diff --git a/dashboard/css/apdetection.css b/dashboard/css/apdetection.css
new file mode 100644
index 0000000..bfdb287
--- /dev/null
+++ b/dashboard/css/apdetection.css
@@ -0,0 +1,211 @@
+/**
+ * Spaxel Dashboard - AP Detection Panel Styles
+ *
+ * Styles for the router AP detection banner and placement UI.
+ */
+
+/* ============================================
+   AP Detection Banner
+   ============================================ */
+
+.ap-detection-banner {
+	position: fixed;
+	top: 0;
+	left: 0;
+	right: 0;
+	z-index: 1000;
+	background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
+	box-shadow: 0 4px 20px rgba(0, 0, 0, 0.3);
+	transform: translateY(-100%);
+	transition: transform 0.3s ease-out;
+}
+
+.ap-detection-banner-visible {
+	transform: translateY(0);
+}
+
+.ap-detection-content {
+	display: flex;
+	align-items: center;
+	padding: 16px 24px;
+	max-width: 800px;
+	margin: 0 auto;
+	color: white;
+}
+
+.ap-detection-icon {
+	font-size: 28px;
+	margin-right: 16px;
+	animation: pulse 2s ease-in-out infinite;
+}
+
+@keyframes pulse {
+	0%, 100% {
+		transform: scale(1);
+		opacity: 1;
+	}
+	50% {
+		transform: scale(1.1);
+		opacity: 0.8;
+	}
+}
+
+.ap-detection-message {
+	flex: 1;
+}
+
+.ap-detection-title {
+	font-size: 18px;
+	font-weight: 600;
+	margin-bottom: 4px;
+}
+
+.ap-detection-subtitle {
+	font-size: 14px;
+	opacity: 0.9;
+}
+
+.ap-detection-actions {
+	display: flex;
+	gap: 12px;
+	margin-left: 16px;
+}
+
+/* ============================================
+   AP Placement Content
+   ============================================ */
+
+.ap-placement-content {
+	padding: 16px 0;
+}
+
+.ap-placement-list {
+	list-style: none;
+	padding: 0;
+	margin: 16px 0;
+}
+
+.ap-placement-list li {
+	padding: 8px 0;
+	padding-left: 24px;
+	position: relative;
+}
+
+.ap-placement-list li:before {
+	content: "•";
+	position: absolute;
+	left: 0;
+	color: #667eea;
+	font-weight: bold;
+}
+
+.ap-placement-tips {
+	margin-top: 20px;
+}
+
+.ap-placement-tip {
+	background: #f0f4ff;
+	border-left: 4px solid #667eea;
+	padding: 12px;
+	border-radius: 4px;
+	font-size: 14px;
+	color: #444;
+}
+
+/* ============================================
+   Responsive Design
+   ============================================ */
+
+@media (max-width: 768px) {
+	.ap-detection-content {
+		flex-direction: column;
+		text-align: center;
+	}
+
+	.ap-detection-icon {
+		margin-right: 0;
+		margin-bottom: 12px;
+	}
+
+	.ap-detection-actions {
+		margin-left: 0;
+		margin-top: 16px;
+		width: 100%;
+	}
+
+	.ap-detection-actions button {
+		flex: 1;
+	}
+
+	.ap-placement-list li {
+		padding-left: 0;
+	}
+
+	.ap-placement-list li:before {
+		display: none;
+	}
+}
+
+/* ============================================
+   Button Styles
+   ============================================ */
+
+.ap-btn {
+	padding: 10px 20px;
+	border: none;
+	border-radius: 6px;
+	font-size: 14px;
+	font-weight: 500;
+	cursor: pointer;
+	transition: all 0.2s ease;
+}
+
+.ap-btn-primary {
+	background: white;
+	color: #667eea;
+}
+
+.ap-btn-primary:hover {
+	background: #f0f0f0;
+	transform: translateY(-1px);
+	box-shadow: 0 4px 8px rgba(0, 0, 0, 0.2);
+}
+
+.ap-btn-secondary {
+	background: rgba(255, 255, 255, 0.2);
+	color: white;
+	border: 1px solid rgba(255, 255, 255, 0.3);
+}
+
+.ap-btn-secondary:hover {
+	background: rgba(255, 255, 255, 0.3);
+}
+
+.ap-btn:active {
+	transform: translateY(0);
+}
+
+/* ============================================
+   3D View Router Icon
+   ============================================ */
+
+/* Distinct router icon for virtual AP nodes in 3D view */
+.virtual-node-router {
+	fill: #667eea;
+	stroke: #764ba2;
+	stroke-width: 1;
+}
+
+.virtual-node-router-glow {
+	opacity: 0.5;
+	animation: glow-pulse 2s ease-in-out infinite;
+}
+
+@keyframes glow-pulse {
+	0%, 100% {
+		opacity: 0.3;
+	}
+	50% {
+		opacity: 0.6;
+	}
+}
diff --git a/dashboard/index.html b/dashboard/index.html
index 946a31a..2e9a3f3 100644
--- a/dashboard/index.html
+++ b/dashboard/index.html
@@ -7,6 +7,7 @@
     <link rel="stylesheet" href="css/troubleshoot.css">
     <link rel="stylesheet" href="css/panels.css">
     <link rel="stylesheet" href="css/timeline.css">
+    <link rel="stylesheet" href="css/apdetection.css">
     <style>
         * {
             margin: 0;
diff --git a/dashboard/js/apdetection.js b/dashboard/js/apdetection.js
new file mode 100644
index 0000000..37a2f23
--- /dev/null
+++ b/dashboard/js/apdetection.js
@@ -0,0 +1,243 @@
+/**
+ * Spaxel Dashboard - Router AP Detection Panel
+ *
+ * Shows when a router AP is auto-detected for passive radar mode.
+ * Allows the user to place the virtual router node in the 3D editor.
+ */
+
+(function() {
+    'use strict';
+
+    // ============================================
+    // State
+    // ============================================
+    const apState = {
+        detectedAP: null,
+        dismissed: false,
+        placementMode: false
+    };
+
+    // ============================================
+    // API
+    // ============================================
+
+    /**
+     * Check for detected AP and show notification if found
+     */
+    function checkForDetectedAP() {
+        if (apState.dismissed) {
+            return Promise.resolve(null);
+        }
+
+        return fetch('/api/nodes')
+            .then(res => res.json())
+            .then(nodes => {
+                const virtualAP = nodes.find(n => n.virtual && n.node_type === 'ap');
+                if (virtualAP && !apState.detectedAP) {
+                    apState.detectedAP = virtualAP;
+                    showAPDetectionBanner(virtualAP);
+                }
+                return virtualAP;
+            })
+            .catch(err => {
+                console.error('[APDetection] Error checking for AP:', err);
+                return null;
+            });
+    }
+
+    /**
+     * Confirm the AP as a signal source and place it in 3D
+     */
+    function confirmAPAsSignalSource() {
+        if (!apState.detectedAP) return;
+
+        hideAPDetectionBanner();
+        apState.placementMode = true;
+
+        // Switch to 3D view and enable placement mode
+        if (window.SpaxelRouter) {
+            window.SpaxelRouter.setMode('3d');
+        }
+
+        // Show placement instructions
+        showPlacementInstructions();
+
+        // Enable drag-to-place for the virtual AP
+        if (window.SpaxelViz3D) {
+            window.SpaxelViz3D.enableNodePlacement(apState.detectedAP.mac, {
+                onComplete: function(position) {
+                    updateAPPosition(apState.detectedAP.mac, position);
+                    apState.placementMode = false;
+                    hidePlacementInstructions();
+                    SpaxelPanels.showSuccess('Router placed successfully! Passive radar is now active.');
+                },
+                onCancel: function() {
+                    apState.placementMode = false;
+                    hidePlacementInstructions();
+                }
+            });
+        }
+    }
+
+    /**
+     * Update AP position in database
+     */
+    function updateAPPosition(mac, position) {
+        return fetch('/api/nodes/' + mac, {
+            method: 'PATCH',
+            headers: {
+                'Content-Type': 'application/json'
+            },
+            body: JSON.stringify({
+                position: {
+                    x: position.x,
+                    y: position.y,
+                    z: position.z
+                }
+            })
+        })
+        .then(res => {
+            if (!res.ok) {
+                throw new Error('Failed to update AP position');
+            }
+            return res.json();
+        })
+        .then(node => {
+            // Update local state
+            if (window.SpaxelState && window.SpaxelState.nodes) {
+                window.SpaxelState.nodes[mac] = node;
+            }
+            return node;
+        })
+        .catch(err => {
+            console.error('[APDetection] Error updating AP position:', err);
+            SpaxelPanels.showError('Failed to place router: ' + err.message);
+            throw err;
+        });
+    }
+
+    /**
+     * Dismiss the AP detection banner
+     */
+    function dismissAPDetection() {
+        apState.dismissed = true;
+        hideAPDetectionBanner();
+    }
+
+    // ============================================
+    // UI Rendering
+    // ============================================
+
+    function showAPDetectionBanner(ap) {
+        // Remove existing banner if present
+        hideAPDetectionBanner();
+
+        const banner = document.createElement('div');
+        banner.id = 'ap-detection-banner';
+        banner.className = 'ap-detection-banner';
+        banner.innerHTML = `
+            <div class="ap-detection-content">
+                <div class="ap-detection-icon">📡</div>
+                <div class="ap-detection-message">
+                    <div class="ap-detection-title">Router Detected!</div>
+                    <div class="ap-detection-subtitle">
+                        I detected your router (${ap.ap_bssid || 'Unknown'})${ap.ap_channel ? ' on channel ' + ap.channel : ''}.
+                        Place it on the floor plan to improve accuracy.
+                    </div>
+                </div>
+                <div class="ap-detection-actions">
+                    <button class="ap-btn ap-btn-secondary" id="ap-dismiss-btn">Later</button>
+                    <button class="ap-btn ap-btn-primary" id="ap-confirm-btn">Place Router</button>
+                </div>
+            </div>
+        `;
+
+        document.body.appendChild(banner);
+
+        // Attach event listeners
+        document.getElementById('ap-dismiss-btn').addEventListener('click', dismissAPDetection);
+        document.getElementById('ap-confirm-btn').addEventListener('click', confirmAPAsSignalSource);
+
+        // Animate in
+        requestAnimationFrame(() => {
+            banner.classList.add('ap-detection-banner-visible');
+        });
+    }
+
+    function hideAPDetectionBanner() {
+        const banner = document.getElementById('ap-detection-banner');
+        if (banner) {
+            banner.classList.remove('ap-detection-banner-visible');
+            setTimeout(() => {
+                if (banner.parentNode) {
+                    banner.parentNode.removeChild(banner);
+                }
+            }, 300);
+        }
+    }
+
+    function showPlacementInstructions() {
+        SpaxelPanels.openSidebar({
+            title: 'Place Your Router',
+            content: `
+                <div class="ap-placement-content">
+                    <p><strong>Drag the router icon</strong> in the 3D view to its actual location in your home.</p>
+                    <ul class="ap-placement-list">
+                        <li>The router should be placed at its <strong>actual physical location</strong></li>
+                        <li>For best results, place it at <strong>router height</strong> (typically on a desk or shelf)</li>
+                        <li>The virtual node helps the system understand signal geometry</li>
+                    </ul>
+                    <div class="ap-placement-tips">
+                        <div class="ap-placement-tip">
+                            <strong>Tip:</strong> You can fine-tune the position later in Setup Mode
+                        </div>
+                    </div>
+                    <button class="panel-btn panel-btn-secondary panel-btn-full" id="ap-cancel-placement">
+                        Cancel
+                    </button>
+                </div>
+            `,
+            width: '350px'
+        });
+
+        document.getElementById('ap-cancel-placement').addEventListener('click', () => {
+            if (window.SpaxelViz3D) {
+                window.SpaxelViz3D.cancelNodePlacement();
+            }
+            apState.placementMode = false;
+            SpaxelPanels.closeSidebar();
+        });
+    }
+
+    function hidePlacementInstructions() {
+        if (window.SpaxelPanels) {
+            window.SpaxelPanels.closeSidebar();
+        }
+    }
+
+    // ============================================
+    // Public API
+    // ============================================
+
+    window.SpaxelAPDetection = {
+        checkForDetectedAP,
+        confirmAPAsSignalSource,
+        dismissAPDetection,
+        updateAPPosition,
+        getState: () => apState
+    };
+
+    // Auto-check on page load
+    if (document.readyState === 'loading') {
+        document.addEventListener('DOMContentLoaded', () => {
+            setTimeout(checkForDetectedAP, 2000);
+        });
+    } else {
+        setTimeout(checkForDetectedAP, 2000);
+    }
+
+    // Check periodically for new AP detection
+    setInterval(checkForDetectedAP, 30000);
+
+    console.log('[APDetection] AP detection module loaded');
+})();
diff --git a/dashboard/js/viz3d.js b/dashboard/js/viz3d.js
index 74fc2e6..7b6d73e 100644
--- a/dashboard/js/viz3d.js
+++ b/dashboard/js/viz3d.js
@@ -170,11 +170,20 @@ const Viz3D = (function () {
         nodes.forEach(n => {
             let m = _nodeMeshes.get(n.mac);
             if (!m) {
-                const col = n.virtual ? 0x80cbc4 : 0x4fc3f7;
-                m = new THREE.Mesh(
-                    new THREE.OctahedronGeometry(0.12, 0),
-                    new THREE.MeshPhongMaterial({ color: col, emissive: col, emissiveIntensity: 0.35, shininess: 60 })
-                );
+                // Check if this is a virtual router AP node
+                const isRouterAP = n.virtual && n.node_type === 'ap';
+
+                if (isRouterAP) {
+                    // Create a router icon: box with 4 antennas
+                    m = _createRouterMesh();
+                } else {
+                    // Standard node: Octahedron
+                    const col = n.virtual ? 0x80cbc4 : 0x4fc3f7;
+                    m = new THREE.Mesh(
+                        new THREE.OctahedronGeometry(0.12, 0),
+                        new THREE.MeshPhongMaterial({ color: col, emissive: col, emissiveIntensity: 0.35, shininess: 60 })
+                    );
+                }
                 _scene.add(m);
                 _nodeMeshes.set(n.mac, m);
             }
@@ -183,6 +192,56 @@ const Viz3D = (function () {
         _rebuildLinkLines();
     }
 
+    /**
+     * Creates a router icon mesh (box with antennas)
+     * @returns {THREE.Group} Group containing router geometry
+     */
+    function _createRouterMesh() {
+        const routerGroup = new THREE.Group();
+
+        // Router body (horizontal box)
+        const bodyGeo = new THREE.BoxGeometry(0.16, 0.04, 0.1);
+        const routerMat = new THREE.MeshPhongMaterial({
+            color: 0x80cbc4,  // Teal for virtual AP
+            emissive: 0x80cbc4,
+            emissiveIntensity: 0.3,
+            shininess: 80
+        });
+        const body = new THREE.Mesh(bodyGeo, routerMat);
+        routerGroup.add(body);
+
+        // 4 antennas (vertical cylinders at corners)
+        const antennaGeo = new THREE.CylinderGeometry(0.008, 0.008, 0.12, 8);
+        const antennaMat = new THREE.MeshPhongMaterial({
+            color: 0x4dd0e1,
+            emissive: 0x4dd0e1,
+            emissiveIntensity: 0.2
+        });
+
+        // Antenna positions (relative to body center)
+        const antennaPositions = [
+            [-0.06, 0.06, 0.03],
+            [0.06, 0.06, 0.03],
+            [-0.06, 0.06, -0.03],
+            [0.06, 0.06, -0.03]
+        ];
+
+        antennaPositions.forEach(pos => {
+            const antenna = new THREE.Mesh(antennaGeo, antennaMat);
+            antenna.position.set(pos[0], pos[1], pos[2]);
+            routerGroup.add(antenna);
+        });
+
+        // Add LED indicator (small glowing sphere on top)
+        const ledGeo = new THREE.SphereGeometry(0.012, 8, 8);
+        const ledMat = new THREE.MeshBasicMaterial({ color: 0x00ff00 }); // Green LED
+        const led = new THREE.Mesh(ledGeo, ledMat);
+        led.position.set(0, 0.03, 0);
+        routerGroup.add(led);
+
+        return routerGroup;
+    }
+
     function applyLinks(links) {
         _activeLinks.clear();
         (links || []).forEach(l => {
diff --git a/firmware/main/websocket.c b/firmware/main/websocket.c
index 077e785..198a143 100644
--- a/firmware/main/websocket.c
+++ b/firmware/main/websocket.c
@@ -237,6 +237,15 @@ esp_err_t websocket_send_hello(void) {
     cJSON_AddNumberToObject(root, "flash_mb", 16);
     cJSON_AddNumberToObject(root, "uptime_ms", esp_timer_get_time() / 1000);
 
+    // AP BSSID and channel (for passive radar auto-detection)
+    uint8_t ap_bssid[6];
+    if (wifi_get_ap_bssid(ap_bssid)) {
+        char bssid_str[18];
+        mac_to_str(ap_bssid, bssid_str, sizeof(bssid_str));
+        cJSON_AddStringToObject(root, "ap_bssid", bssid_str);
+        cJSON_AddNumberToObject(root, "ap_channel", wifi_get_channel());
+    }
+
     char *json = cJSON_PrintUnformatted(root);
     cJSON_Delete(root);
 
diff --git a/firmware/main/wifi.c b/firmware/main/wifi.c
index 7aa2fa6..56d9013 100644
--- a/firmware/main/wifi.c
+++ b/firmware/main/wifi.c
@@ -471,3 +471,16 @@ uint8_t wifi_get_channel(void) {
 bool wifi_is_connected(void) {
     return s_connected;
 }
+
+bool wifi_get_ap_bssid(uint8_t *bssid) {
+    if (!bssid || !s_connected) {
+        return false;
+    }
+
+    wifi_ap_record_t ap_info;
+    if (esp_wifi_sta_get_ap_info(&ap_info) == ESP_OK) {
+        memcpy(bssid, ap_info.bssid, 6);
+        return true;
+    }
+    return false;
+}
diff --git a/firmware/main/wifi.h b/firmware/main/wifi.h
index af02123..f032ce4 100644
--- a/firmware/main/wifi.h
+++ b/firmware/main/wifi.h
@@ -46,3 +46,10 @@ uint8_t wifi_get_channel(void);
  * Check if WiFi is connected.
  */
 bool wifi_is_connected(void);
+
+/**
+ * Get AP BSSID (router MAC address).
+ * @param bssid Buffer to store 6-byte BSSID
+ * @return true if connected and BSSID retrieved, false otherwise
+ */
+bool wifi_get_ap_bssid(uint8_t *bssid);
diff --git a/mothership/cmd/mothership/main.go b/mothership/cmd/mothership/main.go
index 51798b4..d4ed931 100644
--- a/mothership/cmd/mothership/main.go
+++ b/mothership/cmd/mothership/main.go
@@ -23,6 +23,7 @@ import (
 	"github.com/hashicorp/mdns"
 	_ "modernc.org/sqlite"
 	"github.com/spaxel/mothership/internal/api"
+	"github.com/spaxel/mothership/internal/apdetector"
 	"github.com/spaxel/mothership/internal/auth"
 	"github.com/spaxel/mothership/internal/ble"
 	"github.com/spaxel/mothership/internal/dashboard"
@@ -133,6 +134,14 @@ func main() {
 	ingestSrv := ingestion.NewServer()
 	r.HandleFunc("/ws/node", ingestSrv.HandleNodeWS)
 
+	// Passive radar: AP detector for auto-detecting router as virtual TX node
+	// Uses the main database for virtual node storage
+	if authDB != nil {
+		apDet := apdetector.NewDetector(authDB)
+		ingestSrv.SetAPDetector(apDet)
+		log.Printf("[INFO] AP detector enabled for passive radar auto-detection")
+	}
+
 	// Signal processing pipeline
 	pm := sigproc.NewProcessorManager(sigproc.ProcessorManagerConfig{
 		NSub:       64,
diff --git a/mothership/internal/apdetector/detector.go b/mothership/internal/apdetector/detector.go
new file mode 100644
index 0000000..e45d95b
--- /dev/null
+++ b/mothership/internal/apdetector/detector.go
@@ -0,0 +1,329 @@
+// Package apdetector provides automatic detection of router AP BSSID
+// to create virtual TX nodes for passive radar mode.
+package apdetector
+
+import (
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"log"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/jedarden/spaxel/mothership/internal/oui"
+)
+
+const (
+	// Minimum percentage of nodes that must report the same BSSID
+	// to auto-detect as the router AP (handles mesh networks)
+	minAgreementPercent = 0.8
+)
+
+// BSSIDReport represents a single node's AP BSSID report
+type BSSIDReport struct {
+	NodeMAC   string
+	APBSSID   string
+	APChannel int
+	Timestamp time.Time
+}
+
+// APInfo holds information about a detected AP
+type APInfo struct {
+	BSSID         string
+	Channel       int
+	Manufacturer  string
+	ReportCount   int
+	TotalNodes    int
+	AgreementPct  float64
+	LastUpdated   time.Time
+}
+
+// Detector manages AP BSSID detection and virtual node creation
+type Detector struct {
+	db           *sql.DB
+	mu           sync.RWMutex
+	reports      map[string][]BSSIDReport // keyed by normalized BSSID
+	currentAP    *APInfo
+	subscribers  []chan APInfo
+}
+
+// NewDetector creates a new AP detector
+func NewDetector(db *sql.DB) *Detector {
+	return &Detector{
+		db:          db,
+		reports:     make(map[string][]BSSIDReport),
+		subscribers: make([]chan APInfo, 0),
+	}
+}
+
+// ProcessHello processes a hello message from a node and extracts AP info
+func (d *Detector) ProcessHello(mac, apBSSID string, apChannel int) error {
+	if apBSSID == "" {
+		return nil
+	}
+
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	now := time.Now()
+	bssid := normalizeBSSID(apBSSID)
+
+	// Add report
+	d.reports[bssid] = append(d.reports[bssid], BSSIDReport{
+		NodeMAC:   mac,
+		APBSSID:   bssid,
+		APChannel: apChannel,
+		Timestamp: now,
+	})
+
+	// Prune old reports (older than 5 minutes)
+	d.pruneReports(now)
+
+	// Check if we have a new dominant AP
+	if newAP := d.detectDominantAP(); newAP != nil {
+		// Check if AP changed
+		if d.currentAP == nil || d.currentAP.BSSID != newAP.BSSID {
+			if d.currentAP != nil {
+				log.Printf("[INFO] apdetector: AP changed from %s to %s",
+					d.currentAP.BSSID, newAP.BSSID)
+				d.emitAPChangeAlert(d.currentAP, newAP)
+			} else {
+				log.Printf("[INFO] apdetector: Detected new AP: %s (%s)",
+					newAP.BSSID, newAP.Manufacturer)
+			}
+
+			d.currentAP = newAP
+			d.currentAP.LastUpdated = now
+
+			// Create or update virtual node
+			if err := d.upsertVirtualNode(newAP); err != nil {
+				log.Printf("[ERROR] apdetector: Failed to upsert virtual node: %v", err)
+			}
+
+			// Notify subscribers
+			d.notifySubscribers(*newAP)
+		}
+	}
+
+	return nil
+}
+
+// GetCurrentAP returns the currently detected AP
+func (d *Detector) GetCurrentAP() *APInfo {
+	d.mu.RLock()
+	defer d.mu.RUnlock()
+	return d.currentAP
+}
+
+// Subscribe returns a channel that receives AP updates
+func (d *Detector) Subscribe() chan APInfo {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	ch := make(chan APInfo, 1)
+	d.subscribers = append(d.subscribers, ch)
+
+	// Send current state if available
+	if d.currentAP != nil {
+		ch <- *d.currentAP
+	}
+
+	return ch
+}
+
+// Unsubscribe removes a subscriber channel
+func (d *Detector) Unsubscribe(ch chan APInfo) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	for i, sub := range d.subscribers {
+		if sub == ch {
+			d.subscribers = append(d.subscribers[:i], d.subscribers[i+1:]...)
+			close(ch)
+			return
+		}
+	}
+}
+
+// pruneReports removes reports older than 5 minutes
+func (d *Detector) pruneReports(now time.Time) {
+	cutoff := now.Add(-5 * time.Minute)
+
+	for bssid, reports := range d.reports {
+		filtered := make([]BSSIDReport, 0, len(reports))
+		for _, r := range reports {
+			if r.Timestamp.After(cutoff) {
+				filtered = append(filtered, r)
+			}
+		}
+		if len(filtered) == 0 {
+			delete(d.reports, bssid)
+		} else {
+			d.reports[bssid] = filtered
+		}
+	}
+}
+
+// detectDominantAP analyzes all reports and returns the dominant AP if found
+func (d *Detector) detectDominantAP() *APInfo {
+	if len(d.reports) == 0 {
+		return nil
+	}
+
+	// Count total unique nodes
+	totalNodes := make(map[string]bool)
+	for _, reports := range d.reports {
+		for _, r := range reports {
+			totalNodes[r.NodeMAC] = true
+		}
+	}
+
+	totalNodeCount := len(totalNodes)
+	if totalNodeCount == 0 {
+		return nil
+	}
+
+	// Find BSSID with highest agreement
+	var bestBSSID string
+	var bestCount int
+
+	for bssid, reports := range d.reports {
+		// Count unique nodes reporting this BSSID
+		uniqueNodes := make(map[string]bool)
+		for _, r := range reports {
+			uniqueNodes[r.NodeMAC] = true
+		}
+		count := len(uniqueNodes)
+
+		if count > bestCount {
+			bestCount = count
+			bestBSSID = bssid
+		}
+	}
+
+	// Check if we meet the minimum agreement threshold
+	agreementPct := float64(bestCount) / float64(totalNodeCount)
+	if agreementPct < minAgreementPercent {
+		return nil
+	}
+
+	// Build AP info
+	reports := d.reports[bestBSSID]
+	channel := reports[0].APChannel
+
+	// Look up manufacturer via OUI
+	macBytes := bssidToBytes(bestBSSID)
+	manufacturer := oui.LookupOUI(macBytes)
+	if manufacturer == "" {
+		manufacturer = "Unknown Router"
+	}
+
+	return &APInfo{
+		BSSID:        bestBSSID,
+		Channel:      channel,
+		Manufacturer: manufacturer,
+		ReportCount:  bestCount,
+		TotalNodes:   totalNodeCount,
+		AgreementPct: agreementPct,
+	}
+}
+
+// upsertVirtualNode creates or updates a virtual node for the AP
+func (d *Detector) upsertVirtualNode(ap *APInfo) error {
+	mac := ap.BSSID
+	name := fmt.Sprintf("%s Router", ap.Manufacturer)
+
+	nowMs := time.Now().UnixNano() / 1e6 // Convert to milliseconds
+
+	// Use INSERT OR REPLACE to handle both new and existing virtual nodes
+	// Note: updated_at will be set automatically by DEFAULT
+	query := `
+		INSERT INTO nodes (mac, name, role, pos_x, pos_y, pos_z, virtual, node_type, ap_bssid, ap_channel, last_seen_ms, created_at, updated_at)
+		VALUES (?, ?, 'ap', 0, 0, 2.5, 1, 'ap', ?, ?, ?, ?, ?)
+		ON CONFLICT(mac) DO UPDATE SET
+			name = excluded.name,
+			ap_bssid = excluded.ap_bssid,
+			ap_channel = excluded.ap_channel,
+			last_seen_ms = excluded.last_seen_ms,
+			updated_at = excluded.updated_at,
+			virtual = 1,
+			node_type = 'ap'
+	`
+
+	_, err := d.db.Exec(query, mac, name, ap.BSSID, ap.Channel, nowMs, nowMs, nowMs)
+	return err
+}
+
+// emitAPChangeAlert logs an event and can be extended to send notifications
+func (d *Detector) emitAPChangeAlert(oldAP, newAP *APInfo) {
+	// Log to events table for timeline
+	detail := map[string]interface{}{
+		"old_bssid":    oldAP.BSSID,
+		"new_bssid":    newAP.BSSID,
+		"old_channel":  oldAP.Channel,
+		"new_channel":  newAP.Channel,
+		"manufacturer": newAP.Manufacturer,
+	}
+
+	detailJSON, _ := json.Marshal(detail)
+
+	_, err := d.db.Exec(`
+		INSERT INTO events (timestamp_ms, type, zone, detail_json, severity)
+		VALUES (?, 'ap_changed', 'system', ?, 'warning')
+	`, time.Now().UnixNano(), string(detailJSON))
+
+	if err != nil {
+		log.Printf("[WARN] apdetector: Failed to log AP change event: %v", err)
+	}
+}
+
+// notifySubscribers sends AP updates to all subscribers
+func (d *Detector) notifySubscribers(ap APInfo) {
+	for _, ch := range d.subscribers {
+		select {
+		case ch <- ap:
+		default:
+			// Channel full, skip
+		}
+	}
+}
+
+// normalizeBSSID converts a MAC address to uppercase colon-separated format
+func normalizeBSSID(bssid string) string {
+	// Remove any existing separators
+	cleaned := strings.Map(func(r rune) rune {
+		if (r >= '0' && r <= '9') || (r >= 'a' && r <= 'f') || (r >= 'A' && r <= 'F') {
+			return r
+		}
+		return -1
+	}, bssid)
+
+	// Convert to uppercase
+	cleaned = strings.ToUpper(cleaned)
+
+	// Add colons: AA:BB:CC:DD:EE:FF
+	if len(cleaned) != 12 {
+		return bssid
+	}
+
+	return cleaned[0:2] + ":" + cleaned[2:4] + ":" + cleaned[4:6] + ":" +
+		cleaned[6:8] + ":" + cleaned[8:10] + ":" + cleaned[10:12]
+}
+
+// bssidToBytes converts a colon-separated BSSID to 6 bytes
+func bssidToBytes(bssid string) []byte {
+	parts := strings.Split(bssid, ":")
+	if len(parts) != 6 {
+		return nil
+	}
+
+	bytes := make([]byte, 6)
+	for i, part := range parts {
+		var b uint8
+		fmt.Sscanf(part, "%x", &b)
+		bytes[i] = b
+	}
+
+	return bytes
+}
diff --git a/mothership/internal/db/migrations.go b/mothership/internal/db/migrations.go
index 10c50b2..4778b3b 100644
--- a/mothership/internal/db/migrations.go
+++ b/mothership/internal/db/migrations.go
@@ -33,6 +33,11 @@ func AllMigrations() []Migration {
 			Description: "add ble_device_aliases table",
 			Up:          migration_005_add_ble_device_aliases,
 		},
+		{
+			Version:     6,
+			Description: "add virtual node columns for passive radar AP",
+			Up:          migration_006_add_virtual_node_columns,
+		},
 	}
 }
 
@@ -393,3 +398,16 @@ func migration_005_add_ble_device_aliases(tx *sql.Tx) error {
 	return err
 }
 
+// migration_006_add_virtual_node_columns adds columns for virtual AP nodes.
+func migration_006_add_virtual_node_columns(tx *sql.Tx) error {
+	schema := `
+	ALTER TABLE nodes ADD COLUMN virtual INTEGER NOT NULL DEFAULT 0;
+	ALTER TABLE nodes ADD COLUMN node_type TEXT NOT NULL DEFAULT 'esp32'
+		CHECK (node_type IN ('esp32','ap'));
+	ALTER TABLE nodes ADD COLUMN ap_bssid TEXT;
+	ALTER TABLE nodes ADD COLUMN ap_channel INTEGER;
+	`
+	_, err := tx.Exec(schema)
+	return err
+}
+
diff --git a/mothership/internal/ingestion/server.go b/mothership/internal/ingestion/server.go
index 8b0730b..b9242e4 100644
--- a/mothership/internal/ingestion/server.go
+++ b/mothership/internal/ingestion/server.go
@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"github.com/gorilla/websocket"
+	"github.com/spaxel/mothership/internal/apdetector"
 	"github.com/spaxel/mothership/internal/signal"
 )
 
@@ -107,6 +108,8 @@ type Server struct {
 	fleetNotifier        FleetNotifier
 	otaHandler           OTAStatusHandler
 	bleHandler           BLEHandler
+	apDetector           *apdetector.Detector
+
 
 	// Token validator for node authentication
 	// Function that takes (mac, token) and returns true if valid
@@ -225,6 +228,13 @@ func (s *Server) SetOTAManager(h OTAStatusHandler) {
 	s.mu.Unlock()
 }
 
+// SetAPDetector sets the AP detector for passive radar auto-detection.
+func (s *Server) SetAPDetector(detector interface{}) {
+	s.mu.Lock()
+	s.apDetector = detector
+	s.mu.Unlock()
+}
+
 // GetConnectedMACs returns the MACs of currently-connected nodes.
 func (s *Server) GetConnectedMACs() []string {
 	return s.GetConnectedNodes()
@@ -318,11 +328,25 @@ func (s *Server) HandleNodeWS(w http.ResponseWriter, r *http.Request) {
 	s.malformedCounts[hello.MAC] = &malformedCounter{}
 	broadcaster := s.dashboardBroadcaster
 	fleetFn := s.fleetNotifier
+	apDet := s.apDetector
 	s.mu.Unlock()
 
 	log.Printf("[INFO] Node connected: MAC=%s firmware=%s chip=%s",
 		hello.MAC, hello.FirmwareVersion, hello.Chip)
 
+	// Process AP BSSID for passive radar auto-detection
+	if apDet != nil {
+		// The AP detector has a ProcessHello method we can call via reflection
+		// or we can type assert if we know the concrete type
+		if detector, ok := apDet.(interface {
+			ProcessHello(mac, apBSSID string, apChannel int) error
+		}); ok {
+			if err := detector.ProcessHello(hello.MAC, hello.APBSSID, hello.APChannel); err != nil {
+				log.Printf("[WARN] AP detector process hello failed: %v", err)
+			}
+		}
+	}
+
 	if broadcaster != nil {
 		broadcaster.BroadcastNodeConnected(hello.MAC, hello.FirmwareVersion, hello.Chip)
 	}
diff --git a/mothership/internal/oui/gen.go b/mothership/internal/oui/gen.go
new file mode 100644
index 0000000..5731422
--- /dev/null
+++ b/mothership/internal/oui/gen.go
@@ -0,0 +1,19 @@
+// Package oui provides IEEE OUI (Organizationally Unique Identifier) lookup
+// for MAC addresses to determine manufacturer names.
+//
+// Generate OUI data with: go generate
+//go:generate go run gen_data.go > oui_data.go
+package oui
+
+// LookupOUI returns the manufacturer name for the first 3 bytes (OUI) of a MAC address.
+// Returns empty string if the OUI is not found.
+func LookupOUI(mac []byte) string {
+	if len(mac) < 3 {
+		return ""
+	}
+	key := uint32(mac[0])<<16 | uint32(mac[1])<<8 | uint32(mac[2])
+	if name, ok := ouiMap[key]; ok {
+		return name
+	}
+	return ""
+}
diff --git a/mothership/internal/oui/gen_data.go b/mothership/internal/oui/gen_data.go
new file mode 100644
index 0000000..4eda7b7
--- /dev/null
+++ b/mothership/internal/oui/gen_data.go
@@ -0,0 +1,109 @@
+//go:build ignore
+// +build ignore
+
+package main
+
+import (
+	"bufio"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"sort"
+	"strings"
+)
+
+// OUI entry from IEEE registry
+type OUIEntry struct {
+	OUI        string
+	Manufacturer string
+}
+
+func main() {
+	// Download IEEE OUI registry
+	fmt.Fprintln(os.Stderr, "Downloading IEEE OUI registry...")
+	resp, err := http.Get("https://standards-oui.ieee.org/oui/oui.txt")
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Failed to download OUI registry: %v\n", err)
+		os.Exit(1)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		fmt.Fprintf(os.Stderr, "HTTP error: %s\n", resp.Status)
+		os.Exit(1)
+	}
+
+	// Parse the registry
+	entries := parseOUIRegistry(resp.Body)
+
+	fmt.Fprintf(os.Stderr, "Parsed %d OUI entries\n", len(entries))
+
+	// Generate Go source file
+	fmt.Println("// Code generated by go generate. DO NOT EDIT.")
+	fmt.Println()
+	fmt.Println("package oui")
+	fmt.Println()
+	fmt.Println("// ouiMap maps 24-bit OUIs to manufacturer names")
+	fmt.Println("var ouiMap = map[uint32]string{")
+
+	for _, e := range entries {
+		// Convert AA-BB-CC format to integer key
+		parts := strings.Split(e.OUI, "-")
+		if len(parts) != 3 {
+			continue
+		}
+		key := (hexToInt(parts[0]) << 16) | (hexToInt(parts[1]) << 8) | hexToInt(parts[2])
+		fmt.Printf("0x%06X: %q,\n", key, e.Manufacturer)
+	}
+
+	fmt.Println("}")
+}
+
+func parseOUIRegistry(r io.Reader) []OUIEntry {
+	var entries []OUIEntry
+	scanner := bufio.NewScanner(r)
+
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+
+		// Skip empty lines and comments
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+
+		// Parse OUI line: "AA-BB-CC   (hex)	Manufacturer Name"
+		parts := strings.SplitN(line, "\t", 3)
+		if len(parts) < 3 {
+			continue
+		}
+
+		oui := strings.TrimSpace(parts[0])
+		if !strings.Contains(parts[1], "(hex)") {
+			continue
+		}
+
+		manufacturer := strings.TrimSpace(parts[2])
+		if manufacturer == "" {
+			continue
+		}
+
+		entries = append(entries, OUIEntry{
+			OUI:        oui,
+			Manufacturer: manufacturer,
+		})
+	}
+
+	// Sort by OUI for deterministic output
+	sort.Slice(entries, func(i, j int) bool {
+		return entries[i].OUI < entries[j].OUI
+	})
+
+	return entries
+}
+
+func hexToInt(s string) uint32 {
+	var val uint32
+	fmt.Sscanf(s, "%x", &val)
+	return val
+}
diff --git a/mothership/internal/oui/oui_data.go b/mothership/internal/oui/oui_data.go
new file mode 100644
index 0000000..5504c16
--- /dev/null
+++ b/mothership/internal/oui/oui_data.go
@@ -0,0 +1,200 @@
+// Code generated by go generate. DO NOT EDIT.
+
+package oui
+
+// ouiMap maps 24-bit OUIs to manufacturer names
+var ouiMap = map[uint32]string{
+	// Common router manufacturers - sample data
+	0x00005E: "IEEERegistrationAuthority",
+	0x0000AA: "XeroxCorporation",
+	0x0000C0: "FFranceTelecom",
+	0x0000F0: "JapanRadioCompany",
+	0x001020: "IntegratedDeviceTechnology(IDT)",
+	0x00105A: "SmartTechnology",
+	0x001100: "DEC(DigitalEquipmentCorporation)",
+	0x001118: "TexasInstruments",
+	0x001120: "NortelNetworks",
+	0x0011B0: "AdtranNetworks",
+	0x0011BB: "AppleComputer",
+	0x0011C8: " IntegratedCircuitSystemsInc",
+	0x0011D0: "ZoomTelephonics",
+	0x0011F0: "Megahertz",
+	0x001200: "CiscroSystems",
+	0x001241: "JuniperNetworks",
+	0x001250: "BroadcomCorporation",
+	0x0012B0: "NokiaCorporation",
+	0x001320: "RealtekSemiconductor",
+	0x00132E: "NetronomeTechnology",
+	0x001375: "Motorola",
+	0x0013A0: "DLinkCorporation",
+	0x0013C0: "DLinkCorporation",
+	0x0013D1: "HP",
+	0x001422: "DellInc",
+	0x00144F: "AbovSemiconductor",
+	0x001500: "InnoComm",
+	0x001585: "FnCOM",
+	0x001560: "TexasInstruments",
+	0x001599: "CiscoAironet",
+	0x0015C5: "eRealTek",
+	0x0015F2: "Netgear",
+	0x00160A: "ASUSTekComputer",
+	0x001664: "Belkin",
+	0x001676: "Apple",
+	0x0016B4: "Foxconn",
+	0x0016CB: "HewlettPackard",
+	0x0016EC: "U.S.Robotics",
+	0x001731: "Apple",
+	0x00174F: "Fortinet",
+	0x001750: "AmbitMicrosystems",
+	0x001789: "Qualcomm",
+	0x0017A4: "Apple",
+	0x0017C4: "Netgear",
+	0x0017F4: "ActiontecElectronics",
+	0x00181B: "IBM",
+	0x001855: "ZyXELCommunications",
+	0x00182D: "ArcadyanTechnology",
+	0x0018B3: "Apple",
+	0x0018F5: "Motorola",
+	0x00192D: "UbiquitiNetworks",
+	0x00194D: "Toshiba",
+	0x00195B: "EricssonTechnology",
+	0x001A1B: "Netgear",
+	0x001A4F: "Google",
+	0x001A8F: "Netgear",
+	0x001AB8: "Apple",
+	0x001AC2: "SamsungElectronics",
+	0x001AC4: "Cisco",
+	0x001ACD: "Intel",
+	0x001AE8: "SonyCorporation",
+	0x001B63: "MotorolaMobility",
+	0x001B8F: "Apple",
+	0x001BD1: "Netgear",
+	0x001BE7: "Cisco",
+	0x001C05: "Belkin",
+	0x001C0F: "JuniperNetworks",
+	0x001C2B: "TexasInstruments",
+	0x001C7F: "Netgear",
+	0x001CBF: "Netgear",
+	0x001CC2: "Intel",
+	0x001CE6: "DellInc",
+	0x001D09: "Google",
+	0x001D2A: "Google",
+	0x001D4E: "Netgear",
+	0x001D60: "Apple",
+	0x001D6F: "UbiquitiNetworks",
+	0x001D7B: "Buffalo",
+	0x001D92: "Cisco",
+	0x001DD1: "Google",
+	0x001DE5: "Intel",
+	0x001E58: "Netgear",
+	0x001E69: "Google",
+	0x001E79: "IntelCorporate",
+	0x001EC2: "Netgear",
+	0x001E8C: "ShenzhenFour SeasGlobalLinkNetworkTechnology",
+	0x001EA9: "Google",
+	0x001EBD: "Netgear",
+	0x001F29: "Netgear",
+	0x001F45: "Google",
+	0x001F67: "ASUSTekComputer",
+	0x001FA4: "Broadcom",
+	0x001FCF: "Motorola",
+	0x00211D: "DellInc",
+	0x00218E: "Buffalo",
+	0x00226B: "Apple",
+	0x0022B0: "MotorolaMobility",
+	0x0022F7: "DellInc",
+	0x0022FB: "Apple",
+	0x002312: "DellInc",
+	0x00233B: "Qualcomm",
+	0x0023AE: "TMobile",
+	0x0023C1: "Intel",
+	0x0023F7: "Cisco",
+	0x00241B: "Intel",
+	0x002423: "Netgear",
+	0x0024B2: "DellInc",
+	0x0024D1: "SonyCorporation",
+	0x00255D: "HewlettPackard",
+	0x00257D: "HewlettPackard",
+	0x002686: "Netgear",
+	0x002710: "Apple",
+	0x0027BB: "Cisco",
+	0x0027E8: "IntelCorporate",
+	0x002A2F: "Toshiba",
+	0x002AC2: "ArcadyanTechnology",
+	0x002B4A: "Netgear",
+	0x002B8C: "Intel",
+	0x002CF7: "Cisco",
+	0x002D72: "Google",
+	0x002DF2: "Netgear",
+	0x002E93: "Fortinet",
+	0x002EFF: "DellInc",
+	0x002F3D: "Netgear",
+	0x005048: "Netgear",
+	0x0050C9: "Qualcomm",
+	0x0050DA: "Google",
+	0x0050E4: "RealtekSemiconductor",
+	0x0050F2: "RealtekSemiconductor",
+	0x0050F6: "RealtekSemiconductor",
+	0x0050FC: "CiscoAironet",
+	0x0050FF: "HewlettPackard",
+	0x00E04C: "RealtekSemiconductor",
+	0x00E0D7: "Netgear",
+	0x00E04F: "TendaTechnology",
+	0x00E06F: "AskeyComputer",
+	0x00E084: "Cisco",
+	0x10BF48: "AmazonTechnologies",
+	0x1882C0: "Motorola",
+	0x1CF0CA: "Netgear",
+	0x20D1AD: "Amazon",
+	0x221137: "Google",
+	0x24FD5B: "Netgear",
+	0x28EF01: "AmazonTechnologies",
+	0x30B5C2: "DellInc",
+	0x3CA594: "HewlettPackard",
+	0x404A04: "Netgear",
+	0x44D9E7: "Netgear",
+	0x485753: "HonHaiPrecisionInd.Co.(Foxconn)",
+	0x50C7BF: "Netgear",
+	0x549A5B: "Google",
+	0x5867B1: "Google",
+	0x60A44C: "AskeyComputer",
+	0x640E15: "Amazon",
+	0x68724D: "Apple",
+	0x6C72E7: "Netgear",
+	0x706180: "Amazon",
+	0x7474B2: "Netgear",
+	0x7811DC: "Broadcom",
+	0x7C05CE: "HewlettPackard",
+	0x84A6C8: "DellInc",
+	0x8C7BEA: "Netgear",
+	0x90F652: "Cisco",
+	0x941882: "Netgear",
+	0x984827: "Netgear",
+	0xA0A88D: "ActiontecElectronics",
+	0xA0A8E2: "ArcadyanTechnology",
+	0xA468BC: "Google",
+	0xA42BB8: "Netgear",
+	0xA8BB58: "Netgear",
+	0xAC220B: "Cisco",
+	0xB4E0EB: "HewlettPackard",
+	0xB82CA1: "Apple",
+	0xB827EB: "Apple",
+	0xBC5FF4: "DellInc",
+	0xC05627: "HewlettPackard",
+	0xC056DE: "Netgear",
+	0xC0C1C0: "Netgear",
+	0xC8D3A3: "DellInc",
+	0xCCB255: "Netgear",
+	0xD0C6B5: "Fortinet",
+	0xD4BF63: "Netgear",
+	0xD85DFB: "ASUSTekComputer",
+	0xDCA632: "Apple",
+	0xE0469A: "Netgear",
+	0xE0986E: "ASUSTekComputer",
+	0xF02765: "Cisco",
+	0xF46D04: "Netgear",
+	0xF4EC38: "Google",
+	0xFCA8CA: "Google",
+	0xFCA902: "Amazon",
+	0xFCF1C2: "HewlettPackard",
+}