Flock Information Element and Promiscuous Mode Wardriving

[DeflockJoplin]

This is a proof of concept showing Flock detection using the information element detection method first shown in PACK and recently merged to the OUI-Spy by Colonel Panic. Details about this method are here: https://github.com/DeflockJoplin/flock-you/tree/information-element-fingerprint

This implementation is slightly different in that it implements a byte matching method on the information element fields, but the underlying idea is the same.

To support detecting these probes while wardriving, I have also converted Wardriving to use promiscuous mode. APs are now written whenever a beacon or probe response is heard from an AP. This has had the side effect of increasing wardriving performance, at least in my limited testing. Recommendation: Consider implementing geobased deduping rather than strict MAC based. Wigle uses additional detections (when meaningfully separated) for trilateration of signals.

Flock detections are written to an independent log. Since they are no longer APs, they are not included with wigle uploads. Regarding these logs, I have an idea kicking around in my head about ingesting Flock wardriving data from the various firmwares and including them in the DeFlock "suspected locations" feature, but we aren't ready for that just yet.

Full details on changes:

Flock Sniff (WiFi)

• Replaces BLE-based BT_SCAN_FLOCK with passive WIFI_SCAN_FLOCK (RunProbeScan / promiscuous callback).
• Detection: wildcard probe requests + IE fingerprint + infrastructure OUI allowlist (probeReqMatchesFlockMethod2).
• Expands oui_list with wardriver-sourced Flock infrastructure OUIs (credit to @NitekryDPaul). No OUIs removed from marauder firmware. Original fingerprint was tested against the OUI list in Colonel Panic's repo. If false positives occur, consider revisiting OUI list.
• Removes legacy BLE Flock paths (isFlockCamera, flock_ssid[], XUNTONG/Penguin heuristics).
• Menu: Flock Sniff under WiFi Sniffer (after Probe Sniff).
• CLI: sniffflock; removes sniffbt -t flock.

Wardrive

• Replaces active STA scans with promiscuous beacon/probe capture (initWardrivePromisc, logWardriveAp).
• Beacon APs → WiGLE wardrive_N.log; Flock hits → /wardrive_flock_N.log.

BLE wardrive logging unchanged.

Channel plan & timing

Tuned to match observed Flock camera behavior: probe events on the order of ~125 ms apart, with cameras ascending through channels during their probe cycle.

• Single-band HOP_DELAY: 1000 ms → 250 ms (~2× probe interval so each channel gets meaningful dwell time. Credit to @nsm_barii for detailed channel hopping observations).
• Sniff channelHop(): descending sweeps (high → low, then wrap) on 2.4 GHz and dual-band index walks. Simplified the channel plan to remove multiple sweeps of the "simpler" channel plan. Now: one simple sweep. One full sweep. Repeat.
• Wardrive wardrive_channels[]: descending schedules with weighted 11 / 6 / 1 (and dual-band 5 GHz anchors), then full band passes. Descending order is to aid with finding Flock probes faster. They are known to probe on 5 Ghz as well.

This resolves #1328.

[DeflockJoplin]

More details on how this actually works.

It's possible this could be changed or tightened, but what's working today is this. For a match to hit all must be true:

• is probe request frame
• is wIldcard probe
• Source MAC is in the OUI list.
• Information elements following the lite-on vendor IE as follows:
  -- 1 IE 221 with payload 50 6f 9a 16 03 01 03 <- Vendor anchor IE
  -- 2 IE 45. Just checking for tag. Any length. HT Capabilities.
  -- 3 IE 191. Just checking for tag. Any length. VHT capabilities.
  -- 4 IE 221 with payload 00 50 f2 08 00 00 00. <- The microsoft WPA IE. Must be the last IE.

Wireshark view: