Is there an existing issue for this?
Is your feature request related to a problem? Please describe
Create a plugin that surfaces classic 802.11 threat signals (evil twin, rogue APs, security downgrade, duplicate SSID) using periodic AP scan data — no monitor-mode radio, no dedicated hardware, works with any WiFi interface NetAlertX (or a companion host) already has.
Why?
Standalone WiFi IDS tools like ESP32 WiFi Canary (https://github.com/simeononsecurity/esp32-wifi-canary) implement 9 detection heuristics, but they're isolated single-purpose devices with no device-inventory context. NetAlertX already knows which devices/APs are legitimate — pairing that context with a few of these heuristics seems like a natural fit, without needing to build a whole separate detection stack.
What's actually portable
Of the 9 heuristics, 6 only need a periodic AP scan (iw scan or equivalent — no monitor mode, no exclusive radio use, safe to share with an interface doing other duty):
| Heuristic |
What it checks |
| Nearby pwnagotchi |
BSSID de:ad:be:ef:de:ad present in a scan |
| WiFi Pineapple OUI |
BSSID bytes[1:2] == 13:37 |
| Evil twin / open clone |
Known SSID reappears unencrypted |
| Original AP absent + clone present |
Baseline AP missing, open clone visible |
| Security downgrade |
Known SSID, weaker encryption than baseline |
| Duplicate SSID, different vendor |
SSID collision with an OUI mismatch |
3 heuristics genuinely need monitor-mode frame capture (they count management-frame rates, not just presence — a scan snapshot can't see this): deauth/disassoc burst, probe-request flood, beacon/SSID flood. Flagging these as out of scope for this proposal, not something the scan-based version can cover.
Describe the solution you'd like
A RUN_SCHD-scheduled plugin, structurally close to unifi_api_import/rest_import (both already import/enrich from a periodic external data source) — reads periodic scan output, compares against a rolling baseline, flags anomalies.
Open question I haven't worked through: whether this enriches existing devices (an AP NetAlertX already tracks) or needs its own standalone feed for APs that aren't devices at all (attacker-controlled ones by definition won't be).
Describe alternatives you've considered
Wifi-cannary
Anything else?
Not something I'm picking up myself right now — posting it in case it's useful to someone, or worth a maintainer opinion on scope/design before anyone invests time.
Am I willing to test this? 🧪
Can I help implement this? 👩💻👨💻
Is there an existing issue for this?
Is your feature request related to a problem? Please describe
Create a plugin that surfaces classic 802.11 threat signals (evil twin, rogue APs, security downgrade, duplicate SSID) using periodic AP scan data — no monitor-mode radio, no dedicated hardware, works with any WiFi interface NetAlertX (or a companion host) already has.
Why?
Standalone WiFi IDS tools like ESP32 WiFi Canary (https://github.com/simeononsecurity/esp32-wifi-canary) implement 9 detection heuristics, but they're isolated single-purpose devices with no device-inventory context. NetAlertX already knows which devices/APs are legitimate — pairing that context with a few of these heuristics seems like a natural fit, without needing to build a whole separate detection stack.
What's actually portable
Of the 9 heuristics, 6 only need a periodic AP scan (iw scan or equivalent — no monitor mode, no exclusive radio use, safe to share with an interface doing other duty):
3 heuristics genuinely need monitor-mode frame capture (they count management-frame rates, not just presence — a scan snapshot can't see this): deauth/disassoc burst, probe-request flood, beacon/SSID flood. Flagging these as out of scope for this proposal, not something the scan-based version can cover.
Describe the solution you'd like
A RUN_SCHD-scheduled plugin, structurally close to unifi_api_import/rest_import (both already import/enrich from a periodic external data source) — reads periodic scan output, compares against a rolling baseline, flags anomalies.
Open question I haven't worked through: whether this enriches existing devices (an AP NetAlertX already tracks) or needs its own standalone feed for APs that aren't devices at all (attacker-controlled ones by definition won't be).
Describe alternatives you've considered
Wifi-cannary
Anything else?
Not something I'm picking up myself right now — posting it in case it's useful to someone, or worth a maintainer opinion on scope/design before anyone invests time.
Am I willing to test this? 🧪
netlertx-devimage when requested within 48h and report bugs to help deliver a great user experience for everyone and not to break existing installations.Can I help implement this? 👩💻👨💻