Adds Michael / DeFlockJoplin's high-precision detection method on top of
the NitekryDPaul baseline: a Flock camera is flagged when it transmits a
Probe Request (type=0 subtype=4) with a wildcard SSID IE (tag 0 len 0)
AND its addr2 matches the OUI list. Drive-test in Joplin: 11/12 cameras
caught with only 2 false positives.
- New AlertType ALERT_WILDCARD_PROBE, emitted as detection_method
'wifi_wildcard_probe' (high-precision class)
- Wildcard-probe hits suppress the addr2 broad alert for the same frame
to prevent double counting; non-probe OUI matches still emit as
'wifi_oui_addr2'
- IE parser returns tri-state (1=wildcard / 0=directed / -1=no SSID IE),
with FCS-trailer retry only on the -1 no-IE case
- addr1 receiver-side sleeper-catch and the optional addr3 + SSID paths
are unchanged — wildcard is purely additive
- 31st OUI 82:6b:f2 added to target_ouis[] and to the dataset doc; it's
the OUI of the 12th camera in Michael's drive-test that the original
30 didn't catch
- README explains the wildcard-probe method, credits Michael with a link
to github.com/DeflockJoplin/flock-you, and bumps Acknowledgments
Source: https://github.com/DeflockJoplin/flock-you
Known MACs that haven't been heard from in >30 s now refire the
ascending new-discovery chirp when they reappear. Shorter gaps (like
Flock burst-sleep cycles) still just resume the heartbeat beep-pair
without a chirp.
fyAddDetection now returns an 'outChirpWorthy' bool: true for
brand-new MACs and for rediscoveries past the threshold. Replaces
the old count==1 check, which only ever fired once per MAC per
session.
Only consider a target 'still around' if it was seen within the last
3 seconds (was 20 s). Heartbeat interval stays 10 s. Net effect: the
monotone beep-pair only fires while the device is actively in RF
range, stops almost immediately on departure.
Replaces the single beep-per-detection with two distinct patterns:
- New MAC (first sighting): two fast ascending beeps, 2000 -> 2800 Hz,
55 ms each with 25 ms gap
- Same MAC still active (last seen within 20 s): two monotone 1500 Hz
heartbeat beeps, 70 ms each, every 10 s
- Silent once nothing has been seen for 20 s, until the next new MAC
Global "last seen" timer refreshes on every inbound hit, including ones
suppressed by the serial rate limit, so quieter repeats still count as
"still around" for the heartbeat. LED still flashes on every emitted
detection.
- Moved promiscuis-flock-you/{main.cpp,partitions.csv,platformio.ini} to root
- Removed BLE firmware (src/main.cpp, src/CMakeLists.txt) — the 'main' branch
still has it
- Removed the subfolder README (root README has the full walkthrough)
- Updated README paths and build commands for the flat layout
- Retagged the BLE companion section as a pointer to the 'main' branch
The 'promiscious' branch is now purely the WiFi promiscuous firmware plus
the shared Flask app (api/), datasets, and branding. Builds green with
the standard 'pio run' from the repo root.
The 'promiscious' branch is about the WiFi promiscuous detector, not BLE.
Reworked the root README to lead with:
- @NitekryDPaul credit front-and-center (30-OUI list + addr1 technique)
- What the WiFi firmware does and why promiscuous mode is the right tool
- Detection pipeline, OUI list, SPIFFS envelope format
- Flask dashboard integration with the wifi_oui_addr1/addr2 methods
- Hardware, build, config cheatsheet
- SMB 1-2 underground boot melody
The BLE firmware is now a short pointer to main at the bottom.
Explains how the new WiFi promiscuous firmware in promiscuis-flock-you/
complements the existing BLE detector — same hardware class, same Flask
dashboard schema, complementary RF coverage.
Full research credit to ØяĐöØцяöЪöяцฐ / @NitekryDPaul for the 30-OUI
target list and the addr1-receiver detection technique. Added to
Acknowledgments.
Modded from @NitekryDPaul's promiscuous-mode firmware. Adds:
- SPIFFS session persistence with atomic CRC-envelope writes
- Flask-compatible JSON emission over USB CDC (ingested by api/flockyou.py)
- Onboard LED flash and buzzer beep per detection
- USB-optional operation (non-blocking Serial for standalone runs)
- First 6 notes of SMB World 1-2 as boot melody
- Prior-session promotion to /prev_session.json on boot
30-OUI target list and the addr1-receiver detection technique are
@NitekryDPaul's research (see datasets/NitekryDPaul_wifi_ouis.md).
30 Flock Safety infrastructure OUIs discovered through 2.4 GHz
promiscuous-mode analysis by @NitekryDPaul, including the addr1
receiver-side detection technique that catches Flock STAs during
their burst-sleep duty cycles when addr2-only sniffs miss them.
30 Flock Safety infrastructure OUIs identified by @NitekryDPaul via
2.4 GHz promiscuous-mode analysis, including the addr1-receiver
detection technique that catches Flock STAs during burst-sleep
duty cycles. Full credit and methodology in the new file.
Fix GPS not tagging all detections:
- Add dedicated fyGPSMutex guarding fyGPSLat/Lon/Acc/Valid/LastUpdate
- fyGPSSnapshot() + fyGPSUpdate() replace direct global reads/writes,
eliminating the race between BLE callback (reader) and /api/gps
HTTP handler (writer)
- fyBackfillGPS() runs every 2s in loop(), stamping any detection that
was recorded before the first phone GPS fix became available
- BLE callback JSON emitter now uses snapshot instead of raw globals
Make data saving/transfer bulletproof:
- New envelope format: header line {v,count,bytes,crc32} + payload array
- CRC32 verification catches any truncation or corruption on read
- Atomic write: compute CRC pass 1, write tmp + verify, then rename to
final (SPIFFS.rename with copy+delete fallback)
- Boot-time recovery: if session.json is missing/corrupt, recover from
session.tmp; legacy raw-array files still load for back-compat
- Save cadence tightened: within 5s of first detection, after any new
unique detection (3s throttle), and periodic safety net every 15s
- Export mutex timeouts raised 200->500ms to prevent empty CSV/JSON
exports under heavy BLE traffic
- /api/history and /api/history/kml strip envelope header before
returning body so downstream tools keep working unchanged
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Low-confidence mac_prefix_mfr hits no longer update fyLastDetTime/fyLastHB,
preventing them from keeping the heartbeat alive after a high-confidence
device leaves range. Bump FYDetection::method from 24 to 32 bytes so
"mac_prefix_soundthinking" (23 chars) has headroom.
- fyPromotePrevSession now reads session.json, writes to prev_session.json,
then deletes the original — SPIFFS.rename() silently fails on ESP32
- prior session KML export: added style defs, raven metadata, error handling,
moved file validation before response stream init
- reduced auto-save interval 60s → 15s, added 5s quick-save on first detection
Address Copilot review: contract manufacturer OUIs (Liteon/USI) are now
in a separate flock_mfr_mac_prefixes[] array emitting "mac_prefix_mfr"
as the detection method. SoundThinking/ShotSpotter gets its own array
and "mac_prefix_soundthinking" method. Low-confidence detections (mfr
OUIs) suppress buzzer/heartbeat but still emit JSON events so consumers
can apply their own thresholds.
Collapse the two-branch snprintf into a single call so every
detection message includes is_raven (true/false) and raven_fw,
making the format self-describing regardless of device type.
BLE server callbacks run on the NimBLE host task, not the Arduino
loop task. Calling WiFi state changes and delay() from that context
can stall BLE processing or trip watchdogs, and mutating scan
duration creates a cross-task data race.
Fix: callbacks now just set a volatile pending flag. The actual
WiFi/scan changes are applied in loop() where they're safe.
Expand MAC prefix detection with entries sourced from:
- Flock WiFi (Liteon/USI): f4:6a:dd, f8:a2:d6, e0:0a:f6, 00:f4:8d,
d0:39:57, e8:d0:fc — contract manufacturer OUIs (Liteon Technology and
USI/Universal Scientific Industrial) identified via the OUI-SPY firmware
ecosystem table and cross-referenced against the IEEE OUI registry.
These manufacturers produce Flock Safety's WiFi-enabled camera hardware.
- Flock Safety direct: b4:1e:52 — registered directly to "Flock Safety"
in the IEEE OUI database (MA-L assignment). This is their own prefix
rather than a contract manufacturer's.
- SoundThinking/ShotSpotter: d4:11:d6 — registered to "SoundThinking Inc"
(formerly ShotSpotter) in the IEEE OUI database. Their acoustic gunshot
detection sensors use BLE for local diagnostics and provisioning.
Enable DeFlock mobile app connectivity via BLE GATT notifications,
and desktop host detection via USB serial heartbeat. When a companion
is connected, WiFi AP is disabled to free radio bandwidth and BLE
scan duty cycle is increased for better detection performance.
- BLE GATT server advertising service UUID a1b2c3d4-e5f6-7890-abcd-ef0123456789
with TX characteristic (NOTIFY) for streaming detection JSON
- Chunked BLE notification sender respecting negotiated MTU
- "event":"detection" field added to JSON output for DeFlock parser
- Serial host detection via heartbeat timeout (5s)
- Companion mode: WiFi AP off + scan duration 2s→3s when connected
- Scan interval/duration converted from #define to mutable variables
Complete rewrite of standalone Flock-You firmware:
- Remove WiFi promiscuous mode, all detection is now BLE-only
- Add web dashboard served on AP "flockyou" at 192.168.4.1
- GPS wardriving via phone browser Geolocation API
- SPIFFS session persistence with auto-save every 60s
- Prior session tab (PREV) survives reboots
- KML export for Google Earth (current + prior session)
- JSON/CSV export with GPS coordinates
- Serial JSON output for Flask live ingestion
- Crow call boot sounds with detection/heartbeat alerts
- 200 unique device storage with FreeRTOS mutex
- Flask app: add KML import endpoint, GPS data handling
- Update platformio.ini with AsyncWebServer, ArduinoJson 7, SPIFFS partition
- Rewrite README to reflect current functionality
Colonel Panic