Integrate Flock probe fingerprint without replacing wardrive scans

[justcallmekoko]

Summary

• adopt the Flock wildcard probe-request IE fingerprint and expanded infrastructure OUI set proposed in Flock Information Element and Promiscuous Mode Wardriving #1348
• move Flock Sniff from Bluetooth to passive Wi-Fi and expose sniffflock in the CLI
• retain Marauder current active per-channel Wi-Fi wardrive scans, dwell times, weighted channel schedule, BLE wardriving, and global channel-hop behavior
• keep Flock probe deduplication separate from AP/BLE wardrive deduplication so a Flock hit cannot suppress a legitimate network row
• record fingerprint hits in /wardrive_flock_N.log rather than representing client probes as WPA2 APs in WiGLE output
• remove the legacy BLE/name/OUI-only Flock convention

Why this differs from #1348

PR #1348 contains the useful detector, but also replaces the wardrive acquisition engine with beacon-only promiscuous capture, globally changes hopping direction/timing, and removes substantial current behavior from a stale master base. This PR isolates the detection convention and avoids those wardriving regressions.

Detection convention

A match requires all of: probe-request frame, wildcard SSID, known Flock infrastructure OUI, and the terminal Lite-On/HT/VHT/WPA IE fingerprint. Optional four-byte FCS capture trailers are accepted.

Validation

• native Unity: 45/45 passed, including six positive/negative fingerprint tests
• git diff --check: passed

Credits: detection method and OUI additions adapted from #1348 by @DeflockJoplin and its cited upstream research.

[codecov]

Codecov Report

❌ Patch coverage is 36.70213% with 119 lines in your changes missing coverage. Please review.
✅ Project coverage is 2.85%. Comparing base (03b1080) to head (989aeb3).
⚠️ Report is 1 commits behind head on develop.

Files with missing lines	Patch %	Lines
esp32_marauder/WiFiScan.cpp	0.00%	92 Missing ⚠️
esp32_marauder/FlockDetector.cpp	75.51%	5 Missing and 7 partials ⚠️
esp32_marauder/MenuFunctions.cpp	0.00%	12 Missing ⚠️
esp32_marauder/CommandLine.cpp	0.00%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           develop   #1478      +/-   ##
==========================================
+ Coverage     2.43%   2.85%   +0.42%     
==========================================
  Files           32      34       +2     
  Lines        17735   17526     -209     
  Branches        70      90      +20     
==========================================
+ Hits           431     500      +69     
+ Misses       17276   16991     -285     
- Partials        28      35       +7     

Flag	Coverage Δ
firmware-unit-tests	2.85% <36.70%> (+0.42%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[DeflockJoplin]

Hey @justcallmekoko!! I'm really sorry, I forgot this was still out there. I would not use this right now. Something started changing with the wifi coming out of the cameras around 8/6 timeframe.

I am planning to do more work on this to get it updated and can ping you again.

[justcallmekoko]

Hey @justcallmekoko!! I'm really sorry, I forgot this was still out there. I would not use this right now. Something started changing with the wifi coming out of the cameras around 8/6 timeframe.

I am planning to do more work on this to get it updated and can ping you again.

Does this method not work at all or has it's efficacy just degraded?

[DeflockJoplin]

Does this method not work at all or has it's efficacy just degraded?

Not at all. I still got some hits using an OUI list + wifi probe as the filter a few days ago, but I haven't had time to fully check things out. I'm getting conflicting reports about what the current state of things is. Some people say the cameras are doing nothing, but others are still seeing something. I am going to be doing some fresh packet captures soon to figure out what's going on.

[justcallmekoko]

I understand. I am still probably going to merge this in for now and just keep it there until there is a new validated detection method.