Title: Aerial Detection
Description: Detect drones, controllers, and OpenDroneID broadcasts with sequential Wi-Fi/BLE sweeps
URL: /latest/wifi/aerial-detection/
Version: latest
Section: Wi-Fi
Search index: /search-index.json

# Aerial Detection

> Detect drones, controllers, and OpenDroneID broadcasts with sequential Wi-Fi/BLE sweeps

## On this page

- [How it works](#how-it-works)
- [How to use](#how-to-use)
- [Via terminal](#via-terminal)
- [Via display](#via-display)
- [What gets detected](#what-gets-detected)
- [Spoofing Remote ID for testing](#spoofing-remote-id-for-testing)
- [Troubleshooting](#troubleshooting)

---

GhostESP’s aerial detector watches both Wi-Fi and BLE airspace to find Remote ID beacons, DJI links, and drone-branded networks. It alternates radios so scans run reliably on every ESP32 board. You need a board with both Wi-Fi and BLE (ESP32-S2 can only run the Wi-Fi phase) and serial, GhostLink display, or WebUI terminal access; a GPS module is optional for pairing detections with coordinates.
## How it works
- Phase 1 - Wi-Fi sniffing: Promiscuous capture with channel hopping looks for OpenDroneID NAN frames, DJI OUIs, and drone SSIDs.
- Phase 2 - BLE scanning: Wi-Fi is suspended so BLE can search for OpenDroneID (UUID 0xFFFA) and DJI advertisements (UUID 0xFFE0).
- Automatic recovery: When BLE stops, GhostNet AP and STA sessions return without user interaction.
Order of an aerial sweep
1
Wi-Fi phase: promiscuous sniff + channel hopLooks for OpenDroneID NAN frames, DJI OUIs, and drone SSIDs
2
Suspend Wi-Fi, start the BLE scanFrees the radio for BLE
3
BLE phase: listen for Remote ID advertsOpenDroneID (`0xFFFA`) and DJI (`0xFFE0`)
4
Restore AP and STAGhostNet and any STA session return automatically
The radios take turns; Wi-Fi comes back automatically after the BLE phase.
## How to use
### Via terminal
- Scan for aerial devices (default 30 seconds):
aerialscan 30
- Review captured drones:
aeriallist
- Track one device by index or MAC:
aerialtrack 0
- Stop scanning or tracking at any time:
aerialstop
### Via display
- Open the on-device BLE menu.
- Select Aerial Detector.
- Choose an action such as Scan Aerial Devices, List Aerial Devices, or Track Aerial Device.
- Wait for the command to finish in the terminal pane, then review the results card.
Note for Flipper app: The Aerial Detector submenu is under the Wi-Fi category (not BLE) in the Flipper UI. On-device displays keep it under BLE.
## What gets detected
- OpenDroneID Remote ID (ASTM F3411) - Wi-Fi NAN frames and BLE service 0xFFFA decode BasicID, Location, System, SelfID, and OperatorID messages.
- DJI protocols - MAC OUI matching and BLE service 0xFFE0 flag Mavic, Phantom, Inspire, and other DJI links.
- Drone SSIDs - Pattern matching for DJI, Parrot, Autel, Skydio, and FPV networks.
Each device record stores MAC, vendor, RSSI, GPS/altitude (if broadcast), operator position, and flight status so you can triage real aircraft versus test spoofers.
## Spoofing Remote ID for testing
Use the spoof workflow to broadcast a test drone and confirm your detector (or another receiver) reacts:
aerialspoof DRONE-TEST 37.7749 -122.4194 120
- Sends alternating BasicID and Location frames once per second.
- Wi-Fi remains suspended until you run aerialspoofstop.
- Pair a second GhostESP, run aerialscan, and verify it lists DRONE-TEST.
## Troubleshooting
- “Wi-Fi suspended” message: Normal during BLE phase or spoofing. It clears after the command finishes or you run aerialstop.
- No detections: Increase scan time (aerialscan 60) so each phase lasts longer, or move closer to the suspected drone.
- ESP32-S2 board: Only Wi-Fi detections work; BLE phase is skipped.
- Heap errors during repeated scans: Restart your device.