RF Sentinel

Multi-protocol RF collector module with public-safe event replay.

RF Sentinel is the RTG Spectrum module for passive multi-protocol RF evidence, entity tracking, WiFi topology, Pattern-of-Life analytics, and normalized events. It has strong live workflows across Bluetooth Classic, BLE, Zigbee, and WiFi, with experimental FM and sub-GHz integration paths. Live LTE/5G survey context is handled by the companion Cellular Survey module and reviewed through the shared platform timeline.

Open GitHub Geospatial RF Analytics

A live multi-protocol collector workflow reviewers can run without radios.

The public demo generates deterministic synthetic detection events, starts the normal RF Sentinel backend and UI, and feeds the same discovery pipeline used by scanner plugins. It is designed to show module behavior without shipping real RF captures, sensitive locations, or live environment data.

Run the public Docker demo in one command:

docker compose -f docker-compose.demo.yml up --build

Synthetic events, real dashboard behavior.

The demo data is intentionally synthetic and public-safe. It uses notional identifiers and event timing to show how RF Sentinel handles multiple protocol families, scanner assignments, detection cards, WiFi topology, and channel activity as a live system.

Run It

git clone https://github.com/rtg-engineering/rf-sentinel.git
cd rf-sentinel
docker compose -f docker-compose.demo.yml up --build

Open http://<machine-ip>:8080 on the local network. Stop it with docker compose -f docker-compose.demo.yml down.

Verify It

curl http://127.0.0.1:8080/api/devices
curl http://127.0.0.1:8080/api/status

A healthy demo reports demo_mode: true, synthetic devices, and non-empty detections across the public demo protocol set.

Operator view for multi-protocol RF activity.

RF Sentinel presents protocol evidence as an operator-facing web application: SDR assignments, RF health, grouped detections, most-interesting entities, WiFi topology, and 2.4 GHz activity are visible from the browser rather than hidden in scripts or terminal output. The same evidence can feed Trace Analyzer for correlation and platform-level baseline/change review.

Fresh screenshots from the synthetic event replay workflow.

These images were captured from the public Docker demo. Bluetooth Classic is labeled BTC inside the application, matching RF Sentinel's internal shorthand for Bluetooth Classic evidence.

RF Sentinel public Docker demo dashboard with synthetic multi-protocol detections — Full browser dashboard showing synthetic SDR assignments, RF health metrics, grouped Bluetooth Classic, BLE, Zigbee, WiFi, and experimental FM/sub-GHz detections.

RF Sentinel public demo table filling with synthetic RF detections — Detection table view populating from deterministic synthetic replay events, including weekly pattern-of-life badges such as 1 wk, 1 mo, and 231 days.

RF Sentinel WiFi AP and station topology from public synthetic event replay — Expanded WiFi AP and station topology showing a notional access point with five connected station devices in a hub-and-spoke view.

RF Sentinel pattern-of-life analytics modal with weekend recurrence and anomaly triage — Pattern-of-life analytics modal summarizing weekend cadence, normal baselines, and anomaly flags from the same public synthetic replay.

RF Sentinel detections can be reviewed beside WiFi, cellular, BLE, GPS, and PASSIVE-SHIELD events.

RF Sentinel publishes synthetic or live scanner detections into the same event model Trace Analyzer uses for AirScope, Cellular Survey, BLE HCI/GPS, SDR-Shark, and PASSIVE-SHIELD. The public demo includes Bluetooth Classic, BLE, Zigbee, WiFi, FM, and sub-GHz workflows that support RF signal classification, entity review, and Pattern-of-Life analysis; the strongest live maturity is currently across Bluetooth Classic, BLE, Zigbee, and WiFi, while FM and sub-GHz remain experimental integration paths. Cellular Survey provides the live LTE/5G survey path into the broader source-aware platform timeline. Tighter cellular entity fusion inside RF Sentinel is a next integration path, not a claim made by the current public demo.

Turn protocol detections into normalized, reviewable RF intelligence.

Correlate observations

Bring WiFi, BLE, Bluetooth Classic, Zigbee, and experimental FM/sub-GHz evidence into one entity-oriented workflow.

Establish baselines

Track recurring devices, weekend-only activity, normal patterns, and anomalous appearances over time.

Add location context

Repeated observations of decoded entities can support likely-source review when GPS-tagged collection context is available.

Explain topology

Show AP and station relationships as hub-and-spoke evidence instead of isolated packet rows.

Where this applies.

RF Event Pipelines

Normalize scanner outputs, protocol plugin data, and spectrum observations into reviewable entities and evidence records.

Operator Dashboards

Build web interfaces for RF health, protocol activity, entity triage, AP topology, event review, and field-support workflows.

Multi-Protocol Sensing

Prototype passive detection across Bluetooth, BLE, WiFi, and Zigbee, with experimental integration paths for FM, sub-GHz, and other RF signal families.

Public-Safe Demos

Create deterministic demonstrations that show real software behavior without exposing customer data, RF captures, or deployment details.