WiFi threat-detection plugin (deauth/evil-twin/rogue-AP heuristics)

Is there an existing issue for this?

• I have searched the existing open and closed issues

Is your feature request related to a problem? Please describe

Create a plugin that surfaces classic 802.11 threat signals (evil twin, rogue APs, security downgrade, duplicate SSID) using periodic AP scan data — no monitor-mode radio, no dedicated hardware, works with any WiFi interface NetAlertX (or a companion host) already has.

Why? Standalone WiFi IDS tools like ESP32 WiFi Canary (https://github.com/simeononsecurity/esp32-wifi-canary) implement 9 detection heuristics, but they're isolated single-purpose devices with no device-inventory context. NetAlertX already knows which devices/APs are legitimate — pairing that context with a few of these heuristics seems like a natural fit, without needing to build a whole separate detection stack.

What's actually portable Of the 9 heuristics, 6 only need a periodic AP scan (iw scan or equivalent — no monitor mode, no exclusive radio use, safe to share with an interface doing other duty):

Heuristic	What it checks
Nearby pwnagotchi	BSSID de:ad:be:ef:de:ad present in a scan
WiFi Pineapple OUI	BSSID bytes[1:2] == 13:37
Evil twin / open clone	Known SSID reappears unencrypted
Original AP absent + clone present	Baseline AP missing, open clone visible
Security downgrade	Known SSID, weaker encryption than baseline
Duplicate SSID, different vendor	SSID collision with an OUI mismatch

3 heuristics genuinely need monitor-mode frame capture (they count management-frame rates, not just presence — a scan snapshot can't see this): deauth/disassoc burst, probe-request flood, beacon/SSID flood. Flagging these as out of scope for this proposal, not something the scan-based version can cover.

Describe the solution you'd like

A RUN_SCHD-scheduled plugin, structurally close to unifi_api_import/rest_import (both already import/enrich from a periodic external data source) — reads periodic scan output, compares against a rolling baseline, flags anomalies. Open question I haven't worked through: whether this enriches existing devices (an AP NetAlertX already tracks) or needs its own standalone feed for APs that aren't devices at all (attacker-controlled ones by definition won't be).

Describe alternatives you've considered

Wifi-cannary

Anything else?

Not something I'm picking up myself right now — posting it in case it's useful to someone, or worth a maintainer opinion on scope/design before anyone invests time.

Am I willing to test this?

• I will do my best to test this feature on the netlertx-dev image when requested within 48h and report bugs to help deliver a great user experience for everyone and not to break existing installations.

Can I help implement this? ‍‍

• Yes
• No