WiFi Shuriken A New Architecture For High Performance Scanning

The speaker opens with a primer on wardriving, which is passive collection of wireless metadata such as network names, BSSIDs, channels, security settings, signal strength and location, typically uploaded to the public WiGLE database. He then presents the Wi-Fi Shuriken, a standalone device with an RP2350 controller that coordinates six ESP32-C5 scanners, a multi-constellation GNSS receiver, and an SD card that logs data in WiGLE CSV format. The design is deliberately limited to Wi-Fi, with no display, no web interface and no runtime configuration, so memory stays free for scanning.

The core of the talk is the architecture. Scanners share a 20 MHz bidirectional bus with a binary protocol and a three-command set, and they hold results until the controller polls them, which avoids overwhelming it. Each scanner covers different channels, so losing one radio does not silence a band. Deduplication happens in two tiers: each scanner filters repeats before sending, and the controller filters again using a hash table keyed on everything except signal strength, with first-in-first-out eviction for fast lookups. The speaker says the table holds over 4,000 entries and that shift registers could add more scanners later.

Results were compared against a phone running the Wiggle app, War Driver UK and Kismet. The Shuriken found roughly 20 to 35 percent more networks in a car, and it trailed War Driver UK at 2.4 GHz because it spends only a third of its airtime there. Kismet, which scans passively, returned fewer results than active probing in some runs, though the runs were not simultaneous. The practical takeaways are to keep older gear for dense areas, pay attention to antennas and routes, and expect dwell-time tuning to remain an open question.