ESP-NOW Under the Hood: Action Frames, MAC Pairing & Sub-5ms Telemetry

If you have ever built a battery-powered sensor using traditional 2.4 GHz Wi-Fi, you know the frustration: your microcontroller wakes from deep sleep in 10 milliseconds, but spends three to five seconds scanning for SSIDs, performing the 4-way WPA2/WPA3 handshake, waiting for a DHCP IP lease, and finally opening an MQTT socket.

During those four seconds, the Wi-Fi radio pulls 80 to 120 mA, chewing through your battery before transmitting a single integer.

ESP-NOW solves this problem by stripping away the entire IP network stack. Developed by Espressif for the ESP8266, ESP32, ESP32-S3, and ESP32-C series, ESP-NOW is a connectionless protocol that transmits raw application data inside standard IEEE 802.11 Vendor-Specific Action Frames.

There is no router, no SSID association, and no IP address assignment. A battery-powered node can wake from deep sleep, blast a telemetry packet, receive a hardware MAC acknowledgment, and return to deep sleep in less than 5 milliseconds.

01 · How It Works: The 802.11 Action Frame Mechanic

ESP-NOW is not a proprietary 2.4 GHz modulation like Nordic Gazell. It uses standard 802.11 DSSS/OFDM physical layer frames. That means it runs on existing ESP32 Wi-Fi radio hardware alongside standard Wi-Fi.

+-------------------------------------------------------------------------+
| Standard 802.11 MAC Header (Frame Control: Type 00 Mgmt, Subtype 1101)  |
| Destination MAC | Source MAC | BSSID (Broadcast / Custom)               |
+-------------------------------------------------------------------------+
| IEEE 802.11 Action Frame Body                                           |
|   Category: 127 (Vendor-Specific)                                       |
|   OUI: 0x18, 0xFE, 0x34 (Espressif IEEE Registered OUI)                 |
|   Vendor Data: ESP-NOW Header + Encrypted / Plain Payload (Up to 250B)  |
+-------------------------------------------------------------------------+
| 32-bit Frame Check Sequence (FCS / CRC)                                 |
+-------------------------------------------------------------------------+

Because action frames are part of the baseline IEEE 802.11 specification, an ESP32 can transmit an action frame onto the channel without associating with an access point. Any listening ESP32 tuned to that exact 2.4 GHz Wi-Fi channel catches the frame at the MAC layer, validates the Espressif OUI (18:FE:34), and fires an interrupt in your firmware.

02 · Unicast vs. Broadcast: Peer Tables and Payload Sizes

To communicate over ESP-NOW, you configure either directed unicast or open broadcast:

Unicast Communication

• Targeting: The sender specifies the exact 6-byte hardware MAC address of the receiver.
• Hardware Acknowledgments: The receiver automatically returns an 802.11 MAC ACK within microseconds. If the ACK is missing, the sender’s radio hardware retransmits up to the configured retry count before returning an error code to the application.
• Hardware Peer Table: Each ESP32 maintains an internal peer table. On classic ESP32 chips, the peer list accommodates up to 20 total paired nodes (and up to 6 encrypted peers).

Broadcast Communication

• Targeting: The destination MAC is set to FF:FF:FF:FF:FF:FF.
• Zero Acks: Every listening node on the channel receives the packet, but no MAC ACKs are generated.
• Bypassing Peer Limits: Broadcast transmissions do not require pairing entries in the hardware peer table, making broadcast ideal for multi-room sensor nodes reporting to a central receiver.

03 · Security Architecture: CCMP AES-128 vs. Broadcast Vulnerability

ESP-NOW incorporates hardware-accelerated AES-128 CCMP (Counter Mode with CBC-MAC) encryption:

1. Primary Master Key (PMK): A 16-byte key used to encrypt the Local Master Keys during initial pairing negotiations.
2. Local Master Key (LMK): A unique 16-byte key assigned to each individual paired peer in the hardware peer table. Unicast packets exchanged with that peer are encrypted and authenticated with AES-CCM.

The Critical Broadcast Security Trap

ESP-NOW does not support MAC-layer encryption for broadcast packets.

If your sensor uses FF:FF:FF:FF:FF:FF to broadcast data to multiple receivers, the entire action frame payload is transmitted as plaintext over the air. Anyone with an SDR, a Wi-Fi card in monitor mode, or another ESP32 can capture every byte.

If you need one-to-many communications with confidentiality, you must implement application-layer encryption (such as ChaCha20-Poly1305 or AES-GCM) inside the payload buffer before handing it to esp_now_send().

04 · The Channel Collision Trap: Simultaneous Wi-Fi + ESP-NOW

A popular architecture among home automation builders is the ESP-NOW Bridge Gateway: an ESP32 that connects to home Wi-Fi to publish MQTT messages to Home Assistant, while simultaneously listening for ESP-NOW sensor packets from remote battery nodes.

This setup contains a major trap: The ESP32 has a single physical radio frontend.

[ Battery Node: CH 1 ] ──────(Action Frame)──────► [ ESP-NOW Bridge ]
                                                          │
                                                    Connected to Home AP (CH 6)
                                                          │
                                                  *PACKET LOST!*

When an ESP32 connects to a home Wi-Fi access point, the access point dictates the operating channel (e.g., Channel 6). The ESP32’s internal radio frequency synthesizer locks to Channel 6.

If your remote battery-powered sensors are hardcoded to transmit on Channel 1, the bridge node will never hear them.

How to Solve It:

1. Lock your home 2.4 GHz access point to a fixed channel (e.g., Channel 6).
2. Configure all battery nodes to transmit strictly on that channel.
3. In gateway firmware, register a Wi-Fi event handler: if the router changes channels, the gateway must update its ESP-NOW listening channel accordingly.

05 · FCC Part 15 Compliance in 2.4 GHz

ESP-NOW devices operate across the 2400–2483.5 MHz band under 47 CFR §15.247 and §15.249:

• Digital Modulation Standards: Because ESP-NOW action frames use standard 20 MHz Wi-Fi OFDM channels, the measured 6 dB bandwidth is approximately 16–18 MHz, easily surpassing the 500 kHz minimum under §15.247(a)(2).
• Power Ceilings: Pre-certified ESP32 modules (such as the ESP32-WROOM-32E) are FCC-certified under intentional radiator rules, typically operating between +18 dBm and +20 dBm conducted power.
• Antenna Modifications: Replacing a certified module’s PCB trace antenna with a high-gain external collinear antenna (or modifying SMA pigtails) alters the equipment grant under 47 CFR §15.204. Keep directional gain at or below 6 dBi to maintain full conducted output without exceeding EIRP limits.

06 · Field Deployment Checklist

• Lock Wi-Fi Channels: Verify that all transmitting nodes and listening bridges share the exact same 2.4 GHz channel (Channel 1, 6, or 11).
• Optimize Wake-to-Sleep Firmware: Disable RF calibration on boot (esp_wifi_init with calibrated fast-boot settings) to cut wake-to-transmit duration to under 4 ms.
• Handle MAC ACK Status: Inspect the esp_now_send_cb_t callback status. If status is ESP_NOW_SEND_FAIL, log the dropped frame and retry once before entering deep sleep.
• Implement Application Crypto on Broadcasts: If transmitting private telemetry via broadcast action frames, encrypt the payload buffer using a lightweight symmetric cipher before sending.
• Measure Deep Sleep Current: Verify sleep current with a Nordic PPK2 or precision multimeter. A properly configured ESP32 in deep sleep should draw between 4.5 µA and 10 µA.