ESP32-C5 Wardriving: The Chip Is a Constant, the Board Is the Choice - PINGEQUA

ESP32-C5 Wardriving: The Chip Is a Constant, the Board Is the Choice

PINGEQUA Lab · Hardware deep-dive · 7 min read · Updated 2026-09-20

Choosing software? See our wardriving firmware comparison: SigRoam vs ESP32 Marauder, GhostESP and Bruce.

ESP32-C5 brought native 2.4 GHz + 5 GHz Wi-Fi 6 to a single Espressif SoC. For wardriving hardware, the chip establishes the radio capability; the board around it determines GPS, storage, control interface, firmware path and revision-specific behavior.

Quick answerThe ESP32-C5 is Espressif's first chip with a single dual-band 2.4 + 5 GHz Wi-Fi 6 radio. Before it, seeing 5 GHz on a Flipper meant bolting on a second radio; now one chip does both bands. That is why ESP32-C5 appears across current dual-band wardriving hardware including JustCallMeKoKo's C5 platforms, Apex 5 and Scout Lite. Sharing the SoC does not make the boards equivalent: compare GPS source, storage, UART routing, control interface, primary firmware and hardware revision. On ESP32 Marauder, the C5's 5 GHz is scan/enumeration only — exactly what wardriving needs.

What the ESP32-C5 actually is

The ESP32-C5-WROOM-1U is built on Espressif's C5 SoC — the industry's first RISC-V MCU with 2.4 and 5 GHz dual-band Wi-Fi 6 (802.11ax), backward-compatible to 802.11a/b/g/n/ac. It reached mass production in 2025. The headline for wardriving is simple: one radio, both bands, natively. When ESP32 Marauder runs on a C5, its Wi-Fi scan now spans 5 GHz as well as 2.4 — so you log 5 GHz access points a 2.4-only rig walks straight past.

Why 5 GHz used to be hard

The older ESP32 on classic Flipper Wi-Fi boards is a 2.4 GHz-only radio — it physically can't tune 5 GHz. So the pre-C5 way to see 5 GHz was to add a separate second Wi-Fi radio beside the ESP32: two RF front-ends, two antenna paths, two chips. The C5 folds both bands into one radio, which is why the newest modules dropped the second Wi-Fi chip entirely.

Scan-only, and that's fine: on ESP32 Marauder the C5's 5 GHz is enumeration only — you see 5 GHz APs, but handshake/deauth work stays on 2.4 GHz. Wardriving is enumeration, so scan-only is exactly the right tool. If you specifically want active 5 GHz deauth, that's a different, dedicated-radio job — not a wardriving requirement.

The chip is a constant — the board is the choice

Here's the part that matters for buying. Because JustCallMeKoKo's C5 Adapter, the Apex 5, the Rabbit-Labs board and Scout Lite all use the same C5, they all see both bands. What separates them is how many other radios each one bolts on — and how much you assemble:

Board Wi-Fi Extra radios Focus
Scout Lite ESP32-C5 dual-band None (GPS onboard) Flipper-first integrated wardriver
koko C5 Adapter ESP32-C5 (DevKit) None (DIY, add GPS) DIY Flipper C5 adapter
Apex 5 ESP32-C5 dual-band 2× sub-GHz + NRF24 All-in-one multi-radio Flipper board
Rabbit-Labs C5 ESP32-C5 dual-band CC1101 sub-GHz Multi-radio Flipper board

For wardriving, extra radios are separate capabilities rather than part of the Wi-Fi/GNSS logging path. Their presence alone does not establish better or worse survey performance; that requires controlled RF testing. The practical comparison is architectural: whether GNSS and microSD are integrated, how UART resources are routed, what firmware is supported, and whether a hardware revision changes the workflow. See the Scout Lite vs Apex 5 vs JCMK technical comparison.

Scout Lite — ESP32-C5 + onboard GNSS + microSD

Scout Lite combines ESP32-C5 dual-band Wi-Fi, onboard L86-M33 GNSS and microSD in a Flipper-first board. It supports the SigRoam wardriving stack and ESP32 Marauder software paths.

Get Scout Lite Wardriving guide

FAQ

Is the ESP32-C5 really Wi-Fi 6?
Yes. The ESP32-C5 is Espressif's first dual-band 2.4/5 GHz Wi-Fi 6 (802.11ax) SoC, backward-compatible with 802.11a/b/g/n/ac. It entered mass production in 2025.
If two boards both use ESP32-C5, what should I compare?
Compare GPS source, storage, UART routing, control interface, firmware path, enclosure/power design and hardware revision. The shared C5 SoC establishes dual-band Wi-Fi capability, but it does not make the complete boards equivalent.
Can the ESP32-C5 capture 5 GHz handshakes?
On ESP32 Marauder, 5 GHz is scan/enumeration only. You'll see 5 GHz access points, which is what wardriving needs, but handshake capture stays on 2.4 GHz.
Do extra radios automatically reduce wardriving performance?
No general conclusion should be made from component count alone. RF layout, shielding, antennas, firmware behavior and simultaneous activity all matter. A valid performance comparison requires controlled testing of the actual board revisions.
Does it need special Flipper firmware?
Wardriving runs through the ESP32 Marauder app; Momentum bundles it and maps the GPS pins to GPIO 15/16 out of the box.

Sources: Espressif — "Introducing ESP32-C5: Espressif's first Dual-Band Wi-Fi 6 MCU" and ESP32-C5 product page (espressif.com, 2025); CNX Software — ESP32-C5 mass production (2025-04), Apex 5 module (2026-02-11), Rabbit-Labs C5 multi-board (2026-03-16); justcallmekoko/ESP32Marauder wiki (github.com, 2026). Scout Lite specs per PINGEQUA listing.

For authorized network research, security auditing and electronics education only. Only scan or assess networks you own or are explicitly permitted to test. End users are responsible for compliance with local radio regulations (FCC Part 15, ISED RSS, RED, MIC). Product names belong to their respective owners and are referenced for comparison.

Back to blog