coordinator/__pycache__/dashboard.cpython-314.pyc

+
1Òiž�ãóZa€RUt@0tRt^RIt^RIt^RIt^RIt^RIt^RIHtH	t	H
t
^RIHtH
t
Ht]PP!]PP#]4R4t]PP!]PP#]4RR4t]PP!]PP#]4RR4t]PP!]PP#]4RR	4t]PP!]PP#]4R
4t^t^dt/^RVb^RWb^RXb^RYb^RZb^R[b^R\b^R]b^R^b^	R_b^
R`b^Rab^
Rbb^Rcb^Rdb^Reb^Rfb^Rg^Rh^Ri^Rj^Rk^Rl^Rm^"Rn^'Ro^-Rp^/Rq^cRr^gRs^“Rt/Ct]^kRRltR
Rlt]!]4t]^kRRltRRltRuRRllt ]3RRllt!RRlt"]R3RRllt#RRlt$RRlt%RR lt&R!R"lt'R#R$lt(R%R&lt)R'R(lt*R)t+]!R*R+7t,]+!4],P[R,]R-7R.4t.],P[R/4R04t/],P[R14R24t0],P[R34R44t1],P[R54]3R6R7ll4t2],P[R84R94t3],P[R:4R;4t4],P[R<4R=4t5],P[R>4R?4t6],P[R@4RvRARBll4t7],P[RC4RwRDREll4t8],P[RF4RG4t9],P[RH4RI4t:],P[RJ4RKRLl4t;],P[RM4RN4t<]=RO8Xd^RI>t>]>P~!RPRQRRRSRT7R#R#)xz]
WiFi Recon Dashboard
Reads from events.db (written by udp_ingest.py), serves a live web UI.
N)ÚFastAPIÚRequestÚ
HTTPException)ÚHTMLResponseÚStreamingResponseÚFileResponsez	events.dbÚ	templateszdashboard.htmlÚstaticz
dashboard.csszdashboard.jszoui.txtcóR€V^8„dQhR\R\\\3,/#)éÚcodeÚreturn)ÚintÚtupleÚstr)Úformats"Úcoordinator/dashboard.pyÚ__annotate__r<s&€÷MñMœSðM¤U¬3´¨8¥_ñMócó.€\PVR4#)úUnknown / vendor-specific)rÚnormal)ÚDEAUTH_REASONSÚget)rs&rÚdeauth_reason_infor<s€Ü×Ñ˜dÐ$KÓLÐLrcóR€V^8„dQhR\R\\\3,/#)rÚpathr
©rÚdict)rs"rrrAs"€÷
ñ
”Cð
œD¤¤c �Nñ
rcóÌ€/p\PPV4'gV#\VRRR7;_uu_4pVF�pRV9dKVP	R4pV^,P4P
RR4P4pV^,P4pV'gKsV'gK}WaV&Kƒ	RRR4V# +'giT#;i)zutf-8Úignore)ÚencodingÚerrorsz(hex)Ú-Ú:N)ÚosrÚexistsÚopenÚsplitÚstripÚreplaceÚupper)rÚdbÚfÚlineÚpartsÚprefixÚvendors&      rÚ	_load_ouir2Asµ€Ø€BÜ
�7‰7�>‰>˜$×ÒØˆ	Ü	
ˆd˜W¨X×	6Õ	6¸!ÛˆDØ˜dÔ"ÙØ—J‘J˜wÓ'ˆEØ˜1•X—^‘^Ó%×-Ñ-¨c°3Ó7×=Ñ=Ó?ˆFØ˜1•X—^‘^Ó%ˆFß‰vŸ&™&Ø#�6“
ñ÷
7ð€I÷
7Ö	6ð€IúsÁA1CÂ6CÃCÃC#	cóR€V^8„dQhR\R\\\3,/#)rÚmacr
)rrÚbool)rs"rrrSs#€÷3ñ3”Cð3œE¤#¤t )Õ,ñ3rcóZ€V'd\V4^8dR#\VPRR4PRR4R,^4p\V^,4pT'dR	#TP4R,p\PTR4R3# \dRu#i;i)
z£
Returns (vendor_name, is_randomized).
Randomized MACs have the locally-administered bit set (bit 1 of first byte).
OUI lookup is meaningless for randomized MACs.
ÚUnknownFr$Úr#:NrN:NéN)r7F)zRandomized MACT)Úlenrr*r5Ú
ValueErrorr+Ú_OUI_DBr)r4Ú
first_byteÚ
randomizedr0s&   rÚ
oui_lookupr?Ss›€÷”#�c“(˜Q”,Ø!Ð!ð"Ü˜Ÿ™ S¨"Ó-×5Ñ5°c¸2Ó>¸rÕBÀBÓGˆ
Ü˜* tÕ+Ó,ˆ
÷Ø'Ð'Ø
�Y‰Y‹[˜�_€FÜ�K‰K˜ 	Ó*¨EÐ2Ð2øôô"Ø!Ò!ð"úsœABÂ
B*Â)B*có8€V^8„dQhR\P/#©rr
)Úsqlite3Ú
Connection)rs"rrrgs€÷ñ”'×$Ñ$ñrcó†€\P!\4p\PVnVPR4V#)zPRAGMA journal_mode=WAL)rBÚconnectÚDB_PATHÚRowÚrow_factoryÚexecute©Úconns rÚget_connrLgs.€Ü�?Š?œ7Ó#€DÜ—{‘{€DÔØ‡L�LÐ*Ô+Ø€KrcóR€V^8„dQhR\R\R\\,/#)rÚsqlÚparamsr
)rrÚlistr)rs"rrrns%€÷#ñ#Œsð#œEð#¬4´:ñ#rcóÜ€\4;_uu_4pVPW4P4pRRR4XUu.uFp\V4NK	up# +'giL+;iuupi©N)rLrIÚfetchallr)rNrOrKÚrowsÚrs&&   rÚqueryrVnsJ€Ü	�Œ�tØ�|‰|˜CÓ(×1Ñ1Ó3ˆ÷
á!Ó"™T˜ŒD�ŽG™TÑ"Ð"÷
�üâ"s“ A¿A)ÁA&	cóJ€V^8„dQhR\R,R\R\/#)rÚ	last_seenNÚ	thresholdr
©rr)rs"rrrts%€÷ñœC $�Jð´3ðÌñrcóô€V'gR#\PPV4p\PP4V,
P4pW18:dR#R# \dR#i;i)ÚofflineÚonline)ÚdatetimeÚ
fromisoformatÚutcnowÚ
total_secondsr;)rXrYÚdtÚdeltas&&  rÚ_node_statusrdtsg€ßÙðÜ
×
Ñ
×
,Ñ
,¨YÓ
7ˆÜ×"Ñ"×)Ñ)Ó+¨bÕ0×?Ñ?ÓAˆØ Ô-ˆxÐ<°9Ð<øÜôÚðúsŒAA(Á&A(Á(A7Á6A7có:€V^8„dQhR\\,/#rA©rPr)rs"rrr€s€÷ñ”Tœ$•Zñrcó€\R4p\R4pVUu/uFq"R,VbK	ppVFÈpVPVR,/4pVPR4VR&VPR4VR&VPR4VR&VPR4VR&VR,;'g
VR,VR&VR,'d\VR,^R	7VR
&K±\VR,^<R	7VR
&KÊ	V#uupi)a
        SELECT
            node_id,
            MAX(received_at)  AS last_beacon,
            COUNT(*)          AS total_events,
            MIN(received_at)  AS first_seen
        FROM beacon_events
        GROUP BY node_id
        ORDER BY node_id ASC
    zÕ
        SELECT node_id, received_at AS last_heartbeat,
               uptime_ms, free_heap, wifi_rssi
        FROM heartbeat_events
        WHERE id IN (SELECT MAX(id) FROM heartbeat_events GROUP BY node_id)
    Únode_idÚlast_heartbeatÚ	uptime_msÚ	free_heapÚ	wifi_rssiÚlast_beaconrX©rYÚstatus)rVrrd)rTÚhb_rowsrUÚhb_mapÚhbs     rÚbuild_nodesrs€s€Üð	ó		€Dôðó	€Gñ(/Ó
/¡w !�	�l˜AŠo¡w€FÐ
/Û
ˆØ
�Z‰Z˜˜)� bÓ
)ˆØ Ÿf™fÐ%5Ó6ˆÐ
ÑØ Ÿf™f [Ó1ˆˆ+‰Ø Ÿf™f [Ó1ˆˆ+‰Ø Ÿf™f [Ó1ˆˆ+‰ØÐ 0Õ1×EÐE°Q°}Õ5Eˆˆ+‰àÐ
×ÔÜ& qÐ)9Õ':ÀbÔIˆAˆh‹Kä& q¨Õ'7À2ÔFˆAˆh‹Kñð€Kùò0s›C?có`€V^8„dQhR\R\R,R\\,/#)rÚlimitrhNr
)rrrPr)rs"rrr¢s)€÷
ñ
œð
´#¸µ*ð
ÌÌTÍ
ñ
rcóF€V'd\RW34#\RV34#)zt
            SELECT * FROM beacon_events
            WHERE node_id = ?
            ORDER BY id DESC LIMIT ?
        zJ
        SELECT * FROM beacon_events
        ORDER BY id DESC LIMIT ?
    ©rV©rurhs&&rÚbuild_eventsry¢s:€ßÜððÐ
ó	ð	ô
ððˆóðrcó:€V^8„dQhR\\,/#rArf)rs"rrr¯s€÷ñœœT�
ñrcó€\R4pV#)aê
        SELECT
            ssid,
            bssid,
            MAX(rssi)                AS best_rssi,
            ROUND(AVG(rssi), 1)      AS avg_rssi,
            channel,
            encryption,
            COUNT(*)                 AS times_seen,
            COUNT(DISTINCT node_id)  AS node_count,
            MAX(received_at)         AS last_seen
        FROM beacon_events
        WHERE bssid IS NOT NULL
        GROUP BY bssid
        ORDER BY times_seen DESC
        LIMIT 300
    rw)rTs rÚbuild_networksr|¯s€Üðó	€Dð"€Krcó:€V^8„dQhR\\,/#rArf)rs"rrrÄs€÷'ñ'”tœD•zñ'rcóÒ€\R4pV'g.#VUu.uFqR,NK
	ppRPR\V4,4p\RVR2\V44p/pVF2pVP	VR,.4PVR,4K4	VF;pVP
VR,.4VR&\VR,4wrxWqR	&W�R
&K=	V#uupi)zK
Per unique src_mac: aggregated stats and the SSIDs they were probing for.
aL
        SELECT
            src_mac,
            COUNT(*)                        AS times_seen,
            COUNT(DISTINCT node_id)         AS node_count,
            MAX(rssi)                        AS best_rssi,
            ROUND(AVG(rssi), 1)             AS avg_rssi,
            COUNT(DISTINCT NULLIF(ssid,'')) AS unique_ssids,
            MIN(received_at)                AS first_seen,
            MAX(received_at)                AS last_seen
        FROM probe_events
        WHERE src_mac IS NOT NULL
        GROUP BY src_mac
        ORDER BY times_seen DESC
        LIMIT 300
    Úsrc_macÚ,Ú?zS
        SELECT DISTINCT src_mac, ssid FROM probe_events
        WHERE src_mac IN (zI) AND ssid IS NOT NULL AND ssid != ''
        ORDER BY src_mac, ssid
    ÚssidÚprobed_ssidsr1r>)rVÚjoinr:rÚ
setdefaultÚappendrr?)	rTrUÚmac_listÚplaceholdersÚ	ssid_rowsÚssids_by_macÚsr1r>s	         rÚ
build_clientsrŒÄsù€ôðó	€D÷"Øˆ	Ù*.Ó/©$ Q�i—L�L©$€HÐ/Ø—8‘8˜C¤# h£-Õ/Ó0€LÜðà'˜.ð)ðô
ˆx‹ó	€Ið
€LÛ
ˆØ×Ñ  )¥¨bÓ1×8Ñ8¸¸6½ÖCñóˆØ(×,Ñ,¨Q¨y\¸2Ó>ˆˆ.ÑÜ'¨¨)Ó5ÑˆØ ˆ(‰Ø$ˆ,‹ñ	ð
€Kùò!0sšC$có$€V^8„dQhR\/#rA©r)rs"rrrîs€÷86ñ86œ$ñ86rcóÊ€\R4pVUu.uFqR,NK
	pp\R4p/pVFipVR,pWT9d$RVRVR,RVR,RVR,R//WE&R	VR	,R
VR
,RVR,/WE,R,VR,&Kk	\VP4RR
R7pVFp\VR,4VR&K	RVRV/#uupi)zÒ
For every BSSID, return per-node RSSI stats side by side.
Result: { node_ids: [...], networks: [{bssid, ssid, channel, encryption,
          node_count, nodes: {node_id: {best_rssi, avg_rssi, times_seen}}}] }
z;SELECT DISTINCT node_id FROM beacon_events ORDER BY node_idrha«
        SELECT
            b.bssid,
            MAX(b.ssid)            AS ssid,
            MAX(b.channel)         AS channel,
            MAX(b.encryption)      AS encryption,
            b.node_id,
            MAX(b.rssi)            AS best_rssi,
            ROUND(AVG(b.rssi), 1)  AS avg_rssi,
            COUNT(*)               AS times_seen
        FROM beacon_events b
        WHERE b.bssid IN (
            SELECT bssid FROM beacon_events
            WHERE bssid IS NOT NULL
            GROUP BY bssid
            ORDER BY COUNT(DISTINCT node_id) DESC, COUNT(*) DESC
            LIMIT 300
        )
        GROUP BY b.bssid, b.node_id
        ORDER BY b.bssid, b.node_id
    Úbssidr‚ÚchannelÚ
encryptionÚnodesÚ	best_rssiÚavg_rssiÚ
times_seencó&€\VR,4#)r“)r:)Úxs&rÚ<lambda>Ú"build_cross_node.<locals>.<lambda> s€”c˜!˜G�*”orT)ÚkeyÚreverseÚ
node_countÚnode_idsÚnetworks)rVÚsortedÚvaluesr:)Ú	node_rowsrUržrTrŸr�ÚresultÚnets        rÚbuild_cross_noder¥îs
€ôÐSÓT€IÙ'0Ó1¡y !�9—�¡y€HÐ1äðó	€Dð,€HÛ
ˆØ�'•
ˆØÔ à˜eØ˜a �iØ˜a 	�lØ˜a �oØ˜bðˆH‰Oð
˜!˜K�.Ø˜!˜J�-Ø˜!˜L�/ð2
ˆ�˜Õ   9¥Ó.ñô Ø�‰ÓÙ%Øô€Fó
ˆÜ  G¥Ó-ˆˆLÓñð
˜ *¨fÐ5Ð5ùòc2s�C có$€V^8„dQhR\/#rArŽ)rs"rrr)s€÷nñnœñnrc
óä€\PP4pV\P!^R7,
PRR7pV\P!^R7,
PRR7p\	RV34p.pVF6p\VR,4wrgV'dK!WeR&VP
V4K8	\	RV34p.p	VF0p\VR,4wrgWeR&WuR&V	P
V4K2	\	R	V34p
\	R
4p.pVF0p\VR,4wrgWeR&WuR&VP
V4K2	\	R4p
RVR
V	RV
RVRV
/#)é©ÚhoursÚseconds©ÚtimespecaÃ
        SELECT src_mac,
               COUNT(*)              AS times_seen,
               MAX(rssi)             AS best_rssi,
               ROUND(AVG(rssi), 1)   AS avg_rssi,
               MAX(received_at)      AS last_seen,
               COUNT(DISTINCT node_id) AS node_count
        FROM probe_events
        WHERE src_mac IS NOT NULL AND received_at > ?
        GROUP BY src_mac
        HAVING COUNT(*) > 1
        ORDER BY last_seen DESC
    rr1a™
        SELECT src_mac,
               MIN(received_at)      AS first_seen,
               MAX(rssi)             AS best_rssi,
               COUNT(*)              AS times_seen,
               COUNT(DISTINCT node_id) AS node_count
        FROM probe_events
        WHERE src_mac IS NOT NULL
        GROUP BY src_mac
        HAVING MIN(received_at) > ?
        ORDER BY first_seen DESC
        LIMIT 100
    r>aó
        SELECT bssid,
               MAX(ssid)             AS ssid,
               MIN(received_at)      AS first_seen,
               MAX(rssi)             AS best_rssi,
               MAX(channel)          AS channel,
               MAX(encryption)       AS encryption,
               COUNT(DISTINCT node_id) AS node_count
        FROM beacon_events
        WHERE bssid IS NOT NULL
        GROUP BY bssid
        HAVING MIN(received_at) > ?
        ORDER BY first_seen DESC
        LIMIT 100
    af
        SELECT src_mac,
               COUNT(DISTINCT date(received_at)) AS days_seen,
               MIN(received_at)                  AS first_seen,
               MAX(received_at)                  AS last_seen,
               MAX(rssi)                         AS best_rssi,
               COUNT(*)                          AS times_seen,
               COUNT(DISTINCT node_id)           AS node_count
        FROM probe_events
        WHERE src_mac IS NOT NULL
        GROUP BY src_mac
        HAVING COUNT(DISTINCT date(received_at)) >= 2
        ORDER BY days_seen DESC, times_seen DESC
        LIMIT 50
    a×
        SELECT bssid,
               MAX(ssid)                         AS ssid,
               COUNT(DISTINCT date(received_at)) AS days_seen,
               MIN(received_at)                  AS first_seen,
               MAX(received_at)                  AS last_seen,
               MAX(rssi)                         AS best_rssi,
               MAX(channel)                      AS channel,
               MAX(encryption)                   AS encryption,
               COUNT(DISTINCT node_id)           AS node_count
        FROM beacon_events
        WHERE bssid IS NOT NULL
        GROUP BY bssid
        HAVING COUNT(DISTINCT date(received_at)) >= 2
        ORDER BY days_seen DESC, best_rssi DESC
        LIMIT 50
    ÚpresentÚnew_macsÚnew_networksÚreg_macsÚreg_networks)r^r`Ú	timedeltaÚ	isoformatrVr?r†)ÚnowÚ	cutoff_1hÚ
cutoff_24hÚpresent_rowsr®rUr1r>Únew_mac_rowsr¯r°Úreg_mac_rowsr±r²s              rÚbuild_presencer»)s�€Ü×"Ñ"×)Ñ)Ó+€CØœ×*Ò*°Ô3Õ3×>Ñ>È	Ð>ÓR€IØœ×*Ò*°Ô4Õ4×?Ñ?ÈÐ?ÓS€Jôððˆó€Lð€GÛ
ˆÜ'¨¨)Ó5Ñˆß‰zØ ˆh‰KØ�N‰N˜1Öñ	ôððˆó€Lð€HÛ
ˆÜ'¨¨)Ó5ÑˆØ ˆ(‰Ø$ˆ,‰Ø�‰˜Öñ	ôððˆó€Lô"ðó	€Lð€HÛ
ˆÜ'¨¨)Ó5ÑˆØ ˆ(‰Ø$ˆ,‰Ø�‰˜Öñ	ôðó	€Lð&	˜Ø˜Ø˜Ø˜Ø˜ððrcó$€V^8„dQhR\/#rArŽ)rs"rrršs€÷HñH”dñHrcóP€\PP4pV\P!^R7,
PRR7pV\P!^R7,
PRR7p\	R4p\	RV34pV'd´VUu.uFqUR,NK
	ppRPR	\
V4,4p\	R
VR2\V44pVU	u/uFq™R,V	bK	p
p	VFDpV
PVR,/4pVPR4VR&VPR
4VR
&KF	\	RV34p\	R4p
V
'd•V
Uu.uFqîR,NK
	ppRPR	\
V4,4p\	RVR2\V44pVU	u/uFq™R,V	R,bK	p
p	V
FpV
PVR,4VR&K 	\	R4pVF"p\VR,4wppVVR&VVR&K$	\	R4pVF"p	\V	R,4wppVV	R&VV	R&K$	\	R4pRTRTRV'd
V^,M/RV
RVRVR V/#uupiuup	iuupiuup	i)!é)Úminutesr«r¬r©zL
        SELECT * FROM deauth_events
        ORDER BY id DESC LIMIT 100
    aÈ
        SELECT
            bssid,
            subtype,
            COUNT(*)                AS count,
            COUNT(DISTINCT node_id) AS node_count,
            COUNT(DISTINCT src)     AS unique_srcs,
            MIN(received_at)        AS first_seen,
            MAX(received_at)        AS last_seen
        FROM deauth_events
        WHERE received_at > ?
        GROUP BY bssid, subtype
        HAVING COUNT(*) >= 10
        ORDER BY count DESC
    r�r€r�z{
            SELECT bssid, MAX(ssid) AS ssid, MAX(encryption) AS encryption
            FROM beacon_events WHERE bssid IN (z%)
            GROUP BY bssid
        r‚r’aˆ
        SELECT
            COUNT(*)                AS total,
            COUNT(DISTINCT bssid)   AS unique_bssids,
            COUNT(DISTINCT src)     AS unique_srcs,
            SUM(CASE WHEN subtype='deauth' THEN 1 ELSE 0 END)   AS deauth_count,
            SUM(CASE WHEN subtype='disassoc' THEN 1 ELSE 0 END) AS disassoc_count
        FROM deauth_events
        WHERE received_at > ?
    a�
        SELECT
            bssid,
            COUNT(*)                AS total_frames,
            COUNT(DISTINCT src)     AS unique_srcs,
            COUNT(DISTINCT node_id) AS node_count,
            MIN(received_at)        AS first_seen,
            MAX(received_at)        AS last_seen
        FROM deauth_events
        GROUP BY bssid
        ORDER BY total_frames DESC
        LIMIT 10
    z\
            SELECT bssid, MAX(ssid) AS ssid
            FROM beacon_events WHERE bssid IN (aŸ
        SELECT
            dst,
            COUNT(*)                    AS total_frames,
            COUNT(DISTINCT bssid)       AS networks_used,
            COUNT(DISTINCT node_id)     AS node_count,
            MIN(received_at)            AS first_seen,
            MAX(received_at)            AS last_seen
        FROM deauth_events
        GROUP BY dst
        ORDER BY total_frames DESC
        LIMIT 10
    Údstr1r>a‡
        SELECT reason,
               COUNT(*)                AS total_frames,
               COUNT(DISTINCT bssid)   AS unique_bssids,
               COUNT(DISTINCT dst)     AS unique_targets,
               MIN(received_at)        AS first_seen,
               MAX(received_at)        AS last_seen
        FROM deauth_events
        GROUP BY reason
        ORDER BY total_frames DESC
    ÚreasonÚdescriptionÚclassificationa%
        SELECT date(received_at)                            AS day,
               CAST(strftime('%H', received_at) AS INTEGER) AS hour,
               COUNT(*)                                     AS frames
        FROM deauth_events
        GROUP BY day, hour
        ORDER BY day, hour
    ÚrecentÚburstsÚsummaryÚtop_targetsÚtop_targeted_devicesÚreason_statsÚheatmap)r^r`r³r´rVr„r:rrr?r)rµÚ	cutoff_5mr¶rÄrÅÚbÚ
bssid_listrˆr‰rUÚssid_mapr¤rÆrÇÚtrÈÚdr1r>Úreason_rowsÚdescrÃÚheatmap_rowss                       rÚbuild_alertsrÔšsë€Ü×#Ñ#×*Ñ*Ó,€CØœ×+Ò+°AÔ6Õ6×AÑAÈ9ÐAÓU€IØœ×+Ò+°!Ô4Õ4×?Ñ?ÈÐ?ÓS€Iôðó	€Fôððˆó€F÷"Ù*0Ó1©& Q˜—j�j©&ˆ
Ð1Ø—x‘x ¤c¨*£oÕ 5Ó6ˆÜð0à0<¨~ð>	ðô�:Ó
ó	 ˆ	ñ
,5Ó5©9 a�g•J ’M©9ˆÐ5ÛˆAØ—,‘,˜q �z¨2Ó.ˆCØ!Ÿg™g f›oˆAˆf‰IØ!Ÿg™g lÓ3ˆAˆl‹Oñôð	ðˆó	€Gôðó	€K÷Ù,7Ó8©K q˜'Ÿ
˜
©Kˆ
Ð8Ø—x‘x ¤c¨*£oÕ 5Ó6ˆÜð"0à0<¨~ð>	ðô�:Ó
ó	 ˆ	ñ
4=Ó=±9¨a�g•J  &¥	Ò)±9ˆÐ=ÛˆAØ Ÿ™ Q w¥ZÓ0ˆAˆf‹Iñô!ð"ó	Ðó"ˆÜ'¨¨%Ó1Ñˆ�
Ø ˆˆ(‰Ø$ˆˆ,‹ñ"ôð
ó
	€KóˆÜ1°!°Hµ+Ó>ÑˆˆnØ"ˆˆ-ÑØ,ˆÐ
Óñôðó	€Lð	 Ø Ø¯g ¨¦
¸2Ø ØÐ 4Ø Ø ððùòC2ùò6ùòB9ùò>sÂJÃ0JÅ2JÇJ#có0€V^8„dQhR\R\/#)rÚqr
r)rs"rrr%s€÷WñW”CðWœDñWrcó(a€V'd\V4^8d/#RVR2p/p\RW34pV'dW2R&\RV34pV'd�\RV34p/pVF2pVPVR,.4PVR,4K4	VF;p\	VR,4wršW˜R&W¨R	&VPVR,.4VR
&K=	WBR&\RV34pV'd*VFp\	VR,4wršW˜R&W¨R	&K!	W²R
&\RV34pV'd*VFp\	VR,4wršW˜R&W¨R	&K!	WÂR&\RV34p
V
'dWÒR&VP
4o\P4UU	u.uFwréSV	P
49gKVNK 	up	pR,pV'Ed;RPR\V4,4p\RVR2\V44pV'dš\RVR2\V44p/pVF2pVPVR,.4PVR,4K4	VF;p\	VR,4wršW˜R&W¨R	&VPVR,.4VR
&K=	VVR&\RVR2\V44pV'dVVR&RV9gRV9d,\V3Rl\P44V4VR&V#uup	pi) rÚ%aä
        SELECT bssid, MAX(ssid) AS ssid,
               COUNT(*) AS times_seen,
               MAX(rssi) AS best_rssi, ROUND(AVG(rssi),1) AS avg_rssi,
               MAX(channel) AS channel, MAX(encryption) AS encryption,
               COUNT(DISTINCT node_id) AS node_count,
               MIN(received_at) AS first_seen, MAX(received_at) AS last_seen
        FROM beacon_events
        WHERE bssid LIKE ? OR ssid LIKE ?
        GROUP BY bssid ORDER BY times_seen DESC LIMIT 20
    Ú
as_networkag
        SELECT src_mac,
               COUNT(*) AS times_seen,
               MAX(rssi) AS best_rssi, ROUND(AVG(rssi),1) AS avg_rssi,
               COUNT(DISTINCT node_id) AS node_count,
               MIN(received_at) AS first_seen, MAX(received_at) AS last_seen
        FROM probe_events
        WHERE src_mac LIKE ?
        GROUP BY src_mac LIMIT 10
    zŠ
            SELECT DISTINCT src_mac, ssid FROM probe_events
            WHERE src_mac LIKE ? AND ssid IS NOT NULL AND ssid != ''
        rr‚r1r>rƒÚ	as_clienta'
        SELECT src_mac,
               COUNT(*) AS times_seen,
               MAX(rssi) AS best_rssi,
               MIN(received_at) AS first_seen, MAX(received_at) AS last_seen
        FROM probe_events
        WHERE ssid LIKE ?
        GROUP BY src_mac ORDER BY times_seen DESC LIMIT 20
    Úprobing_foraN
        SELECT dst,
               COUNT(*) AS total_frames,
               COUNT(DISTINCT bssid) AS networks_used,
               COUNT(DISTINCT node_id) AS node_count,
               MIN(received_at) AS first_seen, MAX(received_at) AS last_seen
        FROM deauth_events
        WHERE dst LIKE ?
        GROUP BY dst LIMIT 10
    rÀÚ	as_victimaS
        SELECT bssid,
               COUNT(*) AS total_frames,
               COUNT(DISTINCT dst) AS unique_targets,
               COUNT(DISTINCT node_id) AS node_count,
               MIN(received_at) AS first_seen, MAX(received_at) AS last_seen
        FROM deauth_events
        WHERE bssid LIKE ?
        GROUP BY bssid LIMIT 10
    Úas_impersonated:Né<Nr€r�af
            SELECT src_mac,
                   COUNT(*) AS times_seen,
                   MAX(rssi) AS best_rssi, ROUND(AVG(rssi),1) AS avg_rssi,
                   COUNT(DISTINCT node_id) AS node_count,
                   MIN(received_at) AS first_seen, MAX(received_at) AS last_seen
            FROM probe_events
            WHERE substr(src_mac,1,8) IN (zI)
            GROUP BY src_mac ORDER BY times_seen DESC LIMIT 30
        zo
                SELECT DISTINCT src_mac, ssid FROM probe_events
                WHERE substr(src_mac,1,8) IN (zD)
                  AND ssid IS NOT NULL AND ssid != ''
            Úvendor_clientsaÁ
            SELECT bssid, MAX(ssid) AS ssid,
                   COUNT(*) AS times_seen,
                   MAX(rssi) AS best_rssi, ROUND(AVG(rssi),1) AS avg_rssi,
                   MAX(channel) AS channel, MAX(encryption) AS encryption,
                   COUNT(DISTINCT node_id) AS node_count,
                   MIN(received_at) AS first_seen, MAX(received_at) AS last_seen
            FROM beacon_events
            WHERE substr(bssid,1,8) IN (zG)
            GROUP BY bssid ORDER BY times_seen DESC LIMIT 30
        Úvendor_networksc3óZ<"€TF wrSVP49gKVx€K"	R#5irR)Úlower)Ú.0ÚkÚvÚq_lowers&  €rÚ	<genexpr>Úbuild_search.<locals>.<genexpr>¹s"øé€ÐG™‘t�q°'¸Q¿W¹W»YÑ2F—’›ùsƒ+¡
+Úvendor_name)r:rVr…r†r?rrâr<Úitemsr„rÚnext)rÖÚlikeÚresultsrÙrÚr‰rŠr‹rUr1r>rÛrÜrÝr0Úmatching_prefixesÚphrßràræs&                  @rÚbuild_searchrð%s‰ø€ß”�A“˜”
Øˆ	Ø
ˆqˆc�ˆ8€DØ€Gôð
ðˆó
€J÷Ø *�Ñôð	ðˆó	€I÷ÜððˆWóˆ	ð ˆÛˆAØ×#Ñ# A i¥L°"Ó5×<Ñ<¸Q¸v½YÖGñãˆAÜ!+¨A¨iLÓ!9ÑˆFØ &ˆh‰KØ *ˆl‰OØ ,× 0Ñ 0°°9µ¸rÓ BˆAˆnÓñ	ð
 )�Ñôððˆó€K÷ÛˆAÜ!+¨A¨iLÓ!9ÑˆFØ$ˆh‰KØ(ˆl‹Oñð"-�
Ñôð	ðˆó	€I÷ÛˆAÜ!+¨A¨eHÓ!5ÑˆFØ$ˆh‰KØ(ˆl‹Oñð )�Ñôð	ðˆó	€O÷Ø%4Ð!Ñ"ð�g‰g‹i€Gä%,§]¡]¤_ôÙ%4‘>�6Ø�f—l‘l“nÑ$÷	ˆ¡_òð
õÐ÷
ÐØ
�X‰X�cœCÐ 1Ó2Õ2Ó
3ˆäð$+ð,.¨$ð/	ð	 ôÐ$Ó
%ó	'ˆ÷Üð#/à/1¨dð3
ðôÐ(Ó)ó	+ˆIð
"$ˆLÛ�Ø×'Ñ'¨¨)°bÓ9×@Ñ@ÀÀ6ÅÖKñã#�Ü%/°°)µÓ%=Ñ"�Ø$*�(‘Ø$.�,‘Ø$0×$4Ñ$4°Q°yµ\À2Ó$F��.Ó!ñ	$ð
)7ˆGÐ$Ñ%äð%)ð*,¨ð-	ð
!ôÐ$Ó
%ó
'ˆ÷Ø)8ˆGÐ%Ñ&à˜wÔ&Ð*;¸wÔ*FÜ%)ÜGœwŸ}™}œÓGÈó&ˆG�MÑ"ð€NùóksÆLÆ8Lcó>€V^8„dQhR\R\R,/#)rrhr
Nr)rs"rrr¿s€÷$ñ$œsð$¤t¨d¥{ñ$rcó€\RV34pV'gR#V^,p\RV34pV'd
V^,M/pVPR4VR&VPR4VR&VPR4VR&VPR4VR&VR,'d\VR,^R7VR&M\VR	,^<R7VR&VR
,'d\VR
,^4MRVR
&\	\
VR7VR&V#)
aà
        SELECT
            node_id,
            MIN(received_at) AS first_seen,
            MAX(received_at) AS last_seen,
            COUNT(*)         AS total_events,
            COUNT(DISTINCT ssid)  AS unique_ssids,
            COUNT(DISTINCT bssid) AS unique_bssids,
            AVG(rssi)        AS avg_rssi,
            MIN(rssi)        AS min_rssi,
            MAX(rssi)        AS max_rssi
        FROM beacon_events
        WHERE node_id = ?
        GROUP BY node_id
    Nz¬
        SELECT received_at AS last_heartbeat, uptime_ms, free_heap, wifi_rssi
        FROM heartbeat_events
        WHERE node_id = ?
        ORDER BY id DESC LIMIT 1
    rirjrkrlrnrorXr•rxÚevents)rVrrdÚroundryÚ	EVENT_CAP)rhrTÚdetailrprrs&    rÚbuild_node_detailr÷¿s€Üððˆó€D÷ÙØ
�!�W€FÜðð
ˆó€G÷ˆ�Ž B€BØ!Ÿv™vÐ&6Ó7€FÐÑØ!Ÿv™v kÓ2€Fˆ;ÑØ!Ÿv™v kÓ2€Fˆ;ÑØ!Ÿv™v kÓ2€Fˆ;ÑØ
Ð×ÔÜ'¨Ð/?Õ(@ÈBÔOˆˆxÒä'¨¨{Õ(;ÀrÔJˆˆxÑØ9?À
×9KÔ9Kœ˜v jÕ1°1Ô5ÐQU€Fˆ:ÑÜ%¬I¸wÔG€Fˆ8ÑØ€MrcóP€\4;_uu_4pVPR4VPR4VPR4VPR4VPR4VPR4VP4RRR4R# +'giR#;i)z8Create tables if they don't exist. Runs once at startup.aF
            CREATE TABLE IF NOT EXISTS beacon_events (
                id INTEGER PRIMARY KEY AUTOINCREMENT, received_at TEXT NOT NULL,
                node_id TEXT, node_ts INTEGER, ssid TEXT, bssid TEXT,
                rssi INTEGER, channel INTEGER, encryption TEXT, importance TEXT, confidence TEXT
            )
        a
            CREATE TABLE IF NOT EXISTS probe_events (
                id INTEGER PRIMARY KEY AUTOINCREMENT, received_at TEXT NOT NULL,
                node_id TEXT, node_ts INTEGER, src_mac TEXT, ssid TEXT,
                rssi INTEGER, importance TEXT
            )
        a
            CREATE TABLE IF NOT EXISTS heartbeat_events (
-											ESP32 WiFi recon cluster
										
										
											2026-04-03 14:38:38 +03:00
+								+
-											firmware&dashboard changes
										
										
											2026-04-05 13:06:25 +03:00
+Òiž�ãóZa€RUt@0tRt^RIt^RIt^RIt^RIt^RIt^RIHtH	t	H
 								t
 								^RIHtH
 								t
 								Ht]PP!]PP#]4R4t]PP!]PP#]4RR4t]PP!]PP#]4RR4t]PP!]PP#]4RR	4t]PP!]PP#]4R
-											ESP32 WiFi recon cluster
										
										
											2026-04-03 14:38:38 +03:00
+t^t^dt/^RVb^RWb^RXb^RYb^RZb^R[b^R\b^R]b^R^b^	R_b^
 								R`b^Rab^
-											firmware&dashboard changes
										
										
											2026-04-05 13:06:25 +03:00
+								Rbb^Rcb^Rdb^Reb^Rfb^Rg^Rh^Ri^Rj^Rk^Rl^Rm^"Rn^'Ro^-Rp^/Rq^cRr^gRs^“Rt/Ct]^kRRltR
-											ESP32 WiFi recon cluster
										
										
											2026-04-03 14:38:38 +03:00
+								Rlt]!]4t]^kRRltRRltRuRRllt ]3RRllt!RRlt"]R3RRllt#RRlt$RRlt%RR lt&R!R"lt'R#R$lt(R%R&lt)R'R(lt*R)t+]!R*R+7t,]+!4],P[R,]R-7R.4t.],P[R/4R04t/],P[R14R24t0],P[R34R44t1],P[R54]3R6R7ll4t2],P[R84R94t3],P[R:4R;4t4],P[R<4R=4t5],P[R>4R?4t6],P[R@4RvRARBll4t7],P[RC4RwRDREll4t8],P[RF4RG4t9],P[RH4RI4t:],P[RJ4RKRLl4t;],P[RM4RN4t<]=RO8Xd^RI>t>]>P~!RPRQRRRSRT7R#R#)xz]
 								WiFi Recon Dashboard
-											firmware&dashboard changes
										
										
											2026-04-05 13:06:25 +03:00
+								Reads from events.db (written by udp_ingest.py), serves a live web UI.
-											ESP32 WiFi recon cluster
										
										
											2026-04-03 14:38:38 +03:00
+								N)ÚFastAPIÚRequestÚ
 								HTTPException)ÚHTMLResponseÚStreamingResponseÚFileResponsez	events.dbÚ	templateszdashboard.htmlÚstaticz
 								dashboard.csszdashboard.jszoui.txtcóR€V^8„dQhR\R\\\3,/#)éÚcodeÚreturn)ÚintÚtupleÚstr)Úformats"Úcoordinator/dashboard.pyÚ__annotate__r<s&€÷MñMœSðM¤U¬3´¨8¥_ñMócó.€\PVR4#)úUnknown / vendor-specific)rÚnormal)ÚDEAUTH_REASONSÚget)rs&rÚdeauth_reason_infor<s€Ü×Ñ˜dÐ$KÓLÐLrcóR€V^8„dQhR\R\\\3,/#)rÚpathr
 								©rÚdict)rs"rrrAs"€÷
-											firmware&dashboard changes
										
										
											2026-04-05 13:06:25 +03:00
+								ñ
 								”Cð
-											ESP32 WiFi recon cluster
										
										
											2026-04-03 14:38:38 +03:00
+								œD¤¤c �Nñ
-											firmware&dashboard changes
										
										
											2026-04-05 13:06:25 +03:00
+								rcóÌ€/p\PPV4'gV#\VRRR7;_uu_4pVF�pRV9dKVP	R4pV^,P4P
 								RR4P4pV^,P4pV'gKsV'gK}WaV&Kƒ	RRR4V# +'giT#;i)zutf-8Úignore)ÚencodingÚerrorsz(hex)Ú-Ú:N)ÚosrÚexistsÚopenÚsplitÚstripÚreplaceÚupper)rÚdbÚfÚlineÚpartsÚprefixÚvendors&      rÚ	_load_ouir2Asµ€Ø€BÜ
-											ESP32 WiFi recon cluster
										
										
											2026-04-03 14:38:38 +03:00
+								�7‰7�>‰>˜$×ÒØˆ	Ü
-											firmware&dashboard changes
										
										
											2026-04-05 13:06:25 +03:00
+								ˆd˜W¨X×	6Õ	6¸!ÛˆDØ˜dÔ"ÙØ—J‘J˜wÓ'ˆEØ˜1•X—^‘^Ó%×-Ñ-¨c°3Ó7×=Ñ=Ó?ˆFØ˜1•X—^‘^Ó%ˆFß‰vŸ&™&Ø#�6“
 								ñ÷
-											ESP32 WiFi recon cluster
										
										
											2026-04-03 14:38:38 +03:00
+ð€I÷
-											firmware&dashboard changes
										
										
											2026-04-05 13:06:25 +03:00
+Ö	6ð€IúsÁA1CÂ6CÃCÃC#	cóR€V^8„dQhR\R\\\3,/#)rÚmacr
 								)rrÚbool)rs"rrrSs#€÷3ñ3”Cð3œE¤#¤t )Õ,ñ3rcóZ€V'd\V4^8dR#\VPRR4PRR4R,^4p\V^,4pT'dR	#TP4R,p\PTR4R3# \dRu#i;i)
-											ESP32 WiFi recon cluster
										
										
											2026-04-03 14:38:38 +03:00
+								z£
 								Returns (vendor_name, is_randomized).
-											firmware&dashboard changes
										
										
											2026-04-05 13:06:25 +03:00
+								Randomized MACs have the locally-administered bit set (bit 1 of first byte).
-											ESP32 WiFi recon cluster
										
										
											2026-04-03 14:38:38 +03:00
+								OUI lookup is meaningless for randomized MACs.
 								ÚUnknownFr$Úr#:NrN:NéN)r7F)zRandomized MACT)Úlenrr*r5Ú
 								ValueErrorr+Ú_OUI_DBr)r4Ú
 								first_byteÚ
 								randomizedr0s&   rÚ
 								oui_lookupr?Ss›€÷”#�c“(˜Q”,Ø!Ð!ð"Ü˜Ÿ™ S¨"Ó-×5Ñ5°c¸2Ó>¸rÕBÀBÓGˆ
 								Ü˜* tÕ+Ó,ˆ
-											firmware&dashboard changes
										
										
											2026-04-05 13:06:25 +03:00
+								÷Ø'Ð'Ø
-											ESP32 WiFi recon cluster
										
										
											2026-04-03 14:38:38 +03:00
+								�Y‰Y‹[˜�_€FÜ�K‰K˜ 	Ó*¨EÐ2Ð2øôô"Ø!Ò!ð"úsœABÂ
 								B*Â)B*có8€V^8„dQhR\P/#©rr
 								)Úsqlite3Ú
 								Connection)rs"rrrgs€÷ñ”'×$Ñ$ñrcó†€\P!\4p\PVnVPR4V#)zPRAGMA journal_mode=WAL)rBÚconnectÚDB_PATHÚRowÚrow_factoryÚexecute©Úconns rÚget_connrLgs.€Ü�?Š?œ7Ó#€DÜ—{‘{€DÔØ‡L�LÐ*Ô+Ø€KrcóR€V^8„dQhR\R\R\\,/#)rÚsqlÚparamsr
 								)rrÚlistr)rs"rrrns%€÷#ñ#Œsð#œEð#¬4´:ñ#rcóÜ€\4;_uu_4pVPW4P4pRRR4XUu.uFp\V4NK	up# +'giL+;iuupi©N)rLrIÚfetchallr)rNrOrKÚrowsÚrs&&   rÚqueryrVnsJ€Ü	�Œ�tØ�|‰|˜CÓ(×1Ñ1Ó3ˆ÷
-											firmware&dashboard changes
										
										
											2026-04-05 13:06:25 +03:00
+								á!Ó"™T˜ŒD�ŽG™TÑ"Ð"÷
 								�üâ"s“ A¿A)ÁA&	cóJ€V^8„dQhR\R,R\R\/#)rÚ	last_seenNÚ	thresholdr
-											ESP32 WiFi recon cluster
										
										
											2026-04-03 14:38:38 +03:00
+								©rr)rs"rrrts%€÷ñœC $�Jð´3ðÌñrcóô€V'gR#\PPV4p\PP4V,
 								P4pW18:dR#R# \dR#i;i)ÚofflineÚonline)ÚdatetimeÚ
 								fromisoformatÚutcnowÚ
 								total_secondsr;)rXrYÚdtÚdeltas&&  rÚ_node_statusrdtsg€ßÙðÜ
 								×
-											firmware&dashboard changes
										
										
											2026-04-05 13:06:25 +03:00
+								Ñ
-											ESP32 WiFi recon cluster
										
										
											2026-04-03 14:38:38 +03:00
+								×
 								,Ñ
 								,¨YÓ
 ˆÜ×"Ñ"×)Ñ)Ó+¨bÕ0×?Ñ?ÓAˆØ Ô-ˆxÐ<°9Ð<øÜôÚðúsŒAA(Á&A(Á(A7Á6A7có:€V^8„dQhR\\,/#rA©rPr)rs"rrr€s€÷ñ”Tœ$•Zñrcó€\R4p\R4pVUu/uFq"R,VbK	ppVFÈpVPVR,/4pVPR4VR&VPR4VR&VPR4VR&VPR4VR&VR,;'g
 								VR,VR&VR,'d\VR,^R	7VR
 								&K±\VR,^<R	7VR
-											firmware&dashboard changes
										
										
											2026-04-05 13:06:25 +03:00
+								&KÊ	V#uupi)a
 								        SELECT
 								            node_id,
-											ESP32 WiFi recon cluster
										
										
											2026-04-03 14:38:38 +03:00
+								            MAX(received_at)  AS last_beacon,
 								            COUNT(*)          AS total_events,
 								            MIN(received_at)  AS first_seen
 								        FROM beacon_events
 								        GROUP BY node_id
 								        ORDER BY node_id ASC
 								    zÕ
 								        SELECT node_id, received_at AS last_heartbeat,
 								               uptime_ms, free_heap, wifi_rssi
 								        FROM heartbeat_events
 								        WHERE id IN (SELECT MAX(id) FROM heartbeat_events GROUP BY node_id)
 								    Únode_idÚlast_heartbeatÚ	uptime_msÚ	free_heapÚ	wifi_rssiÚlast_beaconrX©rYÚstatus)rVrrd)rTÚhb_rowsrUÚhb_mapÚhbs     rÚbuild_nodesrs€s€Üð	ó		€Dôðó	€Gñ(/Ó
 								/¡w !�	�l˜AŠo¡w€FÐ
 								/Û
-											firmware&dashboard changes
										
										
											2026-04-05 13:06:25 +03:00
+								ˆØ
 								�Z‰Z˜˜)� bÓ
 								)ˆØ Ÿf™fÐ%5Ó6ˆÐ
-											ESP32 WiFi recon cluster
										
										
											2026-04-03 14:38:38 +03:00
+								ÑØ Ÿf™f [Ó1ˆˆ+‰Ø Ÿf™f [Ó1ˆˆ+‰Ø Ÿf™f [Ó1ˆˆ+‰ØÐ 0Õ1×EÐE°Q°}Õ5Eˆˆ+‰àÐ
-											firmware&dashboard changes
										
										
											2026-04-05 13:06:25 +03:00
+								×ÔÜ& qÐ)9Õ':ÀbÔIˆAˆh‹Kä& q¨Õ'7À2ÔFˆAˆh‹Kñð€Kùò0s›C?có`€V^8„dQhR\R\R,R\\,/#)rÚlimitrhNr
-											ESP32 WiFi recon cluster
										
										
											2026-04-03 14:38:38 +03:00
+								)rrrPr)rs"rrr¢s)€÷
 								ñ
 								œð
 								´#¸µ*ð
 								ÌÌTÍ
 								ñ
 								rcóF€V'd\RW34#\RV34#)zt
 								            SELECT * FROM beacon_events
 								            WHERE node_id = ?
 								            ORDER BY id DESC LIMIT ?
 								        zJ
 								        SELECT * FROM beacon_events
 								        ORDER BY id DESC LIMIT ?
-											firmware&dashboard changes
										
										
											2026-04-05 13:06:25 +03:00
+								    ©rV©rurhs&&rÚbuild_eventsry¢s:€ßÜððÐ
 								ó	ð	ô
 								ððˆóðrcó:€V^8„dQhR\\,/#rArf)rs"rrr¯s€÷ñœœT�
 								ñrcó€\R4pV#)aê
 								        SELECT
 								            ssid,
 								            bssid,
 								            MAX(rssi)                AS best_rssi,
 								            ROUND(AVG(rssi), 1)      AS avg_rssi,
 								            channel,
-											ESP32 WiFi recon cluster
										
										
											2026-04-03 14:38:38 +03:00
+								            encryption,
 								            COUNT(*)                 AS times_seen,
 								            COUNT(DISTINCT node_id)  AS node_count,
 								            MAX(received_at)         AS last_seen
 								        FROM beacon_events
-											firmware&dashboard changes
										
										
											2026-04-05 13:06:25 +03:00
+								        WHERE bssid IS NOT NULL
-											ESP32 WiFi recon cluster
										
										
											2026-04-03 14:38:38 +03:00
+								        GROUP BY bssid
-											firmware&dashboard changes
										
										
											2026-04-05 13:06:25 +03:00
+								        ORDER BY times_seen DESC
 								        LIMIT 300
 								    rw)rTs rÚbuild_networksr|¯s€Üðó	€Dð"€Krcó:€V^8„dQhR\\,/#rArf)rs"rrrÄs€÷'ñ'”tœD•zñ'rcóÒ€\R4pV'g.#VUu.uFqR,NK
 									ppRPR\V4,4p\RVR2\V44p/pVF2pVP	VR,.4PVR,4K4	VF;pVP
 								VR,.4VR&\VR,4wrxWqR	&W�R
 								&K=	V#uupi)zK
 								Per unique src_mac: aggregated stats and the SSIDs they were probing for.
 								aL
 								        SELECT
 								            src_mac,
 								            COUNT(*)                        AS times_seen,
 								            COUNT(DISTINCT node_id)         AS node_count,
 								            MAX(rssi)                        AS best_rssi,
 								            ROUND(AVG(rssi), 1)             AS avg_rssi,
 								            COUNT(DISTINCT NULLIF(ssid,'')) AS unique_ssids,
 								            MIN(received_at)                AS first_seen,
 								            MAX(received_at)                AS last_seen
 								        FROM probe_events
 								        WHERE src_mac IS NOT NULL
-											ESP32 WiFi recon cluster
										
										
											2026-04-03 14:38:38 +03:00
+								        GROUP BY src_mac
-											firmware&dashboard changes
										
										
											2026-04-05 13:06:25 +03:00
+								        ORDER BY times_seen DESC
 								        LIMIT 300
 								    Úsrc_macÚ,Ú?zS
-											ESP32 WiFi recon cluster
										
										
											2026-04-03 14:38:38 +03:00
+								        SELECT DISTINCT src_mac, ssid FROM probe_events
 								        WHERE src_mac IN (zI) AND ssid IS NOT NULL AND ssid != ''
-											firmware&dashboard changes
										
										
											2026-04-05 13:06:25 +03:00
+								        ORDER BY src_mac, ssid
 								    ÚssidÚprobed_ssidsr1r>)rVÚjoinr:rÚ
 								setdefaultÚappendrr?)	rTrUÚmac_listÚplaceholdersÚ	ssid_rowsÚssids_by_macÚsr1r>s	         rÚ
 								build_clientsrŒÄsù€ôðó	€D÷"Øˆ	Ù*.Ó/©$ Q�i—L�L©$€HÐ/Ø—8‘8˜C¤# h£-Õ/Ó0€LÜðà'˜.ð)ðô
 								ˆx‹ó	€Ið
 								€LÛ
 								ˆØ×Ñ  )¥¨bÓ1×8Ñ8¸¸6½ÖCñóˆØ(×,Ñ,¨Q¨y\¸2Ó>ˆˆ.ÑÜ'¨¨)Ó5ÑˆØ ˆ(‰Ø$ˆ,‹ñ	ð
 								€Kùò!0sšC$có$€V^8„dQhR\/#rA©r)rs"rrrîs€÷86ñ86œ$ñ86rcóÊ€\R4pVUu.uFqR,NK
 									pp\R4p/pVFipVR,pWT9d$RVRVR,RVR,RVR,R//WE&R	VR	,R
 								VR
 								,RVR,/WE,R,VR,&Kk	\VP4RR
 								R7pVFp\VR,4VR&K	RVRV/#uupi)zÒ
 								For every BSSID, return per-node RSSI stats side by side.
 								Result: { node_ids: [...], networks: [{bssid, ssid, channel, encryption,
 								          node_count, nodes: {node_id: {best_rssi, avg_rssi, times_seen}}}] }
 								z;SELECT DISTINCT node_id FROM beacon_events ORDER BY node_idrha«
 								        SELECT
 								            b.bssid,
 								            MAX(b.ssid)            AS ssid,
 								            MAX(b.channel)         AS channel,
 								            MAX(b.encryption)      AS encryption,
 								            b.node_id,
 								            MAX(b.rssi)            AS best_rssi,
 								            ROUND(AVG(b.rssi), 1)  AS avg_rssi,
 								            COUNT(*)               AS times_seen
 								        FROM beacon_events b
 								        WHERE b.bssid IN (
 								            SELECT bssid FROM beacon_events
 								            WHERE bssid IS NOT NULL
 								            GROUP BY bssid
 								            ORDER BY COUNT(DISTINCT node_id) DESC, COUNT(*) DESC
 								            LIMIT 300
 								        )
 								        GROUP BY b.bssid, b.node_id
 								        ORDER BY b.bssid, b.node_id
 								    Úbssidr‚ÚchannelÚ
 								encryptionÚnodesÚ	best_rssiÚavg_rssiÚ
 								times_seencó&€\VR,4#)r“)r:)Úxs&rÚ<lambda>Ú"build_cross_node.<locals>.<lambda> s€”c˜!˜G�*”orT)ÚkeyÚreverseÚ
 								node_countÚnode_idsÚnetworks)rVÚsortedÚvaluesr:)Ú	node_rowsrUržrTrŸr�ÚresultÚnets        rÚbuild_cross_noder¥îs
 								€ôÐSÓT€IÙ'0Ó1¡y !�9—�¡y€HÐ1äðó	€Dð,€HÛ
 								ˆØ�'•
 								ˆØÔ à˜eØ˜a �iØ˜a 	�lØ˜a �oØ˜bðˆH‰Oð
 								˜!˜K�.Ø˜!˜J�-Ø˜!˜L�/ð2
 								ˆ�˜Õ   9¥Ó.ñô Ø�‰ÓÙ%Øô€Fó
 								ˆÜ  G¥Ó-ˆˆLÓñð
 								˜ *¨fÐ5Ð5ùòc2s�C có$€V^8„dQhR\/#rArŽ)rs"rrr)s€÷nñnœñnrc
 								óä€\PP4pV\P!^R7,
 								PRR7pV\P!^R7,
 								PRR7p\	RV34p.pVF6p\VR,4wrgV'dK!WeR&VP
 								V4K8	\	RV34p.p	VF0p\VR,4wrgWeR&WuR&V	P
 								V4K2	\	R	V34p
 								\	R
 p.pVF0p\VR,4wrgWeR&WuR&VP
 								V4K2	\	R4p
 								RVR
 								V	RV
 								RVRV
 								/#)é©ÚhoursÚseconds©ÚtimespecaÃ
 								        SELECT src_mac,
 								               COUNT(*)              AS times_seen,
 								               MAX(rssi)             AS best_rssi,
 								               ROUND(AVG(rssi), 1)   AS avg_rssi,
 								               MAX(received_at)      AS last_seen,
 								               COUNT(DISTINCT node_id) AS node_count
 								        FROM probe_events
 								        WHERE src_mac IS NOT NULL AND received_at > ?
 								        GROUP BY src_mac
 								        HAVING COUNT(*) > 1
 								        ORDER BY last_seen DESC
 								    rr1a™
 								        SELECT src_mac,
 								               MIN(received_at)      AS first_seen,
 								               MAX(rssi)             AS best_rssi,
 								               COUNT(*)              AS times_seen,
 								               COUNT(DISTINCT node_id) AS node_count
 								        FROM probe_events
 								        WHERE src_mac IS NOT NULL
 								        GROUP BY src_mac
 								        HAVING MIN(received_at) > ?
 								        ORDER BY first_seen DESC
 								        LIMIT 100
 								    r>aó
 								        SELECT bssid,
 								               MAX(ssid)             AS ssid,
 								               MIN(received_at)      AS first_seen,
 								               MAX(rssi)             AS best_rssi,
 								               MAX(channel)          AS channel,
 								               MAX(encryption)       AS encryption,
 								               COUNT(DISTINCT node_id) AS node_count
 								        FROM beacon_events
 								        WHERE bssid IS NOT NULL
 								        GROUP BY bssid
 								        HAVING MIN(received_at) > ?
 								        ORDER BY first_seen DESC
 								        LIMIT 100
 								    af
 								        SELECT src_mac,
 								               COUNT(DISTINCT date(received_at)) AS days_seen,
 								               MIN(received_at)                  AS first_seen,
 								               MAX(received_at)                  AS last_seen,
 								               MAX(rssi)                         AS best_rssi,
 								               COUNT(*)                          AS times_seen,
 								               COUNT(DISTINCT node_id)           AS node_count
 								        FROM probe_events
 								        WHERE src_mac IS NOT NULL
 								        GROUP BY src_mac
 								        HAVING COUNT(DISTINCT date(received_at)) >= 2
 								        ORDER BY days_seen DESC, times_seen DESC
 								        LIMIT 50
 								    a×
 								        SELECT bssid,
 								               MAX(ssid)                         AS ssid,
 								               COUNT(DISTINCT date(received_at)) AS days_seen,
 								               MIN(received_at)                  AS first_seen,
 								               MAX(received_at)                  AS last_seen,
 								               MAX(rssi)                         AS best_rssi,
 								               MAX(channel)                      AS channel,
 								               MAX(encryption)                   AS encryption,
 								               COUNT(DISTINCT node_id)           AS node_count
 								        FROM beacon_events
 								        WHERE bssid IS NOT NULL
 								        GROUP BY bssid
 								        HAVING COUNT(DISTINCT date(received_at)) >= 2
 								        ORDER BY days_seen DESC, best_rssi DESC
 								        LIMIT 50
 								    ÚpresentÚnew_macsÚnew_networksÚreg_macsÚreg_networks)r^r`Ú	timedeltaÚ	isoformatrVr?r†)ÚnowÚ	cutoff_1hÚ
 								cutoff_24hÚpresent_rowsr®rUr1r>Únew_mac_rowsr¯r°Úreg_mac_rowsr±r²s              rÚbuild_presencer»)s�€Ü×"Ñ"×)Ñ)Ó+€CØœ×*Ò*°Ô3Õ3×>Ñ>È	Ð>ÓR€IØœ×*Ò*°Ô4Õ4×?Ñ?ÈÐ?ÓS€Jôððˆó€Lð€GÛ
 								ˆÜ'¨¨)Ó5Ñˆß‰zØ ˆh‰KØ�N‰N˜1Öñ	ôððˆó€Lð€HÛ
 								ˆÜ'¨¨)Ó5ÑˆØ ˆ(‰Ø$ˆ,‰Ø�‰˜Öñ	ôððˆó€Lô"ðó	€Lð€HÛ
 								ˆÜ'¨¨)Ó5ÑˆØ ˆ(‰Ø$ˆ,‰Ø�‰˜Öñ	ôðó	€Lð&	˜Ø˜Ø˜Ø˜Ø˜ððrcó$€V^8„dQhR\/#rArŽ)rs"rrršs€÷HñH”dñHrcóP€\PP4pV\P!^R7,
 								PRR7pV\P!^R7,
 								PRR7p\	R4p\	RV34pV'd´VUu.uFqUR,NK
 									ppRPR	\
 								V4,4p\	R
 								VR2\V44pVU	u/uFq™R,V	bK	p
 								p	VFDpV
 								PVR,/4pVPR4VR&VPR
 VR
 								&KF	\	RV34p\	R4p
 								V
 								'd•V
 								Uu.uFqîR,NK
 									ppRPR	\
 								V4,4p\	RVR2\V44pVU	u/uFq™R,V	R,bK	p
 								p	V
 								FpV
 								PVR,4VR&K 	\	R4pVF"p\VR,4wppVVR&VVR&K$	\	R4pVF"p	\V	R,4wppVV	R&VV	R&K$	\	R4pRTRTRV'd
 								V^,M/RV
 								RVRVR V/#uupiuup	iuupiuup	i)!é)Úminutesr«r¬r©zL
 								        SELECT * FROM deauth_events
 								        ORDER BY id DESC LIMIT 100
 								    aÈ
 								        SELECT
 								            bssid,
 								            subtype,
 								            COUNT(*)                AS count,
 								            COUNT(DISTINCT node_id) AS node_count,
 								            COUNT(DISTINCT src)     AS unique_srcs,
 								            MIN(received_at)        AS first_seen,
 								            MAX(received_at)        AS last_seen
 								        FROM deauth_events
 								        WHERE received_at > ?
 								        GROUP BY bssid, subtype
 								        HAVING COUNT(*) >= 10
 								        ORDER BY count DESC
 								    r�r€r�z{
 								            SELECT bssid, MAX(ssid) AS ssid, MAX(encryption) AS encryption
 								            FROM beacon_events WHERE bssid IN (z%)
 								            GROUP BY bssid
 								        r‚r’aˆ
 								        SELECT
 								            COUNT(*)                AS total,
 								            COUNT(DISTINCT bssid)   AS unique_bssids,
 								            COUNT(DISTINCT src)     AS unique_srcs,
 								            SUM(CASE WHEN subtype='deauth' THEN 1 ELSE 0 END)   AS deauth_count,
 								            SUM(CASE WHEN subtype='disassoc' THEN 1 ELSE 0 END) AS disassoc_count
 								        FROM deauth_events
 								        WHERE received_at > ?
 								    a�
 								        SELECT
 								            bssid,
 								            COUNT(*)                AS total_frames,
 								            COUNT(DISTINCT src)     AS unique_srcs,
 								            COUNT(DISTINCT node_id) AS node_count,
 								            MIN(received_at)        AS first_seen,
 								            MAX(received_at)        AS last_seen
 								        FROM deauth_events
 								        GROUP BY bssid
 								        ORDER BY total_frames DESC
 								        LIMIT 10
 								    z\
 								            SELECT bssid, MAX(ssid) AS ssid
 								            FROM beacon_events WHERE bssid IN (aŸ
 								        SELECT
 								            dst,
 								            COUNT(*)                    AS total_frames,
 								            COUNT(DISTINCT bssid)       AS networks_used,
 								            COUNT(DISTINCT node_id)     AS node_count,
 								            MIN(received_at)            AS first_seen,
 								            MAX(received_at)            AS last_seen
 								        FROM deauth_events
 								        GROUP BY dst
 								        ORDER BY total_frames DESC
 								        LIMIT 10
 								    Údstr1r>a‡
 								        SELECT reason,
 								               COUNT(*)                AS total_frames,
 								               COUNT(DISTINCT bssid)   AS unique_bssids,
 								               COUNT(DISTINCT dst)     AS unique_targets,
 								               MIN(received_at)        AS first_seen,
 								               MAX(received_at)        AS last_seen
 								        FROM deauth_events
 								        GROUP BY reason
 								        ORDER BY total_frames DESC
 								    ÚreasonÚdescriptionÚclassificationa%
 								        SELECT date(received_at)                            AS day,
 								               CAST(strftime('%H', received_at) AS INTEGER) AS hour,
 								               COUNT(*)                                     AS frames
 								        FROM deauth_events
 								        GROUP BY day, hour
 								        ORDER BY day, hour
 								    ÚrecentÚburstsÚsummaryÚtop_targetsÚtop_targeted_devicesÚreason_statsÚheatmap)r^r`r³r´rVr„r:rrr?r)rµÚ	cutoff_5mr¶rÄrÅÚbÚ
 								bssid_listrˆr‰rUÚssid_mapr¤rÆrÇÚtrÈÚdr1r>Úreason_rowsÚdescrÃÚheatmap_rowss                       rÚbuild_alertsrÔšsë€Ü×#Ñ#×*Ñ*Ó,€CØœ×+Ò+°AÔ6Õ6×AÑAÈ9ÐAÓU€IØœ×+Ò+°!Ô4Õ4×?Ñ?ÈÐ?ÓS€Iôðó	€Fôððˆó€F÷"Ù*0Ó1©& Q˜—j�j©&ˆ
 								Ð1Ø—x‘x ¤c¨*£oÕ 5Ó6ˆÜð0à0<¨~ð>	ðô�:Ó
 								ó	 ˆ	ñ
 								,5Ó5©9 a�g•J ’M©9ˆÐ5ÛˆAØ—,‘,˜q �z¨2Ó.ˆCØ!Ÿg™g f›oˆAˆf‰IØ!Ÿg™g lÓ3ˆAˆl‹Oñôð	ðˆó	€Gôðó	€K÷Ù,7Ó8©K q˜'Ÿ
 								˜
 								©Kˆ
 								Ð8Ø—x‘x ¤c¨*£oÕ 5Ó6ˆÜð"0à0<¨~ð>	ðô�:Ó
 								ó	 ˆ	ñ
 =Ó=±9¨a�g•J  &¥	Ò)±9ˆÐ=ÛˆAØ Ÿ™ Q w¥ZÓ0ˆAˆf‹Iñô!ð"ó	Ðó"ˆÜ'¨¨%Ó1Ñˆ�
 								Ø ˆˆ(‰Ø$ˆˆ,‹ñ"ôð
 								ó
 									€KóˆÜ1°!°Hµ+Ó>ÑˆˆnØ"ˆˆ-ÑØ,ˆÐ
 								Óñôðó	€Lð	 Ø Ø¯g ¨¦
 								¸2Ø ØÐ 4Ø Ø ððùòC2ùò6ùòB9ùò>sÂJÃ0JÅ2JÇJ#có0€V^8„dQhR\R\/#)rÚqr
 								r)rs"rrr%s€÷WñW”CðWœDñWrcó(a€V'd\V4^8d/#RVR2p/p\RW34pV'dW2R&\RV34pV'd�\RV34p/pVF2pVPVR,.4PVR,4K4	VF;p\	VR,4wršW˜R&W¨R	&VPVR,.4VR
 								&K=	WBR&\RV34pV'd*VFp\	VR,4wršW˜R&W¨R	&K!	W²R
 								&\RV34pV'd*VFp\	VR,4wršW˜R&W¨R	&K!	WÂR&\RV34p
 								V
 								'dWÒR&VP
 o\P4UU	u.uFwréSV	P
 gKVNK 	up	pR,pV'Ed;RPR\V4,4p\RVR2\V44pV'dš\RVR2\V44p/pVF2pVPVR,.4PVR,4K4	VF;p\	VR,4wršW˜R&W¨R	&VPVR,.4VR
 								&K=	VVR&\RVR2\V44pV'dVVR&RV9gRV9d,\V3Rl\P44V4VR&V#uup	pi) rÚ%aä
 								        SELECT bssid, MAX(ssid) AS ssid,
 								               COUNT(*) AS times_seen,
 								               MAX(rssi) AS best_rssi, ROUND(AVG(rssi),1) AS avg_rssi,
 								               MAX(channel) AS channel, MAX(encryption) AS encryption,
 								               COUNT(DISTINCT node_id) AS node_count,
 								               MIN(received_at) AS first_seen, MAX(received_at) AS last_seen
 								        FROM beacon_events
 								        WHERE bssid LIKE ? OR ssid LIKE ?
 								        GROUP BY bssid ORDER BY times_seen DESC LIMIT 20
 								    Ú
-											ESP32 WiFi recon cluster
										
										
											2026-04-03 14:38:38 +03:00
+								as_networkag
 								        SELECT src_mac,
 								               COUNT(*) AS times_seen,
 								               MAX(rssi) AS best_rssi, ROUND(AVG(rssi),1) AS avg_rssi,
 								               COUNT(DISTINCT node_id) AS node_count,
 								               MIN(received_at) AS first_seen, MAX(received_at) AS last_seen
 								        FROM probe_events
 								        WHERE src_mac LIKE ?
 								        GROUP BY src_mac LIMIT 10
 								    zŠ
 								            SELECT DISTINCT src_mac, ssid FROM probe_events
 								            WHERE src_mac LIKE ? AND ssid IS NOT NULL AND ssid != ''
 								        rr‚r1r>rƒÚ	as_clienta'
 								        SELECT src_mac,
 								               COUNT(*) AS times_seen,
 								               MAX(rssi) AS best_rssi,
 								               MIN(received_at) AS first_seen, MAX(received_at) AS last_seen
 								        FROM probe_events
 								        WHERE ssid LIKE ?
 								        GROUP BY src_mac ORDER BY times_seen DESC LIMIT 20
 								    Úprobing_foraN
 								        SELECT dst,
 								               COUNT(*) AS total_frames,
-											firmware&dashboard changes
										
										
											2026-04-05 13:06:25 +03:00
+								               COUNT(DISTINCT bssid) AS networks_used,
-											ESP32 WiFi recon cluster
										
										
											2026-04-03 14:38:38 +03:00
+								               COUNT(DISTINCT node_id) AS node_count,
-											firmware&dashboard changes
										
										
											2026-04-05 13:06:25 +03:00
+								               MIN(received_at) AS first_seen, MAX(received_at) AS last_seen
-											ESP32 WiFi recon cluster
										
										
											2026-04-03 14:38:38 +03:00
+								        FROM deauth_events
 								        WHERE dst LIKE ?
 								        GROUP BY dst LIMIT 10
 								    rÀÚ	as_victimaS
 								        SELECT bssid,
 								               COUNT(*) AS total_frames,
 								               COUNT(DISTINCT dst) AS unique_targets,
 								               COUNT(DISTINCT node_id) AS node_count,
 								               MIN(received_at) AS first_seen, MAX(received_at) AS last_seen
 								        FROM deauth_events
 								        WHERE bssid LIKE ?
 								        GROUP BY bssid LIMIT 10
 								    Úas_impersonated:Né<Nr€r�af
 								            SELECT src_mac,
 								                   COUNT(*) AS times_seen,
 								                   MAX(rssi) AS best_rssi, ROUND(AVG(rssi),1) AS avg_rssi,
 								                   COUNT(DISTINCT node_id) AS node_count,
-											firmware&dashboard changes
										
										
											2026-04-05 13:06:25 +03:00
+								                   MIN(received_at) AS first_seen, MAX(received_at) AS last_seen
 								            FROM probe_events
 								            WHERE substr(src_mac,1,8) IN (zI)
 								            GROUP BY src_mac ORDER BY times_seen DESC LIMIT 30
 								        zo
 								                SELECT DISTINCT src_mac, ssid FROM probe_events
 								                WHERE substr(src_mac,1,8) IN (zD)
 								                  AND ssid IS NOT NULL AND ssid != ''
 								            Úvendor_clientsaÁ
 								            SELECT bssid, MAX(ssid) AS ssid,
 								                   COUNT(*) AS times_seen,
 								                   MAX(rssi) AS best_rssi, ROUND(AVG(rssi),1) AS avg_rssi,
 								                   MAX(channel) AS channel, MAX(encryption) AS encryption,
 								                   COUNT(DISTINCT node_id) AS node_count,
 								                   MIN(received_at) AS first_seen, MAX(received_at) AS last_seen
 								            FROM beacon_events
 								            WHERE substr(bssid,1,8) IN (zG)
 								            GROUP BY bssid ORDER BY times_seen DESC LIMIT 30
 								        Úvendor_networksc3óZ<"€TF wrSVP49gKVx€K"	R#5irR)Úlower)Ú.0ÚkÚvÚq_lowers&  €rÚ	<genexpr>Úbuild_search.<locals>.<genexpr>¹s"øé€ÐG™‘t�q°'¸Q¿W¹W»YÑ2F—’›ùsƒ+¡
 								+Úvendor_name)r:rVr…r†r?rrâr<Úitemsr„rÚnext)rÖÚlikeÚresultsrÙrÚr‰rŠr‹rUr1r>rÛrÜrÝr0Úmatching_prefixesÚphrßràræs&                  @rÚbuild_searchrð%s‰ø€ß”�A“˜”
 								Øˆ	Ø
 								ˆqˆc�ˆ8€DØ€Gôð
 								ðˆó
 								€J÷Ø *�Ñôð	ðˆó	€I÷ÜððˆWóˆ	ð ˆÛˆAØ×#Ñ# A i¥L°"Ó5×<Ñ<¸Q¸v½YÖGñãˆAÜ!+¨A¨iLÓ!9ÑˆFØ &ˆh‰KØ *ˆl‰OØ ,× 0Ñ 0°°9µ¸rÓ BˆAˆnÓñ	ð
 								 )�Ñôððˆó€K÷ÛˆAÜ!+¨A¨iLÓ!9ÑˆFØ$ˆh‰KØ(ˆl‹Oñð"-�
 								Ñôð	ðˆó	€I÷ÛˆAÜ!+¨A¨eHÓ!5ÑˆFØ$ˆh‰KØ(ˆl‹Oñð )�Ñôð	ðˆó	€O÷Ø%4Ð!Ñ"ð�g‰g‹i€Gä%,§]¡]¤_ôÙ%4‘>�6Ø�f—l‘l“nÑ$÷	ˆ¡_òð
 								õÐ÷
 								ÐØ
 								�X‰X�cœCÐ 1Ó2Õ2Ó
 ˆäð$+ð,.¨$ð/	ð	 ôÐ$Ó
 								%ó	'ˆ÷Üð#/à/1¨dð3
 								ðôÐ(Ó)ó	+ˆIð
 								"$ˆLÛ�Ø×'Ñ'¨¨)°bÓ9×@Ñ@ÀÀ6ÅÖKñã#�Ü%/°°)µÓ%=Ñ"�Ø$*�(‘Ø$.�,‘Ø$0×$4Ñ$4°Q°yµ\À2Ó$F��.Ó!ñ	$ð
 								)7ˆGÐ$Ñ%äð%)ð*,¨ð-	ð
 								!ôÐ$Ó
 								%ó
 								'ˆ÷Ø)8ˆGÐ%Ñ&à˜wÔ&Ð*;¸wÔ*FÜ%)ÜGœwŸ}™}œÓGÈó&ˆG�MÑ"ð€NùóksÆLÆ8Lcó>€V^8„dQhR\R\R,/#)rrhr
 								Nr)rs"rrr¿s€÷$ñ$œsð$¤t¨d¥{ñ$rcó€\RV34pV'gR#V^,p\RV34pV'd
 								V^,M/pVPR4VR&VPR4VR&VPR4VR&VPR4VR&VR,'d\VR,^R7VR&M\VR	,^<R7VR&VR
 								,'d\VR
 								,^4MRVR
 								&\	\
 								VR7VR&V#)
 								aà
 								        SELECT
 								            node_id,
 								            MIN(received_at) AS first_seen,
 								            MAX(received_at) AS last_seen,
 								            COUNT(*)         AS total_events,
 								            COUNT(DISTINCT ssid)  AS unique_ssids,
 								            COUNT(DISTINCT bssid) AS unique_bssids,
 								            AVG(rssi)        AS avg_rssi,
 								            MIN(rssi)        AS min_rssi,
 								            MAX(rssi)        AS max_rssi
 								        FROM beacon_events
 								        WHERE node_id = ?
 								        GROUP BY node_id
-											ESP32 WiFi recon cluster
										
										
											2026-04-03 14:38:38 +03:00
+								    Nz¬
 								        SELECT received_at AS last_heartbeat, uptime_ms, free_heap, wifi_rssi
 								        FROM heartbeat_events
-											firmware&dashboard changes
										
										
											2026-04-05 13:06:25 +03:00
+								        WHERE node_id = ?
-											ESP32 WiFi recon cluster
										
										
											2026-04-03 14:38:38 +03:00
+								        ORDER BY id DESC LIMIT 1
 								    rirjrkrlrnrorXr•rxÚevents)rVrrdÚroundryÚ	EVENT_CAP)rhrTÚdetailrprrs&    rÚbuild_node_detailr÷¿s€Üððˆó€D÷ÙØ
 								�!�W€FÜðð
 								ˆó€G÷ˆ�Ž B€BØ!Ÿv™vÐ&6Ó7€FÐÑØ!Ÿv™v kÓ2€Fˆ;ÑØ!Ÿv™v kÓ2€Fˆ;ÑØ!Ÿv™v kÓ2€Fˆ;ÑØ
 								Ð×ÔÜ'¨Ð/?Õ(@ÈBÔOˆˆxÒä'¨¨{Õ(;ÀrÔJˆˆxÑØ9?À
 								×9KÔ9Kœ˜v jÕ1°1Ô5ÐQU€Fˆ:ÑÜ%¬I¸wÔG€Fˆ8ÑØ€MrcóP€\4;_uu_4pVPR4VPR4VPR4VPR4VPR4VPR4VP4RRR4R# +'giR#;i)z8Create tables if they don't exist. Runs once at startup.aF
 								            CREATE TABLE IF NOT EXISTS beacon_events (
-											firmware&dashboard changes
										
										
											2026-04-05 13:06:25 +03:00
+								                id INTEGER PRIMARY KEY AUTOINCREMENT, received_at TEXT NOT NULL,
 								                node_id TEXT, node_ts INTEGER, ssid TEXT, bssid TEXT,
 								                rssi INTEGER, channel INTEGER, encryption TEXT, importance TEXT, confidence TEXT
 								            )
 								        a
 								            CREATE TABLE IF NOT EXISTS probe_events (
 								                id INTEGER PRIMARY KEY AUTOINCREMENT, received_at TEXT NOT NULL,
 								                node_id TEXT, node_ts INTEGER, src_mac TEXT, ssid TEXT,
 								                rssi INTEGER, importance TEXT
 								            )
 								        a
 								            CREATE TABLE IF NOT EXISTS heartbeat_events (