Fix SSE reconnect storm and document node dropout findings
- Fix stale EventSource accumulation: onerror handler now closes the existing EventSource before creating a new one, preventing multiple live instances from stacking up and flooding /api/nodes on reconnect. - Add in-flight guard on /api/nodes fetch so concurrent requests are dropped if one is already in progress. - Add dominant reason code column to Alerts tab (Most Impersonated Networks and Most Targeted Devices tables) and Sessions tab rows. - README: document node dropout root cause (AP overwhelm on staggered power cycle), overnight stability confirmation, and dedicated AP todo. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
@@ -349,6 +349,16 @@ The **Bursts** section is the anomaly detector. A single unique source MAC gener
|
||||
|
||||
Multi-node confirmation (`node_count > 1`, highlighted red) significantly raises confidence — it means the source is physically close and strong, not a distant weak signal.
|
||||
|
||||
### Node dropout — AP overwhelm on simultaneous reconnect
|
||||
|
||||
Observed 2026-04-06: three of four nodes dropped off the dashboard after being power cycled individually at different times. Symptoms included reason-15 deauth floods (`4-way handshake timeout`) from the affected nodes captured by the surviving node, and nodes getting stuck in a reconnect loop without ever successfully sending data to the coordinator.
|
||||
|
||||
**Root cause:** the sandbox AP was overwhelmed by multiple nodes power cycling at slightly different times and hammering it with simultaneous association requests. Each node hops channels every ~4 seconds, briefly dropping and reconnecting to sandbox on every cycle. When several nodes do this at the same time after a staggered power cycle, the AP's association table fills with stale entries and stops completing WPA2 handshakes for new clients.
|
||||
|
||||
**Confirmed not a firmware issue:** all four nodes ran for 21 hours continuously without a single drop when power cycled simultaneously (clean start, all connect at once). Heap stayed stable across all nodes throughout (234K–247K, no drift).
|
||||
|
||||
**Mitigation:** power cycle all nodes at the same time rather than individually, so they all connect fresh together rather than in a staggered loop. Long-term fix is a dedicated AP for the nodes only, so their reconnect churn is isolated from regular network traffic and the AP is never competing with other clients.
|
||||
|
||||
### Our own networks
|
||||
|
||||
To avoid investigating our own infrastructure, these SSIDs and BSSIDs are ours:
|
||||
@@ -409,8 +419,12 @@ Broadcasting an open unauthenticated hotspot. Next step: connect via Parrot lapt
|
||||
- [x] Sessions tab — deauth events grouped into sessions by source MAC + 2-min gap, sortable, expandable rows
|
||||
- [x] Dashboard performance overhaul — fixed tab switch latency and Networks tab failing to load (see below)
|
||||
- [x] DB pruning / retention policy — background task deletes events older than HOT_DAYS every 6 hours
|
||||
- [x] Alerts tab — dominant reason code added to Most Impersonated Networks and Most Targeted Devices tables
|
||||
- [x] Sessions tab — dominant reason code + description shown per session row and in expanded detail panel
|
||||
- [x] SSE reconnect bug fix — multiple stale EventSource instances were accumulating on reconnect, flooding /api/nodes on tab re-open; fixed with proper close-before-reconnect and in-flight guard
|
||||
- [ ] Surface assoc events in dashboard (Search results or dedicated view)
|
||||
- [ ] Scan interval control from dashboard
|
||||
- [ ] Dedicated AP for nodes to isolate reconnect churn from regular network traffic
|
||||
|
||||
---
|
||||
|
||||
|
||||
@@ -34,6 +34,13 @@ function impBadge(imp) {
|
||||
return `<span class="imp-${cls}">${fmt(imp)}</span>`;
|
||||
}
|
||||
|
||||
function reasonCell(code, desc, cls) {
|
||||
if (code == null) return '<span class="muted">—</span>';
|
||||
const color = cls === 'attack' ? '#e74c3c' : cls === 'suspicious' ? '#e67e22' : 'var(--text-muted)';
|
||||
return `<span style="color:${color};font-weight:${cls === 'attack' ? 500 : 400}">${code}</span>`
|
||||
+ `<span class="muted" style="font-size:10px;margin-left:4px">${desc || ''}</span>`;
|
||||
}
|
||||
|
||||
function encClass(enc) {
|
||||
if (!enc || enc === 'OPEN' || enc === 'None') return 'enc-open';
|
||||
if (enc === 'WPA3' || enc === 'WPA2/WPA3') return 'enc-secure';
|
||||
@@ -652,6 +659,7 @@ function renderSessionsView() {
|
||||
<td>${s.unique_targets.length}</td>
|
||||
<td>${s.node_count}</td>
|
||||
<td>${s.peak_rssi != null ? s.peak_rssi + ' dBm' : '—'}</td>
|
||||
<td>${reasonCell(s.dominant_reason, s.dominant_reason_desc, s.dominant_reason_class)}</td>
|
||||
<td><span class="sev-label ${sevClass}">${s.severity}</span></td>
|
||||
`;
|
||||
tbody.appendChild(mainRow);
|
||||
@@ -683,14 +691,14 @@ function renderSessionsView() {
|
||||
: '';
|
||||
|
||||
detailRow.innerHTML = `
|
||||
<td colspan="11" class="session-detail-cell">
|
||||
<td colspan="12" class="session-detail-cell">
|
||||
<div class="session-detail-inner">
|
||||
<div class="session-meta">
|
||||
<span><strong>BSSIDs:</strong> ${bssidList}</span>
|
||||
<span><strong>Targets:</strong> ${targetList}</span>
|
||||
<span><strong>Nodes:</strong> ${nodeList}</span>
|
||||
<span><strong>Avg RSSI:</strong> ${s.avg_rssi != null ? s.avg_rssi + ' dBm' : '—'}</span>
|
||||
<span><strong>Reason:</strong> ${s.dominant_reason}</span>
|
||||
<span><strong>Dominant Reason:</strong> ${reasonCell(s.dominant_reason, s.dominant_reason_desc, s.dominant_reason_class)}</span>
|
||||
</div>
|
||||
<table class="session-events-table">
|
||||
<thead><tr>
|
||||
@@ -791,6 +799,7 @@ function renderAlertsView() {
|
||||
<td class="dim">${fmt(t.bssid)}</td>
|
||||
<td>${fmt(t.ssid, '<hidden>')}</td>
|
||||
<td style="color:#e74c3c;font-weight:500">${t.total_frames}</td>
|
||||
<td>${reasonCell(t.dominant_reason, t.dominant_reason_desc, t.dominant_reason_class)}</td>
|
||||
<td class="muted">${t.unique_srcs}</td>
|
||||
<td class="${t.node_count > 1 ? 'nodes-multi' : 'muted'}">${t.node_count}</td>
|
||||
<td class="dim">${shortTime(t.last_seen)}</td>
|
||||
@@ -814,6 +823,7 @@ function renderAlertsView() {
|
||||
<td class="dim">${fmt(d.dst)}</td>
|
||||
<td class="${vendorCls}">${d.vendor || '—'}</td>
|
||||
<td style="color:#e74c3c;font-weight:500">${d.total_frames}</td>
|
||||
<td>${reasonCell(d.dominant_reason, d.dominant_reason_desc, d.dominant_reason_class)}</td>
|
||||
<td class="muted">${d.networks_used}</td>
|
||||
<td class="${d.node_count > 1 ? 'nodes-multi' : 'muted'}">${d.node_count}</td>
|
||||
<td class="dim">${shortTime(d.last_seen)}</td>
|
||||
@@ -1234,8 +1244,14 @@ async function init() {
|
||||
}
|
||||
|
||||
// ── SSE ───────────────────────────────────────────────────────────────────────
|
||||
let _currentES = null; // track active EventSource so we can close it on reconnect
|
||||
let _nodesFetching = false; // in-flight guard — prevents concurrent /api/nodes requests
|
||||
|
||||
function startSSE() {
|
||||
if (_currentES) { _currentES.close(); _currentES = null; }
|
||||
|
||||
const es = new EventSource('/api/stream');
|
||||
_currentES = es;
|
||||
const dot = document.getElementById('live-dot');
|
||||
let sseTimer = null;
|
||||
|
||||
@@ -1265,18 +1281,29 @@ function startSSE() {
|
||||
else if (currentView === 'alerts') await fetchAlerts();
|
||||
else if (currentView === 'analysis') await showAnalysis();
|
||||
|
||||
const nodes = await fetch('/api/nodes').then(r => r.json());
|
||||
nodeData = Object.fromEntries(nodes.map(n => [n.node_id, n]));
|
||||
renderSidebar(nodes);
|
||||
|
||||
if (currentView === 'detail' && currentNode) {
|
||||
const data = await fetch(`/api/nodes/${currentNode}`).then(r => r.json());
|
||||
renderDetail(data);
|
||||
if (!_nodesFetching) {
|
||||
_nodesFetching = true;
|
||||
try {
|
||||
const nodes = await fetch('/api/nodes').then(r => r.json());
|
||||
nodeData = Object.fromEntries(nodes.map(n => [n.node_id, n]));
|
||||
renderSidebar(nodes);
|
||||
if (currentView === 'detail' && currentNode) {
|
||||
const data = await fetch(`/api/nodes/${currentNode}`).then(r => r.json());
|
||||
renderDetail(data);
|
||||
}
|
||||
} finally {
|
||||
_nodesFetching = false;
|
||||
}
|
||||
}
|
||||
}, 2000);
|
||||
};
|
||||
|
||||
es.onerror = () => { dot.classList.remove('alive'); setTimeout(startSSE, 3000); };
|
||||
es.onerror = () => {
|
||||
dot.classList.remove('alive');
|
||||
es.close();
|
||||
_currentES = null;
|
||||
setTimeout(startSSE, 3000);
|
||||
};
|
||||
}
|
||||
|
||||
// ── Boot ──────────────────────────────────────────────────────────────────────
|
||||
|
||||
Reference in New Issue
Block a user