From ac12e69198b0fbce7f67407759ec33c3f6426b58 Mon Sep 17 00:00:00 2001 From: Colonel Panic Date: Wed, 13 May 2026 17:15:56 -0400 Subject: [PATCH] datasets: pull in @NitekryDPaul's 2026-05-13 status update MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reflects the changes in nite-oui-collection commit 1ed6333 (his "Update MAC status and remove unnecessary sections" push earlier today): - 08:3a:88 picks up a "BLE Ring conflict" flag. The firmware array is unchanged — promiscuous WiFi detection isn't affected — but a header comment in main.cpp now calls out the caveat, and the dataset markdown grows a new "Flagged but still tracked" section so BLE consumers (oui-spy-unified-blue's flockyou mode) know to expect occasional Ring-doorbell false positives on this prefix. - The "Demoted / low confidence" section in the dataset markdown now also catalogues cc:cc:cc and 00:0c:e7 — both Removed in his notes, but only f8:a2:d6 was documented here previously. OUI count is unchanged (42); the firmware array doesn't need to move. This is documentation-tracking so the next sync against nite-oui-collection has clean priors to diff against. --- datasets/NitekryDPaul_wifi_ouis.md | 11 +++++++++++ main.cpp | 3 +++ 2 files changed, 14 insertions(+) diff --git a/datasets/NitekryDPaul_wifi_ouis.md b/datasets/NitekryDPaul_wifi_ouis.md index c57f25f..5ae02f1 100644 --- a/datasets/NitekryDPaul_wifi_ouis.md +++ b/datasets/NitekryDPaul_wifi_ouis.md @@ -112,6 +112,15 @@ e0:0a:f6 | e0:0a:f6 | Flock Safety infrastructure | WiFi 2.4 GHz | @NitekryDPaul (Apr 2026) | | 82:6b:f2 | Flock Safety infrastructure | WiFi 2.4 GHz (wildcard probe) | Michael / DeFlockJoplin | +## Flagged but still tracked + +These prefixes remain in the active firmware OUI array but have a known +caveat documented by @NitekryDPaul. + +| Prefix | Caveat | Source | +|---|---|---| +| `08:3a:88` | BLE Ring conflict — expect occasional Ring-doorbell false positives when this OUI is matched against BLE advertisements. WiFi-side detection is unaffected. Flagged per @NitekryDPaul's latest [my_tested_flock.md](https://github.com/nitekry/nite-oui-collection/blob/main/groups/flockers/my_tested_flock.md) update (2026-05-13). | @NitekryDPaul | + ## Demoted / low confidence These prefixes were in earlier revisions of the list but have been removed @@ -120,6 +129,8 @@ from the active firmware OUI array. | Prefix | Reason | Source | |---|---|---| | `f8:a2:d6` | Low confidence; observed hitting a Sony Media Player rather than a Flock device. Demoted per @NitekryDPaul's [my_tested_flock.md](https://github.com/nitekry/nite-oui-collection/blob/main/groups/flockers/my_tested_flock.md) field notes. | @NitekryDPaul | +| `cc:cc:cc` | No observed hits across @NitekryDPaul's testing. Originally a placeholder/test prefix from the early GainSec list; never produced a real detection. | @NitekryDPaul | +| `00:0c:e7` | MediaTek prefix that appeared in early field tests as a possible Flock-adjacent observation; later determined to be a likely false positive. | @NitekryDPaul / Crowdsource | ## Detection strategy diff --git a/main.cpp b/main.cpp index 7494e1c..1a3ac00 100644 --- a/main.cpp +++ b/main.cpp @@ -85,6 +85,9 @@ static const char* target_ouis[] = { // @NitekryDPaul / OrdoOuroborous — original promiscuous-mode set, 29 OUIs. // f8:a2:d6 has been demoted (Sony Media Player false positive — see // nite-oui-collection/groups/flockers/my_tested_flock.md). + // 08:3a:88 stays in the array but is flagged for a BLE Ring conflict; + // promiscuous WiFi detection is unaffected, BLE-side users should be + // aware of occasional Ring-doorbell false positives. "70:c9:4e", "3c:91:80", "d8:f3:bc", "80:30:49", "b8:35:32", "14:5a:fc", "74:4c:a1", "08:3a:88", "9c:2f:9d", "c0:35:32", "94:08:53", "e4:aa:ea", "f4:6a:dd", "24:b2:b9", "00:f4:8d",