Mirror/flock-you
1
0
Fork 0
mirror of https://github.com/colonelpanichacks/flock-you.git synced 2026-07-29 17:58:10 -07:00
Code Issues Packages Projects Releases Wiki Activity

sync OUIs with @nitekry/nite-oui-collection — 12 adds, 1 demote

Browse Source 
Brings the target OUI array up to parity with @NitekryDPaul's upstream
nite-oui-collection (April 2026):

  - Adds 12 prefixes: 04:0d:84, f0:82:c0, 1c:34:f1, 38:5b:44, 94:34:69,
    b4:e3:f9, b4:1e:52, 14:b5:cd, 94:2a:6f, f4:e2:c6, d4:11:d6, e0:0a:f6
  - Demotes f8:a2:d6 — flagged as a Sony Media Player false positive
    in his my_tested_flock.md notes, retained only as documentation in
    the dataset's "Demoted / low confidence" section.

Active firmware count is now 42 (29 from @NitekryDPaul's original set,
12 April 2026 additions, 1 from Michael / DeFlockJoplin).

Also: replaces the stylised cyrillic researcher name with its decoded
form OrdoOuroborous and links his GitHub @nitekry, since the unicode
glyphs don't render reliably and made the credit hard to follow.
This commit is contained in:
Colonel Panic
2026-05-10 20:13:33 -04:00
parent 467901d2f7
commit d7a0172551
3 changed files with 73 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+19 -16
View File
@@ -1,20 +1,16 @@
# Flock-You: Promiscuous WiFi Edition (`promiscious-dev` branch)
# Flock-You: Promiscuous WiFi Edition (`promiscious` branch)
<img src="flock.png" alt="Flock You" width="300px">
**Passive 2.4 GHz promiscuous-mode detector for Flock Safety surveillance infrastructure. Runs standalone or feeds the Flask dashboard over USB for live GPS-tagged wardriving.**
> **Dev note:** This is the `promiscious-dev` branch — adds the
> DeFlockJoplin wildcard-probe tightening and a 31st OUI on top of the
> `promiscious` baseline. See "Further research" below.
---
## Credit
All WiFi promiscuous detection research — the **30-OUI target list**, the **promiscuous-mode strategy**, and the **addr1-receiver detection technique** — is the work of **ØяĐöØцяöЪöяцฐ / @NitekryDPaul**. The firmware here is a mod of his original firmware with added SPIFFS persistence and Flask-dashboard integration. Full research writeup: [`datasets/NitekryDPaul_wifi_ouis.md`](datasets/NitekryDPaul_wifi_ouis.md).
All WiFi promiscuous detection research — the **41-OUI Flock Safety target list**, the **promiscuous-mode strategy**, and the **addr1-receiver detection technique** — is the work of **OrdoOuroborous / @NitekryDPaul** (GitHub [@nitekry](https://github.com/nitekry)). The firmware here is a mod of his original work with added SPIFFS persistence and Flask-dashboard integration. Upstream OUI source: [nitekry/nite-oui-collection](https://github.com/nitekry/nite-oui-collection). Full research writeup: [`datasets/NitekryDPaul_wifi_ouis.md`](datasets/NitekryDPaul_wifi_ouis.md).
Additional research credit to **Michael / DeFlockJoplin** for the **wildcard-probe-request signature** and the 31st OUI (`82:6b:f2`). Field-tested to 11/12 cameras caught with only 2 false positives in Joplin. Source: [DeflockJoplin/flock-you](https://github.com/DeflockJoplin/flock-you).
Additional research credit to **Michael / DeFlockJoplin** for the **wildcard-probe-request signature** and OUI `82:6b:f2`. Field-tested to 11/12 cameras caught with only 2 false positives in Joplin. Source: [DeflockJoplin/flock-you](https://github.com/DeflockJoplin/flock-you).
---
@@ -43,7 +39,7 @@ Checking `addr1` in addition to `addr2` picks those silent stations up. It requi
- `addr1` is broadcast (`ff:ff:ff:ff:ff:ff`) in beacons and broadcasts — **multicast filter**
- Modern devices use randomised (locally-administered) MACs that can't be fingerprinted by OUI — **randomised-MAC filter** on byte 0 bit 1
Both are applied before the OUI match. This whole approach, including the 30-OUI list, is **@NitekryDPaul's research**.
Both are applied before the OUI match. This whole approach, including the 41-OUI list, is **@NitekryDPaul's research**.
---
@@ -53,7 +49,7 @@ Michael / DeFlockJoplin used the OUI + addr1/addr2/addr3 work above as a startin
> The cameras are hopping channels and sending out a wildcard WiFi probe request on every channel. This specific type of request combined with OUI matching has created what seems to be a fairly unique signature.
His drive-test in Joplin caught **11 of 12 cameras** with only **2 false positives**. The 12th camera was doing the same wildcard-probe behaviour but with an OUI (`82:6b:f2`) that wasn't in @NitekryDPaul's original 30 — it's now the 31st entry in our list, credited to him.
His drive-test in Joplin caught **11 of 12 cameras** with only **2 false positives**. The 12th camera was doing the same wildcard-probe behaviour but with an OUI (`82:6b:f2`) that wasn't in @NitekryDPaul's original set — it's now in our list, credited to him.
The tightened signature that's active on this branch:
@@ -104,15 +100,22 @@ The split between callback and loop is deliberate: the WiFi task has hard real-t
## OUI target list (@NitekryDPaul research)
All lowercase, colon-separated. 31 Flock Safety infrastructure prefixes:
All lowercase, colon-separated. 42 Flock Safety infrastructure prefixes —
29 from @NitekryDPaul's original set, 12 from his April 2026 additions, plus
1 from Michael / DeFlockJoplin. `f8:a2:d6` from the original set has been
demoted as a Sony Media Player false positive (see
[`datasets/NitekryDPaul_wifi_ouis.md`](datasets/NitekryDPaul_wifi_ouis.md)).
```
70:c9:4e 3c:91:80 d8:f3:bc 80:30:49 b8:35:32
14:5a:fc 74:4c:a1 08:3a:88 9c:2f:9d c0:35:32
94:08:53 e4:aa:ea f4:6a:dd f8:a2:d6 24:b2:b9
00:f4:8d d0:39:57 e8:d0:fc e0:4f:43 b8:1e:a4
70:08:94 58:8e:81 ec:1b:bd 3c:71:bf 58:00:e3
90:35:ea 5c:93:a2 64:6e:69 48:27:ea a4:cf:12
94:08:53 e4:aa:ea f4:6a:dd 24:b2:b9 00:f4:8d
d0:39:57 e8:d0:fc e0:4f:43 b8:1e:a4 70:08:94
58:8e:81 ec:1b:bd 3c:71:bf 58:00:e3 90:35:ea
5c:93:a2 64:6e:69 48:27:ea a4:cf:12
04:0d:84 f0:82:c0 1c:34:f1 38:5b:44 94:34:69 ← Apr 2026 adds
b4:e3:f9 b4:1e:52 14:b5:cd 94:2a:6f f4:e2:c6
d4:11:d6 e0:0a:f6
82:6b:f2 ← contributed by Michael / DeFlockJoplin
```
@@ -253,8 +256,8 @@ The BLE-only sibling of this firmware lives on the [`main` branch](https://githu
## Acknowledgments
- **ØяĐöØцяöЪöяцฐ (@NitekryDPaul)** — **WiFi promiscuous detection research**: the 30-OUI Flock Safety target list and the addr1-receiver detection technique that are the baseline of this firmware. The code here is a mod of his original work.
- **Michael / DeFlockJoplin** ([DeflockJoplin/flock-you](https://github.com/DeflockJoplin/flock-you), [deflockjoplin.today](https://deflockjoplin.today)) — **wildcard-probe-request signature** + the 31st OUI (`82:6b:f2`). Drive-tested in Joplin to 11/12 cameras caught with only 2 false positives.
- **OrdoOuroborous (@NitekryDPaul, GitHub [@nitekry](https://github.com/nitekry))** — **WiFi promiscuous detection research**: the 41-OUI Flock Safety target list and the addr1-receiver detection technique that are the baseline of this firmware. The code here is a mod of his original work. Upstream OUI tracking: [nite-oui-collection](https://github.com/nitekry/nite-oui-collection).
- **Michael / DeFlockJoplin** ([DeflockJoplin/flock-you](https://github.com/DeflockJoplin/flock-you), [deflockjoplin.today](https://deflockjoplin.today)) — **wildcard-probe-request signature** + OUI `82:6b:f2`. Drive-tested in Joplin to 11/12 cameras caught with only 2 false positives.
- **Will Greenberg** ([@wgreenberg](https://github.com/wgreenberg)) — BLE manufacturer company ID detection (`0x09C8` XUNTONG) sourced from his [flock-you](https://github.com/wgreenberg/flock-you) fork (used by the BLE companion on `main`)
- **[DeFlock](https://deflock.me)** ([FoggedLens/deflock](https://github.com/FoggedLens/deflock)) — crowdsourced ALPR location data and detection methodologies. Datasets included in `datasets/`
- **[GainSec](https://github.com/GainSec)** — Raven BLE service UUID dataset (`raven_configurations.json`) used by the BLE companion