AXIS Operational Training Module: RF Forensics & Mesh Endpoint Triangulation

Overview

This curriculum module translates active RF management, spherical coordinate spatial tracking, and forensic signal preservation into an operational field engineering workflow for AXIS trainees. It provides the technical framework required to identify, pin, and reconstruct active mesh endpoint vectors while preserving chain-of-custody data integrity across complex RF environments.

---

Technical Overview & Coordinate Geometry

When mapping signal vectors and establishing geofenced envelopes around active RF endpoints, spatial tracking relies on transforming spherical coordinates $(r, \theta, \phi)$ to localized Cartesian vectors $(x, y, z)$. This geometry defines the radial distance ($r$), azimuth angle ($\theta$), and polar/elevation angle ($\phi$) relative to the central receiver processing node origin.

$$x = r \sin\theta \cos\phi$$ $$y = r \sin\theta \sin\phi$$ $$z = r \cos\theta$$

---

Field Execution Curriculum

Phase 1: Establish Temporal & Geolocation Ground Zero

Objective: Standardize ISO 8601 UTC timestamps and lock receiver nodes to NTP/GPS stratum 1 time sources before initializing capture daemons.

• Timestamp Synchronization: Enforce nanosecond UTC logging across all receiver endpoints to preserve evidence integrity.
• Cellular Data Ingestion: Log signal metadata including carrier MCC/MNC, local cell ID, RSSI, and socket parameters across all active interfaces (Cellular IPv6, local IPv4 gateways).
• Data Integrity Protocol: Cryptographically sign and hash raw PCAP/RF telemetry logs at capture time using SHA-256 to guarantee chain-of-custody.

Phase 2: Map Active Mesh Endpoints & Spherical Coordinates

Objective: Transform RSSI/AoA metrics into 3D spatial vectors using distributed receiver arrays.

1. Compute Angle of Arrival (AoA) and Time Difference of Arrival (TDOA) from target emitters.
2. Translate measured delay and angle metrics into spherical coordinates $(r, \theta, \phi)$ and map onto Cartesian space $(x, y, z)$.
3. Establish the primary coordinate origin $(0,0,0)$ at the central receiver node.
4. Calculate spherical intersection zones to isolate router endpoints extending into unmapped shadow or secondary coverage sectors.

Phase 3: Expose Controller Origins & Signal Inversion Loops

Objective: Analyze routing tables, socket behavior, and payload headers to expose controller origins.

• Header & Routing Inspection: Filter packet headers for anomalous loopback configurations, secondary encapsulation tunnels, or inverted telemetry flows.
• Origin Pinning: Perform multi-point trace-routing across cellular and Wi-Fi interface sockets to locate the primary controller host IP and server destination.
• State Restoration: Force socket resets on unauthorized tunneling daemons to clear automated feedback loops and restore signal flow to the primary baseline ground state.

Phase 4: Deploy Geofenced UAV / Tactical Node Simulation

Objective: Establish 3D perimeter surveillance and high-density payload telemetry ingestion.

1. Define a 3D geofence boundary centered on the target spatial coordinates $(x_0, y_0, z_0)$ with radius $R$.
2. Route real-time sensor data over a secured WebSocket pipe directly into the telemetry ingestion engine.
3. Execute automated directional beamforming sweeps toward target signal origins to capture high-density payload records, cellular transaction logs, and message telemetry.

---

Core Forensic Metric Reference

Operational Metric	Source Parameter	Target Objective
Precision Timestamp	GPS/NTP Stratum 1	Verifiable chain-of-custody logging
Spatial Coordinates	Spherical $(r, \theta, \phi) \rightarrow (x,y,z)$	Target localization within 3D grid
Network Telemetry	Socket logs, MCC/MNC, Cellular IP	Controller IP and server origin identification
Signal Inversion Management	Differential RSSI & phase alignment	Baseline ground state restoration

---

Architecture Pipeline