ESP32-C5 · dual-band management sniffer
Flash a C5 from your browser
A $10 ESP32-C5 becomes a 2.4 and 5 GHz management-frame sensor for WLAN Commander, talking to the app over Bluetooth LE. Plug it in, press the button below, and Chrome writes the image directly — no toolchain, no command line.
What the board does
It listens. In promiscuous mode across 2.4 and 5 GHz, every management and control frame it hears is wrapped in a radiotap header and streamed to the phone over a single BLE characteristic, where WLAN Commander parses it like any other capture source.
It can also ask. Given a list of Passpoint access points, it sends GAS/ANQP queries and captures the replies — a standard pre-association client query, the same one your phone makes before it joins a hotspot. That is what fills in realms, roaming consortiums and venue names on the Passpoint screen.
It boots idle
No promiscuous mode, no channel hopping, no transmission — BLE advertising only. Nothing happens until the app says so, and closing the app stops it again. An earlier build swept and transmitted from the moment it had power, unattended; this one does not.
It stops when you walk away
If the phone disappears — app closed, crash, flat battery, or simply out of range — the board notices the link is gone and stops itself. A board with nobody listening captures frames it then discards, so running on is spent power and spent airtime for nothing.
One radio is enough
Requests go out through the MAC rather than raw injection, so the board hears its own replies. An earlier design paired two boards because a mis-measurement suggested a single radio was deaf to its own transmission. It is not.
Which board to buy
Any ESP32-C5 devkit with a USB data connection will do. Two are worth naming, and they differ in the one respect that matters later.
Seeed XIAO ESP32-C5
8 MB flash · 8 MB PSRAM
What the firmware was developed and tested on. The extra flash is the reason to prefer it — see below.
M5Stack Stamp-C5
4 MB flash · ESP32-C5HF4
Smaller and cheaper, and it runs this image today. It has no room to spare, which is the trade you are making. Shop page.
Flashing
The button above needs desktop Chrome or Edge — Web Serial exists nowhere else. Connect the board by USB, press it, and pick the serial port that appears.
Plug in a data cable
Charge-only USB cables are common and produce a board that powers up and never enumerates. If no port appears in the picker, suspect the cable before the board.
Press Connect & flash
Four images are written: bootloader at 0x2000, partition table at 0x8000, boot_app0 at 0xe000, and the sketch at 0x10000.
Check it came up
The board advertises over BLE as WLC C5 SNIFFER, and prints a status line on serial every two seconds. A freshly flashed board reads run=0 poke=0 cap=0 — idle, waiting, transmitting nothing.
From a command line instead
Download the four images from the repository and write them with esptool:
esptool --port /dev/cu.usbmodem1101 --no-stub write-flash \ --flash-mode dio --flash-freq 80m --flash-size 4MB \ 0x2000 wlc_sniffer.ino.bootloader.bin \ 0x8000 wlc_sniffer.ino.partitions.bin \ 0xe000 boot_app0.bin \ 0x10000 wlc_sniffer.ino.bin
--no-stub is there deliberately. On the boards tested here the stub loader frequently fails to start, and the failure looks like a dead board rather than a flashing problem.
When it will not flash
Three failures account for nearly everything seen on the bench, and none of them looks like what it is.
Nothing appears in the port picker
A charge-only cable, or a hub that carries power but not data. Try a different cable and a port directly on the machine before anything else.
It connects once, then refuses
These boards accept roughly one flashing session per USB enumeration. If a first attempt fails partway, the next one may report no response at all. Unplug it, plug it back in, and try again — do not keep retrying against a wedged port.
Silent, or stuck in a boot loop
Hold BOOT while plugging the board in — or hold BOOT and tap RESET — to force the ROM download mode, then flash. Release BOOT afterwards, or the board will write the image and sit in download mode instead of running it. A board that answers the flasher but never advertises over BLE is usually still being held there.
What it transmits
By default, nothing. Listening is passive, and ANQP queries are off until switched on.
When they are on, the board sends GAS/ANQP requests — the standard query a client makes before associating. It does not deauthenticate, does not inject forged data frames, and does not associate with anything. Asking is still a transmission, so it is opt-in and stops with the rest when the board stops.
Stable or experimental?
Choose the latest experimental all-in-one for screenless 8 MB C5 boards, or the matching touchscreen image. The legacy stable BLE sniffer remains selectable.
Print your field kit
Three boards. One enclosure.
A closer look at the XIAO ESP32-C5 build, with sticker antennas, USB power and a printable case. Choose one, two or three boards, with regular and MagSafe versions.
ESP32-C5 firmware
- Latest all-in-one
- 2026.10.20 · experimental
- Screenless image ZIP
- 838,509 bytes
Select screenless 8 MB, 2.8-inch touchscreen 32 MB, or 1.69-inch touchscreen 16 MB. The 1.69-inch build still needs hardware QA.
Current release, checksums and source · Features and limits
SHA-256 · screenless application binary
a0ac569c87fbde4617f5bf9f36e8bf1b2f751d1872718b10cb1394dc3a435a3d
The September 7 stable BLE sniffer remains an explicit option in the board selector.
Original research and documentation by WLAN Geeks. Sources and credits · Report a documentation issue