Pith. sign in

REVIEW 3 major objections 8 minor 15 references

Wi-Fi Sensing Tool Release: Gathering 802.11ax Channel State Information from a Commercial Wi-Fi Access Point

T0 review · 3 major / 8 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper introduces ZTECSITool, a toolkit for gathering Wi-Fi 6 (802.11ax) channel state information from a commercial access point with up to 160 MHz bandwidth and 512 subcarriers.

desk verdict Useful 802.11ax CSI tool paper whose headline 512-subcarrier/160 MHz claim is unverified; the protocol documentation is the real contribution, and acceptance should hinge on one validation trace. read the letter →

arxiv 2506.16957 v1 pith:BT4WFQ4F submitted 2025-06-20 eess.SP

Zisheng Wang , Feng Li , Hangbin Zhao , Zihuan Mao , Yaodong Zhang , Qisheng Huang , Bo Cao , Mingming Cao
show 2 more authors
Baolin He Qilin Hou
This is my paper · ORCID
classification eess.SP
keywords Wi-FisensingChannelStateInformationZTECSITool802.11axCSIextractioncommercialaccesspointUDPprotocol160MHzbandwidth
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper introduces ZTECSITool, a hardware-plus-software toolkit that turns a commercial ZTE AX3000 Wi-Fi 6 access point into a channel state information (CSI) sensor. The toolkit's claim is that it can collect CSI at higher resolution than existing open tools: bandwidths up to 160 MHz, 512 subcarriers per chain, and 16-bit quantization. ZTECSITool consists of customized experimental firmware for the access point, a UDP command protocol for configuring CSI collection (band, station filter, report destination), a documented binary data format, and a Python graphical interface for real-time visualization and analysis. If the claim holds, researchers gain a commodity, commercially available platform for Wi-Fi sensing experiments at resolutions previously unavailable from access points. The paper is a tool release: it explains the commands, the packet formats, and the parsing rules so that the community can build on the toolkit.

What carries the argument

The central object is ZTECSITool, a hardware-plus-software toolkit that converts the ZTE AX3000 access point into a CSI reporter. The machinery consists of the access point's MediaTek MT7916 chipset running experimental CSI firmware, which estimates the channel from received packet preambles, and a UDP-based command and reporting protocol. The CSI data format (Table IX) is the load-bearing specification: each report packet carries fields such as peer MAC address, RSSI, AGC gain, MCS, and guard interval, followed by two arrays of 512 int32 values for the I and Q components of the channel estimate, enabling downstream applications to parse the raw measurements.

What would settle it

Set up the toolkit with a single associated station transmitting 160 MHz QoS-data frames, reassemble the fragmented UDP CSI reports, and count the number of populated I/Q subcarrier pairs; if the count never reaches 512 or the csi i and csi q arrays contain zero padding beyond the hardware's actual subcarrier count, the central claim fails.

Watch

Extended reading notes

Core claim

The central claim is that a commercial ZTE AX3000 access point, after a firmware update, can be made to estimate and stream channel state information for every received 802.11ax PPDU, covering up to 512 subcarriers at 160 MHz bandwidth with 16-bit in-phase and quadrature samples per chain. The paper specifies a complete control path: six UDP command types with a magic number 0xCAFE2025 for band selection, frame-type filtering, per-station filtering, report enable/disable, and destination configuration, plus a documented CSI report format that carries 512 I and 512 Q integers per packet. It also describes a PC-side Python tool for issuing commands, reassembling fragmented UDP reports, and plotting magnitude, phase, and I/Q data in real time. On the strength of these specifications, the paper claims the highest known specifications to date among open CSI extraction tools.

Load-bearing premise

The load-bearing premise is that the ZTE AX3000's MT7916 chipset, once flashed with the experimental firmware, actually fills all 512 I and Q CSI entries per reported PPDU over UDP as Table IX specifies, since the paper shows no captured frame with a full 512-subcarrier report and states the number of RF chains inconsistently.

Editorial extensions

If this is right

  • Researchers can collect Wi-Fi sensing datasets at 160 MHz bandwidth and 512 subcarriers using a commercial access point rather than specialized or modified client adapters.
  • The documented UDP command flow and CSI parsing rules serve as a reference implementation that could be adapted to other Wi-Fi 6 devices with similar chipsets.
  • Because CSI is reported per received PPDU from any associated station, unmodified commercial phones and laptops can act as transmitters, enabling passive sensing configurations.
  • The 16-bit quantization provides finer amplitude and phase resolution than the 8-bit samples used by earlier tools, which may improve the fidelity of sensing features such as micro-Doppler and angle-of-arrival estimates.
  • The toolkit gives the community a reproducible baseline for benchmarking future 802.11ax CSI extraction methods.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the 512-subcarrier and 160 MHz claims hold, this toolkit effectively removes the bandwidth bottleneck that has limited Wi-Fi sensing resolution, making finer-grained sensing feasible on commodity hardware.
  • A natural test is to compare the CSI from this toolkit against a channel sounder or a second CSI tool in the same environment; any discrepancy in subcarrier count or phase continuity would reveal whether the firmware interpolates or zero-pads the reported data.
  • The fact that the firmware is distributed only by email request, rather than as a publicly downloadable image, is a practical limitation for reproducibility and independent verification of the claims.
  • The paper's inconsistent statements about the number of chains (3x2 MIMO in the introduction, 6 chains in the conclusion, and 16-element arrays in the data format) leave ambiguity about whether the reported CSI captures all spatial streams or contains formatting artifacts.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 8 minor

Summary. The manuscript presents ZTECSITool, a CSI extraction toolkit for commercial ZTE AX3000 802.11ax access points, comprising custom experimental firmware, a PC-side controller/collector, and a Python GUI. The paper documents the system architecture, six UDP configuration commands (report enable, STA filter, CSI configuration, report configuration, band configuration, and availability check), the required command ordering, the binary CSI report format, and the firmware update procedure. The headline specifications claimed are support for up to 160 MHz bandwidth, 512 subcarriers with 16-bit I/Q quantization, and multiple RF chains.

Significance. If the headline capabilities were demonstrated, ZTECSITool would fill a genuine gap: existing open-source CSI tools are mostly limited to 802.11n/ac and lower subcarrier counts, while an 802.11ax 160 MHz/512-subcarrier AP-side toolkit would be of clear value to the Wi-Fi sensing community. The paper's useful contributions are the documented command protocol, the field-level data format in Table IX, and the release of PC software and example captures. However, the strongest capabilities are asserted rather than verified, and several internal inconsistencies remain unresolved. This is a plausible tool announcement, but the evidence as presented does not yet establish the headline claims.

major comments (3)
  1. [III-D and Table IX] The central claim of 512 subcarriers per chain is not supported by any demonstrated capture. Table IX defines csi_i[512] and csi_q[512] as fixed-size arrays and a csi_cnt field; these merely reserve space and do not show that the MT7916 experimental firmware populates all 512 entries. Figure 3 is a Wireshark screenshot of fragmented UDP packets whose reassembled payload is not shown, so the actual number of nonzero subcarriers in a captured PPDU cannot be verified. Please add a validation section: a parsed CSI record from a real capture showing csi_cnt=512 (or the actual count for a known PPDU), a text dump or clear screenshot of the reassembled payload, and, ideally, a comparison of the extracted CSI magnitude and phase against a known channel, such as a calibrated attenuator or a back-to-back loopback test.
  2. [I, Table I, III-D/Table IX, Conclusion] The MIMO chain counts are internally inconsistent across the manuscript. Section I states 3x Tx/Rx antennas for 5 GHz and 2x for 2.4 GHz; Table I lists MIMO as "3x2"; the Conclusion claims "6 chains"; and Table IX carries rssi[16], resv[3][16], and agc_gain[16], which suggest a 16-chain layout. Please clarify the exact number of supported chains, how the 512-subcarrier arrays in Table IX relate to per-chain data (for example, interleaving, separate packets, or a fixed chain order), and reconcile the 16-element fields in Table IX with the stated 3x2 or 6-chain configuration.
  3. [III-G] The experimental firmware is distributed only by email request after providing the AP's serial number, which is inconsistent with the "open-source" characterization in the Abstract and prevents reviewers and readers from independently verifying the claimed 160 MHz and 512-subcarrier capabilities. To support the load-bearing claims, please make the firmware publicly and permanently downloadable, or provide a publicly accessible captured CSI dataset that demonstrates the full 512-subcarrier operation together with the parser and a reproducible capture procedure. If the firmware must remain proprietary, the manuscript should state that clearly and restrict the claims to what can be verified from the released data.
minor comments (8)
  1. [Abstract] The phrase "CSI extraction from commercial Wi-Fi access point lacks and out of date" is ungrammatical; consider "CSI extraction from commercial Wi-Fi access points is lacking and out of date."
  2. [III-B] The text "All field is little-end" should read "All fields are little-endian," and the term "little-end" appears repeatedly in the table descriptions.
  3. [III-C] "At least 500ms interval is required" should be "At least a 500 ms interval is required," and the paragraph on command ordering would benefit from stating whether the 500 ms interval applies between every pair of commands or only between specific ones.
  4. [III-D and Table IX] There are several small language errors in this section: "The number of CSI in this packets" should be "The number of CSI in this packet," and "resvered" should be "reserved."
  5. [III-E] Figure 3 is described as showing "UDP packets which carrier a CSI data"; it should be "carry CSI data." More importantly, the figure should show the reassembled payload fields rather than only fragmented packets; see the major comment about validation.
  6. [III-G] "click 'request update' bottom" should be "click the 'request update' button," and "use ZTECSITool PC software to collection CSI Information" should be "to collect CSI information."
  7. [Section III, GitHub URL] The repository URL as printed contains a space ("https://github.com/WiFiZTE2025/ZTE WiFi Sensing.git") and is not a valid clickable link; please provide the correct URL and check that the repository is publicly accessible.
  8. [Table I] The Nexmon CSI Extractor row leaves the Subcarriers and Bandwidth cells blank; filling these entries would make the comparison table complete and more informative.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the paper is a tool release with hardware and format descriptions, and its capability claims are not derived from fitted inputs or self-cited theorems.

full rationale

This paper contains no mathematical derivation, no fitted parameters, and no predictive model whose output is defined by its input. The central claims, such as support for 160 MHz bandwidth and 512 subcarriers, are presented as hardware/firmware capabilities of the ZTE AX3000 AP and the MT7916 chipset, not as quantities derived from equations or fitting procedures. The data structure in Table IX reserves csi_i[512] and csi_q[512] arrays, but that merely defines a format; it does not by itself establish that the experimental firmware populates all 512 entries, which is a verification gap, not a circularity. The paper's own software outputs are used to demonstrate the tool, but this is weak evidence, not circular reasoning, because the tool's validity is an empirical question about hardware behavior, not a definitional equivalence. No load-bearing self-citation appears: the references are to external toolkits and datasets, and none is invoked as an authority to force the paper's conclusions. The inconsistent MIMO descriptions (3x2, 6 chains, rssi[16] arrays) and the gated firmware distribution are significant limitations relevant to reproducibility and confidence, but they do not make any claim reduce to its own input. Therefore, the appropriate circularity score is 0.

Assumptions & free parameters 0 free parameters · 2 assumptions · 0 invented entities

This is a tool release, so no free parameters are fitted to data and no new theoretical entities are introduced. The central claim depends on unverified assumptions about the capability of the MT7916/802.11ax chipset and about the completeness of the documented data format.

assumptions (2)
  • domain assumption The ZTE AX3000 MT7916 chipset, under the custom firmware, will populate all 512 I and Q CSI entries for a 160MHz report.
    Used throughout Section III-D and III-G, but the paper provides no capture proving a full 512-subcarrier payload; the chain count is inconsistent.
  • domain assumption 802.11ax PPDU preambles on commercial hardware yield channel estimates accurate enough for the stated sensing applications.
    Invoked in Section I; no comparison with a known channel or a reference measurement is given.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Wi-Fi Sensing Tool Release: Gathering 802.11ax Channel State Information from a Commercial Wi-Fi Access Point." pith.science (2026). https://pith.science/paper/BT4WFQ4F

@misc{pith2026250616957,
  author       = {Pith},
  title        = {Pith review of: Wi-Fi Sensing Tool Release: Gathering 802.11ax Channel State Information from a Commercial Wi-Fi Access Point},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BT4WFQ4F}},
  note         = {Machine review of arXiv:2506.16957}
}
read the original abstract

Wi-Fi sensing has emerged as a powerful technology, leveraging channel state information (CSI) extracted from wireless data packets to enable diverse applications, ranging from human presence detection to gesture recognition and health monitoring. However, CSI extraction from commercial Wi-Fi access point lacks and out of date. This paper introduces ZTECSITool,a toolkit designed to capture high-resolution CSI measurements from commercial Wi-Fi 6 (802.11ax) access points, supporting bandwidths up to 160 MHz and 512 subcarriers. ZTECSITool bridges a critical gap in Wi-Fi sensing research, facilitating the development of next-generation sensing systems. The toolkit includes customized firmware and open-source software tools for configuring, collecting, and parsing CSI data, offering researchers a robust platform for advanced sensing applications. We detail the command protocols for CSI extraction, including band selection,STA filtering, and report configuration, and provide insights into the data structure of the reported CSI. Additionally, we present a Python-based graphical interface for real-time CSI visualization and analysis

Figures

Figures reproduced from arXiv: 2506.16957 by the authors.

Figure 1
Figure 1. An example system architecture of the CSI collection system using [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. An example of an UDP packet carrying CSI Band Command [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 4
Figure 4. The home page of ZTECSITool. AP. To update ZTECSITool firmware, the following step needs to be done: 1) Login to the management web page of ZTE AP (by default 192.168.5.1). On the bottom of the main page, record the sequence number. 2) Send an email to the corresponding author and attach the sequence number. 3) Users will receive confirmation from the author and your device will be ready for the experimental test. 4… view at source ↗
Figures from the paper (2 more)
Figure 3
Figure 3. Figure 3: An example of an UDP packet carrying CSI data format. [PITH_FULL_IMAGE:figures/full_fig_p005_3.png]
Figure 5
Figure 5. Figure 5: shows the example of web pages [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

15 extracted references · 15 canonical work pages

  1. [3]

    Precise Power Delay Profiling with Commodity WiFi,

    Y . Xie, Z. Li and M. Li, “Precise Power Delay Profiling with Commodity WiFi,” in Proceedings of the 21st Annual International Conference on Mobile Computing and Networking (MobiCom) , ACM, 2015, pp. 53–64

    work page 2015

  2. [1]

    Tool release: Gath- ering 802.11n traces with channel state information,

    D. Halperin, W. Hu, A. Sheth, and D. Wetherall, “Tool release: Gath- ering 802.11n traces with channel state information,” ACM SIGCOMM Computer Communication Review , vol. 41, no. 1, pp. 53, 2011

    work page 2011

  3. [2]

    Nexmon: The C- based Firmware Patching Framework,

    M. Schulz, D. Wegemer and M. Hollick, “Nexmon: The C- based Firmware Patching Framework,” 2017. [Online]. Available: https://nexmon.org

    work page 2017

  4. [4]

    Lightweight and Standalone IoT Based WiFi Sensing for Active Repositioning and Mobility,

    S.M. Hernandez and E. Bulut, “Lightweight and Standalone IoT Based WiFi Sensing for Active Repositioning and Mobility,” in Proceedings of the 21st International Symposium on ”A World of Wireless, Mobile and Multimedia Networks (WoWMoM), IEEE, 2020, pp. 277–286

    work page 2020

  5. [5]

    On spatial diversity in WiFi-based human activity recognition: A deep learning-based approach,

    F. Wang, W. Gong and J. Liu, “On spatial diversity in WiFi-based human activity recognition: A deep learning-based approach,” IEEE Internet of Things Journal, vol. 6, no. 2, pp. 133–136, 2019

    work page 2019

  6. [6]

    Direction-agnostic gesture recognition system using commercial WiFi devices,

    Y . Qin, S. Sigg, S. Pan and Z. Li, “Direction-agnostic gesture recognition system using commercial WiFi devices,” Computer Communications, vol. 216, pp. 34–44, 2024

    work page 2024

  7. [7]

    Cross-domain extendable gesture recognition system using WiFi signals,

    Y . Qin, S. Pan and Z. Li, “Cross-domain extendable gesture recognition system using WiFi signals,” Electronics Letters, vol. 59, no. 16, pp. 133– 136, 2023

    work page 2023

  8. [8]

    ReWiS: Reliable Wi-Fi sensing through few-shot multi-antenna multireceiver CSI learning,

    N. Bahadori, J. Ashdown and F. Restuccia, “ReWiS: Reliable Wi-Fi sensing through few-shot multi-antenna multireceiver CSI learning,” in 2022 IEEE 23rd International Symposium on a World of Wireless, Mobile and Multimedia Networks (WoWMoM) , IEEE, 2022, pp. 50–59

    work page 2022

Show all 15 references
  1. [9]

    WiTraj: Robust indoor motion tracking with WiFi signals,

    D. Wu, Y . Zeng, R. Gao, S. Li, Y . Li, R. C. Shah, H. Lu, D. Zhang “WiTraj: Robust indoor motion tracking with WiFi signals,” IEEE Trans- actions on Mobile Computing , vol. 22, no. 5, pp. 3062–3078, 2021

    2021

  2. [10]

    Zero-effort cross-domain gesture recognition with Wi-Fi,

    Y . Zheng, Y . Zhang, K. Qian, G. Zhang, Y . Liu, C. Wu and Z. Yang “ Zero-effort cross-domain gesture recognition with Wi-Fi,” in 2022 Proceedings of the 17th annual international conference on mobile systems, applications, and services (MobiSys) , ACM, 2019, pp. 313–325

    2022

  3. [11]

    Onefi: One-shot recognition for unseen gesture via cots wifi,

    R. Xiao, J. Liu, K. Qian, J. Han and K. Ren “Onefi: One-shot recognition for unseen gesture via cots wifi,” in 2021 Proceedings of the 19th ACM Conference on Embedded Networked Sensor Systems (SenSys) , ACM, 2021, pp. 206–219

    2021

  4. [12]

    Placement matters: Understanding the effects of device placement for WiFi sensing,

    X. Wang, K. Niu, J. Xiong, B. Qian, Z. Yao, T. Lou and D. Zhang “Placement matters: Understanding the effects of device placement for WiFi sensing,” in 2022 Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies (IMWUT), ACM, 2022, pp. 1–25

    2022

  5. [13]

    Mm-fi: Multi-modal non-intrusive 4d human dataset for versatile wireless sensing,

    J. Yang, H. Huang, Y . Zhou, X. Chen, Y . Xu, S. Yuan, H. Zou, C.X. Lu and L. Xie “Mm-fi: Multi-modal non-intrusive 4d human dataset for versatile wireless sensing,” Advances in Neural Information Processing Systems, vol. 36, pp. 18756–18768, 2023

    2023

  6. [14]

    XRF55: A Radio Frequency Dataset for Human Indoor Action Analysis,

    F. Wang, Y . Lv, M. Zhu, D. Han and J. Han “XRF55: A Radio Frequency Dataset for Human Indoor Action Analysis,” Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies, vol. 8, no. 1, pp. 1–34, 2024

    2024

  7. [15]

    CSI-based location- independent Human Activity Recognition with parallel convolutional networks,

    Y . Zhang, Y . Yin, Y . Wang, J. Ai and D. Wu “CSI-based location- independent Human Activity Recognition with parallel convolutional networks,” Computer Communications, vol. 197, pp. 87–95, 2023

    2023

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.