Cobra
3f4e79dd68
Implement passive observation tracking for iOS devices: - Add last_seen dict and lock for tracking passive frame observations - Parse ARP frames (ethertype 0x0806) for MAC observation - Parse mDNS frames (UDP port 5353) for device name auto-discovery - Rename parse_dhcp to parse_frame to reflect broader scope - Add personal_names set for device name matching - Parse NET_ALERTER_PERSONAL_NAMES env var (comma-separated device names) - Add mDNS DNS message parsing to extract PTR/SRV/A record names - Auto-add MACs to personal_devices when mDNS name matches personal_names - Call _update_last_seen on all frame types (ARP, mDNS, DHCP) - Add personal_watchdog thread to fire on_departure after WATCHDOG_TIMEOUT_SEC - Add NET_ALERTER_WATCHDOG_TIMEOUT env config (default 900s) - Fix load_personal_macs_from_env logging to show counts instead of MACs Changes are minimal and focused: - No socket changes (existing AF_PACKET socket already sees all frames) - No new dependencies (stdlib only) - Deadlock prevention (watchdog does not hold locks when calling on_departure) - Backward compatible (personal_names optional, watchdog is passive)