RSSI Heatmaps - Visualizing WiFi and BLE

RSSI Heatmaps With BLEShark Shiver Mesh: Visualizing WiFi and BLE Coverage

Numbers in a table don't communicate the same thing as a visual map. Telling your client "Node 3 measured AP X at -82 dBm" is less useful than showing them a floor plan where the northeast corner is shaded dark, meaning dead zone, and the IT closet area is white, meaning strong coverage. Heatmaps turn RF data into spatial understanding.

With Shiver nodes distributed across a space, you have the raw material for an RSSI heatmap: signal strength readings from multiple known reference positions. This article covers what a heatmap is, how to build one from Shiver scan data, and what it reveals that raw scan results don't.

Table of Contents

What a Heatmap Shows

A WiFi or BLE RSSI heatmap is a floor plan with signal strength overlaid as a color or intensity gradient. Strong signal areas are one shade (typically bright or warm), weak signal areas are another (dark or cold). Dead zones - areas with no signal - are the darkest.

graph TD
    subgraph "Signal Strength Zones"
        STRONG["Strong Signal
-30 to -50 dBm
Green Zone"] 
        MEDIUM["Medium Signal
-50 to -70 dBm
Yellow Zone"]
        WEAK["Weak Signal
-70 to -85 dBm
Orange Zone"]
        DEAD["Dead Zone
Below -85 dBm
Red Zone"]
    end
    subgraph "Diagnostic Insights"
        STRONG --> GOOD[AP placement confirmed]
        MEDIUM --> CHECK[Acceptable - monitor for drops]
        WEAK --> MOVE[Consider AP relocation]
        DEAD --> ADD[Add AP or repeater needed]
    end
    subgraph "Advanced Analysis"
        OVERLAP[Channel overlap detection] --> INTERFERE[Co-channel interference map]
        ROGUE[Rogue AP identification] --> SECURITY[Security concern flagged]
        COVERAGE[Coverage gap analysis] --> DEPLOY[Deployment recommendations]
    end

Interpreting heatmap signal zones and their diagnostic implications

graph TD
    subgraph "1. Physical Setup"
        A[Place Shiver nodes at known positions] --> B[Map node locations to floor plan grid]
        B --> C[Assign each node a fixed coordinate]
    end
    subgraph "2. Data Collection"
        C --> D[Each node scans WiFi networks]
        C --> E[Each node scans BLE devices]
        D --> F[Record RSSI per AP per node]
        E --> G[Record RSSI per BLE device per node]
    end
    subgraph "3. Interpolation"
        F --> H[Triangulate signal source positions]
        G --> H
        H --> I[Apply interpolation method]
        I --> J[IDW - Inverse Distance Weighting]
        I --> K[Kriging - Statistical model]
        I --> L[Linear - Simple triangles]
    end
    subgraph "4. Visualization"
        J --> M[Generate color-coded heatmap overlay]
        K --> M
        L --> M
        M --> N[Overlay on floor plan]
    end

RSSI heatmap generation pipeline - from node placement through data collection to visualization

The heatmap answers questions that raw numbers don't:

  • Where does coverage drop off and why?
  • Are there coverage islands - areas with strong signal surrounded by weak zones?
  • Does a specific AP have a directional coverage pattern (one side of the building gets strong signal, the other doesn't)?
  • Where is a rogue device physically located, based on its signal strength pattern?
  • Are there suspicious signals appearing in parts of the building where no authorized AP should be?

A visual representation of the RF environment is the standard output of a professional wireless site survey. Enterprise tools that produce these (Ekahau, NetSpot) cost hundreds to thousands of dollars and require dedicated hardware. Shiver doesn't replace those tools for high-precision enterprise deployments, but it gives you a functional picture of the RF environment at a fraction of the cost and without dedicated mapping hardware.

Data Collection With Shiver

The Shiver multi-node scan gives you RSSI measurements at each node's fixed position. For a static heatmap based on node positions, this is the core dataset: node position (x, y coordinates on a floor plan) paired with RSSI measurement for the target AP or device.

For a higher-resolution heatmap, you can add a walking survey: carry a Nano through the space and do repeated single-node scans at different positions, recording your position at each scan. This gives you more data points but requires manual positioning work rather than just deploying nodes.

The static multi-node approach (fixed deployed nodes) is the Shiver mesh use case. A walking survey with a single Nano is also valid but doesn't benefit from the mesh - it's just using one device as a scanning tool and you're providing the position data manually.

For a static heatmap from a deployed Shiver mesh:

  1. Record the physical position of each deployed node on your floor plan. Measure actual positions or use a floor plan with room labels.
  2. Run a multi-node WiFi or BLE scan from the Execute menu.
  3. From the scan results, extract the per-node RSSI for your target AP or device.
  4. Pair each RSSI value with the corresponding node's floor plan coordinates.
  5. Use these data points to generate the heatmap.

Building the Heatmap

Building the actual heatmap from your data points requires some processing outside the Nano. The Nano gives you the RSSI data; the heatmap visualization is generated on a computer.

Simple approach for quick results:

  • Export the per-node RSSI data (manually note down from the results screen, or pull from the SPIFFS-stored JSON if you have file portal access).
  • Import into a spreadsheet or Python script.
  • Plot node positions on a floor plan image with RSSI values as labels.
  • Use basic interpolation to estimate signal between nodes.

Python with matplotlib and scipy gives you inverse distance weighting or Kriging interpolation with reasonable effort. The scipy.interpolate library includes griddata() which handles scattered-to-grid interpolation - you give it your node positions and RSSI values, and it computes estimated signal strength across a regular grid that you can overlay on a floor plan image.

For teams doing this regularly, there are open-source WiFi heatmap tools (Heatmapper, NetSpot free tier) that accept CSV data. Format your Shiver output as position + RSSI measurements and import.

Interpolation Methods

Going from a handful of data points (one per deployed node) to a continuous heatmap requires interpolation - estimating signal strength at positions between your measurement points.

Inverse Distance Weighting (IDW): The estimated signal at any position is a weighted average of all measurement points, where the weight decreases with distance. Simple, fast, and works reasonably well for smooth coverage patterns. Tends to produce circular "bullseye" artifacts around measurement points.

Kriging: A geostatistical interpolation method that uses the spatial autocorrelation structure of the data to weight predictions. More accurate than IDW but computationally heavier and requires more tuning. Overkill for quick assessments; appropriate for formal deliverables.

Nearest Neighbor: Each point on the floor plan takes the RSSI value of the nearest measurement node. Fast, no smoothing, produces Voronoi-region boundaries. Useful for seeing exactly what each node covers but looks blocky.

For most security assessment use cases, IDW is sufficient. The output is a readable heatmap that communicates coverage patterns without requiring statistical expertise to generate or interpret.

Important: any interpolation between your node positions involves uncertainty. The interpolated signal at a point halfway between two nodes is an estimate based on the assumption that signal decreases smoothly between those nodes. In practice, a thick wall right between them would cause a sharp drop-off that IDW wouldn't capture. The heatmap is a guide to where to investigate, not a precise RF model.

What a Heatmap Reveals

The patterns that stand out in a well-constructed heatmap:

Coverage gaps: Dark zones on the corporate AP heatmap where employees can't reliably connect. If there are dark zones in areas people use regularly, they'll fall back to other networks - personal hotspots, guest networks, potentially rogue APs.

Coverage asymmetry: An AP that covers the east wing well but has a dead zone to the west suggests the antenna is oriented or mounted incorrectly, or there's a material difference (metal shelving, HVAC units) blocking signal in one direction.

Suspicious signal patterns: A device showing strong signal in an area with no authorized APs nearby is worth investigating physically. The heatmap makes this obvious at a glance - a bright spot in an area that should be dark.

Overlap and interference zones: Areas where multiple APs show strong signal indicate high overlap. This isn't necessarily bad (good coverage redundancy), but if those APs are on the same channel, the overlap zone has significant co-channel interference that degrades performance.

External signal leakage: A strong signal showing up on the exterior walls from a device that your node placement doesn't explain may be leaking in from a neighboring tenant space. Security concern: employees near that wall may be connecting to an external network.

Use Cases

Enterprise wireless audit deliverable: The heatmap is the primary deliverable in most wireless audit reports. Showing a client a floor plan with their coverage visualized - especially one that reveals dead zones, rogue AP hotspots, or external signal leakage - communicates the findings more effectively than a list of RSSI numbers.

Rogue AP location investigation: If multi-node scanning detected an unauthorized AP, the heatmap of that AP's signal strength (color-coded based on per-node RSSI) shows where the signal is strongest, pointing to the physical location of the rogue hardware.

Hidden BLE tracker detection: BLE tracking devices (hidden in offices, under desks, in ventilation ducts) transmit continuously. A Shiver BLE scan heatmap for unknown or suspicious BLE addresses shows their signal distribution. Strong signal in a specific area of the floor points to where to look physically.

Security camera dead zone mapping: A different application - BLEShark's BLE scan combined with known positions of BLE-enabled security cameras or IoT sensors can create a coverage map of physical security system reach. Areas not covered by any sensor show up as dark zones.

Before/after remediation verification: Run a heatmap before installing additional APs or adjusting existing AP placement, then run it again after. The two heatmaps together demonstrate what changed and whether the coverage gaps were addressed.

Multi-Target and Multi-Band Heatmaps

You can build separate heatmaps for each BSSID in your scan results. If you have 30 APs detected, you can generate 30 individual heatmaps showing the coverage footprint of each AP individually.

This is particularly useful for:

  • Comparing the coverage footprint of the corporate SSID vs. the guest SSID to verify they're properly isolated
  • Mapping all BSSIDs that match a target SSID name (detecting rogue APs with copied SSID)
  • Overlaying multiple heatmaps to see channel interference patterns (where multiple 2.4GHz APs on the same channel overlap)

BLE and WiFi heatmaps can be generated from the same scan session. Run a combined WiFi + BLE scan (send both CMD_WIFI_SCAN and CMD_BLE_SCAN), collect both result sets, and generate heatmaps for targets of interest from each technology.

Practical Limits

A few constraints to be clear about:

The Shiver multi-node scan captures a snapshot - a single point in time. The RF environment changes as people move around, devices come online and offline, and interference sources vary. A heatmap built from one scan reflects the state of the environment at that moment. Running scans at different times of day can reveal time-dependent patterns (congestion during meetings vs. off-hours quiet).

The spatial resolution of the heatmap is bounded by the number of nodes. With 4 nodes on a large floor, the interpolated heatmap is a coarse estimate. More nodes = more data points = more accurate interpolation. For a 30-meter by 30-meter office floor, 6-8 nodes give enough spatial sampling for a useful heatmap. The 16-node Shiver maximum supports high-resolution coverage of significant spaces.

The 2.4GHz-only limitation means the heatmap reflects 2.4GHz conditions only. Modern enterprise networks primarily use 5GHz for client devices. The 2.4GHz heatmap from Shiver shows the IoT and legacy device coverage picture, plus interference from neighboring 2.4GHz sources, but not the primary client WiFi experience on 5GHz bands.

Get BLEShark Nano

Back to blog

Leave a comment