AntiHunter is a perimeter detection platform you set up and walk away from. Put a node in a bedroom, along a fence line, at an event, or in a cabin with no signal; it learns what belongs, then tells you when a new device shows up, when someone moves it, or when a Wi-Fi attack starts — naming the tool behind it. It runs on battery with no internet, no cloud, and no subscription, and your data stays on the device.
It's open source and listens only; it never jams or attacks anything. One node works alone. Add more and they compare notes over long-range LoRa radio, confirm each other's alerts, and with GPS put a signal on a map. Control a node from its web page, by text over the mesh, or from the Command Center.
Featured in Seeed Studio's Best 20 XIAO Projects in 2025.
Tip
Flash your first node with the Quick start below, then open the wiki's First setup page to change the default password and keys. The wiki has every feature and troubleshooting in depth.
Each feature has its own wiki page with settings, mesh commands, and troubleshooting.
| Feature | What it does |
|---|---|
| Target scan | Alerts when it hears a MAC, vendor, or network name on your watchlist. |
| Device discovery | Lists nearby Wi-Fi access points and Bluetooth devices. |
| Device classifier | Labels each Bluetooth device by what it is, such as AirPods, a Tile tag, a drone, or a tire-pressure sensor, by reading its advertisement. |
| Probe request scanner | Shows which network names each phone or laptop is looking for. |
| Randomized MAC tracer | Links a phone's changing MAC addresses back to one device, using methods from peer-reviewed research. |
| Drone Remote ID | Reads a drone's ID, position, flight data, and the operator's location. |
| Triangulation | Three or more nodes with GPS estimate where a device is. |
| Feature | What it does |
|---|---|
| Baseline anomaly | Learns which devices belong, then reports new, missing, returning, and moving ones. |
| CSI motion (Beta) | Detects people moving nearby, even through walls, from changes in Wi-Fi signals. |
| Vibration and tamper response | When the node is moved, it alerts you and can start a scan or packet capture on its own. |
| Feature | What it does |
|---|---|
| Sentinel | Runs in the background and reports Wi-Fi attacks such as deauth floods, evil twins, and handshake capture. It names the tool when it recognizes one, such as Marauder, MDK4, or aireplay-ng. |
| Connected client visibility | Lists the devices that join the node's own access point. |
| Mesh radio detection | Finds other Meshtastic and MeshCore radios nearby, and audits the commands sent on your own mesh channel. |
| Deauth detection | Logs every deauth frame and flags floods. |
| Feature | What it does |
|---|---|
| Packet capture | Saves Wi-Fi or Bluetooth traffic to SD as a file Wireshark opens. |
| Scheduled scans | Runs a scan at a set time, once or every day. |
| Secure wipe | Erases the node's data on command, or on its own if someone tampers with it. |
Every node runs the same detectors and shares one LoRa mesh. They differ in the radio and the sensor.
| Node | Board | Covers | Status |
|---|---|---|---|
| DIGI | ESP32-S3 | Wi-Fi and Bluetooth, 2.4 GHz | Stable |
| DIGI C5 | ESP32-C5 | Wi-Fi and Bluetooth, 2.4 and 5 GHz | Testing |
| RadarNode | ESP32-C5 | 24 GHz radar, then a Wi-Fi and Bluetooth sweep | Experimental |
| SDR node | ESP32-S3 | Wideband radio capture | In development |
| Command Center | Server | A whole fleet on one map | Beta |
- Attach all three antennas before you power on.
- Flash the firmware from the Web Flasher in Chrome or Edge on a desktop. Pick Full (with the web UI) or Headless (mesh and serial only). See Full or Headless.
- Connect. For Full, join the
AntihunterWi-Fi network (passwordantihunt3r123), openhttp://192.168.4.1, and log in asadminwith the same password. For Headless, open a serial monitor at 115200 baud. - Set the radio's LoRa region. Without it, the radio never transmits. See Meshtastic radio setup.
- Lock it down. Every unit comes with the same published defaults, so change them: the access point name and password, the node ID, the Meshtastic channel, and the erase key. See First setup.
- Run a scan. Scan only where you have permission. See the legal disclaimer.
The wiki covers each step in detail.
- Wiki: setup, every feature, and troubleshooting
- Mesh command reference: every command, value, and alert
- HTTP API reference: the Full firmware's endpoints
- Operator's Guide (PDF): unboxing to deployment, with a printable quick-reference card
Buy a node from the store, or build one from the bill of materials. The Hardware and BOM wiki page lists the parts, the pinout, and the enclosure files.
Important
Use a regulated 5 V supply. Unregulated batteries cause voltage instability.
A node is built from a Seeed XIAO ESP32-S3 (or a XIAO ESP32-C5 for 5 GHz), a Meshtastic board (Heltec V3.2 or T114), a GPS module, an SD card, a vibration sensor, and a real-time clock.
You need PlatformIO, Git, and a USB cable.
git clone https://github.com/lukeswitz/AntiHunter.git
cd AntiHunter
pio run -e AntiHunter-full -t upload # Full: web UI on its own access point
pio run -e AntiHunter-headless -t upload # Headless: serial and mesh onlyThe first build downloads about 6 GB of tools. The ESP32-C5 builds are on the feat/c5 branch. See Build from source.
Ask questions and share builds in Discussions or on Discord. Report bugs in Issues. Pull requests are welcome. See CONTRIBUTING.md.
Original concept and hardware design by @TheRealSirHaXalot.
This project includes code from opendroneid-core-c, licensed under the Apache License 2.0. Copyright © Intel Corporation and OpenDroneID contributors.
Firmware: GNU Affero General Public License v3.0. Hardware and documentation: as stated in their files.
AntiHunter is for lawful, authorized defensive use only, on infrastructure, networks, devices, radio spectrum, and datasets that you own or have written permission to assess. The full disclaimer covers radio and interception law, privacy, drone Remote ID, computer misuse, export rules, and the warranty limitations. Flashing the firmware is acceptance of those terms. If you do not agree, do not build, flash, assemble, deploy, or operate AntiHunter.