Add deauth/disassoc detection — firmware capture, coordinator ingestion, Alerts tab with burst detection

README.md

@@ -151,6 +151,24 @@ Each node:
 }
 ```
 
+**Deauth / Disassoc event** (management frame captured in promiscuous mode):
+```json
+{
+  "node_id": "F68D6E30",
+  "ts":      12345,
+  "type":    "deauth",
+  "src":     "AA:BB:CC:DD:EE:FF",
+  "dst":     "11:22:33:44:55:66",
+  "bssid":   "AA:BB:CC:DD:EE:FF",
+  "reason":  7,
+  "rssi":    -61
+}
+```
+- `type` is `deauth` (0xC0) or `disassoc` (0xA0)
+- `dst = FF:FF:FF:FF:FF:FF` means broadcast deauth — a classic deauth flood signature
+- `reason` is the 802.11 reason code (7 = class 3 frame received from non-associated station, common in attack tools)
+- Captured passively in the same promiscuous callback as probe requests, flushed to coordinator after each scan cycle
+
 **Heartbeat event** (node health, sent every 10 seconds):
 ```json
 {
@@ -231,6 +249,9 @@ Open `http://192.168.1.133:8080` in your browser.
 - **RSSI history chart** — opens from any Networks row. Shows signal strength over time per node (1h / 2h / 6h / 24h selectable). Each node gets its own coloured line. Useful for spotting interference patterns, seeing how signal fluctuates by time of day, and comparing which node consistently hears a given AP better. Updates live as new scans arrive.
 - **Cross-node** — side-by-side per-node RSSI for every AP. Shows which node is physically closer to each network. Filter to multi-node only to focus on confirmed cross-node observations.
 - **Clients** — probe request data: unique MACs, vendor (OUI lookup), what SSIDs they're searching for, signal, which nodes saw them.
+- **Alerts** — deauth/disassoc frame detection with two sections:
+  - *Detected Bursts* — fires when ≥10 deauth or disassoc frames are seen for the same BSSID within a 5-minute window. Highlighted red when confirmed by 2+ nodes (high confidence, source is physically nearby). Burst rows include BSSID, SSID, frame count, unique source MACs, and node count.
+  - *Raw Feed* — last 100 deauth/disassoc events with src, dst, BSSID, reason code, and RSSI. Useful for inspecting specific events. `dst = FF:FF:FF:FF:FF:FF` (broadcast deauth) is a classic attack tool signature.
 - **Presence** — three sections driven entirely by probe data:
   - *Present Now* — real (non-randomized) MACs seen 2+ times in the last hour. Filters out the city-center noise of transient devices.
   - *New Arrivals* — devices and networks first seen in the last 24 hours, split into two side-by-side tables.
@@ -244,7 +265,7 @@ A node is considered **online** if a heartbeat was received within the last 30 s
 
 ### Live updates
 
-SSE stream pushes new beacon events as they arrive. The feed updates immediately. All other views (sidebar, networks, chart, cross-node, presence) refresh on a 2-second debounce so a single scan burst doesn't flood the server with requests.
+SSE stream pushes new beacon events as they arrive. The feed updates immediately. All other views (sidebar, networks, chart, cross-node, presence, alerts) refresh on a 2-second debounce so a single scan burst doesn't flood the server with requests.
 
 ---
 
@@ -263,6 +284,14 @@ What probe data tells you:
 - **Wildcard probes** (empty SSID): the device is searching for any available network
 - Probe data maps **client devices**, not infrastructure — complementary to beacon scan data
 
+### Deauth frame noise vs real attacks
+
+The raw deauth feed in the Alerts tab will fill up constantly — deauth and disassoc frames are a normal part of WiFi operation (devices disconnecting, APs doing band steering, power saving). This is expected and not cause for concern.
+
+The **Bursts** section is the anomaly detector. A single unique source MAC generating 10+ deauth frames for the same BSSID within 5 minutes is not normal operation — it indicates a deauth flood, the standard precursor to a WPA2 handshake capture attack. The attacker forces connected clients to disconnect, captures the 4-way handshake when they reconnect, and then cracks it offline.
+
+Multi-node confirmation (`node_count > 1`, highlighted red) significantly raises confidence — it means the source is physically close and strong, not a distant weak signal.
+
 ### OUI lookup
 
 The `oui.txt` file is the IEEE public OUI database (39,171 entries as of download). It maps the first 3 bytes of a real MAC to a manufacturer name. Used in the Clients tab. Refresh it occasionally by re-running `deploy.sh` after downloading a fresh copy from `https://standards-oui.ieee.org/oui/oui.txt`.
@@ -283,6 +312,7 @@ The `oui.txt` file is the IEEE public OUI database (39,171 entries as of downloa
 - [x] Node heartbeat every 10s — uptime, free heap, AP signal, drives online/offline status
 - [x] RSSI history chart per network (canvas, per-node coloured lines, 1h/2h/6h/24h range)
 - [x] Presence tab — Present Now, New Arrivals, Regulars
+- [x] Deauth/disassoc frame detection — burst detection with multi-node confirmation, Alerts tab
 - [ ] Scan interval control from dashboard
 - [ ] DB pruning / retention policy (events.db grows indefinitely)