Mirror/flock-you
1
0
Fork 0
mirror of https://github.com/colonelpanichacks/flock-you.git synced 2026-06-12 07:03:31 -07:00
Code Issues Packages Projects Releases Wiki Activity

datasets: pull in @NitekryDPaul's 2026-05-13 status update

Browse Source 
Reflects the changes in nite-oui-collection commit 1ed6333 (his
"Update MAC status and remove unnecessary sections" push earlier
today):

  - 08:3a:88 picks up a "BLE Ring conflict" flag. The firmware
    array is unchanged — promiscuous WiFi detection isn't affected
    — but a header comment in main.cpp now calls out the caveat,
    and the dataset markdown grows a new "Flagged but still tracked"
    section so BLE consumers (oui-spy-unified-blue's flockyou mode)
    know to expect occasional Ring-doorbell false positives on this
    prefix.
  - The "Demoted / low confidence" section in the dataset markdown
    now also catalogues cc:cc:cc and 00:0c:e7 — both Removed in his
    notes, but only f8:a2:d6 was documented here previously.

OUI count is unchanged (42); the firmware array doesn't need to
move. This is documentation-tracking so the next sync against
nite-oui-collection has clean priors to diff against.
This commit is contained in:
Colonel Panic
2026-05-13 17:15:56 -04:00
parent 3bf6f6a5bd
commit ac12e69198
2 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
datasets/NitekryDPaul_wifi_ouis.md
+11
View File
@@ -112,6 +112,15 @@ e0:0a:f6
| e0:0a:f6 | Flock Safety infrastructure | WiFi 2.4 GHz | @NitekryDPaul (Apr 2026) |
| 82:6b:f2 | Flock Safety infrastructure | WiFi 2.4 GHz (wildcard probe) | Michael / DeFlockJoplin |
## Flagged but still tracked
These prefixes remain in the active firmware OUI array but have a known
caveat documented by @NitekryDPaul.
| Prefix | Caveat | Source |
|---|---|---|
| `08:3a:88` | BLE Ring conflict — expect occasional Ring-doorbell false positives when this OUI is matched against BLE advertisements. WiFi-side detection is unaffected. Flagged per @NitekryDPaul's latest [my_tested_flock.md](https://github.com/nitekry/nite-oui-collection/blob/main/groups/flockers/my_tested_flock.md) update (2026-05-13). | @NitekryDPaul |
## Demoted / low confidence
These prefixes were in earlier revisions of the list but have been removed
@@ -120,6 +129,8 @@ from the active firmware OUI array.
| Prefix | Reason | Source |
|---|---|---|
| `f8:a2:d6` | Low confidence; observed hitting a Sony Media Player rather than a Flock device. Demoted per @NitekryDPaul's [my_tested_flock.md](https://github.com/nitekry/nite-oui-collection/blob/main/groups/flockers/my_tested_flock.md) field notes. | @NitekryDPaul |
| `cc:cc:cc` | No observed hits across @NitekryDPaul's testing. Originally a placeholder/test prefix from the early GainSec list; never produced a real detection. | @NitekryDPaul |
| `00:0c:e7` | MediaTek prefix that appeared in early field tests as a possible Flock-adjacent observation; later determined to be a likely false positive. | @NitekryDPaul / Crowdsource |
## Detection strategy
main.cpp
+3
View File
@@ -85,6 +85,9 @@ static const char* target_ouis[] = {
// @NitekryDPaul / OrdoOuroborous — original promiscuous-mode set, 29 OUIs.
// f8:a2:d6 has been demoted (Sony Media Player false positive — see
// nite-oui-collection/groups/flockers/my_tested_flock.md).
// 08:3a:88 stays in the array but is flagged for a BLE Ring conflict;
// promiscuous WiFi detection is unaffected, BLE-side users should be
// aware of occasional Ring-doorbell false positives.
"70:c9:4e", "3c:91:80", "d8:f3:bc", "80:30:49", "b8:35:32",
"14:5a:fc", "74:4c:a1", "08:3a:88", "9c:2f:9d", "c0:35:32",
"94:08:53", "e4:aa:ea", "f4:6a:dd", "24:b2:b9", "00:f4:8d",