The six checks below should pass on any Linux machine before you call it air-gapped. One to three commands each, with the output you should see. Bitcoin Witness station runs them before every workflow, See our full threat model.
6 checks · any Linux+4 · Bitcoin Witnessabout 10 minutesnothing here phones home
Eight air-gap checks, grouped into six cards. Nothing assumes Bitcoin Witness is installed.
01
No network interfaces active
A network interface is any connection to the outside world: WiFi, Ethernet, Bluetooth. On an air-gapped device all of them are down. An interface that is up but unconnected can still be exploited. Station check 1.
Type
ip -o link show | grep "state UP"
Expect
Nothing. Empty output means no interface is up.
If not
eth0 or wlan0 listed means that interface is still active. Bring it down: sudo ip link set wlan0 down, with the name that appeared.
02
No default routes
A route tells the device how to reach the internet. A default route is a known path out, even with no cable plugged in. Station check 2.
Type
ip -4 route show default
ip -6 route show default
Expect
Nothing from either command. No route, no path.
If not
A line beginning default via is a route. Remove it: sudo ip route del default
03
No DNS resolvers
DNS turns names into addresses. A configured resolver is a potential path to the internet. On an air-gapped device the file is empty. Station check 3.
Type
grep nameserver /etc/resolv.conf
Expect
Nothing, or No such file or directory. Both mean DNS is not configured.
If not
Lines starting nameserver are resolvers. Clear the file: sudo truncate -s 0 /etc/resolv.conf
04
No listening sockets
A socket is an open door other machines can connect to: SSH, a web server, file sharing. Only loopback connections, the device talking to itself, are acceptable. Station check 4.
Type
ss -tuln | grep -vE "127\.0\.0\.1|\[::1\]"
Expect
Nothing, or only lines mentioning 127.0.0.1 or [::1].
If not
Lines with 0.0.0.0 or [::] mean a service is listening on all networks. Find and stop it before going further.
05
No wireless hardware active
Bitcoin Witness blocks radios at four independent layers, numbered as on the security page: 1 · hardware, a device-tree overlay so the SoC never initialises the radio; 2 · driver, a kernel-module blacklist; 3 · firmware, the blobs deleted from disk; 4 · OS, an rfkill soft-block and masked services. Three commands show the layers visible at runtime, iw asks whether the kernel sees a radio at all (layer 1), rfkill whether it is blocked (layer 4), and lsmod whether a driver is loaded (layer 2), the authoritative one: firmware with no driver is inert. Station checks 5, 6 and 7.
iw: nothing. rfkill: every entry Soft blocked: yes, or no entries at all. A hardened box may have had its radios removed rather than blocked. lsmod: nothing.
If not
iw listing phy#0 or Interface wlan0 means the radio initialised and the overlay is not in effect. Any rfkill entry Soft blocked: no: run sudo rfkill block all. lsmod listing brcmfmac, cfg80211 or bluetooth means a driver loaded despite the blacklist. Stop and investigate before handling keys.
06
No networking daemons or tools running
SSH, curl, wget and netcat exist to talk over a network. The same command also looks for the three daemons Bitcoin Witness masks at install, wpa_supplicant, bluetoothd, avahi-daemon , layer 4, and the station’s check 8.
Type
ps aux | grep -E "ssh|curl|wget|nc |ncat|wpa_supplicant|bluetoothd|avahi"
Expect
One line: the grep you just ran, finding itself.
If not
sshd, curl or similar: stop them. A running wpa_supplicant, bluetoothd or avahi-daemon means a masked unit started anyway. Investigate that first. Find the process number in the second column and sudo kill 1234 with the real number.
On a Bitcoin Witness station · four more
Verify the mechanism, not only the effect.
The six above prove nothing is talking. Three of these read the install itself: the overlay, the blacklist and the masked units the security page names. The fourth reads the disk for firmware, one per layer. They assume the Linux system is hardened and airgapped during Bitcoin Witness installation, and will not pass on most other machines.
W1
The overlay is set
Layer 1. The device-tree overlay tells the SoC firmware never to initialise the WiFi or Bluetooth radio. Check 05’s empty iw is the effect. This is the setting.
Two lines: dtoverlay=disable-wifi and dtoverlay=disable-bt. On older images the file is /boot/config.txt.
If not
A missing line means the radio is initialised at boot and only the layers above it keep it quiet. Add the line, reboot, and rerun check 05.
W2
The blacklist is in place
Layer 2, the authoritative one. Thirty wireless and Bluetooth modules are blacklisted in sentinel-blacklist.conf. Check 05’s empty lsmod is the effect.
No such file means the blacklist was never installed. A smaller number means it was edited. Either way, treat check 05’s lsmod line as the only thing standing between you and a loaded driver, and reinstall before handling keys.
W3
The daemons are masked, not just stopped
Layer 4. Check 06 catches a daemon that is running. This confirms the three units cannot be started at all.
Type
systemctl is-enabled wpa_supplicant bluetooth avahi-daemon 2>&1
Expect
masked three times.
If not
disabled or enabled means the unit can still be started by hand or by a dependency. Mask it: sudo systemctl mask wpa_supplicant bluetooth avahi-daemon
W4
The firmware is gone from disk
Layer 3, and the station’s check 9. That is a warning, not a violation, because it reads the disk rather than testing the running machine. A driver cannot bring a radio up if its firmware file is absent, which is why Bitcoin Witness deletes those files at install. Belt and braces: check 05 is what proves a radio cannot come up.
Type
ls /lib/firmware/brcm/ 2>/dev/null | grep -E "brcmfmac|BCM.*\.hcd"
Expect
Nothing. Neither the WiFi blobs nor the Bluetooth HCI firmware is left for a driver to load.
If not
brcmfmac43455-sdio.bin (WiFi) or BCM4345C0.hcd (Bluetooth) still on disk is a defence-in-depth gap, not an open radio. A warning here, on an installed station in strict mode, a violation. Removing them is a decision: a reinstall is the only way back.
When you’d rather not do it by hand
Bitcoin Witness runs these before every workflow.
▸ System Health CheckPi 5air-gap ✓ VERIFIED
BITCOIN WITNESS — System Health Check 2026-08-05 00:00:00 UTC ────────────────────────────────────────────── [1] Air-Gap PASS all airgap checks passed [2] Entropy PASS 256 bits available [3] Disk Space PASS [4] Applications PASS [5] File Integrity PASS SHA-256 manifest OK [6] System Time PASS [7] Python Modules PASS [8] Swap PASS zram-zstd (no plaintext) ────────────────────────────────────────────── Overall: 8/8 PASS, 0 FAIL All required checks passed. Device is ready.
Eight checks, 8/8 PASS. This is the on-demand System Health Check. Its air-gap line is the machine running the by-hand checks above for you. The check that runs before every workflow is the air-gap guard, described below.
Keep reading
Watch the station run them.
Bitcoin Witness runs checks like these before every workflow. The walk-through shows every screen, including the health check that refuses to continue when one fails.