Halkon-1
C++ · ESP32 · WiFi Sniffing · Counter-UAS · Embedded
Description
Passive drone detection system that sniffs WiFi beacon, probe request, and data frames on an ESP32. No active emission — it only listens. Serves a real-time military-grade dashboard over a direct access point.
Detection Engine
Multi-factor scoring analysis on every detected device:
| Factor | Weight | What it detects |
|---|---|---|
| OUI Match | +60 | MAC prefix matches known drone manufacturers (DJI, Autel, Parrot) |
| Vendor IE | +50 | Vendor-specific IE reveals manufacturer even with random MAC |
| SSID Keyword | +30 | SSID contains drone-related words (Mavic, Phantom, DJI, etc.) |
| Strong Signal | +10 | RSSI > -50 dBm indicates close proximity |
| Active Probe | +15 | Probe request with suspicious SSID |
Scores map to threat levels: CRITICAL (≥80), HIGH (≥60), MEDIUM (≥30), LOW (<30).
Technical Highlights
- Passive operation — zero RF emission, listens only
- Channel hopping — cycles channels 1–13 (200ms each), full scan in ~2.6s
- Threat classification — real-time scoring with confidence estimation
- On-device dashboard — served over ESP32 access point, no infrastructure needed
- Circular buffer history — 60s loiter detection window for persistent tracking
Tech Stack
C++ (Arduino Core), PlatformIO, ESP32, LittleFS, WiFi Promiscuous Mode
Hardware
Single ESP32 — no external components required. Built-in LED (GPIO2) for status indication.