 records/s cannot drive Doppler processing

Our 10-minute capture averages 95.5 chain records/s over 57,293 records. Closing measurements on chain_info bit 15 gives 7,609 groups over 599.924 seconds, or about 12.68 Hz. After removing anomalous groups, the analysis uses about 12.64 Hz.

The eight chains are different tx/rx combinations at almost the same instant. Concatenating them as a 95.5 Hz series creates a sampling rate that does not exist and treats simultaneous data as if it evolved in time.

For a 12.64 Hz snapshot system, the unambiguous Doppler span is:

[-FS/2, +FS/2] = [-6.32, +6.32] Hz

At 5 GHz, radial motion at 1 m/s has 2v/λ ≈ 33 Hz, which aliases. Consequently:

• slow motion envelopes, respiration, posture changes and low-frequency temporal features are observable;
• the current 12.64 Hz capture cannot recover full walking, arm-swing or fall-impact micro-Doppler;
• true gait Doppler requires a higher independent CSI snapshot rate or a dedicated radar/SDR platform.

Wider bandwidth, more subcarriers or a larger neural network do not remove this limit. Bandwidth improves frequency resolution; it does not increase the snapshot rate.

4. What we actually observed in this capture

The grade E setup is a GL-MT6000, 5 GHz HE80, 256 subcarriers and a dedicated AP interface. The 10-minute capture contains 57,293 records with no gap longer than five seconds ^[3]. The parser and analysis scripts are public ^[4].

The data supports these statements:

• 256-subcarrier CSI can be captured continuously and verified;
• human activity produces repeatable changes in amplitude heatmaps and low-frequency motion metrics;
• a roughly 12.64 Hz independent snapshot rate is sufficient for studying slow changes;
• missing chains, four-chain groups and a few anomalous groups are real and must be handled.

The data does not by itself establish:

• accuracy for a specific range, angle or velocity;
• fall-detection sensitivity in eldercare;
• body-pose, face or identity recovery;
• imaging through arbitrary walls.

The reason is simple: the capture has no synchronised ground truth for position, velocity, pose or events. Without ground truth, you can demonstrate signal changes, not measurement error.

5. A runnable low-frequency Doppler/time-frequency example

The code below assumes one selected chain per measurement and uses the real snapshot rate. Each window removes a linear trend, applies a Hann window and computes FFT power over time:

import numpy as np

FS = 12.64          # independent measurements/s, not 95.5 chain records/s
WIN = 256           # 20.3 s
HOP = 32            # 2.5 s

def slow_doppler(phase):
    phase = np.asarray(phase, dtype=float)
    rows = []
    starts = range(0, len(phase) - WIN + 1, HOP)
    for start in starts:
        x = phase[start:start + WIN].copy()
        idx = np.arange(WIN, dtype=float)
        slope, intercept = np.polyfit(idx, x, 1)
        x = x - (slope * idx + intercept)
        x = (x - x.mean()) * np.hanning(WIN)
        rows.append(np.abs(np.fft.fftshift(np.fft.fft(x))))

    power = np.column_stack(rows)
    freqs = np.fft.fftshift(np.fft.fftfreq(WIN, d=1.0 / FS))
    return freqs, power

freqs, power = slow_doppler(phase)
mask = np.abs(freqs) <= 5.0
freqs, power = freqs[mask], power[mask]

This is not a complete radar pipeline. It has no range gates, array-angle processing, waveform matching or absolute velocity calibration. It is only a way to inspect low-frequency time-frequency structure.

6. Evidence required before making a claim

Work such as "DensePose From WiFi" shows that multi-antenna CSI can reconstruct coarse human pose in a controlled research setting, but the public evidence remains preprint-level ^[5]. It does not imply that a consumer router can recognise faces or identity in real time.

7. If you need real radar capability

Choose the platform from the measurement requirement:

• mmWave radar: better range, velocity and angular resolution, with different coverage and cost tradeoffs;
• UWB: high-accuracy short-range ranging and motion sensing;
• FMCW/SDR: custom waveforms and range-Doppler processing, with a higher engineering barrier;
• dedicated Wi-Fi sensing hardware: wait for a mature 802.11bf ecosystem or use a research platform with a high independent CSI snapshot rate.

For learning the CSI pipeline, human-activity classification and home-network experiments, the GL-MT6000 route remains useful. The mistake is upgrading "can observe channel changes" into "has a complete radar".

8. Privacy and responsible deployment

Even without a camera, CSI can infer motion, presence, routines and some behaviour. A deployment should:

• cover only spaces you own or where participants gave informed consent;
• explain purpose, retention and an off switch;
• avoid marketing a research prototype as medical, security or identity-recognition equipment;
• consider shielding, jamming, auditing and data minimisation in shared spaces.

IEEE 802.11bf and CSI privacy research make sensing security and countermeasures part of the design problem ^{[2] [1]}.

9. Conclusion

• "Wi-Fi CSI radar" is a useful analogy, not a complete radar specification;
• this router is suited to slow-motion, presence and controlled activity research;
• 95.5 chain records/s is not 95.5 Hz; the independent snapshot rate is about 12.64 Hz;
• the current data cannot recover full gait micro-Doppler or prove range, angle and pose accuracy;
• every radar-style claim needs a snapshot rate, unambiguous range, ground truth, error metrics and failure conditions.

Related: respiration detection · the physical limits of through-wall sensing · 80 MHz vs 40 MHz