net.sniff: offline PCAP mode unnecessarily starts net.recon

Summary

When net.sniff.source is set to a PCAP file, net.sniff on still auto-starts net.recon as a hard module requirement. The sniffer correctly opens and parses the file without a live capture handle, but the session also starts a live ARP-cache discovery worker. On minimal Linux systems without iproute2, that worker repeatedly logs missing-ip errors even though offline dissection succeeds.

Steps to reproduce

1. Build bettercap at revision 2359c0be7900c8bf16ed867b49f78d819f14aa62 (observed with bettercap v2.41.7 on Linux/arm64, built with Go 1.26.5).
2. In a root container where the ip binary is absent (a minimal Debian Bookworm image without iproute2), prepare a small Ethernet PCAP with at least one IPv4/TCP payload, such as a single HTTP request.
3. Run a non-interactive session:

bettercap -no-history -no-colors -iface lo -eval \
  'set net.sniff.source /path/to/sample.pcap; set net.sniff.verbose true; set net.sniff.local true; set net.sniff.output /path/to/out.pcapng; net.sniff on; sleep 2; net.sniff stats; active; net.sniff off; active; q'

1. Observe the session log while the offline sniffer runs.

Expected behavior

With net.sniff.source set to a readable PCAP, starting the sniffer should open that file (and optional output) without requiring live host discovery. Documentation for net.sniff.source describes reading from the PCAP file instead of the current interface; offline analysis should not mandate net.recon or host ip/gateway discovery.

Actual behavior

The session starts net.recon before the offline sniffer and the recon worker then reports failures because ip is absent:

[sys.log] [inf] net.sniff starting net.recon as a requirement for net.sniff
[sys.log] [err] net.recon exec: "ip": executable file not found in $PATH
[sys.log] [war] executable ip not found in $PATH
[net.sniff.http.request] http local GET proof.invalid/offline-proof
[sys.log] [inf] Wrote Packets      : 8

The same run parsed the HTTP request, wrote all eight captured packets to a non-empty PCAPNG, and showed net.recon still active after net.sniff off. This demonstrates that offline parsing itself does not need the recon worker, while the unconditional dependency adds live host-discovery behavior and errors.

Affected area

• modules/net_sniff: NewSniffer calls Requires("net.recon") unconditionally
• Session module start path that auto-runs required modules before the sniffer worker
• Documented offline parameter net.sniff.source

Runtime or environment

• bettercap v2.41.7, Linux/arm64, Go 1.26.5
• Source revision 2359c0be7900c8bf16ed867b49f78d819f14aa62
• Root in a disposable Debian Bookworm container without iproute2 (ip confirmed absent)
• Loopback-generated input PCAP; net.sniff.source set; no live sniffer handle requested

Evidence

• At the current master pin, modules/net_sniff/net_sniff.go registers mod.SessionModule.Requires("net.recon") unconditionally, while modules/net_sniff/net_sniff_context.go separately selects pcap.OpenOffline when net.sniff.source is non-empty.
• session/module.go iterates every required module, logs starting %s as a requirement for %s, and executes <module> on before marking the requested module running.
• The disposable offline run showed recon auto-start and repeated missing-ip errors alongside successful HTTP dissection and PCAPNG output. Focused session and net_recon tests passed; modules/net_sniff currently has no test files.
• The official net.sniff documentation says net.sniff.source reads from a PCAP file instead of the current interface; it does not document starting host discovery for this path.

Impact

• Offline and forensic PCAP workflows unexpectedly start live ARP-cache discovery and invoke host tooling (ip neigh on Linux).
• Minimal containers and locked-down lab images show hard errors even when sniffing succeeds.
• Automated agents treating log errors as failure may mark a successful offline parse as failed.
• net.recon remains active after net.sniff off, so ARP-table polling and endpoint events can continue until recon is explicitly stopped or the session exits.

Additional context

The test container also emitted session-start warnings because netstat was absent and no gateway was detected. Those warnings occurred before net.sniff on and are not attributed here to the recon dependency; the recon-specific failure is the repeated net.recon exec: "ip" error after the requirement-start log.

Closure signal: with net.sniff.source set to a valid PCAP and no live-capture intent, net.sniff on does not start net.recon (or otherwise does not require host ip/gateway discovery), offline packets still parse, and the session log is free of recon requirement errors for that path. Live interface sniffing may continue to use recon if that remains an intentional design for Ethernet identity.