How can plain Wi-Fi see you move through a wall? - Paul Herrmann

Where I know this from RWTH course Seminar "Current Trends in Wireless Communications" by Prof. Dr.-Ing. Marina Petrova at RWTH Aachen (winter 2025/26), plus my wireless-communications coursework on OFDM, channel estimation, equalization, and synchronization from the course "Signal Processing for Mobile Communications" by Prof. Dr. Haris Gačanin<br>Hobby project CSI-Toolkit, my open-source pipeline for CSI collection and activity recognition on the ESP32-C6<br>Own research Own reading while writing this: the IEEE 802.11bf-2025 amendment and the Du et al. WLAN-sensing survey, the Wi-Fi Alliance device figures, and prior ESP32 CSI work by Hernandez and by Strohmayer & Kampel (links inline)<br>For my seminar this term I put two tiny chips in my living room. One does nothing but shout the same Wi-Fi frame a hundred times a second. The other one listens, and forwards what it hears to my laptop over USB. No camera, no microphone, no motion sensor. Two microcontrollers you can buy for a few euros each.<br>With that, a completely ordinary machine-learning classifier could tell whether the room was empty, whether someone was walking near the line between the two chips, or whether someone was walking in the far corner. In the clean case it got that right every single time. Then I moved the listener behind a drywall partition so it could no longer “see” the room directly, and it still worked, just not that precisely.<br>That sounded like magic to me when I started, and the point of this post is that it is not. It is a fairly clean tour through how radio actually works, so it got long. Every section builds up the concept it needs before using it, and you can stop after any of them and walk away with a correct, just less detailed, picture.<br>The short answer<br>Here is the whole idea in one paragraph, and if you read nothing else, this is the honest version.<br>Your Wi-Fi devices cannot decode a packet without first figuring out what the wireless path did to the signal on its way over. A radio signal does not travel in a single straight line from sender to receiver. It bounces off walls, furniture, and people, and arrives as a sum of many delayed, weakened copies of itself. To reconstruct the bits, the receiver has to estimate this distortion for every packet and mathematically undo it. That estimate is a surprisingly detailed description of every path the signal took through the room, and it has a name: Channel State Information , or CSI. It is computed purely as a means to an end, decoding data, and then normally thrown away. It usually never leaves the RF-chip.<br>The trick of Wi-Fi sensing is to keep it. When you move through the room, you change which paths exist and how long they are, so the CSI changes with you. Record how it wiggles over time, hand those wiggles to a classifier, and you get “someone is walking in the kitchen” out of a signal that was only ever meant to carry your Netflix stream.<br>Everything below is just making each piece of that paragraph real: what “the room did to the signal” means precisely, why the receiver computes it, and why it turns out to be such a good fingerprint of what is moving.<br>How do bits even ride on a radio wave?<br>To understand what CSI is, I first need to build up what “the signal” is in the first place, because CSI is a statement about how one specific kind of signal got mangled.<br>Start with the wave itself. An antenna is just a piece of metal in which we push electrons back and forth. Wiggle them at a steady rate and they radiate an electromagnetic wave at that frequency: a clean sine wave, oscillating billions of times per second for Wi-Fi (2.4 or 5 GHz). On its own, a pure sine wave carries no information. It is the same forever, so there is nothing to read off it. This bare, information-free wave is called the carrier .<br>To send data, you have to disturb the carrier in a way the receiver can measure. That disturbance is modulation . You can vary the wave’s amplitude (how strong it is), its phase (where in its up-down cycle it is at a given instant), or both at once. The receiver compares what arrives against the steady carrier it expects and reads the data out of the difference.<br>The clever part is that you do not send one bit at a time. You define a small set of allowed (amplitude, phase) combinations, and each one stands for a specific bit pattern. One such combination is a symbol . If you allow 16 distinct amplitude-and-phase points, each symbol picks one of 16 possibilities, which is 4 bits. This scheme is called QAM (quadrature amplitude modulation), and you can picture its symbols as dots arranged in a grid on a 2D plane: the horizontal axis is “how much cosine”, the vertical axis is “how much sine”, and together they encode amplitude and phase as a single point. 16-QAM is a 4x4 grid, 256-QAM is a 16x16 grid packing 8 bits per symbol. The receiver’s job for each symbol is to look at where the incoming point landed and decide...