An operator drives down a street and sees roads, buildings and a car ahead. That same space carries wireless activity that has no visual form. RadAir is an experimental macOS platform for observing that second layer — watch the street dissolve into it. It is built for units that already work that street under a lawful mandate.
WORKING FIELD BUILDINTELLIGENCE LAYER IN DEVELOPMENTPASSIVE SENSORSFOR AUTHORIZED UNITS
SCROLL — THE VISIBLE WORLD BECOMES SIGNAL
01RADIO LAYER
The city starts to emit.
Turn the sensors on and RadAir observes the wireless activity occurring in the same physical space. Each observation can carry a timestamp, the sensor that made it, signal metadata, the position it was collected from and the radio characteristics measured. Not every signal corresponds to a known physical object — an observation is a measurement, not an identification.
PER OBSERVATIONTIME · SENSOR · POSITION
SENSOR SOURCESWi-Fi · BLE · SDR · GNSS
POSITIONCOLLECTION VEHICLE
Position records where the observation was made. It is not the location of the emitter.
02OBSERVATIONS
A single observation means very little.
A radio observation is one measurement at one moment — a BLE advertisement, a Wi-Fi network observed, RF energy above the local background, a GNSS position, an ADS-B frame. On its own it says almost nothing. Repetition is what creates context.
03DENSITY
Radio has a shape.
RadAir renders that raw energy as a kernel-density heatmap before it ever names a single device — where the air is busy, and where it is quiet. One drive can produce thousands of observations. That is a useful survey of the environment, but it is not yet intelligence.
04ORIGIN · DEVICE RELATIONSHIPS
It started with wearables.
RadAir started with a simple field observation. Some wireless devices could be reacquired repeatedly, and devices carried together — a smartwatch, a smart ring, earbuds, phone-related BLE activity — often produced recurring combinations of radio observations. The interesting problem was no longer detecting another device. It became understanding which observations appear to belong together.
ONE DEVICEA DETECTION
REPEATED CO-OCCURRENCECONTEXT
IDENTITYNOT INFERRED
05OBSERVATIONS → CLUSTERS
Which observations belong together?
One observation means little. But signatures that repeatedly appear together, disappear together and return across sessions — from a person, a vehicle or an installation — can form a probabilistic cluster.
EXPERIMENTAL
OBSERVED TOGETHER13 / 15 SESSIONS
TEMPORAL CORRELATIONHIGH
CURRENT VISIBILITY2 / 3 DEVICES
CLASSIFICATIONPROBABLE CARRIED-DEVICE CLUSTER
The system produces C-041 · probable carried-device cluster. A human-readable name is only ever assigned by the operator — RadAir never infers who anyone is.
06FIELD DATA COLLECTION
One pass shows the environment. Repeated passes show what is normal.
A single drive reveals thousands of observations — a survey of the environment, not intelligence. Repeated drives over the same routes separate recurring infrastructure from transient devices and mobile emitters, and surface what is new, missing or persistent. Collecting enough field data to establish those reference patterns is RadAir's current phase.
CURRENT PHASEFIELD DATA COLLECTION
ROUTE REFERENCE SETBUILDING
COMPARISONIN DEVELOPMENT
07WHAT CHANGED
The useful question is not how many.
What changed is the useful question. RadAir is collecting repeated field passes to build reference environments for routes and locations; a new mission is then compared against previous passes, not against thousands of raw detections. Target output: RF-031 at 433.920 MHz, consistent with a source absent from the route reference set.
TARGET ANALYSIS OUTPUT
REFERENCE PASSES8
RECURRING ENTITIES214
NEW THIS PASS12
MISSING FROM EXPECTED SET3
PERSISTENT DEVIATIONS1
Baseline engine IN DEVELOPMENT — illustrative target output, not live telemetry.
08DIRECTION FINDING · PLANNED
Direction turns detection into a search area.
RadAir never infers bearing from ordinary Wi-Fi RSSI or from a basic RTL-SDR — neither can measure direction. This is a planned hardware capability. It requires a direction-finding capable receiver. With one, RadAir can associate real bearing measurements with vehicle position and narrow the probable source area.
PLANNED · DF-CAPABLE SENSOR REQUIRED
BEARING MEASUREMENTDF-CAPABLE RECEIVER
FUSED WITHVEHICLE POSITION
RESULTPROBABLE SOURCE AREA
09ACTIONABLE OUTPUT
AI is the last layer, not the sensor.
Measured observations go through deterministic analytics first — temporal, spatial and recurrence analysis, baseline comparison, clustering, confidence scoring. ML may assist with co-occurrence, cluster similarity and persistence scoring. An LLM sits on top and answers what changed, what deserves attention, what evidence supports it, and what to inspect next.
AI should explain the evidence, not invent it.
CURRENT STATE OF THE PROJECT
A real field build, with the intelligence layer still being built.
The hierarchy is the whole point: first what is transmitting, then what appears together, then what persists, then what changed, then what deserves attention. The sensing layers run in a vehicle today. The layers above them — clustering, reference environments, comparison, operator summaries — are being built on top of the field data being collected now.
Field Ops during a real drive — recorded route, Wi-Fi 659 / BLE 720 observations, live event stream, one RF activity alert. Identifiers masked for publication.
Environment: live Wi-Fi and BLE observations with RSSI and last-seen. ACTIVE. Identifiers masked for publication.RTL-SDR monitoring: per-band energy over learned background, live spectrum and waterfall history. ACTIVE.RF activity alert: energy above the local background in a monitored band. ACTIVE / EXPERIMENTAL — this is energy above background, not confirmed drone identification.
What actually runs today
Native macOS field application
Wi-Fi environment scanning
BLE observation
RTL-SDR input
USB GNSS
Vehicle route recording
Live map
Spectrum view
Waterfall history
Configurable RF monitoring bands
RF activity / energy alerts
Sessions
Playback
Statistics
Reports
Live event feed
ADS-B / Mode S with offline aircraft database
Remote ID over BLE (ASTM F3411)
Sensor node protocol (JSON lines)
Session comparison
Data quality report
Hash-chained decision record
Cursor on Target export to TAK
Editable RF signature library
Observation places and incident records
Wi-Fi source classification, including IP cameras
Fixed-transmitter catalogue per place
Real field use in a moving vehicle
Running in the field
Code that has been used on real hardware, in a moving vehicle.
Field data collectionACTIVE
Wi-Fi / BLE observationACTIVE
RTL-SDRACTIVE
GNSS / route captureACTIVE
Session recording / replayACTIVE
Recurring device historyACTIVE
Sensor node protocol / receiver registryACTIVE
ADS-B / Mode S, offline aircraft databaseACTIVE
Session comparison / data quality reportACTIVE
Decision record / integrity manifestACTIVE
Observation places / incident recordsACTIVE · HYSTERESIS ON SYNTHETIC FIXES
Wi-Fi source classes, incl. IP camerasACTIVE
Fixed-transmitter catalogue per placeACTIVE · 1 OF 11 GROUPS ADMITTED
Cursor on Target export to TAKACTIVE · NOT YET AGAINST ATAK
RF signature libraryACTIVE · NONE FIELD-VERIFIED
Remote ID over BLE (ASTM F3411)IMPLEMENTED · NOT YET SEEN ON AIR
BLE persistence trackingACTIVE / EXPERIMENTAL
Device clusteringEXPERIMENTAL
AI operator summariesEXPERIMENTAL
Being built
The analysis layer on top of the collected field data. Not shipping yet.
Cross-session entity resolutionIN DEVELOPMENT
Cross-sensor entity resolutionIN DEVELOPMENT
Baseline datasetBUILDING
Baseline comparisonIN DEVELOPMENT
Anomaly engineIN DEVELOPMENT
Direction findingPLANNED
Field-class receiver on a sensor nodePLANNED
Per-receiver calibrationIN DEVELOPMENT
Video demodulation and previewPLANNED
Who it is for
RadAir is built for units that already work the street under a lawful mandate — police, border and military field teams, operating their own vehicles, their own routes and their own rules. That is why the constraints on this page are written plainly instead of being buried. An operator who has to justify a decision afterwards needs a tool that recorded what it measured, not one that rounded a measurement up into a conclusion.
Console and sensor node
RadAir is two pieces. The macOS console is what the operator looks at. The sensor node is a Linux machine in the vehicle that drives the receiver and streams frames over a JSON lines protocol — the same protocol a local USB receiver speaks, so the detection engine never learns what is feeding it. The console keeps a registry of receivers, local and networked, and the same frames arrive from live hardware, from a recording or from a node across the vehicle.
CONSOLEmacOS · SwiftUI
SENSOR NODELINUX · JSON LINES
RECEIVERSREGISTRY · LOCAL + NETWORK
TODAYRTL-SDR · 24 MHz – 1.7 GHz
FIELD-CLASS RECEIVERPLANNED
A field-class receiver is a purchasing decision, not a rewrite. The provider layer already exists, so the day one arrives the detection engine does not have to change.
How a detection is actually made
For every band, receiver and sweep grid, RadAir keeps its own background: a per-bin median and spread taken from the last thirty sweeps, usable after ten. An alarm is energy that clears that background by a set margin and holds across sweeps. Nothing here is learned from a training set and nothing is a signature match — it is arithmetic over what the receiver reported, which is why the engine can always say why it fired.
BACKGROUNDPER-BIN MEDIAN · LAST 30 SWEEPS
USABLE AFTER10 SWEEPS
ALARM MARGIN+8 dB OVER BACKGROUND
WHILE THE VEHICLE MOVES+3 dB
LEVELSRELATIVE dB · NEVER dBm
EVENT POSITIONPLACE OF RECEPTION
On top of that arithmetic sits an editable signature library. A signature carries its own confidence, where its numbers came from, and a flag for whether anyone has ever confirmed it in the field — today that flag is empty on every one of them. Signatures are as much for silencing a known emitter as for raising an alarm: an amateur repeater on 430–440 MHz is a fixed transmitter, and saying so out loud is more useful than reporting it again on every pass.
A transmitter already running while the background is being learned becomes part of that background. RadAir says so on screen rather than hiding it. Fibre-guided and LTE-linked drones are invisible to any passive RF sensor, including this one.
Evidence and the decision record
Every operator decision that opens something sensitive is written into a hash-chained record: who, when, which source, on what authority and for how long. Entries cannot be removed from the interface, a unit can require a second person's confirmation, and a session carries an integrity manifest. A field tool that cannot account for its own use is not usable by a service that has to account for everything.
An incident sits in the same chain. It is the operator's own account of something that happened, and it carries references to the alarms, events and decisions it was built from — so the conclusion and the measurements behind it stay attached to each other instead of living in a report somebody wrote afterwards from memory.
DECISION RECORDHASH CHAIN
INCIDENTOPERATOR RECORD · SAME CHAIN
INCIDENT REFERENCESALARMS · EVENTS · DECISIONS
SESSIONINTEGRITY MANIFEST
SECOND PERSONCONFIGURABLE PER UNIT
ENTRIESNOT REMOVABLE FROM UI
Honest limit: the gate protects the decision, not a picture. Video demodulation is not built yet, so there is no frame to withhold.
What the system is willing to call normal
A place can be drawn as a circle or a polygon, and RadAir records entering and leaving it from the console's own GPS, with enough hysteresis that a wandering fix does not manufacture a dozen crossings. What that buys is a baseline with an address: a catalogue of transmitters that belong to a particular place, so a mast that has stood there for years stops being reported as a discovery on every pass.
The bar for entering that catalogue is deliberately awkward. A transmitter has to come back in at least two sessions, on two different days, in the same cells of a 25 m grid. Across eighteen archived sessions the engine has raised fourteen alarms, which resolve into eleven groups, and exactly one has cleared that bar — an irregular 2.1 MHz signal centred on 431.1 MHz, received in the same six cells on 14 September and again on 16 September. The other ten are held back on a single session each, which is the rule working rather than the rule failing. A live alarm can still be labelled a known fixed transmitter by hand, which caps its priority and can silence the spoken warning, but the system will not make that call on its own.
PLACECIRCLE OR POLYGON
ENTRY / EXITCONSOLE GPS · HYSTERESIS
FIXED TRANSMITTER NEEDS2 SESSIONS · 2 DIFFERENT DAYS
SAME PLACE MEANSSAME CELLS OF A 25 m GRID
ALARMS · GROUPS14 · 11
ADMITTED SO FAR1 · 431.1 MHz · 14 + 16 SEP
The same restraint governs naming things. Wi-Fi sources are sorted into classes — vehicles, dash cameras, home and carrier routers, infrastructure, IP cameras — from network names and from 130 manufacturer prefixes checked against the IEEE registry. Across every recording made so far that classifier has produced exactly one camera, and it was a network somebody had named kamera. Zero factory camera names, on any pass. A camera sitting behind a router as an ordinary client emits nothing an access-point scan can see. Monitor mode now exists on a USB Wi-Fi card, but client capture is not built yet, so that camera is still invisible.
Entry and exit hysteresis has been exercised on synthetic fixes and a copy of a recorded journal, never yet against live GPS in a vehicle.
Interoperability
RadAir speaks Cursor on Target, so a vehicle can appear as a sensor inside a picture somebody else owns — multicast on the address ATAK listens to out of the box, or unicast to a TAK server. It is off by default. What matters is not that events leave the machine but what each event admits about itself: an RF alarm is a marker at the place of reception carrying an explicitly unknown accuracy, a Remote ID track says in the message that the position is the transmitter's own claim, and Wi-Fi and BLE contacts travel without identifiers unless an operator turns them on.
FORMATCOT 2.0 · UDP
TRANSPORTATAK MULTICAST · TAK UNICAST
DEFAULTOFF
RF ALARM POSITIONPLACE OF RECEPTION · ACCURACY UNKNOWN
Wi-Fi / BLE IDENTIFIERSWITHHELD BY DEFAULT
Verified so far only against a local UDP listener. It has not yet been put in front of a real ATAK client.
The same model, four contexts
EXPERIMENTAL
CARRIED DEVICE CLUSTERWATCH · RING · EARBUDS
AUTOMOTIVE CLUSTERVEHICLE SSID · VEHICLE BLE
INFRASTRUCTURE CLUSTER2.4 GHz AP · 5 GHz AP · BEACON
UNKNOWN RF ENTITYSIGNATURE · FREQUENCY · HISTORY
EXPERIMENTAL · FUTURE DIRECTION
Sensor fusion
The physical world and the RF layer may describe the same scene differently. Vision may observe a vehicle class and its movement while wireless sensors simultaneously observe an automotive Wi-Fi SSID pattern and BLE activity in the same place at the same time. Repeated spatial and temporal co-occurrence may support a possible association — never an automatic claim that they are the same object.
