CIS-C0/RFSentinel

Passively detects body cameras, license-plate cameras, patrol vehicles, drones, trackers following you, camera glasses and fake cell tower signs from the signals they already broadcast. No root, no Termux, no account.

RF Sentinel (also written RFSentinel) is a free, open-source police detector app for Android. What is RF Sentinel?

Website · Q&A · How it works · Discord

_{Live list (DedSec theme), why a device is flagged, the fsociety theme, and the Android Auto home screen. Demo data. All 13 themes · Android Auto}

• At a glance
• What it detects
• Features
• Quick start
• How it works
• Using the app
• Android Auto
• ESP32 boards
• Themes
• Privacy
• Limitations
• Q&A
• Building from source
• Signatures and sources
• Contributing
• Acknowledgements
• License · Disclaimer

Every match shows its evidence, its source and a confidence tier: weak (< 50), probable (50-79) or strong (80+). Known cameras also raise the threat headline as you get closer (strong within 50 m, fading out by 500 m). Full reference: docs/SIGNATURES.md.

Detection

• Payload, name, UUID and company-ID signatures plus IEEE vendor prefixes (MA-L / MA-M / MA-S), each with a cited source and a confidence
• Evidence fusion: independent matches on one device strengthen each other (noisy-OR, capped at 90)
• Patrol-vehicle detection: police-type gear whose signals rise and fall together is grouped as a possible police vehicle
• Address-rotation linking: keeps following a device when its Bluetooth address changes, including in Locate
• Pinpointing: a flagged device you pass from more than one side is placed where it most likely is, from its signal at every spot you passed (multilateration), with a circle it's very likely in; a straight road that can't tell the side gets a circle covering both. GPS runs precise every second while a flagged device is in range (Settings → Location, on by default)
• Follower alerts: a tracker or flagged device that stays with you (default 10 min and 800 m, adjustable) raises may be following you
• Remote ID drones decoded live, with a drone overhead alert within 200 m
• Optional cell tower change alert: says so each time the phone moves to another serving tower (Settings; a change while parked is a classic fake-tower sign)
• Fake cell tower signs checked every 15 s, with persistence, call and border suppression (modelled on EFF's Rayhunter as far as Android allows without root)
• Hidden WiFi networks identified from WPS data, Cisco AP names and vendor elements, and linked to the visible network on the same router
• Ordinary devices named precisely: exact AirPods / Beats model, device class, IEEE registrant; decoded Apple Continuity, iBeacon, Eddystone, Fast Pair
• Editable watchlist (exact addresses, prefixes, name / vendor rules) with Global, Canada, US, France, UK, Portugal, Germany, Spain and Italy presets; per-category on/off switches
• Bluetooth 5 extended advertising and LE Coded (long range) where the phone supports it

Known cameras

• Plate-reader, speed and red-light cameras from OpenStreetMap appear on the map by themselves and are kept offline, refreshed weekly
• Warned as you approach one, even cellular-only cameras no radio can detect
• Pre-download everything within a radius you set (10-200 km), or every mapped Flock camera in the US and Canada (~143,000)
• Tap a camera to silence its alerts for good

Alerts

• Sound, vibration pattern per tier (1 / 2 / 3 pulses) and spoken announcements through the phone's own speech engine (prioritised, voice and speed pickers)
• Radar-detector beeps option: after an alert, beeps speed up as the flagged device gets closer
• Short spoken alerts option ("Body cam", "Police car", "Speed camera, 50")
• Voice loudness boost up to +15 dB (without distorting) for when music drowns the voice, in the car too, and an option to pause music while an alert is spoken
• Discreet mode, adjustable alert threshold, mute from the app or the car
• Floating threat bubble over Waze, Google Maps or any app, with a pop-up card saying what was just detected
• Alert card on the full screen map: each alert (a flagged device, a known camera, a Waze report, a cell warning) pops up as a card under the turn banner - what it is, how far, how sure, "on your route" when it is - and goes by itself after a few seconds (longer for a strong match or something following you) or when dismissed; tap it to look at the place. Silent, honours Discreet mode and the alert snooze
• Floating mini map over other apps: the devices and known cameras around you, like the app's map (pinch to zoom, drag, resize)
• Android Auto alert cards say what it is, how sure, about how far and how many more are flagged ("BODY CAM · strong · ~40 m · near (-58 dBm) · +2 more flagged")
• Notification, Quick Settings tile and home-screen widget

Map & history

• Vector map (MapLibre with OpenFreeMap, OpenStreetMap data; light and a readable night map with shops, landmarks, one-way arrows and highway shields; optional Mapbox map) with your GPS trace and every device pinned where its signal peaked, flagged devices at their pinpointed spot with its circle (tap a spot to list everything heard there), the same filter chips as the list (including Waze, which draws reports as coloured dots by type), self-centering
• Optional cell tower layer (or the map's Cells chip): every tower seen while scanning, at the spot where its signal was strongest
• Record traces of your route and the devices along it, with the screen off (with the network names each device asked for, when a USB adapter or Marauder board is plugged in)
• History map & timeline: heatmap of where flagged equipment showed up, and when (hour of day, day of week)
• Device history (search): every device the app remembers, in range or not, searchable by address (with or without colons), name, vendor, type or your note, filtered to favorites, flagged before or seen today; tap one for its details page. History is kept as long as you set in Settings → Data

Driving

• Android Auto app: threat headline, next camera ahead, recent alerts, filtered device lists, cell towers, hardware status, live map with cameras and drones, OpenStreetMap turn-by-turn navigation, alerts through the car speakers with Mute 30 min / Ignore buttons
• Starts by itself in the car (your car's Bluetooth or Android Auto) and stops when you leave
• Night Drive red-only theme; screen stays on while charging

Hardware

• ESP32 boards over USB OTG (OUI-Spy, GhostESP, Marauder incl. dual-band ESP32-C5 boards, or through a Flipper Zero) or Bluetooth (OUI-SPY App-Controlled) add their detections and extend range
• USB WiFi adapters in monitor mode over OTG, no root: RTL8811AU / RTL8821AU (e.g. ALFA AWUS036ACS, 2.4 GHz; 5 GHz experimental, Settings → External hardware), RTL8812BU / RTL8822BU (2.4 + 5 GHz, e.g. TP-Link Archer T3U, Wise Tiger AC1200), RTL8814AU (ALFA AWUS1900, 2.4 + 5 GHz), MT7612U (ALFA AWUS036ACM, 2.4 + 5 GHz), MT7921AU (ALFA AWUS036AXML, WiFi 6E: 2.4 + 5 + 6 GHz, experimental), RTL8187 (ALFA AWUS036H), RT3070 (ALFA AWUS036NH / NEH) and, experimental, AR9271 (ALFA AWUS036NHA). No Android scan limit, longer range, and client devices (laptops, phones, cameras connected to a network) the phone's WiFi scan can't see. Single-antenna dongles are detected and handled automatically
• Requested networks: the WiFi names nearby devices ask for (probe requests), from a USB adapter or a Marauder board, in an optional list; watch a name to get an alert whenever any device asks for it
• Record frames to .pcap for Wireshark (Settings → External hardware): every frame a USB WiFi adapter or V2X board hears, with its channel and signal
• The ALFA AWUS036ACS's light blinks with received traffic (Settings → External hardware switches it off, for the adapters whose light the app can control)
• More from every frame: WPS maker / model / device name, a probe fingerprint that survives MAC randomization (watchable: "every device of this type"), and the real name of hidden networks when a device joins them

Interface

• Live list and radar view, filter chips with live counts (flagged, trackers, drones, favorites, new, Bluetooth, WiFi, cells, Waze, external hardware), search; Waze reports in range show nearest first with their exact distance and direction from you (ahead / behind / left / right while driving), and flash at the top once they reach your alert threshold; pull the list down (or use the menu) to check Waze right now, and the Waze status screen shows what is sent and when
• Tools (wrench button next to the List / Radar / Map toggle): Cell towers (serving and neighbour cells with network, IDs, channel and signal, plus every tower seen while scanning), WiFi channels and WiFi spectrum analyzers for 2.4 / 5 / 6 GHz
• Cell towers in the live list: the serving cell and its neighbours appear under All, after the devices
• Scan watchdog: a scanner that goes silent is restarted on its own
• Device details: evidence, identity, decoded data, signal graph, Locate mode, history, raw advertisement
• Setup wizard (theme, region, alerts and voice, bubble, car start, camera warnings, cell alerts, camera radius, screen, permissions); Settings save themselves
• Check for updates (menu ⋮): compares with the latest GitHub release, only when you tap it
• Screen rotation (Settings → General): normal, auto-rotate including upside down, or always upside down with the USB-C port at the top for an antenna or adapter - even on phones like the Pixel that never auto-rotate upside down
• 13 themes, including the DedSec (Watch Dogs 2) and fsociety (Mr. Robot) fan themes

Data & privacy

• Everything stays on the phone; export as CSV, JSON, KML, GPX or GeoJSON
• Report unknown device: a privacy-safe signature (no full address, serials, location or times) to help add new equipment
• No accounts, no cloud, no analytics

Requires Android 8.0 or newer on a 64-bit ARM phone (almost every phone since 2017; the release APK is about 30 MB).

1. On your phone, tap Download the app above, or open the latest release.
2. Under Assets, tap the file ending in -release.apk (not the "Source code" archives).
3. Open the downloaded file from the notification, or from Files → Downloads.
4. If Android blocks it, tap Settings, enable Allow from this source, go back and tap Install.
5. Open RF Sentinel. The setup wizard walks you through theme, region, alerts, camera radius and permissions.
6. Tap Start and grant location and Nearby devices.

Updating: Check for updates has an Install now button: it downloads the new release inside the app (checked against the size and SHA-256 GitHub lists for it, and against the app's own signing key) and hands it to Android's installer. Android asks you once to allow RF Sentinel to install apps, then shows its Update card. You can also install the newer APK over the existing one yourself. History and settings are kept. Samsung, Xiaomi or OnePlus stopping the scan? Set RF Sentinel's battery usage to Unrestricted (Settings has a shortcut).

BLE adverts ─┐
WiFi beacons ─┼─> signatures + watchlist ─> evidence fusion ─> patrol grouping ─> alerts
Cell info ────┤    (SIG IDs, UUIDs, payload   (noisy-OR,       (RSSI correlation    (sound, voice,
ESP32 boards ─┘     tags, IEEE prefixes)       cap 90)           r ≥ 0.6, ≥ 8 s)      bubble, car)
                         │
                         └─> address-rotation linking ─> follow detection (time + distance with you)

• Confidence tiers: weak < 50 (amber, silent by default), probable 50-79 (alerts at the default threshold), strong 80+.
• Fusion: 1 - (1 - top) × Π(1 - 0.5 × support); e.g. watchlisted address 70 + Zebra serial name 50 → 78.
• Patrol vehicle: at least two different roles whose RSSI correlates (Pearson r ≥ 0.6 over ≥ 8 s), or both parked and seen within 30 s; scored 24 + 12 × roles, +10 if moving together, cap 88.
• Rotation linking: same advert fingerprint (names, UUIDs, payload sizes, TX power, connectable) as exactly one device that went silent 1.5-30 s earlier.

Details: How it works and docs/SIGNATURES.md.

• Threat banner: all clear, weak, probable or strong, or may be following you.
• Live list: every device in range (each leaves 30 s after it was last heard on Bluetooth, 60 s on WiFi, adjustable), with vendor, type, radio, signal, rough distance, and NEW / ★ / FOLLOWING badges. A green INTERNAL badge means the phone heard it; a blue ESP32 badge means a connected board reported it. Flagged devices sort first and flash in their category colour.
• List / Radar / Map: turn on one view to fill the screen, or two or all three to see them together (stacked, side by side in landscape), with a handle between each to resize. The Map view is the full map with every button; its ⛶ button opens it on its own screen. On the radar, closer to the centre means a stronger signal; the angle is not a direction (a phone can't measure one).
• Scrolled to the top, the list stays there as alerts arrive; scrolled down, a New alert pill takes you up.
• Filters and search: All, Flagged, Trackers, Drones, Favorites, New, Bluetooth, WiFi, Cells, External (heard by an ESP32 board or a USB WiFi adapter). Search matches name, address, vendor and type.
• Tap a device for details. Long-press for watchlist, whitelist, favorite, copy, ignore, and Report unknown device.
• Floating bubble (Settings, needs Display over other apps): green when clear, orange for probable, red for strong or a follower, with the count. Each new alert shows a small card beside it for a few seconds (what, type, distance).
• Floating mini map (Settings, same permission): the devices and known cameras around you over Waze, Google Maps or any app, centred on you, with a threat-colour border. Pinch to zoom, drag to move, the corner handle resizes it, tap to open the full map.
• In the car (Settings → Start scanning automatically in the car): pick your car's Bluetooth; scanning starts when the phone connects to it or to Android Auto, and stops when you leave if the car started it.

The app never connects to a device. The details screen shows why it's flagged (each signature with its evidence and source), identity and how it was determined, address type and trackability, decoded protocol data, WiFi band, channel and security, drone Remote ID with drone and operator positions, a live signal graph with Locate mode (beeps faster as you get closer), history, and the raw advertisement.

• The map shows your position, the trace being recorded, and every device heard around you, placed where your phone was when its signal was strongest. That's an approximation, not a fix. Each dot stays pinned to its spot as you pan and zoom; tap a spot where several devices were heard to pick one from a list.
• North up / heading up / 3D: the compass button steps through north up, heading up (turns with your direction of travel while moving), and a 3D driving view - tilted in perspective with your position low on the screen, like a car navigation app. The sun / moon button switches the map between light and dark, the gear opens the map settings. Settings → Map sets the default zoom (17 is close to Waze; the 3D view pulls back from it as you speed up), the 3D view angle (30° to 60°) and the map provider: OpenFreeMap (free, no account) or Mapbox. The floating mini map always uses OpenFreeMap.
• Cell towers (Settings → Map → Show cell towers): towers seen while scanning, at the spot where your phone heard them strongest - an estimate, not the tower's real position (looking that up online would reveal where you are).
• Known cameras (Settings → Known cameras): Download cameras around me fetches plate readers within your radius (10-200 km, 100 by default); US & Canada plate cameras fetches every plate reader mapped in the US and Canada (~18 MB, refreshed weekly on WiFi). Both use DeFlock's hourly snapshot of OpenStreetMap, plus cameras it leaves out, straight from OpenStreetMap. Tap a camera → Ignore alerts to never be warned about it again.
• CCTV cameras (Settings → Known cameras → Show CCTV cameras, off by default): ordinary surveillance cameras mapped in OpenStreetMap - city street cameras, shop and building cameras. Everything within your camera download radius is fetched in the background (also by Download cameras around me); they show from city zoom, with a shaded view cone where the direction is mapped when you zoom in. Public ones by default; Include private and indoor CCTV adds the rest. Map only (no alerts). Most are wired, so no scanner can detect them; this shows the ones volunteers have mapped (the same data as Surveillance under Surveillance).
• Record trace saves your route and every device heard along it, with the screen off, and can start with each scan.
• Screen: always on, on while charging (default) or normal.
• Crash log: if the app ever closes unexpectedly, what went wrong is saved on the phone (never sent automatically); it offers to send it next time, or Settings → Lists, tools & about → Export crash log.

Turn-by-turn directions on the map, with your scanner running alongside.

• Where to? The magnifier button on the map searches places and addresses as you type: your own places that fit show first, results say what kind of place they are ("Park · Munich"), the best name match comes before one that merely mentions the words, and a pair of coordinates works too. Pressing the keyboard's search key (or the Search for row) looks in more places at once. Empty, it lists Home, Work, starred and recent places (all kept on the phone) and kinds of place to look for - petrol, charging, food, parking, shops, pharmacy, hospital, cash, toilets, rest stops - near you, and along your route while you are guided (a stop to add, in the order you reach them). A long press on the map drops a pin: it names what's there, offers Directions, and can be starred.
• Routes: up to three, each with its time and the main roads it takes, drawn on the map. Avoid tolls / highways / ferries ticked while you plan (or on the trip menu) is remembered for the next destination, and is the same setting as Settings → Navigation.
• Round cameras: Avoid speed cameras and Avoid plate readers (the same chips, trip menu and Settings → Navigation switches) plan the route around the known cameras of the camera map. The route is asked for, the cameras on it are found, the road each one is on is left out and the route is asked for again (a few times) until none is on it or there is no way round. Each route says what is left on it ("no plate readers", "2 speed cameras") and the fastest way stays on offer to compare. A camera at the start or end, or on the only bridge, can't be avoided and is counted. The cameras along the route are fetched first when they are not on the phone yet (Settings → Known cameras → Download automatically, or download them there beforehand); it also works when you are re-routed and in Android Auto. A detour can be longer. Start begins guidance - and the scan too, unless you turn that off (Settings → Navigation); a scan already running is left as it is, and it keeps going after you arrive.
• Guidance: a banner with the next turn, its distance and street, the lane arrows where the map has them, and the turn after it when it follows closely; an arrival bar with your arrival time, time and distance left; whole route view; mute; add a stop. It follows your north-up / heading-up / 3D choice, zooms in as a turn comes up, keeps the screen on, and carries on with the screen off (a notification shows the next turn). Roundabouts name the exit ("2nd exit"). On the main screen's small map pane there is a slim one-line banner; tap it for the full screen map.
• Arrival time starts from the route's usual driving time and then follows how you really drive (stops at lights, a slow road), so it is closer than a fixed figure without any traffic service.
• Night map: after sunset, worked out on the phone from your position and the time, the map turns to its night look while you are guided (Settings → Navigation; the sun / moon button keeps the look you choose).
• Spoken directions ("In 500 meters, keep right", then "Keep right") come as navigation audio, so music dips under them as in Maps, in the voice, speed and loudness chosen under Alerts. A "something is following you" alert cuts in on a direction; the last prompt before a turn cuts in on other alerts; otherwise they take turns. Miles or kilometres by your region, or your choice.
• Re-routes by itself when you leave the route or turn round, and ends when you arrive. Open in... hands the destination to Google Maps, Waze or any map app.
• Not included: live traffic (the arrival time is the route's usual driving time), speed limits and offline routes.
• Routes come from Valhalla on the OpenStreetMap Germany server and places from Photon as you type, and from OpenStreetMap's own Nominatim as well when you submit a search (the keyboard's search key, or the Search for row) - whichever answers first is shown at once. They see what you search for, where you start, stop and finish, and your IP address - never what you scan - and only when you search, long-press the map or start a route. Search sends your position rounded to about 1 km. Avoiding cameras adds the places on your route where known cameras are (the road of each, nothing else about them) to the route question. Looking for petrol, food and the like asks OpenStreetMap's Overpass servers (the same ones as the camera downloads) for that kind of place around you - your position rounded to about 1 km, or the road ahead as points rounded to about 200 m.

Menu → Export... (or Settings → Data → Export all devices):

A driver-safe, template-based Android Auto app:

_{Home, recent alerts, flagged devices, More, live map and known cameras (demo data).}

• Home, most important first (a car shows about six rows while driving): the threat headline (tap for the flagged devices), the next known camera on your way with its distance, recent alerts, the map, nearby devices and More. Start/Stop and a speaker button that mutes or unmutes all alert sound sit in the header.
• Nearby devices with the phone's filters and live counts (flagged, trackers, drones, favorites, new, Bluetooth, WiFi, ESP32 / USB). Each row says which radio heard it.
• Device details with Whitelist, Watch and Favorite; trackers get the phone's three ignore choices (it's mine, today only, pause follow warnings). Navigate hands drones with a known position to your navigation app. A device that has left still shows its last alert.
• Recent alerts: the last 40 alerts (devices, cameras, cell warnings), kept after the device is gone.
• Cameras: tap one to see it alone on the map, navigate to it, or tap its row to turn its alerts off or back on (faded on the maps).
• More: snooze alerts for 30 minutes, spoken alerts in the car, short spoken alerts, whether AirTags count as trackers, cell towers (fake-cell check status, serving cell and neighbours) and hardware status (phone radios and the scan watchdog, ESP32 / Marauder / Flipper on USB, OUI-SPY over Bluetooth, USB WiFi adapter).
• Live map: RF Sentinel's own OpenStreetMap map on the car screen with devices, known plate / speed / red-light cameras and your position. Drag, pinch or + / −; ◎ follows the car again. Needs car API level 7; older Android Auto gets car-drawn maps with device and camera lists.
• Navigation: Navigate to... searches with Photon and Nominatim (on submit only), starts from Home, Work, starred and recent places kept on the phone, routes with Valhalla, speaks turns and re-routes.
• Alerts appear as heads-up cards with Mute 30 min and Ignore buttons, and play through the car speakers as navigation audio, briefly lowering your music.
• Screens only redraw when what they show has changed, and a screen that fails to build shows a short message instead of closing the app.

In a real car, Android Auto only shows apps like this one when they come from a trusted store. Google lets apps built with its Car App Library (as RF Sentinel is) run in a real car only when they're installed from Google Play or ONE store, and Android Auto's Unknown sources developer setting doesn't cover them (Google's testing guide). The GitHub APK's car screens therefore run only on Google's Desktop Head Unit emulator.

The GitHub APK still works in a real car, through the two app types that setting does cover. Android Auto settings → tap Version ten times → ⋮ → Developer settings → enable Unknown sources, then reconnect:

• RF Sentinel screen (media-style): tabs for Threats, Cameras (nearest known cameras, the one ahead first), Alerts and Status (start / stop scanning, mute, cell towers, hardware), plus a card with the current threat and Scan / Mute buttons. It never plays anything, so your music keeps playing and keeps the steering-wheel buttons.
• Alerts as messages: every alert arrives as a message from RF Sentinel, which the car shows and can read aloud. Reply "mute" to silence alerts for 30 minutes or "ignore" to stop alerting about the latest device.

If RF Sentinel is missing from the car's launcher, tick it under Customize launcher. The live map needs the full car app, so it stays on the Desktop Head Unit.

Plug an ESP32 board into the phone with a USB OTG cable while scanning (allow USB access the first time), or pair one over Bluetooth. What the board reports merges into the list with a blue ESP32 badge.

Native-USB boards (ESP32-S2/S3/C3/C5/C6) and boards with a CP210x or CH340 bridge work. RF Sentinel only asks OUI-Spy for its version and live table, only asks GhostESP to scan and list networks, and only runs Marauder's passive sniffbeacon / sniffprobe sniffers (no attack commands, no settings changes).

Marauder on ESP32-C5 (Marauder v8, BFFB v2, T-Dongle C5, C5 DevKit) hears 5 GHz networks the phone's throttled WiFi scan misses, which helps catch vehicle routers on a pass. Keep Channel Hop on in Marauder's settings; RF Sentinel says so if the board stays on one channel.

Flipper Zero (e.g. with the BFFB board): plug the Flipper into the phone and open GPIO → USB-UART Bridge on the Flipper; RF Sentinel then talks to the board's Marauder through it. A BFFB v2 can also be plugged in by its own USB-C port.

OUI-SPY over Bluetooth: start scanning with the board on, then Settings → Pair OUI-SPY board and pick OUI-SPY-xxxx. Pair it only there, not in Android's Bluetooth settings: the board keeps no pairing keys, so a phone-side pairing breaks the link (the app tells you to tap Forget if it finds one). While scanning, RF Sentinel switches on the board's Flock-BLE, Flock-WiFi, Sky Spy and Detector engines, and by default its Wardrive survey engine so the board relays every WiFi network and Bluetooth device for RF Sentinel's own rules. In that mode the board sends standard WiFi probe requests; turn Settings → OUI-SPY: relay every network and Bluetooth device off to keep it listening only. The board's UniPwn, PCAP and Foxhunter engines are never used.

Plug a supported USB WiFi adapter into the phone with an OTG cable while scanning and allow USB access on the prompt. RF Sentinel drives it directly over Android's USB host API (no root, no kernel driver), puts it in receive-only monitor mode and hops the channels (2.4 GHz on 88xxau, RTL8187, RT3070 and AR9271; 2.4 GHz and 5 GHz on 88x2bu, 8814au and MT7612U; 2.4, 5 and 6 GHz on the MT7921AU, 6 GHz on its 15 preferred scanning channels, where access points beacon). Access points (beacons, probe responses) and client devices (probe requests, data frames) go through RF Sentinel's own rules like everything else, with a purple USB WIFI badge.

The adapter never transmits (on the MT7612U and RT3070 even the automatic ACK replies are switched off). Settings shows its status, and Export USB WiFi adapter log saves a text file (app and phone version, the USB devices plugged in, the driver log) to send to the developer - no nearby devices' addresses or network names are in it.

On a single-antenna 8812BU dongle the antenna sits on one of the chip's two receive paths, while the chip hears 2.4 GHz beacons on path A only. RF Sentinel compares both paths on the first seconds of traffic and moves 2.4 GHz reception to the one with the antenna (about 30 dB better on the dongle we tested - more than Realtek's own Windows driver gets from it).

Plug an RTL-SDR dongle (R820T / R820T2 / R860 tuner, e.g. RTL-SDR Blog V3, or the RTL-SDR Blog V4) into the phone with an OTG cable while scanning. RF Sentinel sweeps the North American public-safety radio bands - the 700 and 800 MHz bands where police, fire and EMS radios (not towers) transmit, and the shared VHF / UHF land-mobile bands - and measures only how much energy each 12.5 kHz channel carries. Nothing is demodulated, decoded, recorded or decrypted: it can't know what was said or who said it.

It first learns which channels are busy all the time where you are (towers, repeaters, trunking control channels, pagers) and ignores them; a strong burst on a normally quiet channel means a radio is transmitting close by, and raises a Two-way radio transmitting nearby alert (category RADIO, can be switched off in Settings). On 700 / 800 MHz that's a probable sign of a public-safety radio; on VHF / UHF, which businesses, schools and transit share, only a very strong signal counts, and only as a weak sign. Consumer walkie-talkies (FRS / GMRS, MURS), marine, railroad, weather and paging channels are skipped. The dongle's log is in the exported USB adapter log.

Cellular transmitters (optional, off by default): it can also watch the phone / modem side of the in-range LTE bands (600, 700 including Band 14 - the public-safety broadband block FirstNet uses in the US - 850 and part of 1700 MHz) for a transmitter close to you: a vehicle modem, a Cradlepoint-style router, a camera with a SIM. Energy only, nothing decoded or identified, and towers (which use the other half of each band) are never watched. A phone counts too, so it's a weak sign on its own; it matters when it travels with you or lines up with a device flagged over WiFi / Bluetooth.

Hits show in the main list (the Radio filter, or under All): frequency, its name when known, signal above the noise, and whether it's getting closer or moving away. The dongle's status shows on the main screen next to the other hardware. Settings → RTL-SDR radio:

• Sensitivity (how far above the noise a burst must be), the built-in bands on / off, your own bands, ranges never to report (e.g. a business band) and frequencies to watch (reported whenever they're active), one per line in MHz.
• Say the frequency (and its name) instead of "Radio transmitting nearby", and a closer / moving away call-out when the signal changes by the set number of dB.
• Frequency names: import a CSV (RadioReference's export, CHIRP, or any file with a frequency and a name column), and / or let RadioReference name the FCC licences near you (US; your own RadioReference Premium login and developer key, stored encrypted; your position rounded to ~1 km is sent, at most once a day per area). A hit takes the closest name within the set ± kHz.

Requested networks (Menu → Requested networks): phones and laptops ask by name for networks they joined before. With an adapter or a Marauder board plugged in, RF Sentinel can keep these names (off by default: they're other people's network names; always kept while a map trace records). Tap Watch on one to get an alert whenever any device asks for it. Devices also show their WPS maker / model / name, a probe fingerprint you can watch ("every device of this type", even with random addresses), and hidden networks show their real name once a device joins them. Built in: Axon Fleet in-car network names ("Axon12-5g", vehicle number + "-5g") and Cradlepoint vehicle routers on their default names.

Pick a theme in the setup wizard or under Settings → Appearance.

DedSec	fsociety	Night Drive	Night Vision
Amber CRT	Synthwave	Tactical	Blueprint
Paper	System	Light	Dark
Material You

Radar view in every theme

DedSec	fsociety	Night Drive	Night Vision
Amber CRT	Synthwave	Tactical	Blueprint
Paper	System	Light	Dark
Material You

_{Screenshots use made-up demo devices (debug builds only), run through the real detection pipeline, so scores, groupings and labels match what the app shows.}

• Receive-only. Nothing is transmitted, jammed, spoofed or connected to.
• No accounts, no cloud, no analytics. Detections live in a local database excluded from cloud backup.
• Network use is limited to map data: the map (vector tiles, styles and fonts from OpenFreeMap, OpenStreetMap data; or from Mapbox if you choose it in Settings → Map, with Mapbox's own usage statistics switched off) while the map is open, the road tiles of your area and direction while Only alert for reports ahead is on (OpenFreeMap, kept on the phone), and the known-camera list for the area you look at, fetched once per area and refreshed weekly from overpass-api.de (or the mirrors overpass.kumi.systems and overpass.private.coffee). Camera downloads also fetch DeFlock's region files from cdn.deflock.me. These servers see your IP address and the area, never your scans. Turn off Show known cameras automatically to fetch only when you tap a download. Navigation, on the phone or in Android Auto, uses Photon and Nominatim (place search) and Valhalla (routes) only when you search, long-press the map or start a route; they see the search, your start and destination, and your IP address. Map data © OpenStreetMap contributors (ODbL), © OpenMapTiles, © Mapbox when chosen.
• Two optional online sources, off by default: Police / government aircraft sends a position rounded to about 1 km to the community ADS-B feeds adsb.fi / adsb.lol every minute while scanning. Waze reports use either your own OpenWeb Ninja API key (stored encrypted on the phone; a box around you at the interval you pick, 4 minutes by default) or, if you choose it in Settings, Waze direct: an anonymous Waze account made on the phone (stored encrypted), presented to Waze as the Waze app, that sends Waze (a Google service) your IP address and your position rounded to a 1 km grid, so never closer than about 500 m, at the interval you pick (every minute by default). Direct's protocol layer is vendored from highway-radar-sabre-plus (MIT), see app/src/main/java/com/rfsentinel/app/online/wazert/LICENSE. OpenWeb Ninja and Waze are third-party services RF Sentinel isn't affiliated with and doesn't endorse; using them is at your own risk and under their terms.
• Data leaves the phone only when you export or share it.
• Optional permissions: Nearby devices → connect only to list your paired Bluetooth devices when you pick your car; Display over other apps only for the floating bubble. No contacts, storage, camera or microphone access.

• A match is a signature, not an identification. 00:25:DF means "a device registered to Axon Enterprise", not "a police officer". Verify weak matches.
• Phone radios are weaker than dedicated hardware. Expect shorter range and fewer catches than purpose-built scanners; an ESP32 board helps.
• WiFi scanning is throttled by Android to about four scans per two minutes; the default 30-second interval respects that.
• WiFi only sees access points. Client devices, such as in-car laptops, are invisible without monitor mode.
• Signal strength is not distance. Estimates are often off by 2-3×, and the radar angle is not a direction.
• Bluetooth needs the phone screen on. With the screen off, Android pauses app Bluetooth scanning, and on some phones (Pixel tested) nothing gets through until the screen comes back on. WiFi, the fake-cell checks, known-camera warnings and ESP32 / USB hardware keep working. Android Auto warns you when a scan starts with the phone screen off and shows "Bluetooth limited" on its home screen.
• Cellular-only devices are undetectable by radio, including most non-Flock plate readers and LTE GPS trackers. The known-camera map covers mapped ones.
• Not a radar detector. Police radar and lidar, and radios' voice channels (VHF / UHF / 700 / 800 MHz), can't be received by a phone.
• Fake cell tower checks are heuristic. Without root, Android shows the cells but not ciphering or signalling, so each sign has innocent explanations. The strongest protection is turning off Allow 2G (Android 12+); Android 15+ can also warn when a network asks for your SIM identity or turns encryption off (Cellular security → Network notifications, linked from Settings).
• Randomized addresses defeat vendor-prefix matching. Payload signatures and rotation linking partly compensate.
• Android only. iOS doesn't expose the advertisement data, WiFi scans or cell info this needs.

70+ more answers on the Q&A page, and how RF Sentinel compares with Flock You, OUI-Spy, Wardrive Go, Fieldwatch and others: comparison.

Requirements: Android Studio, or JDK 17+ with the Android SDK (platform 37).

./gradlew assembleDebug

./gradlew testDebugUnitTest lintDebug

Mapbox is optional: with MAPBOX_ACCESS_TOKEN=pk... (your own public token) in local.properties (git-ignored) the build offers the Mapbox map; without it the app builds and runs on OpenFreeMap only. The Mapbox SDK downloads from Mapbox's public Maven repository without an account.

The debug APK is written to app/build/outputs/apk/debug/. tools/gen_assets.py regenerates the offline IEEE and Bluetooth SIG databases. The website is built from site/ with python tools/build_site.py (see site/README.md).

storeFile=keystore/rfsentinel-release.jks
storePassword=...
keyAlias=rfsentinel
keyPassword=...

adb shell am start -n com.rfsentinel.app.debug/com.rfsentinel.app.MainActivity --ez demo true

Every bundled prefix, company ID and UUID was checked against the IEEE registry or the Bluetooth SIG assigned numbers, and each entry cites its source, score and category. The full reference, including evidence fusion, patrol-vehicle detection and WiFi identification, is in docs/SIGNATURES.md.

• all-cameras-are-beacons signature reference (Apache-2.0): signature values and confidence ladder
• opendroneid-core-c (Apache-2.0): Remote ID message layout
• droneID_FR (github.com/khancyr/droneID_FR): French electronic drone ID beacon layout
• IEEE Registration Authority: vendor database
• Bluetooth SIG assigned numbers: company IDs, service UUIDs, appearance values

• Found an unidentified device? Long-press it → Report unknown device, check what's shared, and paste it into a new issue or the Discord.
• New signatures are welcome when they cite a registry or published research. Please don't guess.
• Map cameras in OpenStreetMap (e.g. through DeFlock): every RF Sentinel user gets them.
• Bugs and ideas: issues or Discord.
• Star the repo so others find it.

Inspired by the nyanBOX hardware device and the RF Party app, which was based on Alan Meekins' DEF CON 31 talk "Snoop Unto Them As They Snoop Unto Us". Some feature ideas come from SØPHIA, BLE Radar (MetaRadar) and ESPsoup. No code from those projects is included. European V2X (ITS-G5) frames are read the way V2X2MAP by Peter Holzhauser does (MIT; see esp/V2X2MAP-LICENSE), with the CAM / DENM messages decoded from ETSI's own ASN.1. Tracker service IDs follow AirGuard by SEEMOO / TU Darmstadt (Apache-2.0). The USB WiFi monitor-mode driver for RTL8811AU / RTL8821AU adapters (app/src/main/java/com/rfsentinel/app/usb/) is ported from Wardrive Go by RocketGod (GPL-3.0), whose register tables come from Realtek's 88xxau Linux driver (aircrack-ng/rtl8812au, GPL-2.0; see usb/NOTICE.md); its handshake / PMKID capture was left out. The RTL8812BU / RTL8822BU driver is ported from the receive path of devourer by OpenIPC (GPL-2.0), with the firmware and register tables from Realtek's rtl88x2bu driver; every transmit path was left out. The RTL8814AU, MT7612U, RT3070 and AR9271 drivers and the FREE-WiLi 2 reader are ported from Wardrive Go too (checked against and fixed from the Linux rt2800usb, mt76x2u and ath9k_htc drivers), and the RTL8187 driver from the Linux rtl8187 driver with Kismet's Android PCAP Capture as the USB reference. The MT7921AU (WiFi 6E) driver is ported from mt76-usb-macos by Network Weather (BSD-3-Clause-Clear), a transcription of the MT7921 path of the Linux mt76 driver (openwrt/mt76, MediaTek and the mt76 authors, BSD-3-Clause-Clear); its transmit path was left out. Their firmware (Ralink rt2870.bin, MediaTek mt7662 and MT7961, open ath9k_htc) is the unmodified linux-firmware images, with their licences in assets/usbwifi/; see usb/NOTICE.md. The map's anchored point layer follows Wardrive Go's approach - thank you.

Part of the MAC-prefix data was cross-checked with, and extended from, the lists in Flock You and OUI-Spy (with @NitekryDPaul's nite-oui-collection), Wardrive Go, Flock-You-Android and Fieldwatch - thank you. Every prefix was re-checked against its IEEE registrant; see docs/SIGNATURES.md. Known plate-reader locations come from DeFlock's snapshot of OpenStreetMap, mapped by its volunteers (data © OpenStreetMap contributors, ODbL) - thank you. The map is drawn by MapLibre Native (BSD-2-Clause) on OpenFreeMap's vector tiles (OpenStreetMap data and OpenMapTiles, ODbL / CC-BY 4.0), with the optional Mapbox Maps SDK under Mapbox's terms. The DedSec and fsociety theme font is Share Tech Mono (SIL Open Font License 1.1). The DedSec theme is an unofficial fan homage to Watch Dogs; its header poster uses DedSec imagery. Watch Dogs, DedSec, ctOS and Blume are trademarks of Ubisoft. The fsociety theme is an unofficial fan homage to Mr. Robot and quotes short lines from the show; Mr. Robot is a trademark of Universal Content Productions. RF Sentinel is not affiliated with or endorsed by Ubisoft, USA Network or NBCUniversal.

Copyright © 2026 CIS-C0

RF Sentinel is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License v3.0 as published by the Free Software Foundation. It is distributed in the hope that it will be useful, but without any warranty; see the LICENSE file for the full text.

Any modified version you distribute must also be released under GPL-3.0 with its source code. Bundled third-party material keeps its own license: the Share Tech Mono font (SIL Open Font License 1.1, app/src/main/assets/licenses/), the Realtek 88xxau register tables in the USB WiFi driver (from Realtek's GPL-2.0 Linux driver, via Wardrive Go; see app/src/main/java/com/rfsentinel/app/usb/NOTICE.md), and the signature and Remote ID references credited above (Apache-2.0).

RF Sentinel is provided for awareness, research and personal privacy. Whether passive Bluetooth and WiFi scanning is legal depends on where you are, so check your local laws. A detection indicates that a device with a given signature is nearby. It is not proof of who is present or what they are doing. This is not legal advice.