Signal Triangulation - Pinpoint devices instantly

RSSI Triangulation: Locating Devices With BLEShark Shiver Mesh

If you know how far away a transmitter is from each of three known reference points, you can calculate where the transmitter is. This is trilateration - the same geometric principle that GPS uses (with satellites instead of Shiver nodes).

The "how far away" measurement comes from RSSI: the Received Signal Strength Indicator. Radio signals attenuate with distance. A device that's 2 meters away sends a much stronger signal than the same device at 20 meters. If you have a model of how signal strength relates to distance for a given environment, you can convert an RSSI measurement into a distance estimate.

With three or more Shiver nodes at known positions each reporting their RSSI from the same target device, you can do the geometry to estimate where that device is physically located. The result isn't GPS precision - RF environments are noisy - but it's enough to say "this rogue AP is probably in the northeast corner of the second floor" rather than "this rogue AP exists somewhere in the building."

graph TD
    A[RSSI Triangulation] --> B[Path Loss and Trilateration]
    B --> C[Noisy RSSI]
    B --> D[Realistic Accuracy Expectations]

Table of Contents

The Math: Path Loss and Trilateration

The standard model for indoor radio propagation is the log-distance path loss model:

RSSI(d) = RSSI(d0) - 10 * n * log10(d / d0)

Where:

  • d = distance from the transmitter to the receiver
  • d0 = a reference distance (typically 1 meter)
  • RSSI(d0) = the measured RSSI at the reference distance (environment-specific, typically around -40 to -50 dBm for WiFi at 1 meter)
  • n = the path loss exponent (typically 2-4 depending on environment: 2 for free space, higher for offices with walls)

Inverting this to get distance from RSSI:

d = d0 * 10^((RSSI(d0) - RSSI) / (10 * n))

So if Node A sees a device at -65 dBm, and your reference measurements say -45 dBm at 1 meter with n=2.5, the distance estimate is:

d = 1 * 10^(((-45) - (-65)) / (10 * 2.5)) = 1 * 10^(20/25) = 1 * 10^0.8 = approximately 6.3 meters

Do this calculation for each Shiver node that saw the device. You now have a distance estimate from each node. Drawing a circle of that radius around each node's known position, the intersection of the circles is the estimated device location. With three nodes, you get a triangular intersection region - the device is somewhere in that region.

This is trilateration, not triangulation. Triangulation is angle-based (like a compass bearing). Trilateration is distance-based. RSSI gives distance estimates, not angle, so the correct term is trilateration, though "triangulation" is commonly used for both.

Why RSSI Is Noisy

The path loss model is a simplification. Real-world RF propagation is messier:

Multipath: Radio waves reflect off walls, floors, ceilings, furniture, and people. The signal arriving at your receiver is the sum of the direct path plus dozens of reflected copies, each arriving at slightly different times and phases. Depending on whether these copies add constructively or destructively, your measured RSSI can be several dB higher or lower than the model predicts. This varies with every tiny change in environment - even someone walking through the room changes it.

Shadowing: Physical objects between the transmitter and receiver absorb or reflect signal. A concrete pillar directly between the device and a Shiver node can cause 10-20 dB of extra attenuation that the model doesn't account for.

Transmit power variation: Not all devices transmit at the same power. A cheap IoT device might transmit at +4 dBm. A laptop might transmit at +20 dBm. The RSSI you see for a given distance varies with transmit power, and you often don't know what power the target device is using.

Antenna orientation: Transmit antennas have radiation patterns - they're not uniformly omnidirectional. A device oriented differently relative to your node can show different RSSI even at the same distance.

The practical consequence: RSSI-based distance estimates have uncertainty of several meters in typical indoor environments. The trilateration result is a probability region, not a point.

Realistic Accuracy Expectations

With 3 Shiver nodes and standard WiFi RSSI measurements in a typical office:

  • Open area, few obstacles: 2-4 meter accuracy
  • Typical office floor with cubicles and meeting rooms: 4-8 meter accuracy
  • Dense environment with concrete walls, metal fixtures: 8-15 meter accuracy

"Accuracy" here means the true device location is within that radius of the estimated location, roughly 68% of the time. Outliers happen.

This is enough to say "the device is in this room or possibly the adjacent one." For most security applications, that's actionable. If you're looking for a rogue AP, knowing it's in one of three offices on the north side of the floor is enough to start a physical search.

What it is not: GPS-precision meter-level location. Don't expect to drop a cursor on a floor plan and have it point to the exact desk. Expect to narrow down the search to a zone.

Practical Workflow

Using Shiver for device location in practice:

  1. Deploy nodes at known positions: Record where you placed each node on a floor plan. The accuracy of trilateration depends entirely on knowing the node positions accurately.
  2. Run a multi-node WiFi or BLE scan: The combined scan gives you per-node RSSI for each detected device or AP.
  3. Identify the target: Find the BSSID or BLE address you're trying to locate in the results.
  4. Check which nodes detected it: If only one node saw it, you can say it's in that node's vicinity. With two nodes, you can draw two circles and find where they overlap. With three or more, you get proper trilateration.
  5. Apply the path loss model: Convert each RSSI to a distance estimate. Use n=2.5 as a starting point for typical office environments. Calibrate against a known device at a known distance if precision matters.
  6. Estimate location: The intersection of the circles on your floor plan is your target zone. Physically search that area.

If the target device transmits continuously (like an AP with periodic beacons), running the scan multiple times and averaging the RSSI values from each node improves the accuracy of the distance estimates by reducing the impact of momentary multipath variations.

Use Cases

Rogue AP location: The most common use case. Multi-node scan finds an SSID or BSSID that shouldn't be there. Per-node RSSI data narrows down which area of the building it's in. Physical investigation confirms.

Unauthorized BLE beacon location: Tile trackers, AirTags, and other BLE tracking devices transmit continuously. If someone placed one in your facility, a Shiver BLE scan from multiple nodes will show it. Per-node RSSI helps locate it physically.

Red team device location: During red team assessments, the blue team may be trying to locate dropped Nanos or other attacker hardware. The inverse of this use case - the red team can pre-map where their deployed nodes will be most useful based on expected coverage from known positions.

Coverage verification: Confirming that corporate WiFi covers the entire floor. Nodes that measure the corporate SSID at weak RSSI (-80 dBm or below) indicate coverage gaps. The floor plan + RSSI data gives IT a map of where to investigate coverage improvements.

Signal anomaly investigation: If a device shows up at very high RSSI on one node but is invisible to all others, it's probably physically close to that node (or it's the node itself). If it shows moderate RSSI on all nodes equally, it's roughly equidistant - probably centrally located. These patterns help before you even run the geometry.

Node Placement for Best Results

Trilateration accuracy is maximized when nodes are positioned to create good geometric coverage - not clustered together, but spread to cover the area from multiple angles.

The ideal configuration for a rectangular floor space is nodes at or near the corners. Three nodes at three corners of a floor give you coverage of the entire floor with overlapping circles. Four nodes at all four corners gives redundancy and better accuracy toward the center.

What to avoid:

  • All nodes along one wall: poor geometry, most of the floor has only 1-2 nodes with valid RSSI
  • Nodes clustered together: range estimates overlap heavily, little useful geometric differentiation
  • Nodes separated by very thick barriers: the RSSI at one node will be dominated by material attenuation rather than geometric distance

For non-rectangular spaces (L-shaped floors, buildings with atriums), more nodes are needed to cover the irregular geometry adequately. The 16-node maximum Shiver supports is more than enough for most commercial floor plans.

BLE vs WiFi Device Location

Shiver supports both WiFi and BLE distributed scanning, so you can use the same trilateration approach for BLE devices (beacons, trackers, IoT sensors, etc.) as for WiFi APs.

A few differences between BLE and WiFi for RSSI-based location:

BLE devices typically transmit at lower power than WiFi APs. The effective detection range is shorter - 10-30 meters in typical indoor environments vs. 30-100 meters for WiFi. This means nodes need to be more densely deployed to triangulate BLE devices reliably.

BLE advertising intervals vary by device type and manufacturer. Some devices advertise every 100ms; others every 10 seconds. For reliable RSSI measurements, you need to scan for long enough to see multiple advertisements from the target device and average them. The BLE scan duration on BLEShark Nano is configurable.

BLE uses randomized MAC addresses for privacy on many device types. Tracking a specific device over time requires identifying it by manufacturer data or service UUIDs rather than MAC address, since the MAC may rotate.

Despite these differences, BLE trilateration with Shiver nodes follows the same geometric process as WiFi. The per-device RSSI data from the multi-node BLE scan is the input; the trilateration math is the same.

Get BLEShark Nano

Back to blog

Leave a comment