Glonce

WaveDigger maps Wi-Fi and cell towers by querying Apple's location API

toolsThe Glonce editorsHacker News🔥45Glonce rating45Impact40Novelty60Relevance70Surprise30Players15Credibility85
WaveDigger maps Wi-Fi and cell towers by querying Apple's location API

WaveDigger is an open-source tool that looks up the approximate physical location of wireless infrastructure: Wi-Fi access points by their BSSID (MAC address), and LTE or 5G NR cell towers by their network parameters such as MCC, MNC, TAC, Cell ID or NCI. It works by querying Apple's own location service API, the same system iPhones use internally to speed up positioning without GPS. A hosted version of the tool is available online, and the source code can also be run locally.

The project accepts a BSSID in several common formats (colon-separated, dash-separated, or plain hex) and shows results on an interactive map built with deck.gl. For 5G NR searches, it returns not just the target cell but surrounding NR cells in the same cluster, and it offers a TAC-cluster view for browsing every tower in a tracking area without needing a specific Cell ID or NCI. Search history is kept for quick access, and results can be exported as JSON or CSV.

Under the hood, WaveDigger sends protobuf-encoded requests to Apple's WLOC endpoint (gs-loc.apple.com/clls/wloc), handling Apple's coordinate encoding, which uses a 64-bit integer with 8 decimal places, and supporting both the default endpoint and a separate one for the China region. None of this was reverse-engineered by the WaveDigger project itself: it is built directly on the protobuf definitions, endpoint documentation and coordinate-encoding research published by the apple-corelocation-experiments team, which the project credits explicitly as the reason it could exist at all.

The tool is frontend Next.js 15 with TypeScript, styled with Tailwind CSS, using deck.gl and react-map-gl for mapping and Next.js API routes on the backend; it requires Node.js 24 or newer to run locally, plus an optional Mapbox token for enhanced map tiles. Not every BSSID turns up a result: the README notes that newly deployed or private access points may simply have no location data in Apple's database. WaveDigger is released under the GNU Affero General Public License v3.0, which means that anyone who runs a modified version of it as a network service is required to make that modified source code available to the service's users.

Key facts

  • WaveDigger looks up Wi-Fi access points by BSSID and LTE/5G NR cell towers by network parameters, returning an approximate physical location on an interactive deck.gl map.
  • It works by querying Apple's real WLOC location API (gs-loc.apple.com/clls/wloc), the service Apple devices use for location lookups.
  • The underlying protobuf definitions, endpoint details and coordinate-encoding (Apple uses a 64-bit integer with 8 decimal places) come from the apple-corelocation-experiments team's prior reverse-engineering research.
  • The stack is Next.js 15 with TypeScript, Tailwind CSS and deck.gl/react-map-gl; running it locally requires Node.js 24 or newer.
  • It is released under the AGPL v3.0, so a modified version run as a network service must have its source made available to that service's users.

Why it matters

WaveDigger turns a piece of reverse-engineering research into a usable, hosted tool: it repackages the apple-corelocation-experiments team's work on Apple's undocumented WLOC API into a simple search box and map, making it accessible to anyone rather than only to people willing to read protobuf definitions and API docs themselves.

Who it affects

It is aimed at people who work with wireless networks or geolocation, such as network engineers, security researchers, and hobbyists investigating Wi-Fi or cellular infrastructure, who want a quick way to check what location data Apple has associated with a given BSSID or cell tower.

How to use it

A hosted version is available at wavedigger.networksurvey.app for direct use in a browser; alternatively the code can be run locally with Node.js 24 or newer and npm, with an optional Mapbox token for better map tiles. The project is released under the AGPL v3.0, meaning any modified version deployed as a network service must have its source code shared with that service's users.

How solid is it

The tool's own README documents its mechanics in detail, including the exact API endpoint it queries and its coordinate-encoding scheme, and it explicitly attributes the reverse-engineering it relies on to the apple-corelocation-experiments team rather than claiming that research as its own.

Risks and caveats

Coverage is incomplete: the README notes that not all BSSIDs are in Apple's database, and newly deployed or private access points may return no location data. The tool also depends entirely on Apple's undocumented WLOC API continuing to work and remain accessible in its current form.

“Not all BSSIDs are in Apple's database. Newly deployed or private access points may not have location data.”

— WaveDigger project README