Part 8 walked through the Flipper Zero's Sub-GHz module in serious depth: how to capture, analyze, and understand the signals your garage door and key fobs are actually transmitting. If you followed along, you've got raw captures sitting in your SD card and a clearer sense of what the 433 MHz band looks like in practice. That foundation matters here, because Part 9 is where the methodology shifts from individual captures to something more disciplined.
This article is about building a RF baseline for your home environment. Not scanning once and moving on. Not opening a Wi-Fi analyzer app, glancing at the list of SSIDs, and closing it. A real, documented, repeatable baseline that tells you what normal looks like so you can recognize when something isn't.
That shift from reactive scanning to systematic documentation is where most hobbyists stop growing. The tools are exciting. The captures feel like discoveries. But without a structured record of what's always present, every new signal looks like a potential threat, and you'll spend your time chasing noise instead of finding actual anomalies. This article gives you the framework to stop doing that.
Why Your Home RF Environment Needs a Baseline
The Signal-to-Noise Problem in Wireless Reconnaissance
Your home is radiating constantly. Right now, without any active attack, without any unusual device, your environment contains dozens of simultaneous RF transmissions across multiple frequency bands. Phones advertising over BLE. A smart meter pulsing on 915 MHz. A neighbor's router bleeding through the wall. Cordless handsets cycling through their DECT channels. A ceiling fan remote waiting for a button press that never comes.
If you don't know which signals belong, all of them look suspicious. That's the core problem. Alert fatigue in RF reconnaissance works exactly the same way it does in network security: when everything triggers concern, nothing gets investigated properly.
Seasoned RF practitioners treat baseline documentation the way network engineers treat traffic baselines: you capture what normal looks like first, you document it rigorously, and then you use that record as the reference point for everything that follows. Without it, you're not doing reconnaissance. You're just scanning.
What Happens When You Skip the Baseline Step
Amateur scanning is reactive by nature. You open your tool, you see something unfamiliar, you try to identify it, and you either succeed or you don't. Then you close the app and forget about it. That's not methodology. That's curiosity with hardware.
The structured approach this article teaches works differently. You'll organize your environment into six RF categories. You'll scan room by room, not as a single merged sweep. You'll log specific fields for every observation. And you'll do it on a weekly cadence so you have longitudinal data, not just a snapshot.
The difference between knowing which cars belong in your neighborhood and not knowing is the difference between noticing a stranger's car parked for three days and never noticing at all. Your RF baseline is that neighborhood knowledge, applied to the electromagnetic layer of your home.
Understanding Baseline Categories: The Six RF Domains in Your Home
Wi-Fi: The Most Documented Layer
Wi-Fi is where most people start, and for good reason. It's the most visible layer, the most tooled, and the most familiar. Your Wi-Fi baseline should document every SSID visible from your home, including your neighbors', along with the associated BSSID (the MAC address of the access point), the channel in use, the signal strength in dBm, and the encryption type. WPA2, WPA3, open networks, and hidden SSIDs all get their own entries.
Neighbor networks belong in your baseline too. They're part of your normal. If a new SSID appears at strong signal strength from an address where you've never seen one, that's worth noting.
BLE: The Hidden Chatter
Bluetooth Low Energy is the layer most people completely miss. BLE devices advertise constantly, and your home is full of them. Phones, smart TVs, speakers, wearables, sleep trackers, smart bulbs, thermostats, and a growing list of IoT devices all broadcast BLE packets on a regular schedule. Most of this traffic is invisible to casual scanning because it doesn't look like Wi-Fi.
Your BLE baseline captures the persistent beacons: the devices that are always advertising, always present, always at roughly the same signal strength from the same room. When a new persistent beacon appears, you'll know it doesn't belong.
Sub-GHz: Remotes, Sensors, and Surprises
The Sub-GHz band is where the infrastructure of your home lives: garage door openers, key fobs, weather stations, smart meters, wireless doorbells, and a wide range of 433 MHz and 915 MHz sensors. These devices don't announce themselves. They transmit briefly, often on a fixed schedule or in response to physical events, and they're invisible to Wi-Fi and BLE tools.
This layer rewards patience. Some devices transmit only when triggered. Others pulse on a timer. Your baseline should capture both categories separately.
NRF24 and the 2.4 GHz Neighborhood
NRF24L01-based devices occupy the 2.4 GHz band without using Wi-Fi or BLE protocols. Wireless keyboards, mice, some baby monitors, and certain drones all use this frequency range with proprietary protocols. They don't show up in your Wi-Fi analyzer. They don't show up in your BLE scanner. They're present, they're transmitting, and without deliberate logging they're invisible.
Why This Category Gets Missed
Most home RF documentation focuses on Wi-Fi because that's what consumer tools surface. NRF24-based devices require a dedicated sniffer or a Flipper Zero with the appropriate application to detect. Skipping this category leaves a meaningful gap in your baseline, particularly if you use wireless peripherals near sensitive systems.
Known Appliances and Known Remotes
Your microwave interferes with 2.4 GHz Wi-Fi every time it runs. Your DECT cordless phone operates in the 1.9 GHz band. These are predictable, benign, and important to log precisely because they're predictable. When you see microwave-pattern interference on your spectrum view, you should be able to match it to a known entry immediately.
The same applies to RF remotes for ceiling fans, motorized blinds, and AV equipment. Log their transmission patterns, their approximate frequency, and their signal characteristics. Fingerprinting these devices means you can rule them out instantly when reviewing captures.
Unknown Repeating Signals: The Category That Matters Most
The most operationally significant category in your entire baseline is unknown repeating signals: transmissions that appear on a schedule or repeat at fixed intervals with no identified source. A signal that appears every 47 seconds at the same frequency from the same direction is not random noise. It's a device doing something. Your job is to either identify it and move it to a known category or flag it as an unresolved anomaly requiring further investigation.
Separating your baseline into these six categories isn't organizational preference. It prevents cross-contamination of your data. A BLE beacon logged under Sub-GHz corrupts both datasets. Keeping categories clean means your comparisons stay valid across weeks and months of observation.
The Room-by-Room Scanning Method
Why Physical Location Changes Everything
RF signals don't care about your floor plan, but your floor plan cares about them. Walls, appliances, building materials, and furniture all affect RSSI in ways that matter for baseline accuracy. A device that reads at -65 dBm in your office doorway might read at -82 dBm from the far corner of the same room. Those aren't the same observation. Logging them as equivalent introduces noise into your baseline from the start.
The room-by-room method treats each room as a distinct measurement environment with its own device population, its own interference profile, and its own signal geometry. Each room gets its own baseline entries. Not a merged scan. Not a single walk-through. A deliberate, positioned observation from a consistent location within that room, every time.
Mark your scan positions. Tape on the floor works. A sketch works. The specific method doesn't matter. Consistency does.
Office
The office is typically your highest device density environment. Computers, wireless peripherals, routers, mesh nodes, smart displays, wireless headsets, and NRF24-based keyboards and mice all coexist here. Expect a dense Wi-Fi layer, active BLE from phones and speakers, and NRF24 traffic if you use wireless peripherals. This room often has the strongest signal readings for your own network and the most complex interference picture.
Bedroom
Bedrooms tend to be BLE-heavy and Wi-Fi-light. Phones on nightstands, wearables charging, smart bulbs, sleep trackers, and smart plugs all generate persistent BLE advertisements. Wi-Fi signal is often weaker here than in the office, particularly in multi-story homes. This room is also where people charge devices overnight, which means BLE activity that's time-shifted compared to daytime patterns.
Kitchen
The kitchen is your primary appliance interference zone. A microwave running at 2.4 GHz creates broadband interference that's immediately visible on any spectrum analyzer. Smart appliances, BLE-connected coffee makers, and refrigerators with Wi-Fi modules all add to the picture. Log microwave interference as a known event with its approximate duration and frequency impact. It will appear in your captures repeatedly, and you want to recognize it on sight.
Garage
The garage is your richest Sub-GHz environment. Garage door openers, wireless sensors on doors and windows, connected power tools, and the residual signal from vehicle key fobs all live here. The garage is also where you're most likely to detect signals from adjacent properties, since exterior walls and the absence of interior furnishings reduce attenuation. Scan from a consistent position near the center of the space, not from the doorway.
Outside Perimeter
Scanning from your property's edge gives you a different picture than scanning from inside. Neighbor bleed-in is highest here. SSIDs that are barely visible from your living room may read at -60 dBm from your front porch. This matters because it establishes the outer boundary of your baseline: what's visible from the perimeter versus what's visible only from inside. Document both, and document the difference.
Vehicle Area
The area where your vehicles are parked is a specific key fob relay attack surface. Your key fobs transmit at Sub-GHz frequencies, and their baseline RSSI from a known position near your vehicle is a useful reference. If you later observe unexpectedly strong Sub-GHz activity near your parked vehicles at unusual hours, you want a documented normal to compare against. Log your own fob signals, their approximate frequency, and any repeating Sub-GHz activity you observe in this zone during your baseline scans.
What to Log: The Complete RF Baseline Field Set
Mandatory Fields: The Non-Negotiables
A log entry without complete mandatory fields isn't just incomplete. It's actively misleading, because you'll try to use it for comparison six weeks later and realize you can't trust it.
Date goes in ISO 8601 format: YYYY-MM-DD. This isn't stylistic preference. It sorts correctly in every spreadsheet application without configuration, and it eliminates ambiguity between date formats across regions.
Time uses 24-hour format with timezone. RF environments shift between morning, afternoon, and night. A device that's present at 0200 and absent at 1400 is telling you something. A log that just says "morning" is not.
Room uses a standardized name from your defined location list. No freeform entries. "Bedroom 2" and "second bedroom" and "BR2" are three different values that all mean the same thing, and that inconsistency will break any filtering you try to do later.
Frequency is logged in MHz or GHz, with a range if you're scanning a band rather than observing a specific signal. Be exact. "2.4 GHz" and "2.437 GHz" are not the same entry.
RSSI is logged in dBm as reported by your tool. Don't interpret it. Don't average it. Write down what the tool said at the moment of observation.
Contextual Fields: Making Your Log Queryable
Tool used includes firmware version. A Flipper Zero running firmware 0.99 reports RSSI differently than one running a later version. That difference matters when you're comparing entries across months.
Antenna used is non-negotiable for comparability. Stock antenna, directional, rubber duck: each produces different RSSI readings for the same signal. A log missing antenna type is effectively useless for longitudinal comparison, because you can't know whether a change in RSSI reflects a change in the signal or a change in your antenna.
Device suspected is your best identification. Leave it blank if you genuinely don't know. A wrong identification is worse than an empty field, because a wrong identification moves a signal out of the "unknown" category and into a named category where it doesn't belong.
Notes captures environmental context: doors open or closed, weather if you're scanning outdoors, anything unusual about the observation session. These details feel trivial when you're logging. They feel essential when you're reviewing entries eight weeks later trying to understand an anomaly.
File and Media Fields: Preserving Raw Evidence
Every Capture Needs a Log Row
A raw file with no corresponding log entry is an orphan. You'll find it in your folder months later with no context about when it was captured, from where, with what tool, or why. Link every saved capture to a log row at the time of capture, not after the fact.
Screenshot or photo provides a visual record of your tool's display at the moment of observation. For spectrum captures especially, the visual context carries information that the text fields don't.
Raw file name is the actual filename of any saved capture, Sub-GHz raw file, or log export. It links the log row to the file on disk. Without this link, your log and your files are two separate systems that can't reference each other.
Choosing and Configuring Your Logging System
Spreadsheet vs. Database vs. Paper Log
Three practical options exist, and the right choice depends on your workflow more than on any technical superiority.
A structured spreadsheet in Google Sheets or LibreOffice Calc is the right starting point for most practitioners. It's portable, shareable, filterable without any setup, and requires no programming knowledge to query. You can sort by room, filter by frequency band, and scan for unknowns in under a minute. The limitation is scale: once you're past a few thousand rows, filtering slows down and cross-referencing becomes cumbersome.
A local database in SQLite or a tool like Notion handles scale better and opens up scripting possibilities. You can write queries that surface all unknown repeating signals across a date range, or flag any entry where antenna type is blank. The tradeoff is setup time and the requirement to think in schema terms from the start.
"The best logging system is the one you'll actually use consistently. A perfect schema you abandon after two weeks is worth less than a simple spreadsheet you maintain for six months."
A paper field notebook has genuine advantages that digital tools don't. It works offline, leaves no digital footprint, and survives device failure. It's a poor primary system for a home baseline because it's not filterable or queryable, but it's an excellent field backup for outdoor scans and a useful complement to any digital system.
Recommended Spreadsheet Schema
One row per observation. Columns in this order: Date, Time, Room,
Conducting Your First Full-Home Baseline Scan
Preparation: Tools, Antennas, and Environment
Before you open a single app or press a single button, do the checklist. This sounds obvious. It isn't. The most common reason a first baseline scan produces garbage data is that someone started scanning with a half-charged Flipper Zero, realized they'd grabbed the wrong antenna, and had to restart three rooms in. Don't do that.
Charge your Flipper Zero to 100 percent. If you're running a secondary tool, charge that too. Pull out your antenna kit and match each antenna to its target band before you leave your desk. Stock Flipper antenna for Sub-GHz, appropriate adapter for 2.4 GHz if you're using an external module, directional antenna staged near your perimeter positions. Open your log template before you move a single step. The template should be visible and ready to receive data, not something you're hunting for on your phone while standing in a hallway.
Environmental prep is equally important, and most guides get this backwards. Do not turn devices off to create a "clean" environment. Turn everything on. Every smart speaker, every thermostat, every TV on standby, every phone connected to Wi-Fi. Your baseline needs to reflect your home as it actually operates, not a sanitized version of it. Log the household activity level too: sleeping, working, cooking, kids home from school. That context becomes meaningful later.
Scan Order and Timing
Start indoors at the highest-density location, typically a home office or living room with a media cluster, and work outward to the perimeter. This order builds from complexity to simplicity, which means you're sharpest when the signal environment is most demanding.
Spend at least five minutes passively scanning each frequency category per room before you log anything. The first thirty seconds of data in any new location are almost always noisy and unrepresentative. Wait. Watch. Then log.
What a Complete First-Pass Looks Like
A medium-sized home with typical smart device density should produce somewhere between 40 and 80 log rows on a complete first pass. That range accounts for variation in device count, room count, and how many Sub-GHz signals are active in your area.
You will miss things. You will log something ambiguous and not know what it is. That's fine. The baseline's job right now is to exist, not to be comprehensive. Every scan you do after this one will be better, faster, and more accurate because this one happened first.
The Weekly Practice: Turning Baseline Into Longitudinal Intelligence
Why Consistency Beats Comprehensiveness
A single scan tells you what was present on one day at one time. That's useful. It's not intelligence. Intelligence comes from pattern, and pattern requires repetition under consistent conditions. This is the part most hobbyist scanners skip, and it's exactly why their data never develops into anything actionable.
The tools you use, the antennas you use, and the positions you scan from need to stay constant across every session. This isn't bureaucratic rigidity. It's methodology. If you switch from the stock Flipper antenna to an aftermarket Sub-GHz antenna between week one and week five, your RSSI values are no longer comparable. You haven't measured a change in your environment. You've measured a change in your equipment. Those are completely different things, and conflating them will send you chasing ghosts.
The Weekly Scan Protocol
Pick a day. Pick a two-hour window. Lock both in as a recurring calendar event. Sunday between 09:00 and 11:00 works well for most households because activity patterns are relatively stable at that time. The specific window matters less than the consistency of it.
Same day. Same time. Same tools. Same antennas. Same scan positions, marked in each room during your first baseline. Return to those exact spots every single week. If you moved a piece of furniture, note it. If you added a device, note it. Every environmental change gets logged as a methodology note so you can account for it during comparison.
Methodology Note Protocol
Any time you change tools, antennas, scan positions, or household configuration, add a methodology note to your log before that session's data. This note is what separates explainable variance from unexplained anomaly.
Comparing This Week Against Last Week
Open last week's log alongside this week's before you do any analysis. Look for new SSIDs that weren't present before. Look for new BLE addresses. Look for Sub-GHz signals that didn't appear in your prior session. Look for RSSI values that have shifted significantly on known devices. Look for devices that were present last week and aren't present now.
Flag any signal that appears this week but was absent last week as new, unverified. Flag anything present last week but absent this week as missing, investigate. Don't try to resolve these flags immediately. Collect them. After four weeks you have a pattern. After twelve weeks you have a behavioral model detailed enough to use for real anomaly detection.
Identifying Anomalies Against Your Baseline
What an Anomaly Actually Looks Like
An anomaly isn't just anything unfamiliar. In the context of an RF baseline, an anomaly is any signal that deviates from documented normal in frequency, RSSI, timing, or presence. That definition matters because it grounds the concept in your specific data, not in some abstract idea of what "normal" wireless looks like.
The four types worth tracking: a new persistent signal that wasn't in any prior session; a known signal whose RSSI has shifted dramatically without any physical explanation; a known device appearing in a room where it has never appeared before; and a repeating unknown signal on a fixed schedule. That last one deserves particular attention. Scheduled transmissions suggest a device with programmed behavior, not passive background noise.
Common False Positives and How to Resolve Them
Most anomalies are mundane. A neighbor got a new router and its SSID is bleeding into your scan zone. A delivery vehicle parked outside for twenty minutes and its fleet telematics showed up in your Sub-GHz log. A guest brought a phone or wearable with a BLE address you don't recognize. Your ISP replaced your modem and the new device has a different MAC.
The resolution process is the same every time: log the anomaly, attempt to identify the source, document your findings, and mark it as resolved with a note explaining what it turned out to be. Do not delete anomaly entries. Resolved anomalies are part of your record.
When to Escalate an Anomaly
Signals Worth Closer Attention
An unknown Sub-GHz signal repeating every 30 to 60 seconds near your vehicle area, a new BLE address with no identifiable device in or near your home, or a signal that appears consistently when you're home and disappears when you leave all warrant deliberate investigation rather than a quick resolved note.
Most of the time, you won't find anything alarming. The value of the baseline isn't that it catches threats constantly. It's that when something genuinely unusual appears, you have the documentation to recognize it as unusual, and that distinction is everything.
Your RF Baseline Action Checklist
Initial Setup Tasks
First Scan Tasks
Ongoing Weekly Tasks
What Comes Next: Using Your Baseline as a Reconnaissance Foundation
How the Baseline Feeds Later Parts of This Series
Everything built in this part becomes the reference layer for the active reconnaissance techniques covered in the parts ahead. That's not a metaphor. When Part 10 introduces more targeted scanning approaches, your baseline is the document you'll open alongside your new captures to determine what's worth investigating and what's already accounted for.
A mature baseline changes how you work. You spend less time identifying signals you already know and more time on the ones you don't. Triage gets faster. Your attention lands where it should. That efficiency doesn't come from better hardware. It comes from documentation.
Sharing and Versioning Your Baseline Over Time
Treat your baseline like a configuration file. When your environment changes significantly, whether that's new devices, moved furniture, a home renovation, or a change in household members, create a new baseline version rather than overwriting the old one. Label it clearly. Keep both. The old version is a historical record, and historical records have a way of becoming useful at unexpected moments.
Be careful about sharing your baseline. It contains a detailed inventory of every wireless device in your home, their signal characteristics, and their behavioral patterns. That's sensitive information. Treat it with appropriate care.
Come back to this article after you've finished the full series. The baseline will look different once you've worked through all thirteen parts. You'll see gaps in your initial schema, fields you wish you'd included, and signals you didn't know how to categorize the first time. That's not a failure. That's the whole point.
Documentation is the discipline that separates hobbyist scanning from genuine wireless security practice. The scan is the easy part. The record is what makes it mean something.
Part 10 covers active probing techniques: how to move from passive observation into deliberate, structured interrogation of the signals your baseline has already catalogued. If Part 9 was about building the map, Part 10 is about learning to read the terrain it describes.
