arXiv Science⌕ Search
Home/Archive/arXiv

arXiv · 2609.13795

Meter-Level Wi-Fi RTT Localization on a Production Enterprise WLAN

Enguang Fan·Binh Minh Tran·Klara Nahrstedt
View original source ↗Read source document ↗Export metadata ↓

Abstract

Wi-Fi Fine Time Measurement (FTM) promises indoor localization by reusing access points (APs) already deployed for connectivity, but prior evaluations mostly use APs purpose-deployed or calibrated for ranging, leaving it unclear whether a production enterprise WLAN can provide useful localization without localization-specific infrastructure. We evaluate Wi-Fi round-trip time (RTT) localization on IllinoisNet, a live campus WLAN whose APs were placed for coverage and capacity. Using five commodity Android phones at 10 static locations across a 50 m x 30 m office floor spanning LOS, NLOS, and multipath conditions, weighted nonlinear least squares achieves a median error of 1.21 m and a 90th-percentile error of 2.68 m, with no AP replacement, repositioning, or ranging calibration. Residuals vary in magnitude and sign across APs and propagation conditions, suggesting a single global correction is insufficient and motivating AP-aware software calibration rather than new localization-specific infrastructure.

Explore related subjects

cs.NI

Keep this discovery

Explore connections, maps & timelines

BibTeXRIS

Enguang Fan, Binh Minh Tran, Klara Nahrstedt. 2026-09-12. Meter-Level Wi-Fi RTT Localization on a Production Enterprise WLAN. https://doi.org/10.1145/3795866.3844758

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

Where Have All the Firewalls Gone? Security Consequences of Residential IPv6 Transition

IPv4 NAT has limited the spread of IoT botnets considerably by default-denying bots' incoming connection requests to in-home devices unless the owner has explicitly allowed them. As the Internet transitions to majority IPv6, however, residential connections no longer require the use of NAT. This paper therefore asks: has the transition from IPv4 to IPv6 ultimately made residential networks more vulnerable to attack, thereby empowering the next generation of IPv6-based IoT botnets? To answer this question, we introduce a large-scale IPv6 scanning methodology that, unlike those that rely on computationally intensive algorithms, can be run on low-resource devices common in IoT botnets. We use this methodology to perform the largest-scale measurement of IPv6 residential networks to date, and compare which devices are publicly accessible to comparable IPv4 networks. We received responses from 93,832,220 distinct IPv6 addresses, 14,901,892 of which are inside of residential networks (i.e., not the external-facing gateway IP). These residential network internal addresses span 4,412 ASes across 144 countries. These responses come from protocols commonly exploited by IoT botnets (including telnet and FTP), as well as protocols typically associated with end-user devices (including iPhone-Sync and IPP). Compared with IPv4, we reach 11x more HP printers over IPv6 than Shodan finds across the entire IPv4 Internet, and thousands of iPhones and smart lights whose services IPv4 NAT made unreachable by default. Collectively, our results show that NAT has indeed acted as the de facto firewall of the Internet, and the IPv4-to-IPv6 transition of residential networks is opening up new devices to attack. Finally, we discuss potential mitigations to prevent in-home network reachability as IPv6 adoption continues to grow.

cs.NI↗
arXiv2026

Burst-mode timing recovery based on fourth-power phase detector for passive optical networks

Driven by the ever-increasing capacity demands, 50G passive optical network (50G-PON) is ready for practical application. It is highly challenging to realize 50GHz burst-mode analog components; therefore, based on 25GHz burst-mode analog devices, burst-mode digital signal processing (DSP) is introduced to achieve the reception and processing of 50Gb/s on-off keying burst signals. To optimize the power consumption and area of the DSP chip, a one-sample-per-symbol (1-SPS) analog-to-digital converter has been applied in 50G-PON. One of the main challenges is implementing burst-mode timing recovery (BM-TR) for the 1-SPS burst signal in 50G-PON. In this paper, we first propose a BM-TR based on the fourth-power phase detector (4PPD) for 50G-PON. We mathematically verify that 4PPD can directly compute the timing phase offset (TPO) from the 1-SPS signal without using training sequences, allowing for immediate BM-TR initialization within 20 cycles to prevent long convergence times. After the initialization, the feedback loop structure tracks the TPO changes based on the sign of 4PPD, the loop filter, and the numerically controlled oscillator. In conclusion, training-sequence-free 4PPD-based BM-TR achieves low burst overhead via fast convergence and is particularly effective for handling burst signals in 50G-PON.

cs.NI↗
arXiv2026

AI-Native Open RAN: A Roadmap from xApps and rApps to Autonomous Network Agents

Open Radio Access Networks (O-RAN) have emerged as a transformative paradigm for future wireless systems by introducing openness, virtualization, disaggregation, and programmable intelligence through the RAN Intelligent Controller (RIC). The availability of standardized interfaces and near-real-time control loops has created unprecedented opportunities for integrating artificial intelligence (AI) into radio access network management and optimization. Over the past several years, a broad range of AI techniques have been proposed to address key O-RAN challenges such as radio resource management, network slicing, traffic prediction, mobility management, interference mitigation, and spectrum sharing. Despite significant progress, existing solutions often remain task-specific, require extensive retraining, and exhibit limited generalization across deployment environments and network conditions. This paper presents a comprehensive review of AI-enabled O-RAN systems and provides a unifying perspective on the evolution of intelligence in wireless networks. We first examine the O-RAN architecture and the role of intelligence within near-real-time and non-real-time RIC frameworks. We then develop a taxonomy of AI approaches for O-RAN, covering machine learning, deep reinforcement learning (DRL), digital-twin-assisted optimization, and emerging foundation-model-based architectures.

cs.NI↗