Per-node quantities for one chamber. Double the BLE spammers if you want a "conference hall" profile; the scenario DSL scales the mix, not the BOM.
Compute / control
| Qty | Item | Role |
|---|---|---|
| 1 | Controller host (NUC / Mac Mini / spare desktop) | Runs the LLM conductor, orchestrator, metrics DB |
| 1 | Managed switch, 16-port | Control-plane LAN (isolated from corp net) |
| 3 | Raspberry Pi 5, 8 GB | BR/EDR nodes (inquiry, page, A2DP) + spares |
Bluetooth BR/EDR nodes
Run on the Pis with USB BT dongles (or onboard BT put in test/engineering mode where the stack allows).
| Qty | Item | Node |
|---|---|---|
| 1 | Pi 5 + BT 5.x USB dongle | inquiry-looper |
| 1 | Pi 5 + BT 5.x USB dongle | page-stormer |
| 1 | Pi 5 + BT 5.x USB dongle | a2dp-hog (streams to a cheap A2DP sink) |
Notes:
- Inquiry/page at 3200 hops/s needs nothing special: any BlueZ host can run
hcitool inq in a loop. That's the point — it's stock behavior.
- a2dp-hog with AFH disabled / full channel map needs controller test mode
or a CSR/Realtek dongle with engineering firmware. Flagged in the catalog
as test-mode-only; the scenario DSL marks it requires: test_mode.
BLE nodes
| Qty | Item | Node |
|---|---|---|
| 3 | ESP32-S3-DevKitC-1 | ble-adv-spammer x3 (20 ms adv, +8 dBm) |
| 1 | ESP32-S3-DevKitC-1 | ble-active-scanner (100% duty cycle) |
| 2 | Nordic nRF52840 DK | ble-extadv-spammer, ble-conn-saturator |
| 1 | Phone (any Android, BLE 5.x) + 1 ESP32 | phonekey-sim pair (aggressive advertiser + 100% scanner) |
nRF Connect SDK covers ext-adv and multi-connection central examples; the spammer firmware is a few dozen lines on ESP-IDF.
LE Audio
| Qty | Item | Node |
|---|---|---|
| 1 | Nordic nRF5340 Audio DK | auracast-tx (BIS broadcast source) |
Any LE Audio broadcast source works; the nRF5340 Audio DK is the reference because its broadcast example is stock SDK.
Wi-Fi
| Qty | Item | Node |
|---|---|---|
| 4 | Dual-band APs with OpenWrt support | wifi-ap-farm-2g (2.4 GHz radios) |
| 3 | Same APs' 5 GHz radios (or 3 dedicated) | wifi-ap-farm-5g (one on 80 MHz, one DFS) |
| 2 | Wi-Fi 6E APs | wifi-ap-farm-6g (overlapping 160 MHz) |
| 1 | Laptop / Pi with Wi-Fi | wifi-slow-client-* per band |
| 1 | Pi + Wi-Fi dongle | probe-stormer-* per band |
AP config is just OpenWrt UCI: beacon interval 100 ms, basic rates including 1 Mbps, TX power max, one AP on 40 MHz in 2.4 GHz. All stock knobs.
802.15.4
| Qty | Item | Node |
|---|---|---|
| 1 | TI CC2652 USB stick (Zigbee coordinator) | zigbee-chatter |
| 6 | Cheap Zigbee sensors (temp/contact) | chatter endpoints, min report interval |
Put the Zigbee network on 802.15.4 ch 11–14 (overlaps Wi-Fi ch 1) for the worst-case overlap profile.
Chamber / RF plumbing
| Qty | Item | Role |
|---|---|---|
| 1 | RF shield box (Ramsey STE3500-class) or shielded room | containment; fallback is a dedicated RF-quiet room after hours |
| 1 | Programmable attenuator, e.g. Mini-Circuits RCDAT-6000-90 | DUT path-loss control (0–90 dB, conductor-driven) |
| 1 | Turntable (manual is fine) | DUT orientation sweeps |
| lot | SMA cables, fixed attenuators, USB hubs, power strips | plumbing |
Optional "real world" tier
Not spec devices, but real: a microwave oven (broadband 2.4 GHz noise), 2.4 GHz wireless presenter dongles (static narrowband). Keep them out of the default scenarios; enable explicitly when you want the full parking-lot/garage profile.
Observers (passive)
| Qty | Item | Node |
|---|---|---|
| 1 | nRF52840 DK with sniffer firmware + Wireshark on controller | rf-observer-2g (BLE) |
| 1 | Monitor-mode Wi-Fi 6E adapter | rf-observer-5g6g (Wi-Fi mgmt) |
| 1 | Pi running btmon |
rf-observer-2g (BR/EDR) |
Spares
One spare Pi, two spare ESP32-S3 boards. Nodes die; scenarios shouldn't.