ESP32 as a WiFi Sniffer/Deauth Detector

What This Covers vs the Flipper WiFi Guides

This is the DIY equivalent of Flipper's WiFi Dev Board Marauder functionality, but running directly on a plain ESP32 dev board — genuinely useful as a cheap, purpose-built, always-on sensor rather than a handheld tool, e.g. a dedicated deauth-detection sensor mounted permanently near your router.

Same Legal Rules Apply

Passive sniffing/monitoring of your own network is legitimate; deploying this against networks you don't own or lack authorization to test is not — see the Flipper Marauder guide's legal section, the same rules apply regardless of which hardware you're using.

Enabling Promiscuous Mode

#include <WiFi.h> #include <esp_wifi.h> void snifferCallback(void* buf, wifi_promiscuous_pkt_type_t type) { wifi_promiscuous_pkt_t* pkt = (wifi_promiscuous_pkt_t*)buf; // pkt->payload contains the raw 802.11 frame // pkt->rx_ctrl.rssi gives signal strength } void setup() { WiFi.mode(WIFI_MODE_NULL); // don't connect normally — we want raw capture esp_wifi_set_promiscuous(true); esp_wifi_set_promiscuous_rx_cb(&snifferCallback); }

Promiscuous mode captures raw 802.11 frames on the current channel — you're seeing management/control/data frame headers regardless of which network they belong to (same passive visibility as beacon/probe sniffing covered in the Flipper guide — this is standard WiFi behavior, not a special exploit).

Detecting Deauth Frames Specifically

void snifferCallback(void* buf, wifi_promiscuous_pkt_type_t type) { wifi_promiscuous_pkt_t* pkt = (wifi_promiscuous_pkt_t*)buf; uint8_t frameType = pkt->payload[0]; if (frameType == 0xC0) { // deauth frame subtype Serial.println("Deauth frame detected!"); // trigger alert — MQTT publish, buzzer, LED, HA webhook, etc. } }

Channel Hopping for Full Coverage

A fixed ESP32 only sees traffic on its current WiFi channel — for full coverage, cycle through channels periodically:

void hopChannel() { static uint8_t channel = 1; esp_wifi_set_channel(channel, WIFI_SECOND_CHAN_NONE); channel = (channel % 13) + 1; // cycle 1-13 }

Call this on a timer (every second or two) if you want broad coverage rather than monitoring one specific known channel where your own AP operates.

Building a Real Alert System

Rather than just Serial.println, wire detection events into MQTT (publish to a topic Home Assistant subscribes to) for a genuinely useful always-on security sensor — "deauth attack detected near [location]" as a real HA notification, correlated with the PMF/802.11w testing covered in the Flipper deauth defense guide to confirm your actual network is resistant even while this sensor confirms attempts are happening.

Why a Dedicated Sensor Beats Occasional Handheld Checks

Deauth attacks (when they happen) are typically brief — a handheld tool only catches them if you happen to be actively monitoring at that exact moment. A permanently-deployed ESP32 sniffer catches and logs events continuously, giving you an actual historical record rather than a one-time spot check.