WiP: Meter-Level Wi-Fi RTT Localization on a Production Enterprise WLAN Enguang Fan∗
Binh Minh Tran∗
Klara Nahrstedt
University of Illinois Urbana-Champaign [email protected]
University of Illinois Urbana-Champaign [email protected]
University of Illinois Urbana-Champaign [email protected]
arXiv:2609.13795v1 [cs.NI] 12 Sep 2026
Abstract Wi-Fi Fine Time Measurement (FTM) promises indoor localization by reusing access points (APs) already deployed for connectivity, but prior evaluations mostly use APs purposedeployed or calibrated for ranging, leaving it unclear whether a production enterprise WLAN can provide useful localization without localization-specific infrastructure. We evaluate Wi-Fi round-trip time (RTT) localization on IllinoisNet, a live campus WLAN whose APs were placed for coverage and capacity. Using five commodity Android phones at 10 static locations across a 50 m × 30 m office floor spanning LOS, NLOS, and multipath conditions, weighted nonlinear least squares achieves a median error of 1.21 m and a 90th-percentile error of 2.68 m—with no AP replacement, repositioning, or ranging calibration. Residuals vary in magnitude and sign across APs and propagation conditions, suggesting a single global correction is insufficient and motivating AP-aware software calibration rather than new localization-specific infrastructure.
CCS Concepts • Networks → Location based services.
Keywords Wi-Fi RTT, Fine Time Measurement, indoor localization, enterprise WLAN ACM Reference Format: Enguang Fan, Binh Minh Tran, and Klara Nahrstedt. 2026. WiP: Meter-Level Wi-Fi RTT Localization on a Production Enterprise WLAN. In The 32nd Annual International Conference on Mobile Computing and Networking (MobiCom ’26), October 26–30, 2026, Austin, TX, USA. ACM, New York, NY, USA, 3 pages. https://doi. org/10.1145/3795866.3844758 ∗ Both authors contributed equally to this research.
This work is licensed under a Creative Commons Attribution 4.0 International License. MobiCom ’26, Austin, TX, USA © 2026 Copyright held by the owner/author(s). ACM ISBN 979-8-4007-2505-0/26/10 https://doi.org/10.1145/3795866.3844758
(a) Aruba AP-635 access point serving the campus network.
(b) Phone mounted on a tripod for data collection.
Figure 1: RTT-capable AP and phone-based collection setup.
1
Introduction
Wi-Fi Fine Time Measurement (FTM) is attractive for indoor positioning because it estimates AP–client distance from round-trip time (RTT) measurements while reusing infrastructure already deployed for network access [2]. In principle, this reuse could enable indoor positioning without installing a separate localization network. In practice, however, the infrastructure-reuse premise remains insufficiently evaluated. Prior RTT localization studies commonly rely on temporary AP deployments or specialized routers configured or calibrated for ranging. Their APs can be selected and positioned for favorable ranging geometry, whereas a production enterprise WLAN is designed primarily for coverage and capacity. Such a deployment may therefore exhibit sparse or unfavorable AP geometry, together with non-line-of-sight (NLOS) and multipath propagation. Whether such an existing deployment can provide useful RTT localization therefore remains an open practical question. We test this premise directly, evaluating Wi-Fi RTT on IllinoisNet, a live campus WLAN, using commodity Android phones, without AP replacement, repositioning, or ranging calibration. Two findings follow: meter-level indoor positioning is achievable without localization-specific infrastructure; and ranging residuals vary in magnitude and sign across APs and propagation conditions, so a single global bias correction is unlikely to suffice.
MobiCom ’26, October 26–30, 2026, Austin, TX, USA
Enguang Fan, Binh Minh Tran, and Klara Nahrstedt
Figure 2: Testbed floor map with IllinoisNet APs and sampling locations. Band 2.4 GHz
5 GHz
Channel
Width
Obs.
Share
1 6 11 42 58 106 122 155
20 MHz 20 MHz 20 MHz 80 MHz 80 MHz 80 MHz 80 MHz 80 MHz
3,446 3,441 3,496 3,878 3,127 3,338 2,778 2,550
13.2% 13.2% 13.4% 14.9% 12.0% 12.8% 10.7% 9.8%
26,054
100.0%
Total
Table 1: Operating-channel diversity observed in the IllinoisNet scan log. The 5 GHz primary channels are grouped by 80 MHz center channel; shares are computed across all scan observations.
2
Testbed Setup
Environment and Propagation Conditions: We conducted the evaluation in a university building where each floor spans approximately 105 m by 62 m. Our testbed covers the 50 m by 30 m left wing of one floor, as shown in Figure 2. The environment exposes RTT ranging to two qualitatively different sources of error. First, drywall partitions obstruct the direct path and introduce an NLOS-dependent ranging offset. Second, large reflective surfaces—including whiteboards, metal cabinets, lockers, and pipe covers—create multipath. Under strong multipath, a receiver may resolve a longer reflected path instead of the direct path, adding excess propagation delay to the measured RTT and increasing variability. These two propagation mechanisms motivate the ranging analysis in Section 3.
Production WLAN Infrastructure: The building is served by IllinoisNet, the live campus WLAN, which uses Aruba AP-635 access points such as the one shown in Figure 1a. Because the deployment is designed for connectivity, AP placement prioritizes coverage and capacity rather than geometric diversity for localization. The resulting geometry is sparse and includes AP–client paths obstructed by walls and reflectors. IllinoisNet also exhibits the channel diversity and dynamics of an enterprise WLAN. As is common in enterprise deployments, a centralized controller distributes APs across the 2.4 GHz and 5 GHz bands and may reassign their channels as interference conditions change. This differs from many controlled RTT evaluations, which keep APs on one fixed channel or a small set of known channels [2]. Our scan log contains the three standard 2.4 GHz channels and five 80 MHz groups in the 5 GHz band, as summarized in Table 1. Our ranging system makes no fixed-channel assumption: it obtains each AP’s current channel from ordinary scan metadata and constructs the FTM request using that current responder configuration. Controller-driven channel changes therefore require no manual reconfiguration. Accessing Unadvertised FTM Support: Although the AP635 firmware supports FTM and responds to ranging exchanges, IllinoisNet does not advertise the FTM-responder capability in its beacon frames. Consequently, standard Android discovery does not identify these APs as ranging responders. Our system addresses this discovery limitation by explicitly supplying the AP responder information from the scan result and issuing a two-sided FTM request. This procedure changes neither AP firmware nor network configuration; the client merely requests a capability already implemented by the deployed AP. Collection System: We collected ranging data from commodity Android phones—Google Pixel 4a, 6a, 7, 7a, and Samsung Galaxy S21—using the setup shown in Figure 1b. We selected 10 static sampling locations across the testbed and mounted each phone on a tripod at a height of 1.25 m to reduce measurement variability. At each location, each phone collected RTT measurements from all visible IllinoisNet APs for 30 seconds, yielding 50 measurements per location.
3
Results
Meter-Level Localization: For each ranging epoch, we estimate the 2D client position using weighted nonlinear least squares: ∑︁ 1 (∥p − a𝑖 ∥ 2 − 𝑟𝑖 ) 2 , (1) p̂ = arg min p |𝜌 | 𝑖 𝑖∈A where a𝑖 , 𝑟𝑖 , and 𝜌𝑖 are the position, RTT-derived range, and RSSI in dBm for AP 𝑖, respectively. Thus, a weak measurement such as −90 dBm receives less weight than a stronger
WiP: Meter-Level Wi-Fi RTT Localization on a Production Enterprise WLAN
MobiCom ’26, October 26–30, 2026, Austin, TX, USA 1.5
1.5
RTT residual (m)
1.0
RTT residual (m)
1.0
LOS 1 Wall NLOS 2 Wall NLOS
0.5 0.0
whiteboard region
Whiteboard-associated Open LOS
0.5 0.0 −0.5 −1.0 −1.5
−0.5
−2.0
−1.0
3 0
5
10
15
20
25
Ground-truth distance (m) Wall 1
AP
5
6
7
8
9
1 Wall NLOS
Increasing AP-client distance
11
12
possible reflected paths
AP
whiteboard-associated
AP LOS
10
directions aligned; not to scale
whiteboard not to scale
Wall 2
4
Ground-truth distance (m)
30
open-LOS reference
2 Wall NLOS
5m 6m Matched AP-client distance
7m
8m
(b) Whiteboard residual variability.
(a) Drywall residual shift.
Figure 3: Structured RTT errors in a production WLAN. (a) Drywall-obstructed paths shift residuals upward. (b) A whiteboard-associated direction has 2.05× the median per-distance IQR of an open-LOS reference and a larger IQR at 10 of 12 distances. Schematics are not to scale. The magnitude of these effects varies across APs, suggesting that a single global correction may be insufficient and motivating AP-aware calibration.
4
Figure 4: CDF of localization error for RTT and the RSSI multilateration baseline across all 10 test locations. one. As a baseline, we use multilateration with an RSSI logdistance path-loss model. Figure 4 answers our central question: the production WLAN provides meter-level static positioning despite AP placement that was not designed for localization. RTT achieves a median error of 1.21 m and a 90th-percentile error of 2.68 m, compared with 3.17 m and 5.60 m for the RSSI baseline, respectively. Structured Ranging Errors: We define the ranging residual as 𝑒𝑖 = 𝑟𝑖 − 𝑑𝑖 , where 𝑑𝑖 is the ground-truth AP distance. Figure 3 separates two recurring effects. Drywall-induced NLOS shifts the residual upward as the direct path is obstructed, whereas a nearby whiteboard produces a wider distribution and more positive outliers through delayed reflected paths.
Conclusion and Future Work
Our evaluation shows that Wi-Fi RTT can provide practical indoor localization in a sparse, unoptimized deployment. The ranging analysis reveals AP-specific RTT offsets associated with distance and propagation conditions, motivating calibration methods that improve ranging accuracy without requiring localization-specific AP deployments. Our evaluation relies on manually surveyed AP coordinates; a future system could incorporate automatic AP-location estimation [1, 3].
Acknowledgments This work was supported by the National Science Foundation under Grants NSF CCF 22-17144, NSF CNS 24-37204.
References [1] Enguang Fan, Emerson Sie, Federico Cifuentes-Urtubey, and Deepak Vasisht. 2025. Poster: Scalable Indoor Localization with Non-Cooperative Wi-Fi Ranging. In Proceedings of the 31st Annual International Conference on Mobile Computing and Networking (ACM MOBICOM ’25). Association for Computing Machinery, 1341–1343. doi:10.1145/3680207.3765680 [2] Katarzyna Kosek-Szott, Szymon Szott, Wojciech Ciezobka, Maksymilian Wojnar, Krzysztof Rusek, and Jonathan Segev. 2025. Indoor Positioning with Wi-Fi Location: A Survey of IEEE 802.11mc/az/bk Fine Timing Measurement Research. arXiv:2509.03901 [cs.NI] [3] Emerson Sie, Enguang Fan, Federico Cifuentes-Urtubey, and Deepak Vasisht. 2025. Crowdsourcing Ubiquitous Indoor Localization with Non-Cooperative Wi-Fi Ranging. arXiv:2506.18317 [cs.HC]