Sensors
Compare sensor boards
Which board for which job, and what limits each one.
A capture passes through five stages: the radio hears the frames, the host bus carries them to the processor, memory holds them, storage saves them, and a link sends them to your phone or analyser. A job runs out at its narrowest stage, and that stage differs from job to job.
Each board, stage by stage
Read across a row to see a board from radio to link. Scroll the table sideways on a phone.
How sure each number is: measuredspecqualifiedexpectedunknown
Measured on our hardware; from the maker’s spec; what WLAN Commander has qualified so far; expected from the same part measured elsewhere; or not known yet.
| Board | Radio | Host bus | Memory | Storage | Link out |
|---|---|---|---|---|---|
| NanoPi Zero2 | QCNCM865 or BE200, 2×2160 MHz measured with the QCNCM865; the BE200 captured 320 MHz frames here in a manual testmeasured / expected | PCIe 2.1 ×1 · 5 GT/sAbout 3.2 Gb/s of real traffic. One USB 2.0 port (480 Mb/s)spec | 1 or 2 GB2 GB tested; capture peaked at 281 MBmeasured | microSD · 12–22 MB/sWrites on two cards we measured; depends on the card. The slot reads at 67–70 MB/smeasured | 1 GbE · USB 2.0Ethernet verified at 1000 Mb/s. USB-C: 480 Mb/s, about 300 Mb/s as a network link (estimate)measured / spec |
| Raspberry Pi 5 | QCNCM865 on an M.2 HAT320 MHz measured. USB adapters also workmeasured | PCIe 2.0 ×1 · 5 GT/sMeasured. 3.0 (8 GT/s) is possible but not set by the image. Two USB 3.0 ports (5 Gb/s)measured / spec | 1 to 16 GBDepends on the model; our unit not recordedspec | microSD · 10–30 MB/sPromised writes by card class (U1/V10 to U3/V30). The slot runs SDR104 (104 MB/s bus)spec | 1 GbENot measured at high ratesspec |
| Raspberry Pi 4 / WLAN Pi R4 | USB adapters onlyMT7925U: 160 MHz measured; its driver never offers 320measured | USB 3.0 · 5 Gb/sBoth USB 3.0 ports share one PCIe 2.0 ×1 link (about 4 Gb/s). Adapter linked at 5 Gb/sspec / measured | 1 to 8 GBDepends on the model; our unit not recordedspec | microSD · 10–30 MB/sPromised writes by card class (U1/V10 to U3/V30). The slot runs DDR50 (50 MB/s bus)spec | 1 GbENot measured at high ratesspec |
| WLAN Pi Pro | Two BE200, 2×2 each320 MHz expected (the same card captured 320 MHz frames on a NanoPi’s Gen2 link); the app offers 160 MHz todayexpected | PCIe 2.0 ×1 · sharedBoth cards share one 5 GT/s lane, about 4 Gb/sspec | 8 GB on the tested unitA CM4 can be 1, 2, 4 or 8 GBmeasured / spec | SD · 10–30 MB/sThe tested unit is a CM4 Lite. Promised writes by card class; the slot runs DDR50 (50 MB/s bus)spec | 1 GbE with PoE inNot measured at high ratesspec |
| WLAN Pi Go | BE200, 2×2320 MHz on 6 GHz tuned on this link; the same card captured frames at 320 on a NanoPi’s Gen2 link; the app offers 160 MHz todaymeasured | PCIe 2.0 ×1 · 5 GT/sMeasured. The card itself can do 16 GT/smeasured | 1 GB stock8 GB on an upgraded CM4spec / measured | eMMC · 8 GB stock32 GB on an upgraded CM4; write speed not measuredspec / measured | USB 2.0 only · 480 Mb/sUSB-C OTG, measured at High-Speed. No Ethernetmeasured |
| ESP32-C5 | Built-in, 1×12.4 and 5 GHz, 20 or 40 MHzspec | On-chipspec | On-chipFrames batched in a ring bufferspec | Nonespec | Bluetooth LE · 45 kb/sMeasured to a phonemeasured |
| GL.iNet Mudi 7 | WCN7850, 2×2Does 320 MHz on a Pi 5; WLAN Commander’s Mudi driver is qualified at 20 MHzqualified | Built inspec | Not recordedunknown | Not usedCaptures stream to the phonequalified | USB-C or EthernetNot measuredunknown |
| GL.iNet Slate 7 Pro | MT7990, tri-band320 MHz on 6 GHz in stock use. Qualified capture: 20 MHz on 2.4/5 GHz on stock firmware, 80 MHz on 5 GHz on the WLAN Commander imagequalified | Built inOne USB 3.2 Gen 1 (5 Gb/s) portspec / measured | 1 GB121–160 MB free with the kiosk runningmeasured | 512 MB NANDThe Debian image runs from a USB stickspec | EthernetNot measuredunknown |
| Ubiquiti AirWire | Two QCN9224, 2×2 each5 GHz up to 240 MHz and 6 GHz up to 320 MHz (Ubiquiti spec); no capture at those widths recorded yetspec | Built inspec | 1 GBAbout 790 MB free after radio firmwaremeasured | 4 GB eMMCmeasured | USB-C Ethernet · 4.2 Gb/sMeasured outbound at 5GBASE-Tmeasured |
From the radio to your file
Six common jobs, each followed from the air to the saved file. The red stage is where the job runs out. The tags show what software does about it, and at which stage.
Full capture, streamed to a phone over USB
The USB link is the limit. Turn on Headers Only, or choose Save on Remote and download afterwards.
- Radio1.5–2.2 Gb/sA saturated 2×2 160 MHz channel (estimate)
- Host bus3.2 Gb/sPCIe 2.0 or 2.1 ×1. Room to spare
- ProcessorNot measuredCopies every frameHeaders Only: about 150 bytes per frame, not up to 11,000
- MemoryHolds burstsWhile the link catches upBuffer bursts (in development)
- Link out≈300 Mb/sUSB 2.0 network linkSave on Remote takes this link out of the path
- PhoneUSB 2.0USB 3 only on iPhone 15 Pro and later Pro models
Full capture saved on the sensor
The SD card is the limit. Use Headers Only, or stream over Ethernet instead.
- Radio450 Mb/sFrames on the air (measured)
- Host bus3.2 Gb/sPCIe 2.1 ×1
- ProcessorUnder investigationOne capture lost half its frames at about 1,700 frames/s, even writing to RAMHeaders Only: a few MB/s instead of 56
- Memory141 MiB queuedWaiting to be written (measured)Buffer bursts (in development): rides out a burst, not a steady rate
- Storage14.7 MB/s ≈ 118 Mb/sNeeded 56 MB/s. 5,358 frames dropped in 62 sA faster card, benchmarked; the label is only a minimum
- Link outNot usedNothing leaves while capturing
Full capture over Gigabit Ethernet
A typical busy channel fits. A saturated wide channel is more than Gigabit Ethernet carries.
- Radio1.5–2.2 Gb/sA saturated 2×2 160 MHz channel (estimate)
- Host bus3.2 Gb/sPCIe 2.x ×1, or USB 3.0
- ProcessorNot measuredAt this rateHeaders Only
- MemoryHolds burstsWhile the link catches upBuffer bursts (in development)
- Link out≈940 Mb/sGigabit Ethernet
- AnalyserLaptopWireshark or PCAPAI
320 MHz on a PCIe 2.0 board
A quiet 320 MHz channel works. A saturated one overruns the bus, and frames drop before software sees them.
- Radio3–4.5 Gb/sSaturated 2×2 320 MHz channel; 5.76 Gb/s PHY rate (estimate)A quiet channel fits; 160 MHz halves the load
- Host bus3.2 Gb/sPCIe 2.0 or 2.1 ×1Headers Only cannot help: frames cross the bus whole and are trimmed afterPCIe 3.0 doubles the room: a Pi 5 setting, not tested
- ProcessorNot measuredAt this rate
- MemoryAs above
- Storage or linkLower stillEvery limit in the diagrams above applies
Header-only capture
Every stage has room. Most roaming, retry and management-frame analysis needs only the headers.
- Radio10,000 frames/sA busy channel
- Host busFull framesAs above
- Processor≈12 Mb/sEach frame trimmed to 128 bytesHeaders Only keeps the 802.11 headers and information elements
- MemorySmall
- Storage or linkRoom to sparemicroSD, USB 2.0 and Ethernet all cope
Bluetooth sensor
Bluetooth is the limit by a factor of thousands. Use it for surveys and management frames, not payloads.
- Radio1×1, 20/40 MHz2.4 or 5 GHz
- ProcessorOn the chipFilters frame types and batches themThe board’s frame filter, set from the app, sends only what you need
- Link out≈45 kb/sBluetooth LE (measured)
- PhoneSaves
Which board for which job
A Limited rating names the stage that limits it. Not yet supported means the hardware can do it and WLAN Commander does not offer it yet. We have not yet measured complete captures end to end on every board; a field test is planned for when capture buffering ships.
| Board | Scans and walking surveysBeacons and headers only. Every board can; what differs is power and carrying. | Header-only captureThe first 128 bytes of each frame (the app's headers-only option). Small enough for any link except Bluetooth. | Full capture saved on the sensorEvery frame written to the sensor's own storage. Storage write speed is usually the limit. | Full capture streamed liveEvery frame sent to the phone or analyser as it arrives. The link out is usually the limit. | 320 MHz channelsRadio, driver and the app all have to allow it. | Two channels at onceTwo radios on different channels, sharing the host's bus. | Unattended and PoELeft running on one cable. |
|---|---|---|---|---|---|---|---|
| NanoPi Zero2 | Good fitSmall and USB-C powered | Good fitAny link copes | LimitedmicroSD writes 12–22 MB/s, about 100–175 Mb/s of frames | Limited1 GbE copes; the USB 2.0 link (480 Mb/s) is the tighter one | Not measuredThe BE200 captured 320 MHz frames on this board in a manual test; the app offers 160 MHz today. The QCNCM865 has not yet run 320 here | LimitedOne M.2 card plus one USB 2.0 adapter | Good fitEthernet, with PoE through a USB-C splitter (used in our testing) |
| Raspberry Pi 5 | LimitedNeeds mains or a large power bank | Good fitAny link copes | LimitedSD card writes: 10 MB/s (U1/V10) to 30 MB/s (V30) promised, about 80–240 Mb/s of frames. A busy full capture can need 56 MB/s | Not measured1 GbE; not measured at high rates | Good fit320 MHz measured with a QCNCM865 | Not measuredPCIe card plus USB 3 adapters; not measured together | LimitedEthernet; PoE needs an untested HAT |
| Raspberry Pi 4 / WLAN Pi R4 | LimitedNeeds mains or a large power bank | Good fitAny link copes | LimitedSD card writes: 10 MB/s (U1/V10) to 30 MB/s (V30) promised, about 80–240 Mb/s of frames. A busy full capture can need 56 MB/s | Not measured1 GbE; not measured at high rates | Not suitedUSB adapters: the mt7925 driver never offers 320 MHz | Good fitTwo USB adapters measured for an hour with no drops | LimitedEthernet; PoE needs an untested HAT |
| WLAN Pi Pro | Good fitBattery-backed and self-contained | Good fitAny link copes | LimitedSD card writes: 10 MB/s (U1/V10) to 30 MB/s (V30) promised, about 80–240 Mb/s of frames. A busy full capture can need 56 MB/s | Not measured1 GbE; not measured at high rates | Not yet supportedThe BE200 captures at 320 MHz on a Gen2 link (tested on a NanoPi); the app offers 160 MHz today | Good fitTwo BE200s for an hour with no drops; they share one PCIe lane and run hot | Good fitPoE with battery backup |
| WLAN Pi Go | Good fitPocket-sized, one USB-C cable | Good fitAny link copes | Not measuredeMMC write speed not measured | LimitedUSB 2.0 (480 Mb/s) is the only link out | Not yet supported320 MHz tuned on this board and captured with the same card on a NanoPi; the app offers 160 MHz today | Not suitedOne radio | Not suitedNo Ethernet |
| ESP32-C5 | Good fitPocket-sized, Bluetooth to the phone | LimitedBluetooth carries about 45 kb/s; frames are truncated | Not suitedNo storage | Not suitedPayloads are truncated; no handshakes | Not suited20/40 MHz chip limit | Not suitedOne radio | Not suitedStreams to a phone |
| GL.iNet Mudi 7 | Good fitTravel router with cellular built in | Good fitStreams to the phone | Not suitedSaving on the router is not offered | Not measuredUSB-C or Ethernet; not measured | Not yet supportedThe WCN7850 does 320 MHz on a Pi 5; the Mudi driver is qualified at 20 MHz | Not suitedOne capture radio; the hotspot pauses | Not suitedPhone-driven |
| GL.iNet Slate 7 Pro | Good fitA router you may already carry | Good fitStreams over Ethernet | Not suited512 MB NAND; saving on the router is not qualified | Not measuredEthernet; not measured | Not yet supported6 GHz runs 320 MHz in stock use; capture qualified at 20 MHz (stock) or 80 MHz (our image) | Not yet supportedThree radios in hardware; capture uses one at a time | LimitedEthernet; capture qualification is narrow |
| Ubiquiti AirWire | LimitedNeeds 15 W USB-C power; no 2.4 GHz | Good fitAny link copes | Not measured4 GB eMMC; not measured | Good fitUSB-C Ethernet measured up to 4.2 Gb/s outbound | Not measured320 MHz on 6 GHz is Ubiquiti’s spec; no capture at 320 recorded yet | Good fit5 and 6 GHz radios at once | LimitedUSB-C powered; tested on one unit |
What you can buy
The same board comes in versions, and some change the numbers above. SD card speed depends on the card you buy, not the board.
| Board | Part | What you can buy | What it changes |
|---|---|---|---|
| NanoPi Zero2 | Memory | 1 GB or 2 GB | Capture peaked at 281 MB, so 1 GB runs every job. More memory rides out longer bursts once capture buffering ships. |
| NanoPi Zero2 | Storage | microSD, any size from 8 GB; no eMMC | Write speed depends on the card you buy, not the board. Benchmark it; see the build guide. |
| NanoPi Zero2 | Wi-Fi card | Qualcomm QCNCM865 (preferred) or Intel BE200 | Both are 2×2 Wi-Fi 7 cards that tune 320 MHz. The comparison page explains what a PCIe 2.x link changes for the Intel card. |
| NanoPi Zero2 | Power | USB-C supply, or PoE through a USB-C splitter | The splitter occupies the USB-C port; a USB-C one-to-two adapter keeps the laptop link. |
| Raspberry Pi 5 | Memory | 1, 2, 4, 8 or 16 GB | Any model runs the image. More memory means longer bursts held once capture buffering ships. |
| Raspberry Pi 5 | Storage | microSD | Write speed depends on the card. The M.2 HAT carries the Wi-Fi card, so it is not free for an NVMe drive. |
| Raspberry Pi 5 | Wi-Fi card | QCNCM865 on an M.2 HAT, or USB 3 adapters | The PCIe card tuned 320 MHz here. USB adapters top out lower; see the MediaTek note. |
| Raspberry Pi 5 | PCIe speed | 2.0 (5 GT/s) as shipped; 3.0 (8 GT/s) by firmware setting | Gen3 is the only board here with room for a busy 320 MHz channel. Raspberry Pi does not certify it, and we have not tested it. |
| Raspberry Pi 5 | Power and PoE | USB-C 5 V / 5 A supply; PoE through an add-on HAT | We have not tested a PoE HAT with the image. |
| Raspberry Pi 4 / WLAN Pi R4 | Memory | 1, 2, 4 or 8 GB | Any model runs the image. More memory means longer bursts held once capture buffering ships. |
| Raspberry Pi 4 / WLAN Pi R4 | Storage | microSD | Write speed depends on the card. |
| Raspberry Pi 4 / WLAN Pi R4 | Wi-Fi | USB adapters only | Plug them into the blue USB 3.0 ports. Two adapters share one 5 Gb/s controller link. |
| Raspberry Pi 4 / WLAN Pi R4 | Power and PoE | USB-C 5 V / 3 A supply; PoE through an add-on HAT | We have not tested a PoE HAT with the image. |
| WLAN Pi Pro | Compute module | CM4 with 1, 2, 4 or 8 GB of memory, and no eMMC (Lite) or 8, 16 or 32 GB | The tested Pro has 8 GB and boots from SD, which means a CM4 Lite. Check yours before writing the image. |
| WLAN Pi Pro | Storage | SD on a CM4 Lite, or the CM4’s eMMC | SD write speed depends on the card. |
| WLAN Pi Go | Compute module | Stock: CM4 with 1 GB and 8 GB eMMC. Upgradable to any CM4 (up to 8 GB memory, 32 GB eMMC) | Our upgraded Go has 8 GB and 32 GB. More eMMC holds longer Save on Remote captures; more memory rides out longer bursts once buffering ships. |
| WLAN Pi Go | Storage | eMMC only | Fixed by the compute module; write speed not measured. |
What software does about it
- Headers Only (128 bytes). Keeps each frame’s 802.11 header and information elements, a small fraction of the data. It trims after the host bus, so it cannot help a saturated bus.
- Save on Remote. The sensor writes the file itself, so the link to the phone is out of the path while capturing. Storage write speed sets the limit instead.
- A narrower channel plan. Fewer channels and longer dwell mean less to carry and more of what you care about.
- Buffer bursts in memory (in development). Hold a burst in RAM and send it on at the link’s pace. More memory rides out longer bursts.
How long a buffer could last, by arithmetic only: a 450 Mb/s burst, the rate measured in the NanoPi storage test, arriving faster than it drains. Free memory figures are assumptions; buffering has not shipped.
| Draining to | 1 GB board (about 0.5 GB free) | 2 GB board (about 1.5 GB free) | 8 GB board (about 6 GB free) |
|---|---|---|---|
| microSD at 15 MB/s | about 12 s | about 36 s | about 2.4 min |
| USB 2.0 network link, about 37 MB/s | about 26 s | about 78 s | about 5.2 min |
Reference
Link ceilings
Read the version, not the connector. USB 3.0, USB 3.1 Gen 1 and USB 3.2 Gen 1 are three names for the same 5 Gb/s link; USB 3.1 Gen 2 and USB 3.2 Gen 2 are the same 10 Gb/s link. A USB-C port says nothing about speed: the NanoPi’s and the WLAN Pi Go’s are USB 2.0. PCIe 2.0 and 2.1 run at the same 5 GT/s.
| Link | Ceiling | Where it applies |
|---|---|---|
| PCIe 2.0 or 2.1 ×1 (5 GT/s) | About 4 Gb/s after 8b/10b encoding; about 3.2 Gb/s of real traffic (estimate). 2.1 adds features, not speed | NanoPi Zero2 (2.1); the CM4 in the WLAN Pi Go and Pro (2.0); Pi 5 as shipped (2.0); the Pi 4’s USB controller (2.0) |
| PCIe 3.0 ×1 (8 GT/s) | About 7.9 Gb/s after 128b/130b encoding; about 6.5 Gb/s of real traffic (estimate) | Pi 5 only, by a firmware setting; the image does not set it |
| USB 2.0 High-Speed | 480 Mb/s signalling; about 300 Mb/s as a USB network link (estimate) | NanoPi USB-A and USB-C; WLAN Pi Go USB-C; most phones |
| USB 3.0 (also named USB 3.1 Gen 1 and USB 3.2 Gen 1) | 5 Gb/s signalling; about 4 Gb/s after encoding, 3.2 to 3.5 Gb/s in practice | Pi 4 and Pi 5 blue ports; Slate 7 Pro |
| USB 3.1 Gen 2 (also named USB 3.2 Gen 2) | 10 Gb/s signalling; not measured with WLAN Commander | iPhone 15 Pro and later Pro models (Apple lists “USB 3, up to 10 Gb/s”) |
| Gigabit Ethernet | 1 Gb/s; about 940 Mb/s of payload | NanoPi, Pi 4 and Pi 5, WLAN Pi Pro |
| Bluetooth LE | About 45 kb/s measured from an ESP32-C5 to a phone | ESP32-C5 |
Your phone is a stage too. Only iPhone 15 Pro and later Pro models have USB 3 on their USB-C port. Other USB-C iPhones, every Lightning iPhone and many Android phones run at USB 2.0, so a stream to them is capped near 300 Mb/s, whatever the sensor supports.
Wi-Fi rates by width and MCS
The most a 2×2 Wi-Fi 7 radio can be sent at each width (standard 802.11be PHY rates, 0.8 µs guard interval; not measurements). Real traffic on a busy channel is roughly half to three-quarters of these.
| Channel width | MCS 9 (256-QAM) | MCS 11 (1024-QAM) | MCS 13 (4096-QAM) |
|---|---|---|---|
| 20 MHz | 229 Mb/s | 287 Mb/s | 344 Mb/s |
| 40 MHz | 459 Mb/s | 574 Mb/s | 688 Mb/s |
| 80 MHz | 961 Mb/s | 1.20 Gb/s | 1.44 Gb/s |
| 160 MHz | 1.92 Gb/s | 2.40 Gb/s | 2.88 Gb/s |
| 320 MHz | 3.84 Gb/s | 4.80 Gb/s | 5.76 Gb/s |
Intel cards on a PCIe 2.0 link
Intel’s Linux driver checks how fast the BE200’s PCIe link trained. Below 8 GT/s (PCIe 3.0), which is every board here except a Pi 5 set to Gen3:
- As a client, the BE200 stops advertising MCS 10 to 13 at 320 MHz, so it tops out at MCS 9: a 3.84 Gb/s PHY rate at 2×2. Narrower widths are unchanged.
- In monitor mode it still captures at 320 MHz. A BE200 on a NanoPi’s PCIe 2.1 link recorded 802.11 frames on a 320 MHz channel in 6 GHz, and one on a WLAN Pi Go’s Gen2 link tuned 320 MHz. We have not yet checked that frames sent at MCS 12 and 13 decode on that link.
- Older kernels were stricter. Linux 6.5 to 6.14 removed 320 MHz entirely on a slow link, which is why earlier tests said a BE200 could not do 320. The boards we tested run newer kernels.
- The app offers up to 160 MHz on Intel cards today. Lifting that limit is planned for a later release.
Qualcomm’s driver (ath12k, for the QCNCM865) has no such check, and the card tunes 320 MHz. MediaTek’s MT7925 never offers 320 MHz in its driver; only the newer MT7927 does.
Capture modes and what they cost
The names are the labels in the app’s capture settings.
| Mode | What you get | What it costs |
|---|---|---|
| Scan | Beacons and probe responses, decoded into networks | Tiny. Any board and any link, Bluetooth included |
| Headers Only (128 bytes) | Every frame’s 802.11 header and information elements; payload dropped | About 150 bytes a frame, after the host bus |
| Full frames | Every byte of every frame, including data payloads | Up to about 11,000 bytes a frame; every stage carries it |
| Stream to Device | The file is written on the phone as frames arrive | The link out and the phone are in the path |
| Save on Remote | The file is written on the sensor; download it afterwards | Storage write speed is in the path instead of the link |
| Channel Hopping | Visits each channel in the plan for its dwell time | Less per channel; frames on other channels are missed while away |
| Two radios | Each radio on its own channel | Both share the host bus; on a WLAN Pi Pro, one PCIe 2.0 lane |
Storage and SD cards
A busy 2.4 GHz capture wrote about 0.8 MB/s. About 450 Mbit/s of frames is 56 MB/s of writes, several times what the microSD cards we measured sustain (12 to 22 MB/s). When writes fall behind, frames drop. The measurements are in the storage field note and the NanoPi build guide.
On boards with an SD card, the card usually sets the write speed. The markings below are minimums from the SD Association; a card can beat its rating. The two cards we measured on the NanoPi wrote 12.1 and 21.7 MB/s, so benchmark a card before trusting it with full captures. Board slots: the NanoPi’s reads top out at 67 to 70 MB/s (measured); the Pi 5 runs SDR104 (104 MB/s bus); the Pi 4 and the CM4 run DDR50 (50 MB/s bus).
| Marking on the card | Promised sustained write | What it means for capture |
|---|---|---|
| Class 10, U1 or V10 | At least 10 MB/s | About 80 Mb/s of frames |
| U3 or V30 | At least 30 MB/s | About 240 Mb/s. The NanoPi build guide’s minimum |
| V60 | At least 60 MB/s | About 480 Mb/s. Mostly UHS-II cards; every board here has a UHS-I slot, where the rating may not hold |
| V90 | At least 90 MB/s | UHS-II cards; same caveat |
| A1 or A2 | Not a write-speed rating | Random access for apps (A1: 500 writes a second, A2: 2,000). Says nothing about sustained capture writes |