ikaros

Hello,

I've been reading the thread about pinpointing the discovered APs in Mappoint ( here ) and I must say I was very impressed by what was done there. As I understood, these scripts indicate where the stongest signal was received.
In order to improve the location of the APs, wouldn't it be possible to calculate their position using the different positions of the vehicle together with the signal strenghts (something similar to calculating the position of the vehicle using the signals of 3 or more GPS sattelites).
This would make it possible to determine in which building the AP is located or at least at which side of the street it is.
I'd like to write or participate to the script but I don't know the formula(s) to achieve this type of calculation.

Ikaros

Scorpy

VERY interesting idea. I think its a great idea. In the very LEAST it could give some quality programmers there first look into AP triangulation. Something that many companies have already written scripts for such as my company. Though i have no idea about programming... I only wardrive ... what i think they did was make a huge database of ever single ping from an ap and use all the pings and a topographical map ect to triangulate and form a 'curviture coverage area' of each ap and checked them back to each other. I hope that makes sence.

Here is some images/webpages to help you understand what i mean!
http://www.wafreenet.org/?page=baynet
http://www.wafreenet.org/?page=network

warwalker

I've been playing around with this idea myself (and REALLY appreciate the additional resources you've referenced), and have come to the following conclusions:

1- The biggest impediment to the quasi-triangulation you refer to is the inconsistent nature of the typical urban landscape. whether you and the AP are separated by a window or steel re-inforced wall seems to affect the signal you receive much more than your distance from it, so a snapshot of the rssi at one point might give the impression that you've moved away from the AP when you've actually moved closer but into a wifi "shadow". Also, reflective surfaces -- such as neighboring buildings -- can bounce signals in decpetive ways.

2- A very practical and accessible solution is a well-shielded yagi, which, when used in conjunction with an app with a good and responsive graphical representation like PocketWinC or PocketWarrior, can help pinpoint the exact office from which a signal is emanating -- even at (relatively) great distance.

3- A more elegant solution might be one simultaneously using two or more receivers. I do all my work on foot and via PDA (IPAQ 2215, Ambicom GPS-CF and SanDisk-SD). I'm interested to know whether two separate, well-calibrated PDAs working simultaneously with identical gross spatial orientation relative to the AP, but separated by 3-5 feet, could detect a meaningful signal differential without being overly thwarted by the signal nuances I describe above. I think that an examination of the log, eliminating signal outliers and accounting for inevitable hardware differences and error, could yield some good data.

Just my impressions. Of course, I'm new to this, so maybe it's been done.

Warwalker

Scorpy

warwalker, i talked to a few guys at my work and everything they coded is completly confidential, since companies pay us BIG bucks to find hidden ap's in not only offices but large commerical enterprises like distribution centers and things. We are a radio company not a software company but I am trying to find out what hardware and methods they use for you.

Your approches and points are very good and it seams you are on the right track. I dont suppose you are into software development and could start to write some test applications?

Also remember unless your gps unit is running hacked firmware the best lock on the unit you will get is anyware up to 15 feet at best.

wrzwaldo

Is that just because you are modifying the EPE? Do you have some hard facts on this? I have been involved with the system from way back and have never heard of a firmware hack that actually improved the positional accuracy of commercial units. Improving (actual) psitional accuracy requires a couple things and last I checked a hacked firware was not on the list. I have however had EPE's of under 7 feet with a WAAS enabled unit and stock firmware. But EPE's really mean dick, actual performance is the real test.

edit: corrected spelling

Barry

You also have to look at environmental factors. Heavy cloud cover, trees, mountains. With all the forest fires up here lately, the smoke gets pretty thick. I was running my gps in the car a couple weeks ago and barely had any signal. My gps is a Garmin eTrex Vista and usually it tells my around 15 to 9 feet accuracy, that day I couldn't really see the accuracy part but the signal lines were the lowest they would go.

__________________
Penny's giving it up. She's giving it up hard. Cause she's with Captain Hammer, and these, are not the hammer...... The hammer is my penis. --- Captain Hammer, Dr. Horrible's Sing-Along Blog.

warwalker

Thanks! But please don't take any chances that might get you in trouble (though I can assure you that I will not betray your confidence).

As it happens, I've done a lot of thinking about this topic in the past couple of days and started a project to see how/if it might work (though my focus has changed a little...I'll PM you with details). It's taking a little time to learn Embedded C++, but I just found an SDK that moved things way ahead.

Actually, I've found that the combination of WAAS and an app I use that does an incredible job of data averaging puts your location reliably within 1 meter. The only problem is that being so calculation-intensive, even my 2215's 400Mhz processor is tapped and has a hard time doing much else (ie, gathering wifi signal data).

I'm pretty excited about this project...I'll let you know more soon.

Warwalker

Scorpy

Well mate bare with it and try and get some projects and things forward. By that i mean you need to get one top of some good research and try a few experiments like you are then we can work on getting you some nice hardware ;-)

As for the firmware hack i can tell you now its very real. I remember a firmware hack for a previous pda receiver i had. I have no idea how it worked but it imporved accuracy down to a meter or two.

Chillout

but what if you do it like this?

(check the 1337 graphics in the attachment for visual support of my idea )

- you are wardriving and the script marks a spot where the signal is detected first (location 1).
- then, at some time, the highest signal is detected (location 2), which is also marked
- after a while, the signal is lost (location 3) and another location is marked.

Now you can draw a circle/ellipse, using the highest-signal as the center, and the first and last signal locations as the outer radius of the ellipse.

In this circle I would use a starburst-gradient coloring, to indicate the signal-strength. It is very probable that the AP is inside this circle. I'm not sure if this is possible to build? Of course it would be impossible to deal with signal loss caused by buildings and stuff, but it's just an idea (hope you like it)

legenda of the image:
- green circles: wireless signal sent by the AP. The darker the color, the stronger the signal. Yes, I should've used a gradient
- red circle: the circle that indicates the probable location of the AP, and also visualises the reach of the signal (which is quite important I think)
- red numbers: the different locations as described above
- the black lines: the road you're driving

Attached Images

leetpaintskillz.jpg (86.8 KB, 1412 views)

Apollyon

Until you step back into the real world with its walls, windows, rebar, cars, filing cabinets, and such that all block or reflect 2.4GHz to some extent or another. You may create a neat picture with the results you get, but it may or may not be at all useful. Ask anyone who has used direction finding gear and/or done any fox hunts.

Try logging your results of signal strength of an AP in a building. Go all around it and different distances from it. Now, consider the results you would get if you had only driven by it at any given tangent.

I have Netstumbler picking up an AP on every pass at one spot on a road over a mile from any buildings. Things like that can well throw off your averaging.

Apollyon

Nerdtalker

Same. I've seen access points seem to go out of distance, and then come back un-expectedly because I've regained LOS, or something interfered with LOS when I picked it up the first time.

It'd be extremely hard to compensate for that unless you had a representation of all topographical features, buildings, and other signal impediements.

I think seeing signal plotted on map (eg with the line changing color as snr/power level changes) would be the best indicator of where the AP is.

jBower

if you can work out all the info you can on the ap it may help (Like looking at the MAC for Vender and Model to find the DB out put), all of the maping software i have seen todate for netstumbler use's 2d maps ( if your trying to DX an AP you need to take all that you can find ) it whould be a good idea to move to a 3d gps - maping system ( off the top of my head you could use the SRTM ( info on SRTM [ http://www2.jpl.nasa.gov/srtm/ ] ) info on nasa's web page and other way's to get info ( Http://www.cplus.org/rmw/dataen.html ) there is one program that dose RF radio progation modeling that dose a good job i use it all the time in my army job working with sincgars radios ( http://www.cplus.org/rmw/english1.html )

could you try and use the time of request to becin to get a rufe idea of range, might be a way to but out the reflecions
i.e. (becin time - repuest time) * 299,702,547 = m to AP i know you have the speed of light changing ( http://www.what-is-the-speed-of-ligh...ive-index.html )as the H2O in the air, and the time it take the ap to think will throw off the #'s but might work for a rule to cut down bad data.

i have had the same thoughts on needing to work out where APs are before, and love to see someone that can take it on good luck.
pixs:
1. this is one map of what Radio Moble dose
2. this is one of the things that i have found that might be a good idea to tie in to the maping system

Attached Images

	contour.gif (78.3 KB, 211 views)
	Sandia_opt-qwersar.JPG (33.8 KB, 198 views)

Skirecs

I think the easiest way would be to try and walk a steady curve with a constant signal strenthg, thats more active, not what your looking for.

Skirecs

I have an idea that would work for finding the location, but my picture wont upload, it says, this document contains no data, s i cant do it. If your interested, AIM at Skirecs or ask at skirecs@gmail.com

I really think it is plausible under good conditions to vaugly position the AP using this syste, but its hard to type, you really need the pic.
It requres two passes through the AP, on different course, maybe even if the GPS is very accurate you cloud use the oppostire sides of the street.
You set a signal strengh level, and mark the two times you get that level, on the way in and on the way out. For the second pass, use teh same level and take antohte 2 point. So you have 4 points, theoretically position on a circle eminating from the AP. Plot them in a graphing calculater, use a circle regression and get hte center

Hope this is clear.

Tuckie

wouldn't gathering more points make the real location more accurate? Having say 100 readings and then averaging them through some form of triangulation would at least compensate somewhat for physical barriers?