How to Inspect Wi-Fi RTT Indoor Positioning and Distance Ranging on Android Using ADB dumpsys rttmanager

GPS signals attenuate rapidly inside multi-storey buildings, warehouses, underground transit tunnels, and hospital complexes. To enable sub-metre indoor navigation and contextual location tracking, modern Android devices and enterprise Wi-Fi 6 access points support the IEEE 802.11mc standard, commercially known as Wi-Fi Round-Trip-Time (Wi-Fi RTT). Rather than relying on inaccurate received signal strength indicators (RSSI)—which fluctuate wildly due to walls, furniture, and human movement—Wi-Fi RTT measures the exact nanosecond time of flight (ToF) of radio waves between the mobile device and nearby access points. In Android, these distance ranging requests are arbitrated by the RttService framework. Using Android Debug Bridge (ADB), engineers can query dumpsys rttmanager to inspect hardware ranging capabilities, active ranging sessions, and measured distance metrics.

Understanding Wi-Fi RTT and RttService Architecture

The Android Wi-Fi RTT subsystem coordinates ranging without requiring the smartphone to connect to or authenticate with the measured Wi-Fi networks:

• Fine Timing Measurement (FTM): The Android Wi-Fi chip exchanges a sequence of bidirectional FTM action frames with 802.11mc-capable access points. The framework records transmission (t1, t4) and reception (t2, t3) timestamps with sub-nanosecond precision.
• Multi-Lateration Positioning: By determining distances to three or more known access point BSSID locations, the operating system calculates accurate two-dimensional or three-dimensional user coordinates with 1-to-2 metre accuracy.
• RttService / RttManager Arbitrator: Governs hardware access, enqueues ranging requests from foreground and background applications, enforces battery throttling, and checks location permission gates (ACCESS_FINE_LOCATION).

Checking Hardware RTT Support via ADB

Not all Android chipsets incorporate IEEE 802.11mc hardware support. Before debugging ranging sessions, verify that the physical Wi-Fi radio advertises RTT capability:

# Query system feature flags for Wi-Fi RTT
adb shell pm list features | grep -i rtt

If supported, Android returns:

feature:android.hardware.wifi.rtt

You can also check the HAL interface capabilities directly:

adb shell cmd wifi get-rtt-status

Inspecting Active RTT Telemetry via dumpsys rttmanager

Connect your Android device with USB or wireless debugging enabled. Query the RTT subsystem state:

adb shell dumpsys rttmanager

The command dumps active ranging clients, hardware driver status, and historical session logs:

Wi-Fi RTT Manager State:
  RttService is enabled: true
  RttNative status: initialized
  Capabilities:
    FTM Responder: true
    One-sided RTT: true
    Two-sided (11mc) RTT: true
  Active Ranging Requests: 1
    Calling Package: com.example.indoor.nav (UID: 10245)
    Target BSSID: 00:11:22:33:44:55, Frequency: 5180 MHz

Auditing Ranging Measurements and Distance Output

When an application initiates a ranging request, RttService calculates the physical distance in millimetres. Filter the dump for measurement blocks:

adb shell dumpsys rttmanager | grep -A 8 "Ranging Result:"

Key parameters reported include:

• Distance (mm): The calculated distance to the target access point. For example, distanceMm: 4520 indicates the phone is 4.52 metres away.
• Standard Deviation (mm): Measures measurement confidence. Lower standard deviations (e.g. < 500 mm) confirm clear line-of-sight signal paths.
• RSSI: Received signal strength in dBm during the measurement exchange.
• Measurement Success Rate: Percentage of FTM frames successfully completed out of the requested burst (typically 8 to 16 frames per burst).

Auditing Peer-to-Peer Wi-Fi Aware (NAN) Ranging

Beginning with Android 9, Wi-Fi RTT also supports peer-to-peer ranging between two smartphones using Wi-Fi Aware (Neighbor Awareness Networking) without any access point present. Under the Aware Ranging: section of the dump, observe direct device-to-device distance calculations used for indoor peer sharing and robotics telemetry:

adb shell dumpsys rttmanager | grep -A 5 "Aware Peers:"

Debugging Common RTT Ranging Errors

If an application fails to acquire distance measurements:

1. Location Master Switch: Wi-Fi RTT is gated behind system location services. Verify that Location is turned on:

   adb shell settings get secure location_mode

   A value of 3 confirms high-accuracy location is enabled.
2. Wi-Fi Scanning Throttle: Confirm background Wi-Fi scanning is not suppressed by developer options:

   adb shell settings get global wifi_scan_throttle_enabled

3. Check Access Point 802.11mc Compatibility: Verify whether nearby access points advertise 802.11mc capability in their beacon frames by inspecting the Wi-Fi scan cache:

   adb shell dumpsys wifi | grep -A 2 -B 2 "80211MC"

Interrogating dumpsys rttmanager empowers developers, network architects, and facility managers to audit, debug, and calibrate next-generation Wi-Fi indoor positioning infrastructure across Android deployments.