Fixes interface auto-detection failures on Pi Zero 2W where wlan0 doesn't exist
at boot. Implementation:
- Added detect_interface_with_retry() function with 3x retry fallback chain
- Config-supplied interface preferred, then /proc/net/route, then UP interface
- Exponential backoff: 5s, 10s, 20s delays between retries
- Filters excluded prefixes: lo, tailscale*, wg*, tun*, docker*, veth*, br-*
- Used in Engine.__init__(), PacketCapture.start(), MacManager.start()
- Full test coverage: 10 tests for detection, backoff, filtering
Addresses issue where network stack initializes after boot and interfaces
become available after 5-10 second delay.
When wlan0 is the primary data interface (WiFi-only deployment), changing
its MAC via SIOCSIFHWADDR drops the AP association and puts all AF_PACKET
sockets into ENETDOWN permanently until wpa_supplicant re-associates.
- _apply_profile: skip set_mac if _eth_iface is a WiFi interface
- _apply_profile: skip WiFi set_mac if _wifi_iface == _eth_iface (same card)
- stop: mirror the same skip logic for MAC restoration
DHCP hostname + TCP stack tuning still applied for blending on WiFi-only nodes.
Three bugs causing all modules to exit within seconds of startup:
1. _module_runner had no keep-alive loop after calling module.start().
All modules use a thread-spawning pattern where start() returns
immediately, so the subprocess exited and killed all daemon threads.
Added while module._running: sleep(1) loop to block until stop().
2. Engine injected capture_bus under key 'capture_bus' but 9 modules
(auth_flow_tracker, cloud_token_harvester, ldap_harvester, network_mapper,
rdp_monitor, quic_analyzer, smb_monitor, db_interceptor, vlan_discovery)
look for '_capture_bus'. Inject both keys so all modules get it.
3. mac_manager crashes on startup when innocuous_macs.db exists but has
no mac_profiles table (DB not yet seeded). Added OperationalError
handler to fall back to random OUI instead of crashing.
6 stealth modules implementing the OPSEC layer:
- MacManager: innocuous MAC profiles from DB, DHCP hostname/vendor class spoofing, TCP stack tuning (TTL, window, timestamps)
- ProcessDisguise: rename processes to system service names via prctl, auto-disguise on MODULE_STARTED/TOOL_RESTARTED events
- LogSuppression: rsyslog filters, auditd exclusions, journald rate limits, shell history/utmp/wtmp clearing with clean removal on stop
- EncryptedStorage: LUKS2 container with HKDF network-derived key (CPU serial + C2 component), fallback key, auto-format and subdirectory creation
- TmpfsManager: tier-aware RAM-backed mounts for working dirs and WAL files, power loss = instant evidence destruction
- Watchdog: periodic health checks, auto-restart (max 3), OOM priority assignment by module type, bus event monitoring
Cobra