ESP32-C5 · dual-band management sniffer

Flash a C5 from your browser

A $10 ESP32-C5 becomes a 2.4 and 5 GHz management-frame sensor for WLAN Commander, talking to the app over Bluetooth LE. Plug it in, press the button below, and Chrome writes the image directly — no toolchain, no command line.

This browser cannot flash. Web Serial is required — use desktop Chrome or Edge. Safari, Firefox and every iOS browser lack the API. There is a command-line route below.

What the board does

It listens. In promiscuous mode across 2.4 and 5 GHz, every management and control frame it hears is wrapped in a radiotap header and streamed to the phone over a single BLE characteristic, where WLAN Commander parses it like any other capture source.

It can also ask. Given a list of Passpoint access points, it sends GAS/ANQP queries and captures the replies — a standard pre-association client query, the same one your phone makes before it joins a hotspot. That is what fills in realms, roaming consortiums and venue names on the Passpoint screen.

It boots idle

No promiscuous mode, no channel hopping, no transmission — BLE advertising only. Nothing happens until the app says so, and closing the app stops it again. An earlier build swept and transmitted from the moment it had power, unattended; this one does not.

It stops when you walk away

If the phone disappears — app closed, crash, flat battery, or simply out of range — the board notices the link is gone and stops itself. A board with nobody listening captures frames it then discards, so running on is spent power and spent airtime for nothing.

One radio is enough

Requests go out through the MAC rather than raw injection, so the board hears its own replies. An earlier design paired two boards because a mis-measurement suggested a single radio was deaf to its own transmission. It is not.

Which board to buy

Any ESP32-C5 devkit with a USB data connection will do. Two are worth naming, and they differ in the one respect that matters later.

Seeed XIAO ESP32-C5

8 MB flash · 8 MB PSRAM

What the firmware was developed and tested on. The extra flash is the reason to prefer it — see below.

M5Stack Stamp-C5

4 MB flash · ESP32-C5HF4

Smaller and cheaper, and it runs this image today. It has no room to spare, which is the trade you are making. Shop page.

Check the flash size before you buy. ESP32-C5 boards ship with either 4 MB or 8 MB, and the listing does not always make it obvious. This image is built for a 4 MB layout and runs on both — the sketch is 1.33 MB in a 1.92 MB application slot, about 71% full, with a second slot the same size beside it for updates. So a 4 MB board is not a mistake. But it is already nearly full, and an 8 MB board leaves room for the firmware to grow without a partition change. If you are choosing now, choose 8 MB.

Flashing

The button above needs desktop Chrome or Edge — Web Serial exists nowhere else. Connect the board by USB, press it, and pick the serial port that appears.

1

Plug in a data cable

Charge-only USB cables are common and produce a board that powers up and never enumerates. If no port appears in the picker, suspect the cable before the board.

2

Press Connect & flash

Four images are written: bootloader at 0x2000, partition table at 0x8000, boot_app0 at 0xe000, and the sketch at 0x10000.

3

Check it came up

The board advertises over BLE as WLC C5 SNIFFER, and prints a status line on serial every two seconds. A freshly flashed board reads run=0 poke=0 cap=0 — idle, waiting, transmitting nothing.

From a command line instead

Download the four images from the repository and write them with esptool:

esptool --port /dev/cu.usbmodem1101 --no-stub write-flash \
  --flash-mode dio --flash-freq 80m --flash-size 4MB \
  0x2000  wlc_sniffer.ino.bootloader.bin \
  0x8000  wlc_sniffer.ino.partitions.bin \
  0xe000  boot_app0.bin \
  0x10000 wlc_sniffer.ino.bin

--no-stub is there deliberately. On the boards tested here the stub loader frequently fails to start, and the failure looks like a dead board rather than a flashing problem.

When it will not flash

Three failures account for nearly everything seen on the bench, and none of them looks like what it is.

Nothing appears in the port picker

A charge-only cable, or a hub that carries power but not data. Try a different cable and a port directly on the machine before anything else.

It connects once, then refuses

These boards accept roughly one flashing session per USB enumeration. If a first attempt fails partway, the next one may report no response at all. Unplug it, plug it back in, and try again — do not keep retrying against a wedged port.

Silent, or stuck in a boot loop

Hold BOOT while plugging the board in — or hold BOOT and tap RESET — to force the ROM download mode, then flash. Release BOOT afterwards, or the board will write the image and sit in download mode instead of running it. A board that answers the flasher but never advertises over BLE is usually still being held there.

What it transmits

By default, nothing. Listening is passive, and ANQP queries are off until switched on.

When they are on, the board sends GAS/ANQP requests — the standard query a client makes before associating. It does not deauthenticate, does not inject forged data frames, and does not associate with anything. Asking is still a transmission, so it is opt-in and stops with the rest when the board stops.