# Wall of Flippers: spotting Flipper Zero devices and BLE spam in the air > Wall of Flippers is a Python project that scans Bluetooth Low Energy advertisements to find Flipper Zero devices and to identify advertisement attacks, covering iOS popup attacks, Samsung and Android popup attacks, Windows Swift Pair attacks, and Bluetooth settings floods. It runs on a Raspberry Pi with a BLE chipset and can also act as a BLE advertiser itself. **k3yomi/Wall-of-Flippers** — A simple and easy way to find Flipper Zero Devices and Bluetooth Low Energy Based Attacks - Repository: https://github.com/k3yomi/Wall-of-Flippers - Stars: 1,042 · Forks: 69 - Language: Python - License: MIT - Published: 2026-10-19 · Updated: 2026-10-19 · Language: en - Canonical page: https://hysenlabs.com/projects/k3yomi-wall-of-flippers ## Two detections that are not the same thing Wall of Flippers is described as a python based project involving the discovery of the Flipper Zero device and the identification of potential Bluetooth advertisement attacks, and the README immediately qualifies it in a way that matters: please keep in mind that these two types of detections may not be related. That caveat is doing real work. The two halves answer different questions. Discovering a Flipper Zero means finding a device that is present and identifiable, which is an inventory problem. Identifying an advertisement attack means noticing a pattern of hostile or abusive BLE traffic, which is a detection problem in the monitoring sense, and the two can occur entirely independently. A room can contain a Flipper Zero that is switched off, a room can contain a BLE spammer that is not a Flipper, and a room can contain both. The project maintainer is k3yomi, and there is a Discord server, and the documentation is written by the maintainer as stated in the banner. The MIT licence, the Python primary language, and the last push on 2026-09-21 complete the identification. The project has also been covered outside the repository, with a BleepingComputer write-up on Wall of Flippers detecting Flipper Zero Bluetooth spam attacks, and a video of the project busting Flipper Zero BLE spammers. That external coverage is a reasonable signal that the tool is used in the security community rather than only by its author. ## The feature list, with the open items left open The features list is written as a checklist with checkboxes, and the unchecked ones are part of the documentation rather than an oversight. For device discovery there is discovery of Flipper Zero devices with Bluetooth enabled, Flipper name discovery, Flipper address discovery, and Flipper identifier discovery covering Transparent, White, and Black Flipper detection. Spoof detection is marked as coming soon, which is the honest way to describe a check for a forged identifier advertisement. There is the ability to archive past Flipper Zero devices discovered, and auto-install functionality for Debian Linux and Windows. For attack identification there is the ability to identify potential Bluetooth advertisement attacks, broken into named categories. The suspected advertisement attacks list includes iOS Popup Advertisement Attacks, Samsung and Android BLE Advertisement Attacks, Windows Swift Pair Advertisement Attacks, and LoveSpouse Advertisement Attacks, which the list glosses as Denial of Pleasure. The Bluetooth settings flood and Bluetooth remote detection are also checked. The remaining features are the tool's own behaviour. A BLE Advertiser lets other Wall of Flippers instances detect each other, with a custom name implementation and BLE Chat. Badge Mode gives less fancy stats. BLE external and internal adapter support is complete on Linux and not yet on Windows. And ratelimiting for new connections is supported on Linux and on Windows with limits noted. The unchecked items are Chromium Web Bluetooth support, iOS and Android pairing detection, and animations, where the project is looking for ascii artists. The pattern across the list is worth noticing. The attack detection categories are the most complete part, and the hardware support and the cross-platform work are the least. The project has grown outward from the detection logic first. ## Hardware, and the Raspberry Pi caveat that decides your setup The requirements section is where the practical constraints are, and the recommendation is specific. A few things are required to properly run Wall of Flippers, and the recommendation is a Raspberry Pi as it is compact and portable. It is also required to have a chipset or a USB adapter that supports Bluetooth Low Energy. At this current time there is limited support for Wall of Flippers on Windows, so a Linux based operating system is recommended, as that is what has been used for testing and development. The second paragraph is the one that decides your hardware. For BLE advertising, an external USB adapter is recommended, because the internal BLE on the Raspberry Pi is not powerful enough to send BLE advertisements long range. That is a real constraint rather than a preference. The internal radio is fine for scanning, but the advertiser mode is a different radio task, and a weak internal antenna means your advertisement does not reach the distance you need for the demonstration to work. The project ships both features, so a scan-only user can get away with the internal radio and an advertiser user cannot. The Debian Linux install is described as currently one of the best ways to run Wall of Flippers, mostly due to it being stable and having a lot of support for BTLE. The project is explicit that it is highly recommended to follow all instructions provided unless you know what you are doing, which is the right warning for a project that shells out to system Bluetooth tools. The dependency file shows the split in the code, and it is a neat one. On Linux the Bluetooth stack is bluepy, and everywhere else it is bleak. So the Linux path uses a different implementation underneath, which explains the strong Linux preference in the documentation. ## Running it headless, and the packaging The table of contents lists a headless usage section alongside the install guides, and headless operation is the mode that makes sense for a device you are going to leave in a room or a building. The repository layout shows the shape of the implementation. There is WallofFlippers.py as the main entry point, a wof.sh shell script, a requirements.txt with the two platform-conditional Bluetooth dependencies, an ascii/ directory that holds the drawing the tool prints, and a utils/ directory for the supporting code. The ascii/ directory is the one that explains the aesthetics. The project prints a banner made of characters, and the project is looking for ascii artists for the animations that are still unchecked, so the drawing is part of the output rather than a decoration bolted on afterwards. A tool whose output is a terminal banner benefits from being a bit theatrical, and the maintainers clearly enjoy that. The shell script is what the auto-install functionality calls, since the feature list mentions auto-install for Debian Linux and Windows, and the instructions for the Debian guide describe a setup procedure rather than a one-liner. That matches the general shape of the install section, which is several pages of distribution-specific steps rather than a package manager entry. For a security tool that runs unattended on a small computer, the headless mode and the auto-install path are the two features that decide whether it is usable in practice, and both are marked as done. ## The attack categories, and what a BLE spammer looks like on the air The named attack categories are the heart of the tool, and they map onto specific behaviours that a Bluetooth stack exhibits. The iOS Popup Advertisement Attacks and the Samsung and Android BLE Advertisement Attacks are the same family on the other mobile platforms, where an advertisement that looks like a pairing request triggers a system prompt. The Windows Swift Pair Advertisement Attacks are the Windows equivalent, using the Swift Pair pairing feature. The LoveSpouse Advertisement Attacks, which the list describes as Denial of Pleasure, and the BT Settings Flood, are floods rather than single popups, and a Bluetooth Remote Detection is a device that is announcing a remote control. The reason a scanner can tell these apart is that each one has a characteristic advertisement pattern, so detection is a matter of watching the advertisement stream rather than of knowing what the target device is. That is also why the two halves of the project are separate: the attack detection does not require a Flipper, and the Flipper detection does not require an attack. The BLE Advertiser mode closes the loop in an interesting way. By having Wall of Flippers advertise, you can detect other Wall of Flippers instances, which is a way of testing your own detection in a controlled way, and the BLE Chat feature turns the same radio into a messaging channel. The custom name implementation means each instance can identify itself, so an exercise can be run with named participants. ## Conclusion Adopt Wall of Flippers if you are running a security awareness exercise, teaching about BLE spam attacks, or auditing a site for stray Flipper Zero hardware. Do not adopt it as a hardened detection system, since it is a research project with a partially built feature list. Verify first that your BLE adapter can both scan and advertise, because the internal radio on a Raspberry Pi is not strong enough for long range advertising and you will need an external USB adapter. ## FAQ ### What does Wall of Flippers detect? It discovers Flipper Zero devices over Bluetooth Low Energy, covering name, address, and identifier discovery for Transparent, White, and Black Flipper detection, and separately it identifies potential BLE advertisement attacks including iOS popup attacks, Samsung and Android popup attacks, Windows Swift Pair attacks, and Bluetooth settings floods. ### What hardware do I need to run Wall of Flippers? A chipset or USB adapter that supports Bluetooth Low Energy, and the recommendation is a Raspberry Pi for its size and portability. For BLE advertising you need an external USB adapter, because the internal BLE on the Raspberry Pi is not powerful enough to send advertisements long range. ### Does Wall of Flippers work on Windows? Support is limited on Windows, so the project recommends a Linux based operating system since that is what has been used for testing and development. Debian Linux is described as currently one of the best ways to run it, because it is stable and has good BTLE support. ### Can Wall of Flippers detect other instances of itself? Yes. The BLE Advertiser feature lets Wall of Flippers announce itself so other instances can detect it, with a custom name implementation and a BLE Chat mode. That makes it possible to test detection in a controlled way rather than only against unknown hardware. ### What is not finished in Wall of Flippers? Spoof detection is marked as coming soon, Chromium Web Bluetooth support is unchecked, iOS and Android pairing detection is unchecked, external and internal BLE adapter support is complete on Linux but not yet on Windows, and the animations are listed as a task for ascii artists. ## Sources - [Issues](https://github.com/k3yomi/Wall-of-Flippers/issues) - [k3yomi/Wall-of-Flippers on GitHub](https://github.com/k3yomi/Wall-of-Flippers) - [License: MIT](https://github.com/k3yomi/Wall-of-Flippers/blob/main/LICENSE) - [README](https://github.com/k3yomi/Wall-of-Flippers/blob/main/README.md) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/k3yomi-wall-of-flippers