Flipper Zero to sniff 24six Gold

General Random questions
,
1

Does anyone have a FlipperZero that could test what its using?

24six Gold: No WiFi?
2
According to ChatGPT, you don't need a Flipper Zero to test what wireless technology the 24six Gold is using, there are many other ways:

Below is a collection of both hardware and software techniques—most under $100—that you can use to passively or actively sniff the Solo Gold or its Connect Station and definitively identify the underlying wireless protocol (Wi-Fi, Bluetooth, proprietary RF, etc.).

Summary:

  • Hardware sniffers like RTL-SDR (~$30), Ubertooth One (~$100), Nordic nRF Sniffer (~$10), BLEShark Nano (~$50), and HackRF One ($150–$300) cover everything from standard 802.11 to Bluetooth LE and very custom 2.4 GHz links (rtl-sdr.com, webasha.com, academy.nordicsemi.com, kismetwireless.net).
  • Software tools on PC or Android—Wireshark with Bluetooth capture support, PCAPdroid for IP-level traffic, Network Analyzer for SSID scans, and Kismet for multi-protocol sniffing—let you detect beacons, hidden SSIDs, BLE advertisements, or odd RF bursts (wiki.wireshark.org, github.com, techet.net).
  • A step-by-step approach (SSID scan → BLE scan → full RF spectrum sweep → packet decode) will reveal whether Solo Gold is secretly using Wi-Fi, BLE, or a true proprietary link.

1. Hardware-Based RF Sniffers

1.1 RTL-SDR USB Dongle (~$25–$35)

A repurposed DVB-T tuner that, with software like GQRX or GNU Radio, can sweep 2.4 GHz for any beacon or burst when the device syncs (rtl-sdr.com, rtl-sdr.com). Use rtl_power to log power vs. frequency over time and spot the Connect Station’s signature.

1.2 Ubertooth One (~$90–$100)

An open-source 2.4 GHz receiver dedicated to Bluetooth Classic & LE, integrates seamlessly with Wireshark or Kismet for live BLE advertisement dumps (webasha.com, wifihax.com).

1.3 Nordic nRF Sniffer (~$10)

A low-cost USB dongle (based on the nRF52) that captures BLE “advertising” and connection packets one channel at a time via Nordic’s nRF Connect Desktop (academy.nordicsemi.com, academy.nordicsemi.com).

1.4 BLEShark Nano (~$50)

A pocket-sized BLE sniffer that plugs into USB-C and streams BLE traffic into Wireshark, useful if you suspect BLE rather than Wi-Fi (rtl-sdr.com).

1.5 HackRF One (+ Portapack) ($150–$300)

A full-duplex SDR covering 1 MHz–6 GHz—overkill but capable of capturing any custom RF protocol, including obscure 2.4 GHz laser-tag style links (github.com).

2. Software & Smartphone-Based Sniffers

2.1 Wireshark with Bluetooth Capture

On Linux, enable BlueZ HCI monitoring (kernel ≥ 2.4.6) and capture BLE packets directly in Wireshark to see real-time advertisements from the Connect Station (wiki.wireshark.org, wiki.wireshark.org).

2.2 PCAPdroid (Android)

An open-source app that logs all IP-level traffic (Wi-Fi or cellular) by simulating a local VPN—good to verify if any IP connections occur during sync (github.com, github.com).

2.3 Network Analyzer (Android/iOS)

Scans and lists all visible SSIDs and channels in real-time—ideal for spotting hidden or default-named Wi-Fi APs near a Connect Station (techet.net).

2.4 Kismet

A multi-protocol sniffer/wardriver that, with a monitor-mode Wi-Fi adapter and Ubertooth attached, can log 802.11, BLE, Zigbee, and raw RF into one unified capture (kismetwireless.net, kismetwireless.net).

3. Step-by-Step Investigation Plan

  1. SSID Scan:

    • Launch Network Analyzer or run iwlist scan on Linux to list all SSIDs within range of the Connect Station (techet.net).
    • Look for hidden or proprietary SSIDs that appear only when you approach with Solo Gold.

  2. BLE Advertisement Check:

    • Plug in Ubertooth One or Nordic nRF Sniffer.
    • Use Wireshark or nRF Connect Desktop to monitor BLE advertising channels—you’ll see any custom BLE beacons if that’s the method (webasha.com, academy.nordicsemi.com).

  3. Broad RF Sweep:

    • With an RTL-SDR dongle, run rtl_power -f 2.400G:2.483G:1M as you trigger a sync to capture spikes at specific frequencies (rtl-sdr.com, rtl-sdr.com).

  4. Deep Packet Analysis:

    • Load captures into Wireshark.
    • Filter for beacon frames (for Wi-Fi), BLE ADV packets, or custom protocols (check for unknown OUI/vendor IDs).

  5. Advanced Validation (Optional):

    • If you suspect a proprietary RF, use HackRF One to record raw I/Q and then decode via GNU Radio or Universal Radio Hacker.

4. Additional Tips

  • Rooted Phone + Extcaps: On Android, use adb + Androiddump extcap plugin to pipe HCI traffic into Wireshark—no extra hardware needed for BLE (wiki.wireshark.org).
  • Time-Synced Logging: Ensure your PC/phone clock is synced to avoid confusing logs when switching between methods.
  • Environment Control: Test in a low-noise environment (e.g., late night) to minimize interference from Wi-Fi routers or BLE beacons.

By combining these low-cost tools and a structured approach, you’ll conclusively determine whether Solo Gold’s “Connect” is truly a custom RF link or simply a locked-down Wi-Fi/Bluetooth channel.

3

@ekjr should have one. Read this

4

If you’re phone has a IR blaster (like the qin) you can try this.

1 Like
5

sorry, I dont have one but i want one

6

Yup, we all do…

1 Like
7

What it’s using? Regarding what

8

It claims not to use Wifi, to download the songs. He wants to know what technology they are utilizing.

3 Likes
9

It’s got to be Wifi, what else? Bluetooth? Range and speed would be terrible. Wifi is simple, anything else would be really complicated… much easier to just rebrand it but technically use Wifi and honestly I have nothing against that

But it still should only work with their stations, whatever method they use for that, which does accomplish the purpose

10

Yes everybody elses thought exactly… Do you think that means we arent gonna test it anyway? :smirking_face:

1 Like
11

I’m quite interested if anyone actually tried sniffing

1 Like
12

Check out this 24six Gold: No WiFi? - General - JTech Forums