Skip to content

Add recon: a WiFi and BLE scanner that identifies what it sees - #11

Open
jgamblin wants to merge 2 commits into
pimoroni:mainfrom
jgamblin:add-recon-scanner
Open

Add recon: a WiFi and BLE scanner that identifies what it sees#11
jgamblin wants to merge 2 commits into
pimoroni:mainfrom
jgamblin:add-recon-scanner

Conversation

@jgamblin

@jgamblin jgamblin commented Aug 1, 2026

Copy link
Copy Markdown

Hello! Adding an app I built for BSidesLV and DEF CON.

recon scans WiFi and Bluetooth and tells you what things are rather than
listing MAC addresses. Carried around for an evening it logged 214 access points
and named 86% of them by manufacturer, plus 93% of the Bluetooth devices it
heard, picking out cable-company gateways, Tile trackers, AirPods, smart-home
hubs and a garage-door opener by name.

Everything is passive. It never associates, transmits or captures traffic; every
beacon and advertisement it reads is a public broadcast.

Dashboard Detail
dash detail

A dashboard counts what is around you by kind and drills into any row; there are
also live list, per-device detail, flags (open networks, WEP, possible evil
twins, trackers), a vendor ranking, and a persistent de-duplicated log.

One thing to flag before you review

data/ is 763KB of compiled vendor databases (39,877 IEEE MA-L prefixes and
3,988 Bluetooth SIG company IDs, as sorted fixed-width binaries). That is a lot
heavier than the other apps here, so entirely understandable if it is too much
for this repo. Happy to either trim it to the few hundred most common vendors,
or ship the app without the data and have people run the builder themselves.
Just say which you prefer.

Notes

  • Passes ci/ruff.toml clean.
  • Vendor lookups run from a 195KB in-RAM index (1.8ms vs 11ms off flash) and
    resolve lazily at two devices a frame, so a crowded room never stalls drawing.
  • Stress-tested with synthetic devices: every view holds under 10ms a frame up
    to 1800 devices.
  • The log takes a bounded 560KB slice of the filesystem and reports when it is
    full rather than silently dropping records.
  • Bluetooth counting is deliberately careful. Only stable addresses count as
    devices. Apple Find My beacons look static by their address bits but rotate
    every ~15 minutes, so rotation is decided from the payload too; without that
    one outing counted 356 "devices" that were roughly 55.

Source, plus the database builder, CSV exporter and stress test:
https://github.com/jgamblin/Tufty2350-Badgeware

jgamblin added 2 commits July 31, 2026 20:12
Names devices by manufacturer, product and protocol rather than listing MAC
addresses, using the IEEE MA-L registry (39,877 prefixes) and Bluetooth SIG
company IDs (3,988) compiled to sorted fixed-width binaries and binary-searched
on the badge, plus parsers for Apple Continuity, GAP appearance, service UUIDs
and SSID conventions.

Dashboard by device kind with drill-down, live list, detail pages, flags for
open networks and possible evil twins, vendor ranking, and a persistent
de-duplicated log with a bounded disk budget.

Entirely passive: no association, no transmission, no traffic capture.
recon moved out of the badge-faces repo into jgamblin/tufty-recon.
@jgamblin

jgamblin commented Aug 1, 2026

Copy link
Copy Markdown
Author

Small update: the scanner now lives in its own repository at https://github.com/jgamblin/tufty-recon rather than alongside my badge faces, so the links in the app README point there. No change to the app itself.

The 763KB data/ question from the description still stands whenever you get to it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant