This Open Source Project Turns a Wi-Fi 7 Router Into a 320 MHz Radio Receiver
W1700K SDR turns a Gemtek Wi-Fi 7 router into a receive-only software-defined radio that streams up to 320 MHz of raw IQ from the 2.4, 5 and 6 GHz bands over 10 gigabit Ethernet, using only open firmware. Here is what it does and what it takes to run.
Most Wi-Fi routers spend their lives quietly passing packets around. A new open source project wants to give one of them a second career as a wideband radio receiver. W1700K SDR, published on GitHub by a developer who goes by h0m3us3r, turns the Gemtek W1700K, a Wi-Fi 7 router built around a MediaTek MT7996 radio, into a software-defined receiver that streams raw radio samples to a computer and draws them as a live spectrum and waterfall in the browser.
The numbers in the project's README are striking. The radio captures 14-bit complex IQ at 40, 80, 160 or 320 million samples per second, on the 2.4 GHz band (through an MT7976 front end) and on the 5 GHz and 6 GHz bands (through two MT7977s). The router's Airoha AN7581 chip moves those samples into a 1 GiB buffer and sends them out over its 10 gigabit Ethernet port as UDP packets. At the top rate, the radio's own cores pack half the data down to 28 bits per sample pair so everything fits on the link, losslessly. One of the repo's screenshots shows the stream carrying 9.75 Gbit/s.
There are no Wi-Fi channels in the usual sense. You tune the receiver to any frequency its synthesizer can lock to, in steps of a few hertz, and retune in about a millisecond without stopping the stream. You also get automatic or manual gain and an analog filter you can set anywhere from 20 to 320 MHz. On the computer side, a small set of tools receives the stream, runs a 262,144-point FFT on every sample at 100 spectra a second, serves the web interface, and records to disk.
The most impressive part is under the hood. The MT7996 runs only firmware built from this repository, with no MediaTek code at all. According to the project's roadmap, the author traced MediaTek's own firmware register by register on a cold, powered-off radio over 69 loads, worked out what reception actually needs, and rewrote those steps in C. The result brings the radio up from a cold start in about two seconds.
That also explains a key detail: the firmware is receive-only. It skips all of MediaTek's transmit calibrations and keeps the transmit path switched off. The README says a gapless watch at 5250 MHz saw nothing during a load, where MediaTek's firmware sends out a full-power burst. Receive-only tools are generally a much lower regulatory concern than anything that transmits, although rules on intercepting other people's communications still vary by country, so it is worth knowing your local rules before you listen in.
This is not a plug-and-play gadget, and the README is honest about it. You need that exact router, either the W1700K (hardware 1.x) or the W1700K2 (hardware 2.1), plus a 3.3 V USB serial adapter on its console header, an Ethernet cable to its lan3 port for installation, and a 10 gigabit network card on your Linux computer cabled to the router's wan port. Installation replaces the router's stock operating system with the project's own U-Boot, Linux 6.18 and a minimal read-only system. The installer backs up the flash first, and a restore script puts the stock firmware back, so keep that backup safe. Some W1700K2 units use a different flash chip that is supported but has never actually been tested on a unit, and the installer refuses to continue on one unless you explicitly accept the risk of flash corruption. The README also warns that poking at undocumented chip addresses can hang the router until a power cycle, and that you should not cable an antenna port straight into a sensitive instrument without an attenuator. On the plus side, the project's ROM patch writes no eFuse, unlike MediaTek's own patches since 2025, which permanently set one bit on first run.
You build everything yourself from public sources with one make, which the README estimates at about ten minutes plus downloads, and no vendor firmware is needed. The code is mostly MIT licensed, with the Linux driver and kernel patches under GPL-2.0, U-Boot patches under GPL-2.0 or later, and files derived from MediaTek's mt76 driver under BSD-3-Clause-Clear.
It is still young. The roadmap says the receiver works end to end, but control currently runs over ssh, with a small daemon on the router planned next, along with a dedicated command channel and changing the sample rate mid-stream. The repo's latest commit is dated October 13, 2026.
If the author's name sounds familiar, it should. Just weeks ago, two efforts found an undocumented debug path in Espressif's ESP32 chips that dumps raw IQ samples straight from the Wi-Fi modem, turning a cheap microcontroller into a receive-only SDR at up to 80 MS/s. The ESPARGOS team documented it in its ESP-SDR project, and RTL-SDR.com reported that Reddit user h0m3us3r found the same feature independently and published code on September 26, streaming an ESP32-S3 to a PC continuously through an FPGA. The ESP32 trick is limited by how slowly samples can leave the chip, so most models only manage snapshots. The W1700K project goes in the other direction: a much bigger radio, four times the sample rate, three bands, and a 10 gigabit pipe to carry all of it.
Both stories point to the same idea. Wireless chips already have very capable radios inside them, and patient reverse engineering keeps finding ways to use them for more than their makers intended. For anyone who wants to look at the 2.4, 5 and 6 GHz bands in real detail, a Wi-Fi 7 router and a weekend of careful tinkering may now be enough.
