Observore
A passive counter-surveillance detector for nine ESP32 boards — headless sensors that report to your network, and touchscreen ones that report to your hand. It sits in one place, learns what is normally there, and tells you what is new.
Flash it from your browserObservore v0.12.0 is released and MIT-licensed. Since v0.6.0 it has grown from one board to eight shipping profiles, learned to recognise the equipment that transmits rather than watches, gained screens you can set up and operate without a browser, and added tailing — a device that was beside you while you were somewhere else, proven on hardware rather than argued from code. An existing device updates itself from its own console.
The Problem
Everything watching you announces itself — to anyone listening
Body cameras, licence-plate readers, IP cameras, trackers and drones all broadcast, unencrypted, by design. The information is there in the air around your home or your office. What is missing is anything that listens to it continuously and tells you when the pattern changes.
Observore is that listener, on hardware that costs less than a meal out. It learns the normal radio furniture of a place, then reports the new arrivals — and it does the listening without ever transmitting, so the things it notices never notice it.
Zero TX
No probe requests, no scan requests, while patrolling
8 boards
Headless sensors and touchscreen displays
209
Surveillance vendor prefixes from the IEEE registry
No cloud
The log lives on the device and on your LAN
Features
A detector that does not announce itself
Observer and omnivore: it eats surveillance signals. Everything below runs on a single board you can hold between two fingers.
Passive While Patrolling
BLE scanning emits no SCAN_REQ, the Wi-Fi access-point scan sends no probe requests, and the sniffer is receive-only. Nothing it observes can observe it back, because nothing leaves the radio.
Three Detection Phases
Continuous BLE passive scan for trackers, body cameras, smart glasses and Remote ID drones; a ~10 s Wi-Fi scan for camera and ALPR vendor APs; and a ~5 s promiscuous sniff across channels 1–13 for Remote ID beacons, hidden access points and deauthentication floods.
Five Kinds of Evidence
209 surveillance vendor prefixes from the IEEE registry; payload signatures (Find My, Tile, SmartTag, Fast Pair, ASTM F3411 Remote ID, Flipper Zero); behaviour, meaning what a device did rather than what it claims; name, SSID and WPS keywords; and persistence. The UI names which one fired, so you can judge a hit rather than trust it.
Equipment That Transmits
Eight deauthentication frames naming one address inside ten seconds is a flood — scored as an act, alongside body cameras and plate readers. Hunter gear (a Flipper, a pwnagotchi, a Pineapple) scores lower, because a tool present is capability where a flood is something being done.
The Follower Heuristic
An unidentified Bluetooth device still around after five minutes is listed as following you — and the whole class together cannot move the verdict past clear. A follower in a house is usually the neighbours, and a warning that is always on is not a warning.
Tailing — The Claim Persistence Cannot Make
A follower that was beside you while you were somewhere else. A journey counts when the access points around you fade or drop away; a device promotes only if it was still there, strongly, at the far end. It alerts on its own, and it needs the accelerometer only the round board carries.
A Census, Not a History
The score is the sum of what is present right now, worked out when asked. Six names an act — a camera recording, a plate reader reading, a flood knocking devices off a network. Three names a capability. No quantity of unidentified devices can push an identified one over the line.
A Verdict You Can Read Across the Room
Clear winks once every five seconds, caution pulses once a second, alert flutters. Boards with a pixel add colour on top of the rhythm rather than sitting lit — a device meant to sit unattended should not be a beacon itself.
Screens That Need No Browser
On a Cheap Yellow Display the findings are on the glass, and touch does the rest: set a baseline, tap a finding to ignore it, join a Wi-Fi network by typing the password on the panel, read the console's address, and install an update. The backlight dims itself to the room it is in.
A Watch Face as a Disguise
The round AMOLED board can show the time instead of a list of everybody's Bluetooth addresses, because a device glanced at in a pocket should not advertise what it is doing. The threat level reaches the wearer as the colour of the hour markers and nothing else.
Baseline What Is Already Yours
Press Set baseline once it has settled in and everything currently in range becomes known — which is why a good install is a quiet one. Protected classes are silenced by address alone, so quieting your own Flipper never quiets a stranger's.
Five Ways to Be Told
The headless boards push to Gotify, ntfy, Pushover, a JSON webhook (Home Assistant, n8n, Node-RED) or Telegram. Findings are queued during patrol and flushed on the next uplink as one digest, ordered by what warrants attention. Tokens are write-only — no endpoint reads them back.
A Console on Your Own Network
The log, the findings, the evidence behind each one, and every setting are served from the device itself — over its own access point when you hold the button, or over your LAN once it has joined. Nothing is uploaded to anyone's cloud, because there isn't one.
Flash It From a Browser
A Web Serial flasher installs the build for the board you plug in — no toolchain. It writes firmware without touching stored configuration, so an upgrade keeps your mute rules, credentials, and console password.
Updates Over the Air, With Rollback
It checks once a day, inside an uplink window it was going to open anyway, against the same manifest the web flasher uses. A new version is mentioned once and installs when you ask — never on the device's own initiative, because a device that is updating is not a device that is watching.
Dual-Band on the ESP32-C5
On a C5 the sniffer covers 25 channels of 5 GHz across UNII-1, 2A, 2C and 3, a slice per cycle, on top of full 2.4 GHz coverage every cycle. DFS channels included — the radar rules govern transmitting, and this radio only listens.
How It Works
Ten minutes to a working detector
Pick a Board, Flash It
A headless sensor — the XIAO S3, either C5, the C6 — reports to your network. A Cheap Yellow Display reports to your hand. Plug it into a Chromium-based browser over USB and the flasher installs the matching build.
Give It Your Network
Hold the button and join the device's own access point, or, on a board with a screen, pick the network and type the password on the glass. The console then lives on your LAN, and the screen will tell you where.
Set a Baseline and Walk Away
Let it patrol where it will live, then mark everything in range as known. After that, expect quiet — a silent detector is the normal state, and the heartbeat on the log tells you it is still watching.
The web flasher needs a Chromium-based desktop browser — Chrome, Edge, Opera, or Brave 1.69 and later. Firefox and Safari do not implement Web Serial, and no mobile browser does. Building it yourself needs ESP-IDF v5.5.5 or later. From v0.7.0 onward a device installs later releases itself, from its own console or its own screen.
What it catches — and what it will miss
A detector you cannot calibrate your trust in is worse than none. Both lists ship in the README, and the second one is the more important of the two.
What it catches
- Body cameras and licence-plate readers by vendor prefix — scored as an act
- Deauthentication floods: eight frames naming one address inside ten seconds
- Hunter gear — a Flipper Zero, a pwnagotchi, a WiFi Pineapple
- Bluetooth trackers: Apple Find My, Tile, Galaxy SmartTag, Google Fast Pair
- IP and vendor cameras by OUI, SSID keyword, and WPS model string
- Remote ID drone beacons over BLE and over Wi-Fi, per ASTM F3411
- Hidden and non-broadcasting access points, via the promiscuous sniff
- Devices that keep reappearing — and, on the round board, ones that came with you
- Your own gear, labelled benign; peer detectors, fixtures and earbuds weighted down
Read this before trusting it
- Address rotation is followed for Bluetooth, by kind rather than individual — and not yet for Wi-Fi
- Absence of evidence is not evidence of absence — a clear reading means nothing was detected
- Wired cameras and cellular ALPR units with the radio off are invisible to it
- On anything but an ESP32-C5, 5 GHz devices are invisible to it
- A deauth flood names the address it was sent as — a victim, not a culprit
- A vendor prefix identifies a manufacturer, not a purpose — a doorbell is not surveillance
- Some signatures are inferred from public reporting; treat those hits as leads
- The console is authenticated but not encrypted — that cookie crosses your LAN in the clear
- A device installing an update is not detecting, which is why it never updates unasked
- Delivery is verified end to end for three of the five notification providers
Technology
Small hardware, unglamorous engineering
Native ESP-IDF, tables generated from the registry rather than maintained by hand, and a parser that assumes every frame it reads is hostile.
A note on the law
Observore is a receiver. It observes broadcasts that are, by design, transmitted publicly and unencrypted. It does not deauthenticate, inject, jam, associate, crack, or interfere with anything. Passive reception of broadcast frames is lawful in most jurisdictions, but “most” is not “all”, and what you do with a log is a separate question from how you gathered it. Check your local law.
Find out what is watching the room
Observore is open source and free to build, from Forged in Feathers Technology. Plug in a board and it is running in about ten minutes.