Mirror/flock-you
1
0
Fork 0
mirror of https://github.com/colonelpanichacks/flock-you.git synced 2026-07-17 20:38:10 -07:00
Code Issues Packages Projects Releases Wiki Activity

sync OUIs with @nitekry/nite-oui-collection — 2 demotes (Ubiquiti FPs)

Browse Source 
@NitekryDPaul's June 2026 update to my_tested_flock.md marked
94:2a:6f and f4:e2:c6 as "Nope - Ubiquiti" — both were shipped
in our April 2026 sync as high-confidence adds. Remove them
from target_ouis[], move them to the Demoted section in the
datasets file with the reason and source, and update all count
references (42 -> 40 total, 12 April adds -> 10, 41 NitekryDPaul
contributions -> 39). Also flag 48:27:ea and a4:cf:12 as
low-confidence WiGLE crowdsource entries per upstream, and
record 6c:cd:d6 as a never-added "Nope - Netgear" for completeness.

Bump the last-synced date on datasets/NitekryDPaul_wifi_ouis.md
to 2026-07-04 to reflect the July le_detect addition upstream
(the LE surveillance-device BLE OUIs land in unified-blue, not
here — flock-you promiscious is WiFi-only).
This commit is contained in:
Colonel Panic
2026-07-09 07:45:09 -04:00
parent ac12e69198
commit bf3ab4a98c
4 changed files with 41 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+9 -7
View File
@@ -8,7 +8,7 @@
## Credit
All WiFi promiscuous detection research — the **41-OUI Flock Safety target list**, the **promiscuous-mode strategy**, and the **addr1-receiver detection technique** — is the work of **OrdoOuroborous / @NitekryDPaul** (GitHub [@nitekry](https://github.com/nitekry)). The firmware here is a mod of his original work with added SPIFFS persistence and Flask-dashboard integration. Upstream OUI source: [nitekry/nite-oui-collection](https://github.com/nitekry/nite-oui-collection). Full research writeup: [`datasets/NitekryDPaul_wifi_ouis.md`](datasets/NitekryDPaul_wifi_ouis.md).
All WiFi promiscuous detection research — the **39-OUI Flock Safety target list**, the **promiscuous-mode strategy**, and the **addr1-receiver detection technique** — is the work of **OrdoOuroborous / @NitekryDPaul** (GitHub [@nitekry](https://github.com/nitekry)). The firmware here is a mod of his original work with added SPIFFS persistence and Flask-dashboard integration. Upstream OUI source: [nitekry/nite-oui-collection](https://github.com/nitekry/nite-oui-collection). Full research writeup: [`datasets/NitekryDPaul_wifi_ouis.md`](datasets/NitekryDPaul_wifi_ouis.md).
Additional research credit to **Michael / DeFlockJoplin** for the **wildcard-probe-request signature** and OUI `82:6b:f2`. Field-tested to 11/12 cameras caught with only 2 false positives in Joplin. Source: [DeflockJoplin/flock-you](https://github.com/DeflockJoplin/flock-you).
@@ -39,7 +39,7 @@ Checking `addr1` in addition to `addr2` picks those silent stations up. It requi
- `addr1` is broadcast (`ff:ff:ff:ff:ff:ff`) in beacons and broadcasts — **multicast filter**
- Modern devices use randomised (locally-administered) MACs that can't be fingerprinted by OUI — **randomised-MAC filter** on byte 0 bit 1
Both are applied before the OUI match. This whole approach, including the 41-OUI list, is **@NitekryDPaul's research**.
Both are applied before the OUI match. This whole approach, including the 39-OUI baseline list (the 40th is DeFlockJoplin's), is **@NitekryDPaul's research**.
---
@@ -100,10 +100,12 @@ The split between callback and loop is deliberate: the WiFi task has hard real-t
## OUI target list (@NitekryDPaul research)
All lowercase, colon-separated. 42 Flock Safety infrastructure prefixes —
29 from @NitekryDPaul's original set, 12 from his April 2026 additions, plus
All lowercase, colon-separated. 40 Flock Safety infrastructure prefixes —
29 from @NitekryDPaul's original set, 10 from his April 2026 additions, plus
1 from Michael / DeFlockJoplin. `f8:a2:d6` from the original set has been
demoted as a Sony Media Player false positive (see
demoted as a Sony Media Player false positive, and `94:2a:6f` / `f4:e2:c6`
from the April 2026 additions have been demoted as Ubiquiti false positives
per @NitekryDPaul's June 2026 update (see
[`datasets/NitekryDPaul_wifi_ouis.md`](datasets/NitekryDPaul_wifi_ouis.md)).
```
@@ -114,7 +116,7 @@ d0:39:57 e8:d0:fc e0:4f:43 b8:1e:a4 70:08:94
58:8e:81 ec:1b:bd 3c:71:bf 58:00:e3 90:35:ea
5c:93:a2 64:6e:69 48:27:ea a4:cf:12
04:0d:84 f0:82:c0 1c:34:f1 38:5b:44 94:34:69 ← Apr 2026 adds
b4:e3:f9 b4:1e:52 14:b5:cd 94:2a:6f f4:e2:c6
b4:e3:f9 b4:1e:52 14:b5:cd
d4:11:d6 e0:0a:f6
82:6b:f2 ← contributed by Michael / DeFlockJoplin
```
@@ -323,7 +325,7 @@ The BLE-only sibling of this firmware lives on the [`main` branch](https://githu
## Acknowledgments
- **OrdoOuroborous (@NitekryDPaul, GitHub [@nitekry](https://github.com/nitekry))** — **WiFi promiscuous detection research**: the 41-OUI Flock Safety target list and the addr1-receiver detection technique that are the baseline of this firmware. The code here is a mod of his original work. Upstream OUI tracking: [nite-oui-collection](https://github.com/nitekry/nite-oui-collection).
- **OrdoOuroborous (@NitekryDPaul, GitHub [@nitekry](https://github.com/nitekry))** — **WiFi promiscuous detection research**: the 39-OUI Flock Safety target list and the addr1-receiver detection technique that are the baseline of this firmware. The code here is a mod of his original work. Upstream OUI tracking: [nite-oui-collection](https://github.com/nitekry/nite-oui-collection).
- **Michael / DeFlockJoplin** ([DeflockJoplin/flock-you](https://github.com/DeflockJoplin/flock-you), [deflockjoplin.today](https://deflockjoplin.today)) — **wildcard-probe-request signature** + OUI `82:6b:f2`. Drive-tested in Joplin to 11/12 cameras caught with only 2 false positives.
- **Will Greenberg** ([@wgreenberg](https://github.com/wgreenberg)) — BLE manufacturer company ID detection (`0x09C8` XUNTONG) sourced from his [flock-you](https://github.com/wgreenberg/flock-you) fork (used by the BLE companion on `main`)
- **[DeFlock](https://deflock.me)** ([FoggedLens/deflock](https://github.com/FoggedLens/deflock)) — crowdsourced ALPR location data and detection methodologies. Datasets included in `datasets/`
api/README.md
+2 -2
View File
@@ -195,8 +195,8 @@ Replay detection (extra fields on top of the live format):
Command reply events:
```json
{"event":"status","fy_det":42,"oui_count":42,"spiffs":1,"prev_session":1,"prev_bytes":4280,"uptime_ms":900000,"free_heap":221408,"channel":6,"channel_mode":"CUSTOM","rssi_min":-95}
{"event":"version","firmware":"flock-you-promiscious","branch":"promiscious","oui_count":42,"max_detections":200,"autosave_ms":60000}
{"event":"status","fy_det":42,"oui_count":40,"spiffs":1,"prev_session":1,"prev_bytes":4280,"uptime_ms":900000,"free_heap":221408,"channel":6,"channel_mode":"CUSTOM","rssi_min":-95}
{"event":"version","firmware":"flock-you-promiscious","branch":"promiscious","oui_count":40,"max_detections":200,"autosave_ms":60000}
{"event":"replay_complete","source":"prev","count":47,"ok":true}
{"event":"clear","target":"prev","ok":true}
{"event":"error","reason":"unknown_command","cmd":"CMD:GARBAGE"}
datasets/NitekryDPaul_wifi_ouis.md
+24 -16
View File
@@ -2,7 +2,7 @@
**Researcher:** OrdoOuroborous (**@NitekryDPaul**, GitHub [@nitekry](https://github.com/nitekry))
This dataset documents Flock Safety and related surveillance-infrastructure WiFi MAC-address OUIs (first three octets) discovered through 2.4 GHz promiscuous-mode analysis. The 42 active prefixes below come from @NitekryDPaul's promiscuous-mode research on Flock camera air traffic (41) and Michael / DeFlockJoplin's wildcard-probe drive-testing (1). Upstream OUI source: [nitekry/nite-oui-collection](https://github.com/nitekry/nite-oui-collection). One prefix from the original set (`f8:a2:d6`) has been demoted — see the [Demoted](#demoted--low-confidence) section.
This dataset documents Flock Safety and related surveillance-infrastructure WiFi MAC-address OUIs (first three octets) discovered through 2.4 GHz promiscuous-mode analysis. The 40 active prefixes below come from @NitekryDPaul's promiscuous-mode research on Flock camera air traffic (39) and Michael / DeFlockJoplin's wildcard-probe drive-testing (1). Upstream OUI source: [nitekry/nite-oui-collection](https://github.com/nitekry/nite-oui-collection). Three prefixes from earlier revisions (`f8:a2:d6`, `94:2a:6f`, `f4:e2:c6`) have been demoted — see the [Demoted](#demoted--low-confidence) section.
## Why promiscuous mode
@@ -10,14 +10,17 @@ Flock stations spend most of their duty cycle asleep, waking briefly to upload a
This addr1 technique is @NitekryDPaul's discovery and is the basis of the `promiscuis-flock-you` firmware.
## OUI list (42 prefixes, lowercase, colon-separated)
## OUI list (40 prefixes, lowercase, colon-separated)
@NitekryDPaul contributed 41 active prefixes — 29 from his original
promiscuous-mode set plus 12 from his April 2026 additions in
[nite-oui-collection](https://github.com/nitekry/nite-oui-collection).
The 42nd (`82:6b:f2`) was contributed by **Michael / DeFlockJoplin** during
follow-up drive-testing in Joplin — it's the OUI of the 12th camera in his
field test, which the original list didn't catch. See
@NitekryDPaul contributed 39 active prefixes — 29 from his original
promiscuous-mode set plus 10 from his April 2026 additions in
[nite-oui-collection](https://github.com/nitekry/nite-oui-collection)
(two of the original 12 April adds — `94:2a:6f` and `f4:e2:c6` — were
subsequently marked as Ubiquiti false positives in his June 2026 update
and have been demoted). The 40th (`82:6b:f2`) was contributed by
**Michael / DeFlockJoplin** during follow-up drive-testing in Joplin —
it's the OUI of the 12th camera in his field test, which the original
list didn't catch. See
[DeflockJoplin/flock-you](https://github.com/DeflockJoplin/flock-you).
```
@@ -58,8 +61,6 @@ f0:82:c0
b4:e3:f9
b4:1e:52
14:b5:cd
94:2a:6f
f4:e2:c6
d4:11:d6
e0:0a:f6
82:6b:f2
@@ -96,8 +97,8 @@ e0:0a:f6
| 90:35:ea | Flock Safety infrastructure | WiFi 2.4 GHz | @NitekryDPaul |
| 5c:93:a2 | Flock Safety infrastructure | WiFi 2.4 GHz | @NitekryDPaul |
| 64:6e:69 | Flock Safety infrastructure | WiFi 2.4 GHz | @NitekryDPaul |
| 48:27:ea | Flock Safety infrastructure | WiFi 2.4 GHz | @NitekryDPaul |
| a4:cf:12 | Flock Safety infrastructure | WiFi 2.4 GHz | @NitekryDPaul |
| 48:27:ea | Flock Safety infrastructure (low confidence — Espressif plausible Flock variant, WiGLE crowdsource) | WiFi 2.4 GHz | @NitekryDPaul |
| a4:cf:12 | Flock Safety infrastructure (low confidence — Espressif plausible Flock variant, WiGLE crowdsource) | WiFi 2.4 GHz | @NitekryDPaul |
| 04:0d:84 | Flock Safety infrastructure | WiFi 2.4 GHz | @NitekryDPaul (Apr 2026) |
| f0:82:c0 | Flock Safety infrastructure | WiFi 2.4 GHz | @NitekryDPaul (Apr 2026) |
| 1c:34:f1 | Flock Safety infrastructure | WiFi 2.4 GHz | @NitekryDPaul (Apr 2026) |
@@ -105,9 +106,7 @@ e0:0a:f6
| 94:34:69 | Flock Safety infrastructure | WiFi 2.4 GHz | @NitekryDPaul (Apr 2026) |
| b4:e3:f9 | Flock Safety infrastructure | WiFi 2.4 GHz | @NitekryDPaul (Apr 2026) |
| b4:1e:52 | Flock Safety infrastructure | WiFi 2.4 GHz | @NitekryDPaul (Apr 2026) |
| 14:b5:cd | Flock Safety infrastructure (high confidence) | WiFi 2.4 GHz | @NitekryDPaul (Apr 2026) |
| 94:2a:6f | Flock Safety infrastructure (high confidence) | WiFi 2.4 GHz | @NitekryDPaul (Apr 2026) |
| f4:e2:c6 | Flock Safety infrastructure (high confidence) | WiFi 2.4 GHz | @NitekryDPaul (Apr 2026) |
| 14:b5:cd | Flock Safety infrastructure (new finding, testing) | WiFi 2.4 GHz | @NitekryDPaul (Apr 2026) |
| d4:11:d6 | Flock Safety infrastructure | WiFi 2.4 GHz | @NitekryDPaul (Apr 2026) |
| e0:0a:f6 | Flock Safety infrastructure | WiFi 2.4 GHz | @NitekryDPaul (Apr 2026) |
| 82:6b:f2 | Flock Safety infrastructure | WiFi 2.4 GHz (wildcard probe) | Michael / DeFlockJoplin |
@@ -119,7 +118,9 @@ caveat documented by @NitekryDPaul.
| Prefix | Caveat | Source |
|---|---|---|
| `08:3a:88` | BLE Ring conflict — expect occasional Ring-doorbell false positives when this OUI is matched against BLE advertisements. WiFi-side detection is unaffected. Flagged per @NitekryDPaul's latest [my_tested_flock.md](https://github.com/nitekry/nite-oui-collection/blob/main/groups/flockers/my_tested_flock.md) update (2026-05-13). | @NitekryDPaul |
| `08:3a:88` | BLE Ring conflict — expect occasional Ring-doorbell false positives when this OUI is matched against BLE advertisements. WiFi-side detection is unaffected. Flagged per @NitekryDPaul's [my_tested_flock.md](https://github.com/nitekry/nite-oui-collection/blob/main/groups/flockers/my_tested_flock.md). | @NitekryDPaul |
| `48:27:ea` | Low confidence — Espressif plausible Flock variant. Sourced from WiGLE crowdsource per @NitekryDPaul's Crowdsource section in [my_tested_flock.md](https://github.com/nitekry/nite-oui-collection/blob/main/groups/flockers/my_tested_flock.md). Kept in the active OUI array per upstream `main.cpp`. | @NitekryDPaul / Crowdsource |
| `a4:cf:12` | Low confidence — Espressif plausible Flock variant. Same source and status as `48:27:ea`. | @NitekryDPaul / Crowdsource |
## Demoted / low confidence
@@ -129,8 +130,11 @@ from the active firmware OUI array.
| Prefix | Reason | Source |
|---|---|---|
| `f8:a2:d6` | Low confidence; observed hitting a Sony Media Player rather than a Flock device. Demoted per @NitekryDPaul's [my_tested_flock.md](https://github.com/nitekry/nite-oui-collection/blob/main/groups/flockers/my_tested_flock.md) field notes. | @NitekryDPaul |
| `94:2a:6f` | Marked "Nope - Ubiquiti" in @NitekryDPaul's June 2026 [my_tested_flock.md](https://github.com/nitekry/nite-oui-collection/blob/main/groups/flockers/my_tested_flock.md) update. Was previously carried as a high-confidence April 2026 addition; hits on Ubiquiti radios rather than Flock. | @NitekryDPaul |
| `f4:e2:c6` | Marked "Nope - Ubiquiti" in @NitekryDPaul's June 2026 [my_tested_flock.md](https://github.com/nitekry/nite-oui-collection/blob/main/groups/flockers/my_tested_flock.md) update. Was previously carried as a high-confidence April 2026 addition; hits on Ubiquiti radios rather than Flock. | @NitekryDPaul |
| `cc:cc:cc` | No observed hits across @NitekryDPaul's testing. Originally a placeholder/test prefix from the early GainSec list; never produced a real detection. | @NitekryDPaul |
| `00:0c:e7` | MediaTek prefix that appeared in early field tests as a possible Flock-adjacent observation; later determined to be a likely false positive. | @NitekryDPaul / Crowdsource |
| `6c:cd:d6` | Marked "Nope - Netgear" in @NitekryDPaul's April 2026 additions section — never entered our active list; recorded here for completeness. | @NitekryDPaul |
## Detection strategy
@@ -163,3 +167,7 @@ The `promiscuis-flock-you` firmware implementing this research is a mod of @Nite
## Credit
All OUI research and the promiscuous-mode detection strategy are the work of **@NitekryDPaul**. Please cite him when using or redistributing this list.
---
Last synced with [nitekry/nite-oui-collection](https://github.com/nitekry/nite-oui-collection): 2026-07-04.
main.cpp
+6 -2
View File
@@ -88,15 +88,19 @@ static const char* target_ouis[] = {
// 08:3a:88 stays in the array but is flagged for a BLE Ring conflict;
// promiscuous WiFi detection is unaffected, BLE-side users should be
// aware of occasional Ring-doorbell false positives.
// 48:27:ea and a4:cf:12 are low-confidence WiGLE crowdsource entries
// (Espressif plausible Flock variants); kept per upstream main.cpp.
"70:c9:4e", "3c:91:80", "d8:f3:bc", "80:30:49", "b8:35:32",
"14:5a:fc", "74:4c:a1", "08:3a:88", "9c:2f:9d", "c0:35:32",
"94:08:53", "e4:aa:ea", "f4:6a:dd", "24:b2:b9", "00:f4:8d",
"d0:39:57", "e8:d0:fc", "e0:4f:43", "b8:1e:a4", "70:08:94",
"58:8e:81", "ec:1b:bd", "3c:71:bf", "58:00:e3", "90:35:ea",
"5c:93:a2", "64:6e:69", "48:27:ea", "a4:cf:12",
// @NitekryDPaul April 2026 additions (nite-oui-collection).
// @NitekryDPaul April 2026 additions (nite-oui-collection), 10 OUIs.
// 94:2a:6f and f4:e2:c6 have been removed — @NitekryDPaul's
// my_tested_flock.md marks both as "Nope - Ubiquiti" (Jun 2026 update).
"04:0d:84", "f0:82:c0", "1c:34:f1", "38:5b:44", "94:34:69",
"b4:e3:f9", "b4:1e:52", "14:b5:cd", "94:2a:6f", "f4:e2:c6",
"b4:e3:f9", "b4:1e:52", "14:b5:cd",
"d4:11:d6", "e0:0a:f6",
// Contributed by Michael / DeFlockJoplin — discovered via wildcard-probe
// + OUI signature during field testing. The 12th camera in his drive-test