diff --git a/ROADMAP.md b/ROADMAP.md
index 24180b5..eb77768 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -58,6 +58,10 @@
 - [ ] Comprehensive error handling
 
 ## Future
+- WiFi probe request capture (promiscuous mode, WIFI_PKT_MGMT)
+  - Capture client SSID searches → `PROBE_DATA,<mac>,<rssi>,<ssid>` via UDP
+  - Uses `esp_wifi_set_promiscuous` with management frame filter
+  - Can coexist with CSI (both use promiscuous callbacks)
 - ESP-NOW mesh (ESP32-to-ESP32 CSI)
 - Multi-channel scanning
 - External sensor support (PIR, temp/humidity via GPIO)
diff --git a/TODO.md b/TODO.md
index c2d672d..d139430 100644
--- a/TODO.md
+++ b/TODO.md
@@ -30,6 +30,7 @@
 - [ ] Compare CSI quality: passive (router) vs active (ESP-NOW)
 
 ## Ideas
+- WiFi probe request capture — sniff client SSID searches via promiscuous mode
 - ESP-NOW mesh for direct ESP32-to-ESP32 CSI
 - External PIR sensor for CSI ground truth validation
 - Battery + deep sleep mode for portable deployment