Router CSI Lab
EN ZH

Get 256-subcarrier Wi-Fi CSI from a GL-MT6000 router (no extra hardware)

2026-10-11 · 3 min read

This is the full reproduction route for a GL-MT6000 (MT7986) router: 80 MHz, 256 subcarriers, no extra NICs. Every step below was executed on real hardware — including the failures.

Every performance number here is a reproducible first-party measurement (grade E) — the raw capture, scripts and SHA-256 are published [2] [3]. The mt76 driver and its CSI patch come from the upstream open-source repository [1].

Results first

Item Measured
Hardware GL.iNet GL-MT6000 (MT7986A + MT7976)
OS OpenWrt SNAPSHOT, Linux 6.18
Wi-Fi firmware mt7986_wm.bin 2026-05-15, MD5 3ce21eda…98019
Capture interface dedicated AP iface (csi0), 5 GHz / HE80 / ch44
Short run 561 frames / 10 s (55 fps)
Long run 57,293 frames / 10 min (95.5 fps), no >5 s gap
Per measurement 256 subcarriers, 8 chains (tx 0/1 × rx 0/1/2/3)

Requirements and risk

⚠️ Flashing has risk. GL-MT6000 has a U-Boot recovery path, but rehearse the rollback first and keep the stock firmware plus a config backup. Research use only.

Build notes (mt76 CSI patch)

CSI needs three parts together:

Component Role
9000-mt7915-csi-implement-csi-support.patch CSI control + reporting in the mt76 driver (nl80211 vendor cmd + debugfs)
mt76-vendor issue CSI commands (enable, MAC filter, frame type)
mt76-csi-daemon (+ LuCI page) continuous capture, UDP/ubus/REST output, visualisation

All three are built on top of OpenWrt's open-source mt76 driver [1].

Firmware version matters. On MT7986 you need the 2026-05-15 Wi-Fi firmware — with older builds the CSI reporting path has no caller, which looks like "enable succeeds but no data ever arrives".

# on the router
md5sum /lib/firmware/mediatek/mt7986_wm.bin   # expect 3ce21edabe201608e7bec0dd16898019
dmesg | grep -i "WM Firmware"                 # expect Build Time: 20260515…

Enabling CSI (the step everyone gets wrong)

Two conditions must hold at the same time, otherwise nothing is ever captured:

# 1) frame-type filter — without it the firmware reports nothing
mt76-vendor <iface> set csi ctrl=1,0,0,34

# 2) add the target station MAC (only filtered stations are reported)
mt76-vendor <iface> set csi ctrl=1,0,0,0 macaddr=<client-mac>

# verify
cat /sys/kernel/debug/ieee80211/phy1/mt76/csi_stats

Notes: the first argument is the interface name (e.g. csi0), not the phy name; CSI is a receive-side measurement, so the client must keep generating traffic; use a dedicated AP interface so your normal Wi-Fi stays clean.

UDP record format

Host byte order (little endian on the target):

Offset Field Notes
0 ts uint32 microsecond timestamp (600 s measured as 599,931,160 µs)
4 ta[6] transmitter MAC
10 rssi int8 dBm
11 snr uint8 dB
12–15 data_bw, pri_ch_idx, rx_mode, pad
16 data_num uint16 subcarriers (256 in this project)
18–19 tx_idx (uint16) transmit chain index
20–21 rx_idx (uint16) receive chain index
22–23 chain_info (uint16) bit15 = last chain of this measurement
24… int16 I/Q pairs 4 bytes per subcarrier

Validate and stabilise

scripts/csi_capture_session.sh 10     # quick check
scripts/csi_capture_session.sh 600    # 10-minute stability run

Pass criteria used here: stable frame rate, no >5 s gaps, complete chains, flat daemon RSS (~5.2 MB) — verified against the 57,293-record capture [2].

The five must-know pitfalls

  1. Missing frame-type filter → zero data (most common);
  2. Missing MAC filter → nothing, or the wrong device;
  3. Wrong firmware version → enable succeeds, no reports;
  4. CSI interfering with your normal SSID → Wi-Fi suddenly slow (see the troubleshooting article);
  5. Testing against a public server → not reproducible; use a LAN traffic source.

Next

References and data sources

Every external claim carries a source and an evidence grade (grading scheme). Grade E marks first-party, reproducible measurements from this project.

  1. Grade C · official docs openwrt/mt76 — mac80211 driver for MediaTek Wi-Fi chipsets
    OpenWrt project / MediaTek
    github.com/openwrt/mt76 · verified: GitHub API 2026-10-11 (stars 890, last push 2026-10-08) · Upstream of the open-source mt76 driver used here; the CSI patch is applied on top of this codebase.
  2. Grade E · first-party measurement This project's 10-minute raw capture (57,293 records / 600.0 s, SHA-256 00373f83…95e2)
    Router CSI Lab · 2026
    csi.okwujun.pw/zh/datasets/ · verified: Reassembled chunks verified byte-identical (2026-10-11)
  3. Grade E · first-party measurement Router CSI Toolkit — capture/analysis/watchdog scripts (MIT)
    Router CSI Lab · 2026
    csi.okwujun.pw/zh/tools/ · verified: Repository bundle has a SHA-256; scripts run on real hardware

This page contains affiliate links (rel="sponsored"). Buying through them costs you nothing extra and earns this site a small commission.