cf380bc9ebc9ea5be1fcbe83b57082b3ba95bd39
seed_from_arp_cache was adding labeled personal devices to known_devices at startup, causing all subsequent arrivals to be ignored (already_known=True). Now skips them so on_arrival fires normally when they rejoin. ARP opcode=2 (replies) are now treated as genuine signals for explicitly labeled devices. iPhones with privacy MACs frequently emit only opcode=2 after initial association — the AP proxy forgery concern doesn't apply to devices the operator has explicitly named.
Description
Network drop implant — passive SOC + active exploitation. Deploy on any Debian host.
Languages
Python
89.2%
Shell
8.5%
HTML
1.1%
C
0.9%
Jinja
0.3%