---

1.1 About this Volume

This is the orientation map for the OUI-SPY family — a set of passive surveillance-detection firmwares published by the GitHub author colonelpanichacks (handle “colonelpanic”; the author’s real name is not published, and this series does not assert one). The goal of the volume is to answer four questions before any hardware or methodology detail arrives in the later volumes:

1. What is OUI-SPY — one brand, many firmwares, one deliberately narrow mission.
2. What are the pieces — the repository list, what each one does, how many people have starred it, and under what licence it ships.
3. What is the Blue/Red split — why everything covered in depth here is passive, and why a small offensive corner is quarantined to a category-level mention only.
4. Where does it fit — against the three sibling detectors already on the Hack Tools bench (SquachWatch, Nyan Box, HaleHound), and which OUI-SPY firmware to reach for which job.

Everything in this volume is written to the project’s public GitHub READMEs and store as of 2026-10-16. Hardware specifics (the Seeed XIAO ESP32-S3, the finished OUI-SPY board, the alternative boards, and the full “Where this firmware runs” supported-hardware table) live in Volume 3 — this volume points down to that table rather than duplicating it. The detection methodology — the OUI union, the wildcard-probe IE fingerprint, the five-tier confidence model, and the BLE signature set — is the subject of Volumes 4 through 6.

Voice note. This is a reference account of a tool that has not been built or operated on this bench. Nothing here is written as first-hand experience. Where a later volume would benefit from a build log or a field session, a JEFF'S STORY GOES HERE marker flags the gap rather than inventing one.

1.2 What OUI-SPY is, and where the name comes from

OUI-SPY is a brand covering a growing collection of ESP32 firmware images whose single shared purpose is to detect fixed and wearable surveillance hardware by listening to the 2.4 GHz band — Wi-Fi management frames and Bluetooth Low Energy (BLE) advertisements — and matching what it hears against a hand-curated, forensically-sourced set of radio signatures.

The name is a two-layer pun. OUI is the Organizationally Unique Identifier: the first 24 bits of every Ethernet/Wi-Fi/BLE MAC address, the block the IEEE assigns to a manufacturer. Those 24 bits are exactly what the firmware keys on first — a camera, a battery pack or a body camera gives away its maker in the top half of its MAC long before it says anything else. Read aloud, “OUI-SPY” is also “we-spy” — the detector that watches the watchers. Both readings are deliberate.

The mission is narrow on purpose. OUI-SPY is not a general wireless scanner, a Wi-Fi auditing suite, or a kitchen-sink multitool. The flagship firmware, flock-you, exists to answer one question — is there a Flock Safety automated licence-plate-reader (ALPR) camera, or one of its accessories, within radio range right now? — and to answer it on a headless US$7.50 board with a piezo buzzer and no screen. The other firmwares widen that question (other vendors, drones, Axon gear) or change its shape (direction-finding, raw packet capture), but each one stays single-purpose. The design thesis of the whole family is depth and minimalism over breadth and UI.

 OUI-SPY in one paragraph
 ═══════════════════════════════════════════════════════════════════════
 a $7.50 XIAO ESP32-S3 listens to matches against
 ┌──────────────────┐ 2.4 GHz air signature sets
 │ Wi-Fi promisc RX │◀── 802.11 mgmt frames ───┐ ┌──────────────────┐
 │ BLE passive scan │◀── BLE advertisements ────┼──▶│ OUI union (34) │
 └─────────┬─────────┘ │ │ probe-req IE sig │
 │ │ │ SSID patterns │
 │ a match, graded by confidence tier │ │ BLE GATT / names │
 ▼ │ │ BLE company IDs │
 ┌──────────────────┐ │ └──────────────────┘
 │ GPIO3 piezo buzzer│ tone + cadence encode the tier (0–4)
 │ GPIO21 LED │ no screen, no phone needed to get the alert
 └──────────────────┘
 │ optional: JSON over USB-CDC → Flask map, or on-device AP page
 ▼
 ═══════════════════════════════════════════════════════════════════════

The payoff of keeping it headless is cost and deniability: the whole instrument is a thumbnail-sized board on a USB cable that beeps. There is no touchscreen to light up, no mascot, no log that has to be read on-device. Anything richer — a map, an export, a device history — is bolted on at the host side (a laptop running a small Flask app) or served from a tiny on-device web page, and is strictly optional. Volume 3 covers the board; Volume 6 covers the companion software.

A short vocabulary is worth fixing now, because the whole series leans on it:

Table 1 — A short vocabulary is worth fixing now, because the whole series leans on it

Term	Meaning in this series
OUI	Organizationally Unique Identifier — the top 24 bits of a MAC, the IEEE-assigned maker block. The first thing the detector keys on.
Probe request	An 802.11 management frame in which a Wi-Fi client asks “what APs are out there?” A wildcard probe names no network (zero-length SSID).
IE / Information Element	A tagged field inside an 802.11 frame. The ordering and contents of a probe’s IEs form a device fingerprint (Volume 4).
GATT / service UUID	The Bluetooth LE attribute model; a device advertises service UUIDs that identify what it is (Volume 5).
Company ID	A Bluetooth-SIG-assigned 16-bit maker identifier carried in a BLE advert’s manufacturer-specific data.
Tier	OUI-SPY’s 0–4 confidence grade for a hit; the piezo tone encodes it (Volumes 4, 6).
Foxhunt / DF	Direction-finding — using signal strength and a directional antenna to walk to an emitter (Volume 8).
Blue / Red	Passive detection (Blue, this series) versus offensive transmit (Red, §4 and Vol 9).

1.3 The ecosystem at a glance

OUI-SPY is not a single repository. It is roughly a dozen repositories under the same author, most sharing code and a common signature philosophy. The table below is the whole published family as of 2026-10-16, with the GitHub star counts at the time of writing as a rough popularity signal. The flock-you flagship is an order of magnitude more starred than anything else in the family, which is a fair indicator of where the project’s centre of gravity sits.

Table 2 — 3. The ecosystem at a glance

Repository	Role	Side	Stars	Covered in
flock-you	Core passive Flock ALPR + accessory detector (flagship)	Blue	~1480	Vols 4–6
oui-spy	Base OUI-SPY detector firmware / board firmware	Blue	552	Vols 1, 7
oui-spy-unified-blue	All-in-one build: boot-selector over 7 modes	Blue	223	Vol 7, 10
Sky-Spy	Passive drone Remote ID detector / mapper	Blue	177	Vol 9
ouispy-detector	Dual-domain general surveillance detector (8 filters)	Blue	64	Vol 7
ouispy-foxhunter	RSSI direction-finding / proximity tracker	Blue	29	Vol 8
axeoff	Headless Axon (body-cam / Taser) detector	Blue	7	Vol 7
ouispy-pcap	Passive Wi-Fi packet capture + dashboard	Blue	7	Vol 7
ouispy-blesniff	Passive BLE-advertisement capture + dashboard	Blue	5	Vol 7
Remote-ID-Spoofer	Offensive drone-RID transmitter	Red	41	Vol 9 (category only)
Oui-Spy-UniPwn	Offensive ESP32 port of the UniPwn Unitree exploit	Red	38	Vol 9 (category only)

Two things to carry forward from this table. First, the family is almost entirely Blue — passive detection; only two repos are on the offensive “Red” side, and those are handled at category level only (Section 4, and Volume 9). Second, the star distribution is a map of the mission: the Flock detector dominates, then the base OUI-SPY firmware and the unified multi-mode build, then a long tail of focused tools (drone RID, dual-domain detector, direction-finder, Axon, packet/advert capture).

[FIGURE SLOT — Vol 1 §3] A screenshot of the colonelpanic.tech store front and/or the GitHub profile showing the repository list, to anchor “this is one author’s ecosystem, sold as finished boards.”

1.4 Blue Edition and the coming Red Edition

The project frames its own firmware in two “editions,” and the distinction is the single most important posture fact in this series.

Blue Edition — the current, shipping firmware — is all-passive detection. It listens. It puts the ESP32 Wi-Fi radio into promiscuous (monitor) receive and runs a BLE scan, compares what arrives against signature sets, and signals a match on a buzzer and LED. In its pure form it never transmits anything that would make a target react. (The one honest asterisk: the general dual-domain detector firmware and the foxhunter both use BLE active scanning, which does transmit scan-request packets — that nuance is called out where it occurs, in Volumes 5, 7 and 8. It is a world away from an attack.)

Red Edition — stated to be in development — is the offensive side. Two repositories already exist on that side and are explicitly separated from the Blue tools:

• Remote-ID-Spoofer — a tool in the class of drone Remote ID transmitters: firmware that emits fabricated ASTM F3411 Remote ID beacons. It is the inverse of Sky-Spy (Volume 9), which only receives them.
• Oui-Spy-UniPwn — an ESP32 port of the publicly-disclosed UniPwn exploit class targeting Unitree robots.

Scope rule for this series. The Red tools are described only at the level of what class of thing they are, why they are kept separate from the detectors, and where the legal and ethical line falls. This series contains no attack steps, no command sequences, and no reproduced menus for them. Everything else in the family — every detector — is passive or near-passive and is covered in full engineering depth. The reasoning: a detector you point at your own neighbourhood to see what is watching you is a categorically different act from a transmitter you point at someone else’s aircraft or robot. Volume 9 draws that line explicitly and stops there.

 Blue (this series, in depth) Red (category mention only, Vol 9)
 ──────────────────────────────── ──────────────────────────────────
 flock-you ouispy-detector Remote-ID-Spoofer (RID transmit)
 oui-spy ouispy-foxhunter Oui-Spy-UniPwn (Unitree exploit)
 Sky-Spy axeoff ─────────────────────────────────
 ouispy-pcap ouispy-blesniff "Red Edition in development"
 oui-spy-unified-blue (all 7 modes) NO procedures reproduced here
 ──────────────────────────────── ──────────────────────────────────
 RECEIVE / LISTEN / DECODE TRANSMIT / INTERFERE
 (active BLE scan on a couple builds) legal line: see Vol 9 §legal

1.5 The licensing is mixed — read it per repo

A common shorthand — “OUI-SPY is MIT” — is wrong, and this series states the licence per repository. The family grew organically and its licensing is not uniform. Treat the table below as authoritative over any blanket claim.

Table 3 — 5. The licensing is mixed — read it per repo

Repository	Stated licence	How it is stated
flock-you	MIT	named MIT in the README
axeoff	MIT	named MIT in the README
ouispy-pcap	MIT	named MIT in the README
ouispy-blesniff	MIT	named MIT in the README
oui-spy	Open source	”open source, modifications welcome” — no SPDX
ouispy-detector	Open source	”open source, modifications welcome” — no SPDX
ouispy-foxhunter	Open source	”open source, modifications welcome” — no SPDX
oui-spy-unified-blue	Open source	”open source, modifications welcome” — no SPDX
Sky-Spy	Apache-2.0 (inherited)	“as-is, educational”; inherits Apache-2.0 from OpenDroneID
Remote-ID-Spoofer	Not stated	offensive repo — no licence stated
Oui-Spy-UniPwn	Not stated	offensive repo — no licence stated

The practical consequences:

• The four MIT repos (flock-you, axeoff, ouispy-pcap, ouispy-blesniff) are the ones with an unambiguous, permissive, reuse-friendly licence — relevant if any signature table or code path is to be lifted into another project.
• The four “modifications welcome” repos declare open-source intent but carry no SPDX identifier, so the exact legal terms are not pinned. Reuse of those should be treated conservatively (ask, or confine to personal use) until an explicit licence is added.
• Sky-Spy is best described as Apache-2.0 because it is built on OpenDroneID, whose Apache-2.0 licence it inherits; the repo itself frames its own additions as “as-is, educational.”
• The two Red repos state no licence at all — a further reason this series keeps them at arm’s length.

Callout — do not claim “the ecosystem is MIT.” It is a mix of MIT, unspecified-but-open, and Apache-2.0, with two unlicensed offensive repos. When citing a licence, cite the repository, not the brand.

1.6 The finished boards — OUI-SPY and the Earrings

OUI-SPY is primarily firmware, but the author also sells finished boards at the store colonelpanic.tech, so a buyer need not source a bare XIAO and solder a buzzer. Two product forms are published:

• The OUI-SPY board — a finished, pre-flashed detector built around the reference hardware. The retail price is not published on the store page as captured, so this series does not quote one; the build-your-own bill of materials in Volume 3 (a ~US$7.50 XIAO plus a piezo and a cable) is the honest floor on what the hardware costs to reproduce.
• The “OUI-SPY Earrings” variant — a wearable form factor with a 100 mAh LiPo and no buzzer (the buzzer being impractical in an earring). Without a buzzer, the Earrings rely on the LED/NeoPixel and the optional web dashboard for the alert channel rather than the audible tiered tones.

The hardware detail — why the XIAO ESP32-S3, the pinout, the buzzer/LED wiring, the antenna options and the full supported-board matrix — is all in Volume 3; see Volume 3 for the full “Where this firmware runs” supported-hardware table, which is the canonical answer to “what can I flash this on.”

[FIGURE SLOT — Vol 1 §6] A product photo of the finished OUI-SPY board and, if available, the Earrings variant, from colonelpanic.tech — to show the two retail forms next to the bare-XIAO reference build.

1.7 Where it sits next to SquachWatch, Nyan Box and HaleHound

Three sibling surveillance-detector tools are already documented on this bench. OUI-SPY is a deliberately different point in the design space from all three. The matrix below is the fast orientation; the detailed head-to-head is repeated as a cheatsheet in Volume 10.

Table 4 — 7. Where it sits next to SquachWatch, Nyan Box and HaleHound

Axis	OUI-SPY	SquachWatch	Nyan Box	HaleHound
Primary form	Headless $7.50 XIAO + buzzer	$15 CYD touchscreen	ESP32 handheld, OLED	$7 CYD + plug-in radios
UI	Buzzer + LED (+ optional web)	Full color touchscreen, mascot	Small OLED menu	Touchscreen
Radios	Wi-Fi + BLE (2.4 GHz)	Wi-Fi + BLE (2.4 GHz)	Wi-Fi + BLE + sub-GHz/2.4 (NRF24)	Wi-Fi + BLE + CC1101 + NRF24
Signature style	Forensic: firmware-dump OUIs + IE fingerprint + tiered grading	Broad named-signature catalogue, graded	Hidden-camera + RemoteID focus	Modular; one module is a Flock detector
Direction-finding	Yes — Foxhunter RSSI DF	No	No	No
Drone Remote ID	Yes — Sky-Spy	Yes	Yes (a focus)	Module-dependent
Breadth	Narrow + deep per target	Broad	Medium	Broad (many modules)
Licence	Mixed (see §5)	GPL-3.0	Open (MIT)	Proprietary firmware

Read it as a spread between two philosophies:

• SquachWatch and HaleHound are breadth + screen tools: a wide catalogue of named signatures presented on a touchscreen, meant to be glanced at. SquachWatch adds a HUNT gauge, LoRa/GPS wardriving and a BLE mesh; HaleHound adds plug-in CC1101/NRF24 radios and dozens of modules.
• OUI-SPY is the depth + minimalism + direction-finding tool: it knows far fewer device classes, but it knows the Flock signature forensically — including two OUIs pulled from an actual Flock camera firmware dump and a wildcard-probe Information-Element fingerprint that nothing else here uses — and it is the only one of the four that can walk you to the emitter via its RSSI foxhunter.
• Nyan Box overlaps most on the drone-RemoteID and hidden-camera axes, but has no Flock-specific forensic signature set and no DF.

The one-line positioning: reach for SquachWatch or HaleHound to see what kinds of surveillance gear are around; reach for OUI-SPY/flock-you when the question is specifically is a Flock camera watching this spot, and can I walk to it — and accept a buzzer instead of a screen as the price of a $7.50 instrument.

A relationship worth stating precisely: OUI-SPY/flock-you is the upstream, single-purpose open-source origin of the Flock-detection technique. HaleHound ships a “Flock You”-named detector module among its many modules. Whether HaleHound forks the flock-you code or independently reimplements the signatures is unverified — so the correct framing is shared technique / upstream origin, not a confirmed code fork.

1.8 Which firmware for which job — the decision graph

With ten-plus firmwares, the practical first question is which one to flash. The graph below routes from the job to the build. The all-in-one Unified Blue image (Volume 7) is the pragmatic default because it carries a boot-time selector over seven of these modes, so a single flash covers most of the tree; the standalone images matter when a mode needs to run leaner or has an extra feature.

 "What am I trying to find / do?"
 ────────────────────────────────────────────────────────────────────────
 │
 ├─ A Flock ALPR camera (or Penguin pack / Raven) nearby?
 │ └─▶ flock-you (the flagship; tiered Wi-Fi+BLE Flock engine)
 │
 ├─ ANY surveillance device — glasses, body-cams, trackers, broadly?
 │ └─▶ ouispy-detector (dual-domain, 8 filter classes, browsable OUI DB)
 │
 ├─ An Axon body-cam / Taser specifically, headless?
 │ └─▶ axeoff (Axon-only buzzer detector)
 │
 ├─ I know the target's BLE MAC — walk me to it physically?
 │ └─▶ ouispy-foxhunter (RSSI direction-finding, buzzer cadence) → Vol 8
 │
 ├─ A drone / its Remote ID broadcast (and the pilot location)?
 │ └─▶ Sky-Spy (OpenDroneID / ASTM F3411 receiver + map) → Vol 9
 │
 ├─ Capture raw Wi-Fi frames for later analysis?
 │ └─▶ ouispy-pcap (passive capture + in-PSRAM pcap download)
 │
 ├─ Capture raw BLE advertisements?
 │ └─▶ ouispy-blesniff (passive BLE-advert capture + dashboard)
 │
 └─ "I just want one flash that does most of the above"
 └─▶ oui-spy-unified-blue (boot-selector: pick a mode at 192.168.4.1) → Vol 7
 ────────────────────────────────────────────────────────────────────────
 (Offensive Remote-ID-Spoofer / UniPwn are NOT on this graph — see Vol 9.)

Pair the graph with the hardware matrix in Volume 3: most of these modes run on the default XIAO ESP32-S3, but Sky-Spy’s dual-band 5 GHz variant needs a XIAO ESP32-C5, and a couple of boards (notably the T-Dongle-S3) are planned but not yet buildable. The supported-hardware table in Volume 3 is the final word on which build runs where.

Three practical notes that keep the decision honest:

• Unified Blue is the sane default. A single flash of oui-spy-unified-blue boots into a selector (Volume 7) and covers seven of the modes above. Reach for a standalone image only when a mode must run as lean as possible, or needs a feature the unified build does not carry.
• Two modes are hardware-gated, not just a flash choice. Full 5 GHz drone Remote ID needs the XIAO ESP32-C5 (xiao-c5-5g); serious foxhunting needs a directional/Yagi antenna on the U.FL connector. Both are Volume 3 hardware decisions, not firmware toggles.
• “Passive” is the default but not absolute. flock-you, the capture firmwares and Sky-Spy are receive-only; the dual-domain detector and the foxhunter use BLE active scan (they transmit scan requests). That nuance is flagged wherever it occurs and does not move those tools onto the Red side.

1.9 How to read this series

Ten volumes, grouped:

Table 5 — Ten volumes, grouped

Vol	Topic	Reach for it when…
1	Overview, brand & decision graph (this volume)	Orienting; picking a firmware
2	The threat it detects — Flock, Penguin, Raven, Axon	Understanding what is being found and why it is detectable
3	Hardware — XIAO ESP32-S3, the boards, the support table	Buying / building / flashing-target decisions
4	Detection methodology I — Wi-Fi (OUI union, IE fingerprint, 5 tiers)	Understanding the Wi-Fi engine
5	Detection methodology II — BLE (NimBLE, GATT/company-ID sigs)	Understanding the BLE engine
6	flock-you in depth — config, buzzer map, Flask + Python companion	Running the flagship end-to-end
7	The OUI-SPY module family — Detector, PCAP, BLE-Sniff, axeoff, Unified	Choosing and switching modes
8	Direction finding — Foxhunter	Walking to an emitter
9	Drones & the Red edge — Sky-Spy, and the offensive line	Remote ID; understanding the Red/Blue boundary
10	Build/flash, operations, legal & comparison cheatsheet	Flashing; posture; the final head-to-head

The spine of the series is Volumes 4–6: the methodology is what makes OUI-SPY worth documenting next to the broader-but-shallower detectors. This volume and Volumes 2–3 are the setup — what the thing is, what it hunts, and what it runs on.

[FIGURE SLOT — Vol 1 §9] A one-page “family tree” graphic of the OUI-SPY ecosystem (flock-you at the root, the module family and Sky-Spy as branches, the Red tools in a greyed-out quarantined box), suitable as the series frontispiece.