Wi-Fi CSI and Motion Sensing

Start with the radio, not the acronym

Wi-Fi motion sensing is easier to understand when we build it from the physical signal upward. We will begin with a repeating wave, turn it into the complex numbers a radio stores, divide a wide channel into OFDM subcarriers, estimate what the room did to each subcarrier, and only then call that estimate CSI.

Every chapter follows the same rhythm: plain intuition, the receiver's system view, and the engineering caveat. Its playground appears directly after the theory so you can test the idea before moving on.

Radio foundation 1

Amplitude, frequency, wavelength, and phase

Imagine watching one point on a skipping rope. It moves up and down in a repeating pattern. A radio's electric field also oscillates, though billions of times per second and in a physical form that is not visible to us. A compact wave model is:

Here s(t) is the signal value observed at time t. A sets its peak size, fsays how many full cycles occur per second, and φ sets the starting angle. One cycle is 2π radians, so2πft converts elapsed time into the angle reached afterf cycles per second. This model describes the signal at one observation point; wavelength describes how the same phase pattern is distributed through space.

This matters for sensing because a reflected path that changes by a fraction of a wavelength changes its phase noticeably. In Playground 1, adjust all four quantities and watch frequency alter the real wavelength while amplitude and phase alter the displayed cycle.

Radio foundation 2

Why radios use I/Q and complex numbers

A high-frequency cosine by itself is awkward to analyze. The receiver compares the signal with two reference waves separated by 90 degrees: cosine and sine. The resulting coordinates are called in-phase (I) and quadrature (Q). Together they form the complex sample I + jQ.

This is not imaginary radio energy. It is a two-axis bookkeeping system. The point's distance from the origin is magnitude, and its angle is phase:

Modulation schemes place data at chosen points in this plane. The channel later scales and rotates those points. Use Playground 2 to rotate a phasor and select QPSK symbols. Notice that one complex number preserves both attenuation and relative phase.

Radio foundation 3

Why a wide channel needs subcarriers

Indoor radio rarely travels along one path. Copies bounce from walls, floors, furniture, and people, arriving at slightly different times. When the transmitted bandwidth is wide enough, those delayed copies combine differently at different frequencies. One part of the channel may reinforce while a nearby part cancels. Engineers call this frequency-selective fading.

OFDM handles that wide, difficult channel by placing data on many narrow tones called subcarriers. Each subcarrier is narrow enough that the channel can be approximated by one complex multiplication. The tones overlap spectrally, but they are spaced so the receiver's FFT can separate them.

Over exactly one useful symbol, every other integer-spaced tone completes whole positive and negative cycles and integrates to zero. That is orthogonality. It is a mathematical cancellation property, not physical spacing between tiny transmitters. Use Playground 3 and shorten the observation window to see that cancellation fail.

The same cancellation also depends on the receiver choosing the correct FFT window and tracking carrier and sampling offsets. Timing error, carrier-frequency offset, phase noise, or a channel that exceeds the guard interval leaks energy between bins as inter-carrier interference.

Radio foundation 4

Inside one OFDM symbol: data, pilots, nulls, FFT, and IFFT

The transmitter first maps coded bits to complex constellation values such as QPSK or QAM. It places those values into frequency bins. Data tones carry user bits, pilot tones carry known references used for tracking, and null tones around the channel edges or at DC transmit no data.

An inverse FFT converts the entire set of frequency bins into one block of time-domain samples. The radio sends those samples. At the receiver, an FFT performs the reverse operation and recovers one complex value per subcarrier. The air carries one combined waveform, not a row of independently visible waves.

In Playground 4, flip data symbols in a small teaching tone plan and watch the combined time waveform change. Real 802.11 formats use format-specific FFT sizes, tone maps, pilot rules, and coding that are intentionally simplified here.

Radio foundation 5

The cyclic prefix makes delayed echoes manageable

An echo from the previous OFDM symbol can spill into the next one, creating inter-symbol interference. Before transmission, OFDM copies the end of each symbol and places that copy at the front. This guard interval is the cyclic prefix.

The receiver discards the prefix and takes the FFT over the useful interval. If the channel impulse response fits inside the prefix, the delayed copies do not contaminate that FFT window in the harmful way shown by the experiment. Mathematically, the prefix lets linear convolution act like circular convolution, so each subcarrier still sees approximately one complex gain. The tradeoff is airtime spent on repeated samples.

Set the echo delay above and below the guard interval in Playground 5. The boundary is idealized, but the reason guard intervals exist becomes visible.

Radio foundation 6

OFDM and OFDMA solve different problems

OFDM describes how one transmission uses many orthogonal subcarriers. In a conventional single-user OFDM PPDU, one station uses the allocated active subcarriers. Wi-Fi can also separate users spatially: 802.11ac introduced downlink MU-MIMO, in which different spatial streams serve multiple stations at once. Wi-Fi 6 adds OFDMA, which groups subcarriers into resource units and can schedule multiple stations within one PPDU.

OFDMA is therefore a multiple-access and scheduling mechanism built on OFDM. Resource units have standardized sizes and signaling; the proportional blocks in Playground 6 are a teaching model rather than an exact 802.11ax RU map. Switch modes and vary station demand to see the distinction.

Radio foundation 7

How the receiver estimates the channel

The receiver cannot decode an unknown data symbol until it has an estimate of the channel. Wi-Fi preambles include known training sequences. On one subcarrier, the useful model is:

• X[k] is the known transmitted training symbol.
• H[k] is the complex channel response.
• N[k] represents noise and unmodeled impairment.
• Y[k] is the complex value observed by the receiver.

Ignoring noise for a moment, the estimate isH-hat[k] = Y[k] / X[k]. Division by a complex number removes the known symbol's magnitude and phase. Practical receivers average training symbols, interpolate tones, and track later phase changes. Use Playground 7 to add noise and observe estimation error, especially during a deep fade.

Now the channel becomes CSI

A Wi-Fi receiver performs channel estimation so it can equalize and decode packets. Research-capable firmware or drivers can expose some of those per-subcarrier complex estimates asChannel State Information, or CSI. The exact values, scaling, tone selection, and metadata depend on the chipset and tool.

In an ideal physical MIMO model, each subcarrier has a channel matrix H[k] ∈ ℂ^(N_RX × N_TX), with one complex response for each receive and transmit spatial dimension. A real CSI tool may instead expose transmit antennas, space-time streams, receive chains, or an effective channel after spatial mapping and chipset processing. Across packets and subcarriers, a capture is therefore often stored as a tensor resemblingpacket × RX × TX-or-stream × subcarrier, but its axis meanings and order are tool-specific. Human motion alters some propagation paths, so that tensor evolves over time.

Playground 8 opens this tensor. Change packet, transmit stream, receive antenna, and subcarrier independently so the dimensions stop feeling abstract.

CSI is richer than RSSI

RSSI compresses received power into a coarse value for a packet or antenna chain. CSI preserves frequency-selective structure: one complex response per reported subcarrier and spatial link. Its magnitude is a relative measured channel gain, while its angle describes phase relative to the receiver's measurement reference. It is not automatically absolute propagation attenuation: AGC, RF/baseband gain, quantization, and tool-specific scaling can change the reported magnitude.

That detail matters indoors. Two subcarriers close in frequency can fade differently because delayed copies combine constructively at one frequency and destructively at another. Multiple receive antennas also observe different spatial mixtures of the same room.

Multipath turns displacement into a measurable change

The channel is a sum of paths. A compact frequency-domain model is:

Each path l has an amplitude a and delaytau. The exponential is a rotating complex vector, or phasor. When a person changes a reflected path's length, that phasor rotates. It then adds differently to the direct and static reflected paths, changing the measured CSI amplitude and phase.

The direct path and reflections from stationary walls and furniture usually form a strong H_static. Motion sensing tries to isolate the smaller H_dynamic created by a moving body, while rejecting noise and hardware variation that can resemble it.

At 5 GHz, a wavelength is only a few centimeters. Small movements can therefore produce substantial phase rotation. Use Playground 9 to move a reflector and watch the vector sum rather than imagining CSI as a photograph of the room.

Raw phase contains hardware error too

The previous model is clean. Commodity measurements are not. Packet synchronization and radio hardware add different kinds of error. Residual carrier-frequency offset and oscillator mismatch primarily create a packet-wide phase rotation that evolves over time. Sampling- frequency offset and packet-detection delay create an approximately linear phase slope across subcarrier index. PLL state and chipset processing can add further offsets, while AGC and RF/baseband gain mainly affect magnitude. Phase is also reported modulo 2π, creating apparent jumps.

Common processing includes phase unwrapping, removing a fitted linear trend, taking phase differences between antennas, or using conjugate multiplication between links. The correct choice depends on the hardware and the physical quantity the experiment needs.Sanitization does not magically recover absolute propagation phase.

Playground 10 deliberately mixes a small physical variation with a large linear error. Apply each step and notice both its benefit and what information it may discard.

Time reveals motion and Doppler

A single CSI snapshot says little about motion. The useful signal appears in a sequence of packets. For a person at positionP(t), the bistatic reflected path is the transmitter-to- person distance plus the person-to-receiver distance:

The minus sign follows one common convention: a shortening path has the opposite Doppler sign from a lengthening path. Some tools use the reverse sign, so magnitude and stated convention matter more than the label “positive.”

The geometry is bistatic: transmitter and receiver are usually in different places. Their angles relative to the moving body determine how body velocity becomes total path-rate dL/dt. A monostatic radar's familiar 2v/λ is only a special case.

Systems often remove static components, window the CSI time series, and use a short-time Fourier transform to expose Doppler energy. Slow periodic motion such as breathing, brief hand motion, and walking occupy different time-frequency patterns. Playground 11 also demonstrates why the packet rate must satisfy the sampling theorem.

Normal Wi-Fi traffic may arrive at irregular times, however, while an FFT or STFT assumes approximately uniform samples. A robust system uses controlled packet cadence or preserves timestamps and resamples or interpolates carefully. Packet loss and jitter are therefore signal-processing problems, not merely missing rows in a dataset.

From packets to a sensing decision

A practical pipeline is more than a neural-network classifier. It must control or observe packet timing, parse chip-specific CSI, reject damaged frames, align antenna streams, calibrate amplitude and phase, suppress static clutter, form temporal features, and estimate confidence.

1. Probe: produce enough decodable Wi-Fi frames at a known cadence.
2. Extract: retain timestamps, sequence numbers, channel configuration, antenna metadata, RSSI/AGC, and complex CSI.
3. Calibrate: scale, align, unwrap, reference, filter, and reject outliers according to the chipset.
4. Transform: build amplitude/phase time series, Doppler spectra, or learned representations.
5. Infer: detect change, classify an activity, and reject uncertain or out-of-domain input.

Experiment with those tradeoffs in Playground 12. It uses an explicitly illustrative score because no universal accuracy number survives a change of room, placement, hardware, people, or task.

From research CSI to standardized Wi-Fi sensing

Wi-Fi sensing began as research systems built around chipset-specific measurements and modified firmware. IEEE 802.11bf-2025 now standardizes MAC and PHY enhancements for WLAN sensing across HE, EHT, DMG, and EDMG operation. In practical terms, compatible devices can coordinate sensing measurements as an explicit WLAN operation instead of every experiment inventing its own traffic procedure.

Standardized sensing is not the same as universal raw CSI access. A laptop, phone, or browser may still expose no CSI at all. Hardware capability, firmware, drivers, operating-system APIs, vendor policy, and privacy controls determine what an application can actually measure.

Capturing CSI on real hardware

A normal browser or portable socket API does not expose CSI. The NIC, firmware, and driver must provide it. Two influential research paths make the hardware dependency concrete.

# after installing the supported driver and firmware
sudo ./log_to_file csi.dat

# after building and configuring Nexmon CSI
tcpdump -i wlan0 dst port 5500 -w csi.pcap

These commands show the final logging step, not a universal install recipe. Kernel, firmware, interface, channel, filter, and supported chipset requirements must match each project's documentation.

Motion, presence, gesture, and breathing are different problems

• Motion detection asks whether the channel changed beyond expected noise. It is usually the simplest target.
• Gesture recognition distinguishes time-frequency patterns and must generalize across people, positions, and rooms.
• Breathing sensing looks for tiny periodic movement and is sensitive to geometry, unrelated motion, and hardware drift.
• Static occupancy is harder than motion detection. A motionless person does not keep producing a strong changing path, so systems often depend on micro-motion or active changes.
• Multiple people create overlapping path changes and Doppler components, making attribution substantially harder.

Where systems fail

• Domain shift: moving furniture, changing device placement, or entering a new room changes the baseline channel.
• Traffic cadence: irregular packets produce irregular samples and can hide or alias motion.
• Interference: other transmitters, collisions, rate changes, and channel switching contaminate the stream.
• Automatic hardware behavior: AGC, antenna selection, beamforming, and firmware decisions can look like environmental changes.
• Geometry: motion perpendicular to sensitive path directions may create weak Doppler.
• Privacy: RF sensing can reveal activity without images. Deployment still requires consent, purpose limitation, and careful data retention.

The mental model to keep

CSI is the receiver's per-link, per-frequency complex description of a radio channel. Human movement perturbs some multipath components, causing structured changes over packets. A sensing system succeeds only when it captures those changes consistently, removes hardware artifacts without erasing the phenomenon, and separates the target from everything else that moves.

The most useful question is therefore not “Can Wi-Fi see a person?” It is: which propagation paths, at which packet cadence, under which geometry and calibration assumptions, contain enough stable information for this particular sensing task?

Primary references

• IEEE 802.11 Wireless LAN standards overview
• IEEE 802.11bf-2025: Enhancements for Wireless LAN Sensing
• MathWorks WLAN reference: legacy long training field and OFDM parameters
• MathWorks Communications reference: OFDM modulation and cyclic prefix
• Cisco technical overview of 802.11ax OFDMA and resource units
• Ma et al., WiFi Sensing with Channel State Information: A Survey
• Xiong et al., π-Splicer: Perceiving Accurate CSI Phases with Commodity Wi-Fi Devices
• Halperin et al., Linux 802.11n CSI Tool and tool-release materials
• Gringoli et al., Nexmon CSI and “Free Your CSI”
• Pu et al., WiSee: Whole-Home Gesture Recognition Using Wireless Signals
• Zheng et al., Widar 3.0: Zero-Effort Cross-Domain Gesture Recognition With Wi-Fi