Original English rewrite with full credit. This article is an independent English-language rewrite of “Monitor live traffic from V2X signals with V2X2MAP open-source Android app and an ESP32-C5 development board”, by Jean-Luc Aufranc (CNXSoft), published on CNX Software on May 25, 2026.
All hardware photos, app screenshots, the legal disclaimer text and the underlying reporting are the work of the original author. The prose below is rewritten in our own words and trimmed for blog length. The article’s three original images are reproduced at their original positions with attribution. For the full article and CNX Software’s ongoing OpenTrafficMap / ESP32-C5 coverage, read the source.
Source: cnx-software.com · Copyright: CNX Software Limited © 2010–2026.
Executive Summary
V2X2MAP is an MIT-licensed Android application by Peter Holzhauser (github.com/pit711/V2X2MAP) that turns a cheap Espressif ESP32-C5 development board into a passive receiver for the European V2X (Vehicle-to-Everything) radio stack. The ESP32-C5 is one of the few sub-$20 chips that ships with dual-band Wi-Fi and supports the 5.9 GHz band used by 802.11p / ITS-G5, the standard that connected cars and roadside infrastructure use in Europe. With the V2X2MAP firmware (ported from CNX Software’s earlier OpenTrafficMap board) flashed onto the ESP32, the Android app streams the radio data in over USB OTG or Bluetooth Low Energy and plots it on an offline or online map.
What ends up on the map is the public face of cooperative driving: CAM (Cooperative Awareness Messages) carrying GPS positions and speeds of nearby vehicles; DENM (Decentralised Environmental Notification Messages) signalling hazards; SPATEM (Signal Phase and Timing) feeding traffic-light countdowns; and MAPEM (Map Extended Messages) describing intersection geometry. The receive range is “a few hundred metres to several kilometres” depending on antenna and clutter. The user can keep the data local, record it in a Wireshark-compatible format, or opt into anonymised contributions to OpenTrafficMap over MQTT. For security and privacy engineers, this is the first time a Wireshark-grade V2X tap has been within a $20 hobby budget — with all the visibility and the regulatory questions that come with it.
What the build actually is
The hardware shopping list is short. The article picks the Waveshare ESP32-C5-WIFI6-KIT (16 MB flash, 4 MB PSRAM N16R4 variant) at roughly $10–$20 from AliExpress, Amazon or Waveshare direct. Other ESP32 boards do not work — the receiver needs the dual-band radio and specifically the 5.9 GHz capability that the ESP32-C5 introduces. Recent CNX Software coverage of the ESP32-C5-WIFI6-KIT walks through the board itself. The firmware is a port of the receiver that ran on the earlier OpenTrafficMap C-ITS receiver board — same ESP32-C5-WROOM-1 module, just without the GPS module, Ethernet and PoE the OpenTrafficMap hardware shipped with.
Flashing is one-click via a Windows installer. On the application side, the V2X2MAP app talks to the ESP32 over USB OTG (any recent Android phone) or BLE, with an optional Wi-Fi link to a local dashboard or an MQTT bridge for cloud submission. The author notes that Claude AI assisted with parts of the code.
The V2X messages on the wire
V2X over 802.11p / ITS-G5 broadcasts a small set of well-defined message types in the clear at 5.9 GHz. V2X2MAP decodes and visualises the ones most useful for a driver-facing view:
- CAM (Cooperative Awareness Message) — periodic heartbeat from each vehicle with GPS coordinates, heading and speed. Maps directly to the moving dots on V2X2MAP.
- DENM (Decentralised Environmental Notification Message) — event-driven hazard alerts: stopped vehicle ahead, road works, accident, slippery conditions.
- SPATEM (Signal Phase and Timing Extended Message) — current and upcoming traffic-light phase per movement, with countdown timers.
- MAPEM (Map Extended Message) — geometric description of an intersection’s lanes, connections and signal groups, used by the app to align SPATEM data on the correct turn.
Effective receive range is a few hundred metres to several kilometres depending on the antenna, terrain and infrastructure density. The app supports offline maps, a Wireshark-compatible capture format for analysts, and an optional MQTT upload path to cits1.opentrafficmap.org that contributes anonymised data to the OpenTrafficMap project.
Legal and privacy footing
Because ITS-G5 broadcasts touch licensed spectrum and identify real vehicles, the app shows a disclaimer on first launch. The CNX Software write-up reproduces the text:
Receiving and forwarding ITS-G5 radio data may be subject to national telecommunications law and data-protection law. The Android app shows a disclaimer on first launch. Use at your own risk.
V2X2MAP first-launch disclaimer, via CNX Software
In most European jurisdictions, passive reception of ITS-G5 is comparable to receiving any other open RF broadcast — permitted, but with restrictions on retransmission, recording and on what can be done with personal data. GDPR sits on top of that: even though CAM messages do not include a stable identifier, the vehicle’s position, heading and timing can be linked back to an identifiable person under standard GDPR doctrine. The OpenTrafficMap MQTT submission is opt-in for exactly this reason.
Why this matters for defenders
From an offensive-security perspective, V2X2MAP itself is a passive receiver — it does not transmit, and it cannot forge or replay messages. But it dramatically lowers the cost of visibility into a class of broadcast traffic that has historically required dedicated 802.11p hardware from a small set of automotive suppliers. The same hardware ($10–$20 ESP32-C5 board) and the same firmware base can in principle be repurposed to transmit, and once transmission is on the table the C-ITS message bus becomes interesting in the usual ways:
- Tracking and pattern-of-life from CAM: with multiple stationary V2X2MAP receivers, an attacker (or a researcher) can derive vehicle movement patterns within a town — this is the same problem WiFi-probe and BLE-beacon trackers have, but specifically for vehicles broadcasting C-ITS.
- DENM spoofing risk: a forged hazard message can convince a downstream HMI to display a warning. The certificate authority infrastructure of ITS-G5 is the mitigation, but field deployments vary.
- SPATEM / MAPEM as ground truth: signal-timing data over the air is useful both to attackers (timing patterns of intersections) and to defenders red-teaming smart-city deployments.
- Geographic asymmetry: ITS-G5 is Europe; most other regions (notably China and the United States) are standardising on cellular C-V2X. V2X2MAP is useful in EU corridors and largely silent elsewhere.
Key Takeaways
- V2X2MAP turns a $10–$20 ESP32-C5 board into a CAM/DENM/SPATEM/MAPEM receiver for European 802.11p ITS-G5 traffic.
- Hardware is constrained to ESP32-C5: dual-band Wi-Fi with 5.9 GHz support is mandatory. Other ESP32 variants will not work.
- Software stack: ESP-IDF firmware (with a Windows installer for flashing) + Android app over USB OTG or BLE + optional MQTT bridge to
cits1.opentrafficmap.org. - Captures are Wireshark-compatible — useful for protocol researchers and automotive security teams who previously had to buy purpose-built sniffers.
- Legal footing is jurisdiction-dependent: reception generally OK in the EU, retransmission and data-handling subject to national telecoms and GDPR law. The app shows a disclaimer on first launch.
- Geographic scope is Europe: ITS-G5 dominates EU deployments; C-V2X (cellular) dominates US/China. V2X2MAP is silent on C-V2X.
Hardening Checklist (for V2X / C-ITS operators)
- Inventory your CAM signal disclosures. Treat passing-vehicle data as PII for GDPR purposes, even though CAM lacks a stable identifier — positional patterns are enough to re-identify.
- Verify your DENM signing chain. ITS-G5 supports certificate-based authentication of DENM — confirm your roadside units validate signatures and reject unsigned hazard messages from $20 hobby boards.
- Rate-limit SPATEM/MAPEM disclosures on perimeter intersections. Intersection geometry plus timing maps cleanly into red-team route planning.
- Monitor for unusual receivers on the 5.9 GHz band in sensitive corridors (industrial sites, government installations, controlled-area parking). RF spectrum monitoring is cheap relative to the cost of an incident.
- Treat V2X firmware as Wi-Fi firmware. The ESP32-C5 RF stack is software-defined enough that “passive receiver” can become “active transmitter” with a firmware flip. Asset-inventory accordingly.
- If you operate C-ITS infrastructure, expect researchers and journalists to start arriving with $20 receivers. Plan disclosure paths and a triage process for hobbyist-grade findings.
Conclusion
V2X2MAP is the kind of project that quietly shifts the cost curve of a research area: ITS-G5 reception used to require dedicated automotive hardware and a vendor relationship, and now it requires a Waveshare board, a USB-C cable and an evening with a Windows installer. For drivers in Europe it’s an unusually transparent window into the cooperative driving systems already operating around them; for security and privacy teams it’s a reminder that “broadcast in the open” is now affordable to inspect at scale. Jean-Luc Aufranc’s original CNX Software write-up is the practical entry point if you want to build one — we recommend reading it directly.
This article is an independent English-language rewrite of «Monitor live traffic from V2X signals with V2X2MAP open-source Android app and an ESP32-C5 development board» by Jean-Luc Aufranc (CNXSoft), originally published on CNX Software on May 25, 2026. All product photos, app screenshots and original reporting are the author’s. Please cite CNX Software when referencing this material.