Active Injection vs Passive Sniffing

Executive summary

The lab's crowd-sensing thesis wants to be passive: read the Wi-Fi packets that phones and laptops already send, instrument nobody. But passive capture inherits the arrival statistics of real traffic — bursty, on-off, with long idle gaps — instead of the steady metronome you get from active injection. Every Doppler / spectrogram feature the thesis uses silently assumes the samples are evenly spaced in time. This experiment asks whether that assumption survives real traffic: at the same average packet rate, does a bursty passive capture carry the same motion information as a smooth active one, or does the unevenness spread the motion signature into noise?

Stated honestly: the core experiment has not been run. No campaign in the vault yet varies arrival regularity at a fixed mean rate. What does exist is two sealed, real (simulated) campaigns on an adjacent axis — commodity-NIC hardware impairments (thermal noise, carrier offset, IQ imbalance) rather than arrival timing. Those two carry a finding that sharpens the stakes here: the very Doppler/phase feature EXP-008 wants to protect from burstiness is already fragile — the CSI Rician-K occupancy slope sign-flips even at a generous 30 dB SNR (c-csi-impairment-sim-to-real) — whereas a BLE RSSI anchor, a plain power read, keeps its occupancy ordering across the whole 5–40 dB range (c-ble-impairment-robustness). Both results are on a self-authored impairment prior with no figures rendered, so they are design inputs, not measured fidelity. The arrival-regularity question itself is laid out below as a plan, not a result.

The problem, in plain words

Think of a spectrogram as a set of evenly-spaced snapshots of a moving object. If someone walks past a Wi-Fi link, each snapshot catches the reflected signal at a slightly different phase, and stacking them reveals the walking speed as a Doppler shift. This only works if the snapshots are evenly spaced in time — like frames of a film shot at a steady 24 fps (yang2026_6c4f).

Now imagine the camera fires at random: three frames in a burst, then a two-second gap, then one frame, then nothing. Even if you took the same total number of frames over the minute, the motion is smeared — you cannot tell a fast walk from a slow one, because the timing between frames is all over the place. That is exactly what passive sniffing does to CSI: you only get a sample when some device happens to send a packet, and real network traffic is bursty. Active injection avoids this — you send your own probe packets on a fixed clock — but it means transmitting, which costs energy and is less "invisible" (sharma2024_c8a2 ↗).

The tempting shortcut is to spec capture by mean packet rate alone: "as long as I average 200 packets per second, I'm above the Nyquist limit, so I'm fine." This experiment tests whether that shortcut is a trap. If a bursty 200-Hz-mean stream loses the motion feature that a smooth 200-Hz stream keeps, then mean rate is not the spec — arrival regularity is a separate thing the thesis must measure and engineer for.

What we are trying to prove

Hypothesis (falsifiable). At a fixed mean rate R that comfortably clears the Nyquist bound, an active (uniform) capture yields a significantly higher motion-feature SNR than a passive (bursty) capture, because uneven sampling spreads the Doppler signature into spectral leakage. Concretely: the matched-mean active-vs-bursty difference is positive, grows with burstiness, and crosses a usability threshold at some idle-fraction / Fano factor.
What a null means. If active and bursty captures are statistically indistinguishable at matched mean rate across scenes and seeds, then mean PRR is a sufficient spec and passive deployment is viable wherever ambient traffic is dense enough — a positive result for the deployable stance. The hypothesis is only interesting because it can fail this way; the experiment is designed so the null is a clean, publishable finding, not an absence of one.
The mitigation fork. If burstiness does destroy the feature, a secondary question decides the engineering response: does a non-uniform-aware estimator (Lomb–Scargle / NUFFT) placed on the true sample times recover the active-capture feature SNR, or is light active-probe injection to fill the idle gaps the only fix? One answer says "redesign the feature"; the other says "you cannot be fully passive."

How the experiment works (plain method)

One physically-consistent master run. Reuse the single high-rate ray-traced CSI run from EXP-007 (coupled walk → Sionna Doppler-CFR). Because every arrival process is a resampling of the same underlying channel, arrival regularity is the only thing that varies — scene, walk paths, carrier, and motion ground truth are held identical.
Three arrival processes at each mean rate R ∈ {500, 200, 100} Hz: active (evenly spaced — the control), passive-Poisson (memoryless burstiness), and passive-onoff (dense bursts separated by idle gaps, sweeping burstiness from mild to severe). A fourth condition tests the W3 §4 gotcha of snapping bursty samples to a uniform grid instead of honouring their true times.
Fixed, dumb feature pipeline. The same spectrogram window and the same motion detector are applied to every arrival process, so any difference is about the data's information content, not model tuning — the feature pipeline follows the CSI-ratio / Doppler construction of wu2022_75d3 ↗ and the DFS/BVP features of zheng2019_5389 ↗.
Measure and sweep. Per (R, arrival process) record the Doppler feature SNR (motion-band energy vs leakage floor) and a fixed detection metric; sweep burstiness to find where it breaks; then, only if it breaks, probe the two mitigations against the active control.

What we've found so far (honest — the core axis is unrun)

The burstiness experiment itself has not executed. No vault campaign resamples a master run onto active vs passive arrival processes. The two campaigns attached to this umbrella live on the measurement- model axis (how a commodity NIC corrupts the sample values), not the sampling axis (how bursty timing corrupts the sample spacing). They are genuine, sealed, real-run sessions — reported here because they change the risk picture for EXP-008, not because they test it.

Adjacent campaign	Runs	What it actually varied	Real finding	Figures
c-csi-impairment-sim-to-real	13 (12 impaired + 1 clean control), sealed `01KTPNH0PV`	SNR {5,10,20,30} dB × CFO {0,2k,10k} Hz on a fixed scene	The impairment stage is correct + strictly additive, but the CSI occupancy signature is fragile: mean blockage attenuation halves (27.5 → 12.3 dB/person) and the Rician-K occupancy slope sign-flips (+10.12 → −2.40) even at SNR=30 dB. No defensible SNR capture budget is quotable (the brief's survival metric was non-monotone — an AWGN-shadow artifact). Verdict: transfer moves speculative → testable, but the result strengthens the case for real calibration.	none
c-ble-impairment-robustness	14 of 15 (one raced the attach), sealed `01KVWSXM8Q`	n_agents {4,8,12} × SNR {5..40} dB, `ble.enabled`, fixed phase-impairment base	The **BLE RSSI anchor's occupancy rank-correlation (	ρ

Why this matters for EXP-008: the feature this experiment wants to defend against bursty sampling is the Doppler/phase feature — and the adjacent evidence says that same phase feature is already the fragile one under commodity hardware, while amplitude/power reads are robust. So EXP-008's burstiness penalty stacks on top of an impairment penalty on the same signal. Both campaigns are self-authored impairment priors (IP-101 Q3=A) with zero rendered figures — per the 2026-07-15 integrity audit, a sealed verdict with no figure and a synthetic noise model is design-grade evidence only. The honest state of EXP-008 is: designed, motivated, and de-risked in premise — not executed.

The plan (what a run must deliver)

Outputs. dataset/exp008/arrival_traces/ (active / Poisson / on-off timestamp sets per R), feature_snr.csv (Doppler SNR + detection metric per condition), doppler/ spectra showing leakage under bursty arrivals vs clean active. Headline figure: feature SNR vs burstiness at matched mean rate. Mitigation figure: STFT-on-bursty vs NUFFT-on-bursty vs active control.
Primary analyses. (1) Matched-mean paired comparison (active vs on-off at equal R) with effect size and a paired test across scenes/seeds; (2) the burstiness threshold (idle fraction / Fano factor) at which passive feature SNR falls below usable; (3) the mitigation verdict.
Guardrails (campaign-rigor audit). Keep the detector fixed and dumb; validate the known doppler frame // n_sub alignment gotcha before trusting any SNR number; state that the mechanism (leakage from non-uniform sampling) is geometry-agnostic while the magnitude needs the hardware check.
The standing real-hardware gate. AX210 active injection vs monitor-mode sniff of genuine ambient traffic in the FIIT room, anchored against a public real-CSI set (meneghello2023_0a93 ↗, huang2025_060d). Required before any thesis claim leaves the simulator.

Review panel

Each voice is a prepared expert with a one-line stance and the literature it argues from. Verdicts are about this experiment's current state — a design with adjacent-axis evidence, not a completed run.

+ 📡 Field Scientist — *RF sensing physics & real deployments*

Stance: does bursty ambient sampling match how passive Wi-Fi sensing actually behaves? Yes — operational passive Wi-Fi radar already rides whatever the reference AP happens to transmit, and its literature is explicit that opportunistic, uneven illumination is the norm, not a corner case (li2022_4220 ↗; li2021_1875 ↗). Ambient traffic also self-interferes in ways that shift what you can sense (li2026_2b30). Ask: your on-off model is a tidy caricature; real traffic is heavy-tailed and correlated with the very people you are counting (more occupants → more packets). Model that coupling, or the passive arm looks worse than reality — or better. Verdict: premise is physically real; make the traffic model less polite.

+ 📊 Statistician — *design, power, inference*

Stance: I audit the design, and the design has a replication problem hiding in it. Resampling one master run means your "seeds" are draws of the arrival process, not independent physical realizations — the unit of replication is the scene/walk, and there is currently one (EXP-007's master). A paired test across arrival draws on a single scene will look powerful and generalize to nothing (peck2008_2ba0). Ask: pre-register ≥2 matched mean rates and multiple scenes/walks; report the matched-mean difference with a paired CI and a between-scene variance component; state the minimum detectable burstiness effect. Beware the multiplicity of the 3 rates × 3 processes × burstiness sweep. Verdict: promising, but scope the claim to the replication you actually have.

+ 🔴 Sim-to-Real Red-Team — *the professional sceptic*

Stance: assume this is a simulation artifact until a real capture says otherwise — and here the self-confirmation risk is unusually high. You resample your own master run onto your own Poisson draw and score it with your own detector: every degree of freedom is authored by the same hand. A clean "uniform beats bursty" on that sandbox is close to a tautology. Worse, the two campaigns hung on this umbrella do not test arrival regularity at all — they test SNR/CFO — so nothing sealed so far is evidence for the burstiness claim; do not let the card imply otherwise. Real ambient traffic is heavier-tailed and occupancy-coupled than Poisson, so the sim may understate the penalty. Ask: the only evidence that counts is an AX210 monitor-mode sniff of real traffic vs an active AX210 probe in the same room, cross-checked against a public real-CSI set (huang2025_060d; meneghello2023_0a93 ↗). Verdict: until then, this is a constructible claim, not a measured one — keep it out of any paper's results.

+ 🔧 Deployment Practitioner — *would this survive a real install?*

Stance: I mount the NIC and answer the ticket, and this experiment decides my whole architecture. If bursty passive loses the feature, "just be passive" dies and I need either active probing (energy, RF footprint) or a co-located anchor. The good news from the adjacent BLE campaign is that a cheap BLE/RSSI anchor is impairment-robust and pairs naturally with packet-capture occupancy (longo2019_b72f; sharma2024_c8a2 ↗). Ask: give me the real number — what is the actual CSI arrival rate and burstiness off an AX210 in monitor mode in a normal office, per hour of day? That single measurement tells me whether passive is even on the table before any of the modelling matters. Verdict: highest-value next step is a half-day of real arrival-trace logging, not more sim.

+ 📶 Standards / Protocol Engineer — *is there a spec-level escape hatch?*

Stance: the whole active-vs-passive dilemma is precisely what IEEE 802.11bf was standardized to dissolve — it defines a sensing measurement procedure with scheduled sounding, so a compliant AP delivers regularly-spaced CSI without you injecting your own probes or scavenging ambient traffic (ropitault2024_d49d; du2025_5663). Ask: add 802.11bf-style scheduled sounding as a fourth arrival process — it is the uniform ideal but obtained without transmitting sensing data, and it is where commodity hardware is heading. If the thesis targets 2027+ deployments, "bursty passive" may be a problem the standard already retires. Verdict: frame active/passive as two of three options; the standardized third may be the real answer.

Key references

sharma2024_c8a2 ↗ — the ambient-traffic passive stance whose burstiness this quantifies.
li2022_4220 ↗, li2021_1875 ↗ — operational passive Wi-Fi radar riding opportunistic, uneven illumination.
li2026_2b30 — ambient-traffic interference on CSI sensing.
yang2026_6c4f, wu2022_75d3 ↗, zheng2019_5389 ↗, wang2015_48cf ↗ — the Doppler/DFS feature pipeline that assumes regular sampling.
ropitault2024_d49d, du2025_5663 — the standardized scheduled-sounding escape hatch.
longo2019_b72f — the deployment-side packet-capture occupancy baseline.
peck2008_2ba0 — the design/replication reference for the matched-mean paired comparison.
huang2025_060d, meneghello2023_0a93 ↗ — public real-CSI anchors for the standing hardware gate.
guarino2026_e72c ↗, zhang2026_ccac — the reproducibility bar the SWE voice invokes.

Active Injection vs Passive Sniffing

Environment