Wi-Fi Pineapple · Volume 7
Hak5 WiFi Pineapple Volume 7 — Generic Hardware Architecture
The SoC, the role-based radio model, the antennas, and the MediaTek / Qualcomm chipset landscape that underlies all four current models
Contents
1. About this volume
This is the generic hardware picture — the architecture pattern every WiFi Pineapple follows, before the per-model volumes (9, 12, 14) get into each model’s specific board. Understand the pattern here and the per-model hardware volumes become deltas against it rather than four from-scratch treatments.
All specs are research-baseline (docs.hak5.org / shop.hak5.org, 2026-05) — Hak5 iterates hardware revisions, so part numbers should be re-verified on acquisition. The architecture, though — networking SoC plus role-assigned radios — is stable across the whole line and the whole history.
2. The architecture pattern — networking SoC + dedicated radios
A WiFi Pineapple is not built like a laptop or a Raspberry Pi. It’s built like what it is — a piece of networking equipment — and that shapes everything:
The Pineapple hardware pattern
════════════════════════════════════════════════
┌─────────────────────────────────────────────┐
│ Networking SoC │
│ (MIPS on Mark VII · quad-core ARM Cortex-A7│
│ on Enterprise) — optimized for moving │
│ packets, not for general compute │
│ │
│ ┌────────┐ ┌────────┐ ┌────────┐ ... │
│ │ radio │ │ radio │ │ radio │ │
│ │ (a) │ │ (b) │ │ (c) │ │
│ └───┬────┘ └───┬────┘ └───┬────┘ │
│ │ │ │ │
└───────┼───────────┼───────────┼─────────────┘
│ │ │
antenna antenna antenna
│ │ │
ROLE: ROLE: ROLE:
management PineAP monitor / recon
(your link) (rogue AP) / injection
The radios aren't interchangeable peripherals — they're
ASSIGNED ROLES. That assignment is the whole architecture (§ 3).The SoC is a networking SoC — silicon designed to move 802.11 and Ethernet frames efficiently, not to run general workloads. The Mark VII uses a single-core MIPS network SoC; the Enterprise steps up to a 717 MHz quad-core ARM Cortex-A7. Either way, the design priority is radio throughput and packet handling, not desktop-class compute. The Pineapple doesn’t need to be fast at computing — it needs to be good at being several Wi-Fi radios at once.
3. The role-based radio model — the defining design
This is the single most important hardware concept in the entire series, so it gets its own section:
A WiFi Pineapple has multiple Wi-Fi radios, and each one is assigned a role. That role separation is what lets the device attack and observe simultaneously — which a single-radio device fundamentally cannot do.
The three canonical roles:
| Role | What that radio does | Why it must be dedicated |
|---|---|---|
| Management | Carries your connection to the device — the link your browser/SSH rides on | If your management link shared a radio with PineAP, configuring the attack would keep knocking you off the device |
| PineAP | Is the rogue AP — runs the PineAP daemon, sends beacons/probe-responses, hosts the associations (Vol 3 § 6-7) | The PineAP daemon needs dedicated radio access; it conflicts with that radio being in client mode (Vol 3 § 7) |
| Monitor / recon / injection | Listens to the airspace (recon, probe logging) and injects (deauth) | Monitoring must happen while PineAP runs — different radio, different job, same moment |
Why a single-radio device can’t be a Pineapple: a single radio can be a rogue AP, or it can monitor the airspace, or it can carry your management link — but not all three at once. It has to time-slice, and time-slicing means the rogue AP flickers, the monitor misses frames, and your link drops. The Pineapple’s role-based multi-radio design is the thing that makes the full Vol 3 attack chain run concurrently and reliably. It’s the architectural reason the Pineapple is a category of its own and not “an ESP32 with attack firmware.”
Single radio (e.g. a basic ESP32 tool): Pineapple (role-based):
────────────────────────────────────── ────────────────────────
one radio, time-slicing: radio A: management ── always
▓ rogue AP ░ monitor ░ mgmt ▓ rogue... radio B: PineAP ── always
everything flickers, frames missed, radio C: monitor ── always
management link unstable all three, concurrently, stableThe operational consequence: mis-assigning radio roles breaks the attack chain — and the role-assignment UI lives in Settings (Vol 6 § 3). The per-model volumes give each model’s exact role map; the Enterprise’s five radios allow role assignments the Mark VII’s three simply can’t (§ 5).
4. The chipset landscape — MediaTek MT76xx and Qualcomm IPQ
The Pineapple’s radios are commodity Wi-Fi chipsets — specifically the ones with excellent open-driver support in the security community. The docs note that “chipsets from Atheros and MediaTek have excellent support” — that driver-support quality is why these chipsets are chosen. A radio is only useful for monitor mode + injection if its driver supports those modes well, and the MediaTek MT76 family and the Qualcomm/Atheros lineage are the community’s well-trodden ground.
The chipsets across the current line (research-baseline):
| Chipset | Family | Bands | Used in | Notes |
|---|---|---|---|---|
| MT7601U | MediaTek MT76, single-band | 2.4 GHz b/g/n | Mark VII | One of the Mark VII’s role radios |
| MT7610U | MediaTek MT76 | 2.4 / 5 GHz a/b/g/n/ac (1×1) | Mark VII | One of the Mark VII’s role radios |
| MT7612U | MediaTek MT76 | 2.4 / 5 GHz a/b/g/n/ac, 866 Mbps (2×2) | MK7AC adapter (the +AC kit); Enterprise (×3) | The “AC” workhorse — dedicated dual-band monitor + injection |
| Qualcomm IPQ4019 | Qualcomm integrated | 2.4 / 5 GHz 802.11ac Wave 2, MU-MIMO, TxBF, 1.733 Gbps | Enterprise (Radio0/1) | The Enterprise’s high-throughput radios — also effectively its SoC-integrated networking silicon |
A few things to read out of that table:
- The MT76 family is the spine. MT7601U, MT7610U, MT7612U — all MediaTek MT76. The Pineapple’s radio strategy is “use the well-supported MediaTek parts.”
- MT7612U is the recurring workhorse. It’s what the MK7AC adapter is (the thing that gives a Mark VII 5 GHz — Vol 11), and it’s three of the Enterprise’s five radios. If you understand the MT7612U, you understand the dual-band-ac capability across most of the line.
- The Enterprise mixes silicon. Two Qualcomm IPQ4019 radios (high-throughput, Wave 2, MU-MIMO) plus three MT7612U radios — five total, deliberately heterogeneous so different radios can take different roles at different performance tiers.
- The Pager is tri-band (2.4/5/6 GHz) + Bluetooth — its exact radio silicon is a per-model research item (Vol 12), but the architecture point holds: a dual-radio array, role-assigned, plus a BT radio.
5. Radio count as the model differentiator
Once you have the role-based model (§ 3), the four models line up cleanly by radio count and capability — that’s the real spec axis:
Radio count → what role assignments are possible
═══════════════════════════════════════════════════
Mark VII 3 radios ── mgmt + PineAP + monitor.
(2.4 GHz native) The classic three roles, exactly
filled. 5 GHz needs the MK7AC.
Mark VII +AC 3 + MK7AC ── the three, plus a dedicated
dual-band ac monitor/inject radio.
Now 5 GHz audit is real (Vol 11).
Pager dual-radio ── a 2-radio array, tri-band
array + BT 2.4/5/6 GHz, plus Bluetooth.
Roles are tighter — it's the
portable, not the maximal (Vol 12).
Enterprise 5 radios ── 2× IPQ4019 + 3× MT7612U. Enough
radios to dedicate roles AND run
multiple PineAP/monitor instances,
cover more channels at once, and
handle ~100 clients (Vol 14).This is why Vol 1 said the line is “a matrix, not a ladder.” The Mark VII fills the three canonical roles. The Enterprise doesn’t just “do the same thing faster” — five radios let it do things three radios can’t: monitor more channels concurrently, run more PineAP instances, dedicate a radio to client-population handling. The Pager goes the other way — fewer radios, but tri-band and pocket-sized. Radio count isn’t a quality score; it’s a capability shape.
6. Antennas, RF, and the bands
Antennas: the Mark VII ships with three high-gain antennas — one per radio. External, usually removable (RP-SMA-class), which means they’re an obvious mod target (Vol 18 — bigger antennas, directional antennas, different gain profiles). The Pager, being pocket-sized, integrates its antennas. The Enterprise, being rack-mount, has its own antenna array.
The bands:
| Band | Which models | Why it matters |
|---|---|---|
| 2.4 GHz | All — native on every model | The legacy band; congested; long range; the Mark VII’s only native band |
| 5 GHz | +AC Tactical (via MK7AC), Pager, Enterprise natively; Mark VII only with the MK7AC module | Where modern networks live — this is why the bare Mark VII’s 2.4-GHz-only nature is a real limitation, and why the +AC kit exists |
| 6 GHz | Pager only | Wi-Fi 6E / 7 territory — the Pager is the only current model that reaches it |
| Bluetooth / BTLE | Pager only (BT 5.2 + BTLE 4.2) | The Pager is the only model that treats BT as a capability |
The practical RF takeaway: “what bands can it see and attack” is a primary model-selection axis. A 2.4-GHz-only Mark VII misses everything modern networks do on 5 GHz. That single fact is most of why Vol 1’s buy recommendation was the +AC Tactical kit, not the bare Mark VII.
7. Compute, memory, storage — and why they’re modest
The numbers look small by laptop standards, and that’s correct and intentional:
| Model | RAM | Storage | CPU |
|---|---|---|---|
| Mark VII | 256 MB | 2 GB eMMC | single-core MIPS |
| Pager | 256 MB | 4 GB eMMC | pocket SoC (per-model — Vol 12) |
| Enterprise | 1 GB DDR3L | 4 GB eMMC | 717 MHz quad-core ARM Cortex-A7 |
Why modest is fine: the Pineapple’s job is to be radios and move frames — not to compute. The heavy compute in a Pineapple workflow happens off-device:
- Cracking captured handshakes → host-side, on a real GPU (Vol 11, Vol 19). The Pineapple captures; it doesn’t crack.
- Deep analysis of captures → host-side, in Wireshark / Kismet / custom tooling (Vol 19).
- The Pineapple holds enough storage for capture artifacts and enough RAM to run PineAP + recon + the web UI concurrently — and that’s the design target.
The Enterprise’s step up (1 GB RAM, quad-core) isn’t for compute — it’s for scale: holding state for ~100 DHCP clients vs. the Mark VII’s 5-10, orchestrating five radios, running more concurrent Campaigns. More clients and more radios need more RAM and more cores; that’s the whole reason the Enterprise’s numbers are bigger.
The implication for tjscientist’s workflow: plan for the host-side toolchain (Vol 19) as part of the kit. The Pineapple is the capture and attack instrument; the laptop with hashcat and Wireshark is the analysis instrument. They’re a pair.
8. Power and thermal across the form factors
Power delivery is one of the cleanest ways the four form factors differ:
| Model | Power | Implication |
|---|---|---|
| Mark VII / +AC | USB-C — bus power or a USB battery pack | Tethered to a laptop, or run off a power bank for portability. Modest draw (it’s a networking SoC, not a hot chip). |
| Pager | 2000 mAh internal LiPo, USB-C charge, ~4 h runtime | Untethered — the whole point. ~4 hours is a real constraint: it’s a short-window-engagement device, and you charge before every outing (Vol 12-13). |
| Enterprise | 100-240 V AC mains, 50/60 Hz | Permanently powered — it’s rack-mount infrastructure, not a field device. AC power is a feature (always-on) and a constraint (it doesn’t go in a backpack). |
Thermal: the Pineapple is a low-to-modest-power device — networking SoCs and Wi-Fi radios don’t dissipate like a CPU under load. The Mark VII in its small puck, the Pager in its pocket body, run warm-not-hot. The Enterprise is the one with real thermal design — five radios + a quad-core ARM in a metal enclosure is genuine heat, which is part of why it’s a metal rack-mount chassis rather than a plastic puck. Per-model volumes carry the specifics; the foundation point is: thermal scales with radio count, and the Enterprise is the only model where it’s a first-order design concern.
9. Resources
Hardware references
- Radios and chipsets (Mark VII): https://docs.hak5.org/wifi-pineapple/wifi-basics/radios-and-chipsets/
- Radios and chipsets (Enterprise): https://docs.hak5.org/wifi-pineapple-enterprise/wifi-basics/radios-and-chipsets/
- MediaTek MT76 driver project (the open-driver lineage these chipsets rely on): the
mt76Linux kernel driver - Qualcomm IPQ4019 — integrated networking SoC / radio (vendor documentation)
Within this series
- Vol 5 — the firmware that’s matched to this hardware
- Vol 9 / 12 / 14 — the per-model hardware deep dives (deltas against this pattern)
- Vol 11 — the MK7AC adapter (the MT7612U that gives a Mark VII 5 GHz)
- Vol 18 — antenna and hardware mods
Cross-tool
- HackRF One / PortaRF deep dives — contrast: those are SDR (raw RF, any waveform); the Pineapple’s radios are fixed-function 802.11 chipsets. Different layer, different design philosophy.
This is Volume 7 of a 21-volume series. Next: Vol 8 is the operational-posture foundation — OPSEC, capture-data discipline, the device’s own attack surface, the pre-engagement checklist, and discovery-response — the practical companion to Vol 4’s legal line.