I think that router hardware is going to be too slow for such an idea. While getting a very short pulse out may be possible, I don't think that you can turn around (go from transmit to receive) quickly enough to be ready to receive the return pulse over a short range. Longer ranges may be OK. A more practical problem that you will come up against is that the existing API probably does not give you visibility of the underlying hardware at the level you need to play around with all the functions. Another practical problem is that the chips inside routers are highly integrated and the guts of the chips are not publicized. You would have to get friendly with someone at, say, Atheros, to get access to the insider information that you need. Such chipsets often have diagnostic portals that allow the factory or R&D department to play around with the hardware, perhaps you could discover this interface.