poppn

WiFi Packet Monitor & Deauth Detector

LilyGO T-Dongle S3 · ESP32-S3 · v6

Flash from your browser

Choose your board:

Browser not supported. Web Serial is required — use desktop Chrome, Edge or Opera. Firefox and Safari cannot flash devices.

HTTPS required. Open this page over https:// to flash.

No install, no toolchain — plug the device in and click.

How to flash

Pick your board above.
T-Dongle S3: hold BOOT while plugging it in, then release. M5StickC Plus2: just plug it in (it enters download mode on its own).
Click Install, pick the serial port in the browser dialog.
Choose Install, confirm the erase, and wait ~30 s.
Unplug and replug. The splash means you're done.

Two boards, one firmware family

T-Dongle S3	ESP32-S3 · logs to a microSD card · read the card as a USB drive · full serial console
M5StickC Plus2	ESP32 · logs to internal flash (LittleFS) · read them over a built-in Web UI (the device hosts its own WiFi hotspot) · same capture formats

The M5 has no SD slot and no USB Mass Storage, so on it you press Btn B to start a hotspot (packmon-XXXX, password packmon123), join it, and open 192.168.4.1 to see live stats and download the CSVs and capture.pcapng. Sniffing pauses while the Web UI is on.

What it does

Promiscuous 802.11 sniffing across channels 1–13, hopping every 500 ms.
Seven pages you cycle with the dongle's button — no config, no app.
Live — packets per second, running totals, a 30 s rate graph, and whether a captured handshake is usable yet.
Channels — activity bars for all 13 channels, busiest one called out.
Networks — nearby APs with SSID, channel, encryption and signal.
Threats — deauth log with attacker MAC, channel, RSSI and age.
Handshake — per network + client, which EAPOL messages M1–M4 were caught and whether it's crackable.
System — uptime, frame-type breakdown, free RAM and frame rate.
Deauth / disassoc detection interrupts any page with a full-screen alert, then returns you to where you were.
SD logging — insert a microSD before power-on and every session is appended to readable CSVs under packmon-logs/, building one combined dataset.
Handshake capture — EAPOL, auth and association frames are saved as .pcapng (radiotap, hcxpcapngtool-ready) in packmon-logs/.
USB drive — mount the SD card straight onto your PC or phone from the USB page; no card removal, no reader.
Serial console — drive everything from a terminal: switch pages, lock channels, list networks, mount the drive. command reference.
Everything renders through a framebuffer at 30 fps — no flicker, animated throughout.
APA102 status LED shifts colour with traffic load, strobes red on attack.

SD logging & handshakes

Logging is opt-in by hardware: it turns on only if a microSD card is detected during the boot animation, and stays off for that whole run otherwise. The splash tells you which — SD OK or no SD.

Fixed filenames, appended to on every boot — one growing dataset, not a new file each time. A session column (and more packets after the pcap's single header) keeps the runs separable; the viewer combines them automatically.

`packmon-logs/events.csv`	every deauth / disassoc: session, time, channel, RSSI, MACs
`packmon-logs/networks.csv`	each network first seen: session, SSID, BSSID, channel, security
`packmon-logs/stats.csv`	a snapshot every 5 s: session, frame counts, rate, per-channel totals
`packmon-logs/capture.pcap`	captured EAPOL handshakes (+ a beacon per network)

→ Open the log viewer — drop in the CSVs and the .pcap files: it draws spider charts, timelines and a network table, and decodes each handshake (SSID, AP/client, which of M1–M4 landed, whether it is crackable) — all in your browser, nothing uploaded. Session chips let you isolate one boot or join any subset.

Controls

Tap the button	next page
Hold ~0.6 s	lock the current channel (stop hopping)
Keep holding to 2.5 s	clear all counters
Hold on the USB page	mount / eject the SD card as a USB drive

Read the card over USB

No need to pop the microSD out. Open the USB page and hold the button: the card mounts on your computer or phone as a normal USB drive, so you can copy off packmon-logs/ (and drop the CSVs straight into the viewer). Hold again to eject.

Logging pauses while mounted — the host owns the card, so packmon stops writing until you eject. The dongle also always appears as a small serial device; that's the debug console, not the drive.

Specs

Board	LilyGO T-Dongle S3 (ESP32-S3)
Display	ST7735 160×80, SPI @ 27 MHz
Rendering	25 KB framebuffer, ~30 fps
Channel hop	500 ms, channels 1–13
Graph window	152 samples @ 200 ms ≈ 30 s
Network table	24 APs, aged out after 2 min
Alert hold	5 s after last deauth frame
Serial log	115200 baud, USB CDC
Flash image	merged, 8 MB layout, offset 0x0

Legal

Receive-only. packmon listens; it never transmits deauth frames or any other attack traffic. Passively monitoring radio spectrum is still regulated in some jurisdictions — check your local law before running it, and only monitor networks you own or are authorised to test.