1. A spectrum analyzer for the price of a dev board

The most immediate use case is also the simplest: flash the firmware, open ESP-WebSDR in a browser and watch the live power spectrum and waterfall of your RF environment. For a technician troubleshooting a flaky wireless link, or a maker trying to find a free Wi-Fi channel in a crowded apartment block, that visibility used to cost an RTL-SDR plus software installation. Now it costs a board and a USB cable.

At 80 MSa/s into SRAM you get real instantaneous bandwidth — enough to see an entire Wi-Fi channel plus its neighbours at once, or to spot the characteristic burst pattern of a microwave oven interfering with your sensors.

2. Localise any 2.4 GHz signal — not just Wi-Fi

This is where raw IQ beats processed CSI. CSI is derived from the L-LTF and HT-LTF pilot symbols of 802.11 packets, so by definition it only exists for Wi-Fi formats the chip can process. That leaves a lot out:

• Bluetooth Classic and Bluetooth Low Energy — beacons, trackers, audio devices
• Zigbee / IEEE 802.15.4 — building automation, industrial sensor meshes
• 802.11b — the legacy format CSI capture never supported
• Wi-Fi with multiple spatial streams — previously unsupported for CSI capture

With raw IQ you can detect, classify and direction-find all of them, using the same antenna array. For anyone doing RF site surveys or interference hunting, that is a step change.

3. Phase-coherent eight-channel arrays (ESPARGOS One)

ESPARGOS One is a 4 × 2 dual-polarised 2.4 GHz antenna array built from eight phase-synchronised ESP32 chips, powered and controlled over Power over Ethernet, priced from €350 excluding VAT. The latest firmware adds raw IQ capture to the existing CSI capability — the hardware already supported it.

What you get out of the box:

• Angle of arrival estimation using the MUSIC algorithm, with a live spatial spectrum
• Azimuth–delay diagrams showing where signals arrive from and how far away they are
• Time of arrival monitoring across all antennas for precise timing work
• Multi-array combining — several 4 × 2 units can be daisy-chained with a reference signal in/out into one large phase-synchronous array
• λ/2 antenna spacing (60 mm), 20 MHz bandwidth or 40 MHz with 802.11n channel bonding, ~3.5 W consumption

Centralised processing also means array gain: weak signals are combined coherently in software, improving sensitivity beyond what a single chip can hear.

4. Wi-Fi sensing: seeing through walls

Beyond the SDR work, the same hardware does Wi-Fi sensing. The camera overlay demo projects received signal power and delay onto a live camera image, revealing movement and human presence through walls. Other demos visualise instantaneous frequency-domain CSI, time-domain channel impulse response, per-antenna received phase, and phase drift over time. For occupancy detection in buildings where cameras are not acceptable — healthcare, restrooms, private homes — this is a genuinely different tool.

5. Pulse-compression radar research

Raw IQ lets you use waveforms chosen for the application rather than for Wi-Fi compliance. Pulse compression radar is the clearest example: transmit-like waveforms can be correlated in software to get range resolution far better than the ISM band’s native bandwidth would suggest. Better still, some preprocessing can run on the chip itself, so the slow host link is not the limiting factor.

6. GNU Radio and Gqrx over SoapySDR

On the ESP32-S31, the open-source SoapyESPSDR driver exposes the chip as a standard SoapySDR receiver. That means it plugs into the tools RF engineers already use:

Interface	Continuous IQ rate
Native high-speed USB	Up to 20 MSa/s
Gigabit Ethernet	Up to 40 MSa/s

You can listen to signals in Gqrx, record sample files for offline analysis, or build your own demodulator in GNU Radio. The driver is receive-only and marked experimental, but it is real and available now.

7. RF site surveys for industrial IoT deployments

Practical, unglamorous and immediately valuable: before installing tens of BLE sensors or a Zigbee mesh on a factory floor, you want to know what is already occupying the band, where the dead spots are, and whether any equipment is spraying broadband noise. A phase-coherent array plus a spectrum viewer gives you that answer at a fraction of the cost of professional test equipment.

The security angle you should not skip

The ESPARGOS team is explicit that this is an undocumented capability, not a vulnerability — but they also point out the obvious consequence. Many ESP32-based devices talk to cloud services that can update firmware remotely, and plenty of ISM-band deployments transmit without encryption. If sensitive data crosses the air in the clear, a board that costs less than a coffee now lets someone look at it. The fix is not to fear the chip; it is to encrypt the link.

Transmission is the other half of the story. The ESP32 can transmit arbitrary waveforms, and on ESPARGOS One even phase-coherently — but the team deliberately withholds a transmitter implementation because of the potential for jamming. Treat any “ESP32 jammer” project you find online as a legal problem, not a technical one.

FAQ

Does this work with any ESP32 board?

The firmware supports the original ESP32, C2, C3, C5, C6, C61, H2, S2, S3 and S31. A board with a working native/debug USB port is the easiest starting point.

Can it receive 433 MHz or 868 MHz sensors?

No — the internal modem only reaches 2.2–2.7 GHz (and 4.8–6.0 GHz on ESP32-C5). For sub-GHz you need an external mixer to translate the signal into the chip’s range; ESPARGOS has prototype multi-channel hardware for this.

Is the capture continuous?

Only on the ESP32-S31, over high-speed USB or Gigabit Ethernet. Other models capture in bursts, which is enough for live spectrum views but may miss packets between windows.

What does it cost to start?

Whatever a supported ESP32 board costs where you live, plus a USB cable. The firmware, the browser interface and the SoapySDR driver are all open source.

Conclusion

An ESP32 used to be a device that could talk Wi-Fi and Bluetooth. With raw IQ capture it becomes a device that can listen to the radio spectrum itself — the same silicon, an undocumented debug path, and open-source software. For wireless research, industrial RF troubleshooting and low-cost phased-array sensing, that is an unusually large capability jump for an unusually small price.

Sources: ESPARGOS — ESP-SDR, ESPARGOS One datasheet, SoapyESPSDR on GitHub.