AirTell: A Bluetooth 5 Security CLI & Streamlit Interface to Sniffle

AirTell: Listening to What the Air Already Knows

Picture the desk in front of you right now…

You plug two inexpensive USB dongles into your machine. Before your fingers even leave the warm plastic housing, the 2.4 GHz spectrum around you is already mid-sentence. Every wearable in the room, every peripheral on the table, every silent background handshake in your pocket is pouring its state out into the invisible commons.

People use the air to tell each other stories. Devices use the air to tell each other everything else.

Over-the-air RF signals are how modern machines negotiate trust, announce presence, and execute a tremendous amount of unseen work. As an homage to that medium — to the air itself, and to the relentless radio chatter that lets people and silicon tell each other so much — I named this project AirTell ( github.com/ncouture/AirTell).

Arriving at that name took the single largest slice out of my fiercely limited personal time pool. Fortunately, it wasn't time spent — it was time invested. Because when you release a new network security tool publicly, agonizing over the name is easily the single least important thing you will do before a single packet is captured. The same advice goes for startups: just call your mom like I did, fill her in on your idea, and ask her what it should be called. Voilà — there is zero chance you won't love a name your own mother gave you, especially when she's proud of you for including her in the build.

The 2026 Hardware Reality: Why Sniffle Still Wins

If you do Bluetooth research in 2026, you already know the trap of the modern tooling market. You can burn thousands of dollars on wideband software-defined radios that drown your bus in raw I/Q samples, or wrestle with bloated vendor suites that hide the physical layer behind ten layers of broken abstractions.

Or you can look at the engineering reality of what NCC Group built with Sniffle ( research paper).

Years after its initial release, Sniffle remains the sharpest trade-off in the Bluetooth 5 ecosystem. It respects the hardware. It runs tight, deterministic firmware directly on commodity TI CC1352/CC26x2 silicon, handling BLE 5 long-range, high-speed PHYs, channel hopping, and connection following right where timing actually matters — at the edge of the radio.

The bottleneck with Sniffle was never the firmware. The bottleneck was operational ergonomics in the field: juggling disparate Python scripts, remembering flag permutations across terminal tabs, and stitching together repeatable workflows under time pressure.

AirTell closes that gap. Built directly on top of NCC Group's Sniffle scripts and firmware, AirTell wraps the ecosystem around a unified, central CLI and introduces documented defense, counter-surveillance, and offensive security techniques.

Two Dongles, 99.9% Machine-Written, Zero Theater

Open-source announcements usually perform a polite ritual: the lone maintainer pretending they hand-carved every abstract syntax tree by candlelight. Let's skip the theater and look at how software actually gets shipped when human bandwidth is the scarcest resource on the board.

Here is the unvarnished truth about AirTell:

• I have barely written — or even read — 99.9% of the code changes I am bringing through this fork. AirTell is a fast-paced, heavily LLM-enhanced wrapper and fork of NCC Group's foundation.
• It works where it counts. I didn't build this to admire clean diffs in an editor; I built it to run live operations on my personal rig. It has been relentlessly tested on two Sonoff ZigBee 3.0 USB Plus dongles flashed with Sniffle's firmware, and it has served me exceptionally well.
• The backlog is larger than my calendar and of my Claude subscriptions token allowance. I have high hopes for AirTell and a massive pipeline of features in mind — most of which I won't even have the free time to type into a GitHub issue backlog anytime soon.

In open-source systems, waiting for a maintainer to have infinite free time is how good tools die in private repos. Shipping a working, LLM-accelerated weaponized CLI on main today creates a surface area that the community can actually use, stress-test, and evolve.

A Call to the Bazaar: Bring Your Silicon

Right now, AirTell ( main branch only ATM) lives at https://github.com/ncouture/AirTell.

Because my primary testing ground has been a dual Sonoff ZigBee 3.0 USB Plus setup, the project now needs the friction of diverse hardware. If you have other Sniffle-supported devices sitting in your lab drawer — TI LaunchPads, OpenSniffer units, or alternative CC2652/CC1352 dongles — your telemetry and edge-case feedback are critical.

A quiet word of caution before you clone: use this software wisely. Putting defensive monitoring, counter-surveillance, and offensive BLE techniques behind a unified CLI lowers the friction of execution. The responsibility for what goes out over the air remains entirely yours.

To the security researchers and curious hackers who still believe — as I do — that Sniffle is the finest trade-off solution for Bluetooth 5 work in 2026: show up. Plug in your dongles. Test AirTell against your hardware, submit PRs to incorporate the features I haven't had time to backlog, or ruthlessly fork my fork and run your own vision.

The radio spectrum around you is already talking. Go see what it has to tell.

Originally published at https://blog.stormvault.net on October 17, 2026.