Wi-Fi Sensing (802.11bf)
IEEE 802.11bf, ratified in September 2025, turns the Wi-Fi radio into a sensing instrument. Instead of inferring the channel as a side effect of beamforming, 802.11bf defines an explicit framework for measuring how bodies and objects perturb the RF environment. This page walks the sensing measurement session signaling, decodes the Sensing Measurement Report wire format, and explains how this framework differs from the beamforming sounding that the BFId attack exploits.
— Shankar K. · Source: IEEE 802.11bf-2025 §9.4, Table 9-129k ·
Wireshark: wlan.fc.type == 0 && wlan.action.category == 63
Wi-Fi already knows the shape of a room. Every beamforming exchange measures the channel, and the channel is the room. 802.11bf formalizes that: a sensing initiator asks one or more responders to measure the channel and report it back on a schedule. The result is motion detection, presence detection, breathing-rate estimation, and gesture recognition, built into the standard rather than bolted on. The same measurement that enables these features is a spatial fingerprint of whoever is in the room.
Two different mechanisms get confused constantly. Beamforming sounding produces Compressed Beamforming Reports (Category 30 for HE, Category 36 for EHT). It has existed since Wi-Fi 5 and is what the BFId family of attacks exploits. 802.11bf sensing is a separate, explicit framework that uses Sensing Measurement Report frames (Category 63) and was only ratified in 2025.
The practical difference: BFI privacy exposure is present on essentially every Wi-Fi 5/6/7 network today, with no opt-in. 802.11bf sensing requires explicit session setup between a sensing initiator and responders, and is only present where the feature is enabled. For the protocol mechanics of beamforming feedback, see /beamforming-sounding.
Sensing measurement session signaling
A sensing session has a setup phase, a repeating measurement phase, and a teardown. The initiator (usually an AP) coordinates; one or more responders measure and report. The measurement instances repeat on the negotiated schedule until the session is torn down.
The initiator negotiates roles, measurement parameters, sounding type (trigger-based or non-trigger-based), and reporting cadence with each responder. This establishes the measurement setup ID that ties subsequent frames together.
Each measurement instance begins with an NDP Announcement that names the participants, followed by a Null Data Packet. The NDP is a known training signal with no payload. Receivers measure how it arrived, which encodes the channel state, and therefore the physical environment.
Responders return their measurement in a Sensing Measurement Report. This is an Action or Action No Ack management frame with Category 63 in the first body byte. Depending on the negotiated report type, the SMR can carry CSI directly or a compressed feedback representation. This frame is the sensing analogue of the beamforming CBR.
Either party tears the session down. The measurement setup ID is released. Measurement instances (steps 2 and 3) repeat on the negotiated cadence until this point.
Category 63 is the wire signature. The same frame type (management) and subtype (13 Action, or 14 Action No Ack) carry beamforming CBR and sensing SMR. Byte 0 of the frame body, the Category field, is what distinguishes them: 30 is HE CBR, 36 is EHT CBR, 63 is a Sensing Measurement Report. Filtering on subtype alone will conflate the two.
SMR wire format decoder
The Sensing Measurement Report body, per IEEE 802.11bf-2025 Table 9-129k, leads with a fixed header that identifies the measurement and describes the report, followed by the measurement payload. The layout below shows the leading fields. Adjust the controls to see how the report size scales.
| Offset | Field | Size | Meaning |
|---|---|---|---|
| byte 0 | Category | 1 byte | 63 = Sensing (distinguishes SMR from CBR 30/36) |
| byte 1 | Sensing Action | 1 byte | Sub-action: identifies SMR among the sensing action frames |
| byte 2 | Measurement Setup ID | 1 byte | Ties this report to the SMSR-negotiated session |
| + | Measurement Report Control | variable | Report type, Nc/Nr, bandwidth, grouping (Ng), codebook |
| + | Measurement payload | variable | CSI or compressed feedback per the negotiated report type |
Note: full per-field payload decode (the 12-bit scaling factor and the per-subcarrier-group I/Q or angle representation) depends on the negotiated report type and is implementation-dependent across early 802.11bf radios. The fields above are the stable leading header per Table 9-129k.
Ng grouping tradeoff
Sensing and beamforming feedback both let the responder report only every Ng-th subcarrier instead of all of them. Larger Ng means fewer reported subcarriers, smaller reports, and less airtime, at the cost of frequency resolution. This is the single biggest lever on report size. Move the controls to see the effect.
Trigger-based vs non-trigger-based sounding
802.11bf inherits two sounding modes from the OFDMA machinery. The negotiated mode is set during the SMSR exchange and shapes how many responders can be measured per instance.
The initiator sends a Trigger frame that solicits simultaneous uplink responses from multiple responders in scheduled resource units. Efficient for measuring many responders per instance. Maps onto the HE/EHT OFDMA uplink. Best for multi-static sensing where several nodes measure the same space.
Sounding without a coordinating Trigger frame, closer to the classic single-link sounding sequence. Simpler, lower coordination overhead, suited to a single initiator-responder pair. Lower aggregate throughput when many responders are involved.
Standard and certification timeline
The privacy questions raised for beamforming BFI apply with equal or greater force to explicit sensing. A measurement designed to detect breathing and gait is, by construction, a measurement of the people in the room. See /bfi-privacy for the attack family and the standards response.
Building WiFi Analyser V2 · CWNA-109 in progress · one post every two weeks