Mirror/rayhunter
1
0
Fork 0
mirror of https://github.com/EFForg/rayhunter.git synced 2026-07-28 09:48:14 -07:00
Code Issues Packages Projects Releases Wiki Activity

Allow enabling/disabling analyzers from config file (#382)

Browse Source 
Co-authored-by: Will Greenberg <willg@eff.org>
This commit is contained in:
Markus Unterwaditzer
2025-06-10 21:37:38 +02:00
committed by GitHub
parent fb2149f0c8
commit 86e08f9a85
8 changed files with 95 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/heuristics.md
+13 -1
View File
@@ -1,3 +1,15 @@
# Heuristics
TODO
Rayhunter includes several analyzers to detect potential IMSI catcher activity. These can be enabled and disabled in your [config.toml](https://github.com/EFForg/rayhunter/blob/main/dist/config.toml.example) file.
## Available Analyzers
- **IMSI Requested**: Tests whether the ME sends an IMSI Identity Request NAS message
- **Connection Release/Redirected Carrier 2G Downgrade**: Tests if a cell
releases our connection and redirects us to a 2G cell. This heuristic only
makes sense in the US, European users may want to disable it.
- **LTE SIB6/7 Downgrade**: Tests for LTE cells broadcasting a SIB type 6 and 7
which include 2G/3G frequencies with higher priorities
- **Null Cipher** (disabled by default): Tests whether the cell suggests using a null cipher (EEA0).
This is currently disabled by default due to a parsing bug triggering false
positives.