Wifi/BLE Paxcounter Project with ESP32 boards

(Verkehrsrot) #315

A Talk on wifi sniffing, market players and legal restrictions:

(Pete) #319

Greetings -

Thank you, @Verkehrsrot, for the code.

I was able to perform a new install of Atom+platformIO on Windows, configure, and compile and load to a TTGO LoRa32 V2.1_1.6 US 915.

(Verkehrsrot) #326


Current paxcounter version in development branch has as strange bug concerning reading the BME680 sensor (if installed): After reproducable 71 minutes (~ 4297860ms) of runtime, the Bosch bsec.cpp routine does not start any longer if called, what means that no new measurements arrive.

Maybe sort of some counter wrap or side effect, but couldn’t find it yet after hours of analyzing… :frowning:

Anyone here who can help?

(Verkehrsrot) #327

Paxcounter new release v1.7.11 was published today!

Bugfixes / internal changes:

  • Bluetooth: changed default to bluetooth disabled, this achieves ~10-30% better wifi sniffing results (can be enabled during runtime by rcommand 0x0e or by changing defaults in configmanager.cpp
  • Bugfixes in Cayenne payload encoder
  • Platformio.ini restructured
  • OTA Wifi download stabilized & debugged
  • Upgrade ESP32 core to ESP-IDF v3.1.2
  • Upgrade Arduino-ESP32 core to v1.0.1 (= PlatformIO espressif32 v1.6.0)
  • Update documentation (readme.md)

New features:

  • Full BME680 environment sensor support, including indoor-air-quality (using BOSCH BSEC library)
  • ESP32 AES hardware encryption option (not used yet)
  • PSRAM support on devices with external SPI RAM now fully functional (used to store MACs)

(Verkehrsrot) #328

This issue seems not to reoccur with new 1.7.11 version.
So far so good but i have now clue why…

(Verkehrsrot) #329

New paxcounter version 1.7.11 working like a charme on different ESP32 boards :sunglasses:


(Verkehrsrot) #330


(Verkehrsrot) #331




Did test with following board’s and all work’s with this new release

Board type : ttgov21, White Heltec, Heltec v2, ttgov22-v07

Let’s counter futher on WiFi an BT.



imagine a square… 100x 100 mtrs
there is a market… the organiser wants to know how many visitors and on what times of the day.

  • how many paxcounters do you need
  • can you make ‘meshed/coordinated’ paxcounters that gives a reliable output for bigger area’s

for that you need to process data from all involved paxcounters, compare them ect.is that allowed

(Verkehrsrot) #334

great! & thanks for testing.

(Verkehrsrot) #335

Meshed counters and comparing MAC addresses will be strong to legal boundaries, that’s why i did not realize this function.

But i think this not needed. Just grab all anonymous counts from every location a make a realtime heatmap of this data on server side.

So this should be a function of the backend.

The project still misses a functional backend with UI etc., who can make one?

(Verkehrsrot) #336

New #paxcounter version 1.7.14 in development branch got a new feature: Operating as a real time master clock controller, it can generate IF482 time telegrams (useful e.g. for synching railway station clocks).

Time source is a buffered on board RTC, as found on TTGO T-Fox, externally synched either by GPS time or by LoRaWAN* network time.

This way discrete DCF77 decoders becomes obsolete. Maybe someone could add DCF77 encoder to paxcounter code? Then a TTGO T-Fox module could emulate a DCF77 decoder.

*) With TTN yet to come with v3 stack, not supported by v2 stack.

(Frasanc1) #337


Good afternoon, I’ve been reading for a few days and I’m new to the forum. This using Mac, VS Code and PlatformIO with the latest master version.

I have compiled the code and made the configuration settings that I believe necessary to make the first tests in the absence of the LoRA communication, I have even added new IDs of Xiaomi in the file vendor_array.h.

The problem is that it detects WIFI devices but it does not detect Bluetooth. Can you give me an idea?

In the file configmanager.cpp I have activated the BLEScanner and also the vendorfilter.

Let’s see if you can give me directions to follow.

Thanks in advance.


(Verkehrsrot) #338

Try to send a remote command 0x0e 0x01 to enable bluetooth.
Go to TTN console, select your device, scroll down to downlink, set FPort to 2 and enter payload 0e 01. Then wait until the paxcounter received the command, it will then turn bluteooth on (if the feature was compiled in code).

You can also modify the default setting “blescan” in configmanager.cpp, then reflash and reboot.

Note: If you modify setting in configmanager.cpp, it will not affect the runtime settings immediately, because settings are saved in NVRAM and reloaded at device startup. So you need to erase NVRAM settings with rcommand 09 02, or you increase the version number in platformio.ini. The device checks the version number during startup and if a newer version is detected, NVRAM settings are cleared.

Yes, this is weird, you’re welcome to make pull request with refactored configmanager.cpp code!

(Frasanc1) #339

Thank you very much for the help.

After different tests I verified what was said in the forum by trying three configurations: Only WIFI, WIFI + Bluetooth, Only Bluetooth.

The WIFI + Bluetooth configuration is not very efficient when performing the detection, much slower. In the end I opted for scanning separately to optimize device detection.

I now enter the assembly of a proprietary LoRAWAN network to send the data.

(Frasanc1) #340


After a few days of trying out configurations I can not send anything through LoRa.

The configuration of the PaxCounter device is with SF = 7

On the other hand I have implemented a 1 channel gateway, and I have registered it in TTN. The Gateway is visible from TTN.

The configuration of the Gateway is SF = 7 and listening on channel 1 868300000.

Any idea?

10 07 29 36 03 16 38

(Verkehrsrot) #341

Paxcounter software relies on LMIC stack, and this expects a full LoRaWAN compliant 8ch gateway. Otherwise it won’t work, at least not with tweaks in LMIC stack.

(Frasanc1) #342

Thanks for the info.

Is there any way to avoid it and be able to transmit through a Gateway own channel?

Some indication to be able to adjust the sending of information by LoRa.

(Verkehrsrot) #343

No one stops you tweaking the source code of LMIC stack, but be aware that you then not only own a LoRaWAN specs non-compliant gateway, but also a non-compliant node, and this may affect the used LoRaWAN networks.

So i would recommend you to spend your effort to get a full 8ch gateway. Nowadays this is an invest of not more than $69 if you buy the new TheThingsIndustries Indoor Gateway (“TIG”).