Skip to content

WiFi threat-detection plugin (deauth/evil-twin/rogue-AP heuristics) #1789

Description

@mauricio-camayo

Is there an existing issue for this?

  • I have searched the existing open and closed issues

Is your feature request related to a problem? Please describe

Create a plugin that surfaces classic 802.11 threat signals (evil twin, rogue APs, security downgrade, duplicate SSID) using periodic AP scan data — no monitor-mode radio, no dedicated hardware, works with any WiFi interface NetAlertX (or a companion host) already has.

Why?
Standalone WiFi IDS tools like ESP32 WiFi Canary (https://github.com/simeononsecurity/esp32-wifi-canary) implement 9 detection heuristics, but they're isolated single-purpose devices with no device-inventory context. NetAlertX already knows which devices/APs are legitimate — pairing that context with a few of these heuristics seems like a natural fit, without needing to build a whole separate detection stack.

What's actually portable
Of the 9 heuristics, 6 only need a periodic AP scan (iw scan or equivalent — no monitor mode, no exclusive radio use, safe to share with an interface doing other duty):

Heuristic What it checks
Nearby pwnagotchi BSSID de:ad:be:ef:de:ad present in a scan
WiFi Pineapple OUI BSSID bytes[1:2] == 13:37
Evil twin / open clone Known SSID reappears unencrypted
Original AP absent + clone present Baseline AP missing, open clone visible
Security downgrade Known SSID, weaker encryption than baseline
Duplicate SSID, different vendor SSID collision with an OUI mismatch

3 heuristics genuinely need monitor-mode frame capture (they count management-frame rates, not just presence — a scan snapshot can't see this): deauth/disassoc burst, probe-request flood, beacon/SSID flood. Flagging these as out of scope for this proposal, not something the scan-based version can cover.

Describe the solution you'd like

A RUN_SCHD-scheduled plugin, structurally close to unifi_api_import/rest_import (both already import/enrich from a periodic external data source) — reads periodic scan output, compares against a rolling baseline, flags anomalies.
Open question I haven't worked through: whether this enriches existing devices (an AP NetAlertX already tracks) or needs its own standalone feed for APs that aren't devices at all (attacker-controlled ones by definition won't be).

Describe alternatives you've considered

Wifi-cannary

Anything else?

Not something I'm picking up myself right now — posting it in case it's useful to someone, or worth a maintainer opinion on scope/design before anyone invests time.

Am I willing to test this? 🧪

  • I will do my best to test this feature on the netlertx-dev image when requested within 48h and report bugs to help deliver a great user experience for everyone and not to break existing installations.

Can I help implement this? 👩‍💻👨‍💻

  • Yes
  • No

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions