RFrf_sentinel / esp32
ESP32 boards
An ESP32 with a decent antenna hears further than a phone and can see things Android hides. RF Sentinel merges what the board reports into its own list, marked with a blue ESP32 badge.
Supported firmware
| Firmware | Link | What RF Sentinel gets |
|---|---|---|
| OUI-Spy (recommended) | USB OTG | Flock-You, Detector and Sky Spy detections as they happen: Flock cameras, the board's watchlist matches, Remote ID drones with position |
| OUI-SPY App-Controlled | Bluetooth | Flock-BLE, Flock-WiFi, Sky Spy, Detector and (optional) Wardrive survey engines |
| GhostESP | USB OTG | The WiFi networks it scans, about every 10 s (no Bluetooth over USB) |
| ESP32 Marauder | USB OTG, or through a Flipper Zero | WiFi networks and client devices from its passive beacon and probe sniffers, batched every 2 s; on ESP32-C5 boards (Marauder v8, BFFB v2, LilyGo T-Dongle C5, C5 DevKit) both 2.4 and 5 GHz |
| V2X2MAP (ESP32-C5, Europe) | USB OTG | European car-to-car radio (ITS-G5, 5.9 GHz): emergency vehicles with their light bar and siren state at the position they broadcast, and their "emergency vehicle approaching" warnings. RF Sentinel only listens to the board's stream; nothing is sent to it. Not in North America, which uses C-V2X |
USB
Plug the board into the phone with a USB OTG cable while scanning and allow USB access on the first prompt. Native-USB boards (ESP32-S2 / S3 / C3 / C5 / C6) and boards with CP210x or CH340 USB bridges work. RF Sentinel only asks OUI-Spy for its version and live table, only asks GhostESP to scan and list networks, and only runs Marauder's passive sniffbeacon / sniffprobe sniffers (no attack commands, no settings changes). Settings shows the board's status.
ESP32 Marauder, ESP32-C5 and Flipper Zero
Dual-band: Marauder on an ESP32-C5 (Marauder v8, BFFB v2, LilyGo T-Dongle C5, C5 DevKit) hears 5 GHz networks that the phone's throttled WiFi scan misses, which helps catch vehicle routers on a pass. Keep Channel Hop on in Marauder's settings; RF Sentinel says so if the board stays on one channel.
Flipper Zero (e.g. with the BFFB board): plug the Flipper into the phone and open GPIO → USB-UART Bridge on the Flipper; RF Sentinel then talks to the board's Marauder through it. A BFFB v2 can also be plugged in by its own USB-C port. The original BFFB uses a 2.4 GHz-only ESP32.
Bluetooth (OUI-SPY App-Controlled)
- Power the board and start scanning in RF Sentinel.
- Settings → Pair OUI-SPY board → pick
OUI-SPY-xxxx. - Pair only there, not in Android's Bluetooth settings: the board keeps no pairing keys, so a phone-side bond breaks the link. The app tells you to tap Forget if it finds one.
While scanning, RF Sentinel switches on the board's Flock-BLE, Flock-WiFi, Sky Spy and Detector engines and switches them off when scanning stops. By default it also runs the Wardrive survey engine so the board relays every WiFi network and Bluetooth device; those go through RF Sentinel's own watchlist, presets and rules. In that mode the board sends standard WiFi probe requests, so turn off OUI-SPY: relay every network and Bluetooth device to keep it purely listening. The board's UniPwn, PCAP and Foxhunter engines are never used.
The status line under Scanning shows connecting… / live · N reports; the ESP32 filter chip lists only what the board reported.
Questions
Which ESP32 board should I buy?
Any board the firmware supports: XIAO ESP32-S3, ESP32-S3 DevKitC, LilyGO T-Dongle-S3 and others are targets of OUI-Spy. An external antenna connector (u.FL / IPEX) is worth having for range.
How do I flash OUI-Spy?
Follow the firmware's own README (PlatformIO or its flash script). RF Sentinel doesn't flash boards.