nexmon-csi

Description

Nexmon is a C-based firmware patching framework for Broadcom Wi-Fi chips. The nexmon_csi extension (Gringoli, Schulz, Hollick et al. 2019) added per-frame CSI extraction on consumer-grade Broadcom radios, which crucially includes the chips inside the Raspberry Pi 3B+ / 4 (BCM43455c0), Nexus 5/6P, and ASUS RT-AC86U routers. This made CSI research possible on hardware costing one tenth of an Intel 5300 setup and unlocked 802.11ac (80 MHz, up to 256 subcarriers) extraction for the first time on commodity gear. Pragmatically tracked here as Hardware because almost every paper that says "Nexmon" means a specific chip + firmware combination.

Specs / capabilities

• 802.11ac on BCM4366c0 / BCM43455c0 (up to 80 MHz, 256 subcarriers)
• 802.11n on BCM4339 / BCM4358 / BCM43455c0 (up to 40 MHz, 128 subcarriers)
• Subcarrier complex CSI per frame, no decimation
• Runs in monitor mode without disconnecting the host
• Cross-compiled firmware patches (make-based build) deploy as .bin blobs

Tooling

• Nexmon framework: https://github.com/seemoo-lab/nexmon
• nexmon_csi: https://github.com/seemoo-lab/nexmon_csi
• Compatible boards: Raspberry Pi 3B+ / 4, ASUS RT-AC86U, Nexus 5 / 6P, Cypress EVK
• csikit and community Python parsers

Used by (papers)

• gringoli2019 — nexmon_csi release paper (Free Your CSI: A Channel State Information Extraction Platform for Modern Wi-Fi Chipsets)
• A large fraction of post-2019 CSI papers using Raspberry Pi or commodity routers as edge sniffers