OUI-SPY · Volume 10
OUI-SPY Volume 10 — Build, Flash, Operations, Legal & Comparison Cheatsheet
10.1 About this Volume
This is the laminate-ready close of the dive: the material an operator wants on a single page when a board is in hand. It gathers the build and flash paths, the first-run configuration and the full AP-credential map (because the single most common failure mode is joining the wrong Wi-Fi network), the operating posture that keeps the tool on the right side of the passive/active line, a legal cheatsheet, and the head-to-head comparison against the three nearest rivals in the Hack Tools hub — SquachWatch, Nyan Box, and HaleHound. It ends with quick-reference cards, a glossary, and an index of every figure slot in the dive.
Reference voice; nothing here records bench work. Where a figure of a built unit or a dashboard would help, a FIGURE SLOT marks it (collected in §9).
10.2 Three ways to flash
The ecosystem supports three flashing paths, trading convenience for control. Most users should start at the top.
EASIEST ───────────────────────────────────────────────► MOST CONTROL
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────────┐
│ 1. Web flasher │ │ 2. PlatformIO │ │ 3. Python batch │
│ (browser, no │ │ (source build, │ │ (flash.py --batch, │
│ toolchain) │ │ pio run) │ │ many boards) │
└──────────────────┘ └──────────────────┘ └──────────────────────┘10.2.1 Browser web-flasher (no toolchain)
Each repo publishes a GitHub-Pages flasher that uses the Web Serial API, so a desktop Chrome / Edge / Opera (not Firefox, not Safari, not mobile) can flash a board with nothing installed. Representative URLs:
https://colonelpanichacks.github.io/oui-spy-unified-blue/ (the 7-in-1 selector)
https://colonelpanichacks.github.io/ouispy-detector/
https://colonelpanichacks.github.io/axeoff/Plug in a data USB-C cable (not a charge-only cable — the single most common “it won’t connect” cause), click Connect & Flash, and the page writes the four standard ESP32 binaries:
Table 1 — four standard ESP32 binaries
| Offset | Binary | Note |
|---|---|---|
0x0 | bootloader | second-stage bootloader |
0x8000 | partitions | partition table |
0xe000 | boot_app0 | OTA selector stub |
0x10000 | application | ~6 MB app + ~2 MB LittleFS |
Callout — the web flasher serves “latest,” not a pinned release. The Unified Blue flasher serves whatever is committed to
master;axeoffalways serves the latest committedsrc/axeoff.bin. There is no version pin in the browser path. If reproducibility matters, build from a known commit with PlatformIO (§2.2). Note also that PCAP mode is not yet in the web flasher — it is a local build only (Vol 7 §6).
10.2.2 PlatformIO (source build)
The control path. One environment, one command:
pio run -e seeed_xiao_esp32s3 # build
pio run -e seeed_xiao_esp32s3 -t upload # build + flash
pio device monitor -b 115200 # serial monitor
pio run -e seeed_xiao_esp32s3 -t erase # last-resort NVS wipeLibrary and core pins seen across the repos (the Detector is the strictest):
NimBLE-Arduino ^1.4.0
ESPAsyncWebServer ^3.0.6 (+ AsyncTCP)
ArduinoJson ^6.21.0
Adafruit NeoPixel ^1.12.0
Preferences ^2.0.0
Arduino-ESP32 core ~3.2–3.3 (Detector pins 3.3.12 / ESP-IDF v5.5.5 for
promiscuous-mode buffer support)PlatformIO itself installs into a Python venv from each repo’s
requirements.txt. Pinning the core matters: the promiscuous-capture path
depends on IDF buffer behaviour that the Detector README calls out explicitly, so
drifting the core version can silently break Wi-Fi capture.
10.2.3 Python batch (flash.py --batch)
For flashing several boards in one pass (a workshop, a fleet), repos ship a
flash.py with a --batch mode that drives esptool across multiple serial
ports. Mechanically it does what the web flasher does — write the four binaries —
but scripted and repeatable.
10.3 First-run config and the AP-credential map
10.3.1 Unified Blue first boot
flash Unified Blue ─► power on ─► AP "oui-spy" / "ouispy123"
│
http://192.168.4.1 (selector)
│
pick 1 of 7 modes ─► NVS ─► reboot into mode
│
(to return: hold BOOT 1.5 s)
│
MAC randomised on every bootflock-you, by contrast, has no selector — its config lives in #defines at the
top of main.cpp and is set at build time (Vol 6). The headline knobs:
CHANNEL_DWELL_MS 250 per-channel dwell on the Wi-Fi hop
RSSI_MIN -95 floor; weaker frames ignored
ALERT_COOLDOWN_MS 5000 per-target re-alert hold-off
ENABLE_SSID_MATCH 0 tier-0 bare-"Flock" SSID match OFF by default
beepmask (NVS) 0x1F flockyou/beepmask — which tiers buzz (all 5 by default)10.3.2 The AP-credential map (the page to memorise)
Across the whole ecosystem, every on-device dashboard lives at the same address
— http://192.168.4.1 — so the only thing that changes between modes is which
Wi-Fi network to join. Getting this wrong looks identical to a dead device.
Table 2 — 3.2 The AP-credential map (the page to memorise)
| Mode / firmware | AP SSID | AP password | Dashboard | Editable? |
|---|---|---|---|---|
| Unified Blue selector | oui-spy | ouispy123 | 192.168.4.1 | yes (NVS) |
| Detector | snoopuntothem | astheysnoopuntous | 192.168.4.1 | yes (NVS) |
| Foxhunter | foxhunter | foxhunter | 192.168.4.1 | fixed |
| PCAP | ouispy-pcap | packetsniffer | 192.168.4.1 | yes (NVS) |
| BLE-Sniff | ouispy-blesniff | sniffuntothem | 192.168.4.1 | yes (NVS) |
| Flock-You | (no AP) | — | USB-CDC → Flask host:5000 | — |
| Sky-Spy | (no AP) | — | serial JSON → mesh-mapper:5000 | — |
| AXEOFF | (no AP) | — | headless, buzzer only | — |
Callout — three gotchas that mimic a broken board. (1) Phone roams off the AP. With mobile data on, a phone may abandon the device’s AP (no internet) and the dashboard “disappears.” Turn mobile data off, or forget-and-rejoin. (2) Wrong SSID for the mode. After a mode switch the SSID changes — looking for
oui-spywhile the Detector is running (snoopuntothem) finds nothing. (3) Charge-only cable. A cable with no data lines flashes nothing and mounts no serial port. All three present as “the device is dead”; none of them are.
10.3.3 Troubleshooting matrix
Table 3 — 3.3 Troubleshooting matrix
| Symptom | Likely cause | Fix |
|---|---|---|
| Web flasher won’t see the board | charge-only cable; Firefox/Safari; board not in download mode | use a data USB-C cable; use Chrome/Edge/Opera desktop; hold BOOT while plugging in if needed |
| Flashes fine, no AP appears | looking for the wrong SSID for the running mode | consult the §3.2 map — the SSID changes per mode |
| AP appears, dashboard won’t load | phone roamed to mobile data; wrong address | disable mobile data; browse exactly http://192.168.4.1 |
| No beeps ever | buzzer disabled in NVS; no matching filter; wrong GPIO on a generic board | re-enable buzzer; add a filter (Detector); confirm buzzer on GPIO3 |
| Detector never flags Wi-Fi | only a BLE filter set | add a PROBE/BEACON filter — a BLE OUI filter does not enable Wi-Fi matching (Vol 7 §4.1) |
| No MQTT messages | Wi-Fi-only filter mix | Wi-Fi-only reports nothing over MQTT; add a BLE filter or expect the ~2–12 s blind window (Vol 7 §4.5) |
| Foxhunter cadence won’t peak | omnidirectional antenna; near-field saturation | fit a directional antenna on U.FL; attenuate/null-steer near the target (Vol 8) |
| Sky-Spy map is blank | MBTiles not pre-cached | run tools/cache_tiles.py for the area before field use (Vol 9 §4) |
| PCAP won’t download | session still RECORDING/PAUSED | STOP first — download is gated to the STOPPED state (Vol 7 §6.2) |
| Stuck / corrupt config | bad NVS state | pio run -e seeed_xiao_esp32s3 -t erase, then re-flash and reconfigure |
| Can’t get back to the selector | running mode, not selector | hold BOOT 1.5 s to return to the oui-spy selector (Unified Blue) |
10.4 Operational posture — passive by default
The dive’s single most important operating principle: the tool ships passive, and the operator should keep it that way unless there is a deliberate, authorised reason not to. But “passive” has an asterisk that an honest reference must state.
10.4.1 The passive/active gradient
PURE LISTEN ──────────────────────────────────────► ACTIVE TRANSMIT
│ │ │ │
axeoff flock-you Detector Remote-ID-Spoofer
PCAP Sky-Spy Foxhunter Oui-Spy-UniPwn
BLE-Sniff (Wi-Fi listen-only; (active BLE (Red — transmit /
(passive BLE scan + BLE active scan on SCAN_REQ during exploit; out of
listen-only Wi-Fi) some phases) scan) scope — Vol 9)
└──── no radiation ───┘ └──── brief SCAN_REQ solicitation ────┘ └── forges/injects ──┘Table 4 — 4.1 The passive/active gradient
| Firmware | Wi-Fi | BLE | Net posture |
|---|---|---|---|
| axeoff | listen-only promiscuous | passive scan (no SCAN_REQ) | genuinely passive |
| PCAP | listen-only promiscuous | — | genuinely passive |
| BLE-Sniff | — | passive scan | genuinely passive |
| flock-you | listen-only promiscuous | active scan (phase) | passive intent, brief TX |
| Sky-Spy | listen-only promiscuous | active scan | receive-only claim; brief TX |
| Detector | listen-only promiscuous | active scan | transmits during BLE phase |
| Foxhunter | — | active aggressive scan | transmits during hunt |
| Red pair | transmit | transmit / exploit | out of scope (Vol 9) |
Callout — “passive” is true of the posture and the Wi-Fi paths, not of every firmware’s radio. An active BLE scan transmits SCAN_REQ packets. So
axeoff, PCAP and BLE-Sniff never radiate, while the Detector and Foxhunter do during their BLE phases. Where local rules distinguish receiving from transmitting — and most do — this distinction is the one that matters. If a genuinely no-transmit tool is required, choose a passive-scan module.
10.4.2 Posture rules
- Default to the passive-scan modules when pure reception is the requirement.
- Treat any move to the Red side as deliberate, authorised and documented — the edition split exists precisely to make that a conscious act (Vol 9).
- Randomise the MAC — it is on by default per boot; leave it on except when MQTT needs a stable lease (Vol 7 §4.5).
- Know the band. All of this is 2.4 GHz ISM (plus 5 GHz on the C5 Sky-Spy variant). Reception is broadly permissible; decoding and especially transmitting are governed by local law (§5).
- Pre-cache maps before a Sky-Spy field run (Vol 9 §4) — a blank basemap in a no-signal area is a self-inflicted failure.
10.4.3 Field-prep checklist
A short pre-deployment list that folds the whole dive’s operational advice onto one card:
[ ] data USB-C cable packed (not charge-only)
[ ] firmware flashed from a KNOWN commit if reproducibility matters (§2.2)
[ ] correct mode selected; AP SSID for that mode noted (§3.2 map)
[ ] buzzer/LED enabled as wanted; MAC randomisation left on (unless MQTT)
[ ] Foxhunt? directional antenna on U.FL; target MAC in hand from a detector
[ ] Sky-Spy? MBTiles pre-cached for the operating area; mesh-mapper tested
[ ] posture confirmed: passive-scan module if no-transmit is required (§4.1)
[ ] legal footing confirmed for the locale and activity (§5)
[ ] battery charged (OUI-SPY board / Earrings LiPo, or USB power bank)10.5 Legal cheatsheet
Not legal advice; a field aide-mémoire. Jurisdictions differ — confirm locally.
Table 5 — 5 Legal cheatsheet
| Activity | General footing | Watch for |
|---|---|---|
| Receiving public RF broadcasts (Wi-Fi mgmt frames, BLE adverts, Remote ID) | broadly permissible in most places | some regimes restrict decoding or recording certain traffic even if reception is legal |
| Active BLE scan (Detector, Foxhunter) | low-power SCAN_REQ in unlicensed ISM; generally fine | it is a transmission — relevant where any TX is regulated |
| Capturing frames to PCAP (PCAP, BLE-Sniff) | reception of over-the-air frames | storing others’ traffic can implicate privacy/wiretap law in some jurisdictions |
| Transmitting forged Remote ID (Red) | restricted / illegal in many places | FAA 14 CFR Part 89; EU Reg. 2019/945; never near airspace/airports |
| Exploiting a device (Red / UniPwn) | lawful only on owned hardware or with explicit written authorisation | computer-misuse / unauthorised-access statutes; no “curiosity” exemption |
Golden rules, in order of importance:
- Own the hardware, or have written authorisation. This governs everything on the Red side and any capture that touches others’ traffic.
- Receiving ≠ transmitting ≠ exploiting. These are three legally distinct acts; the tool makes all three easy, and the law does not treat them alike.
- Remote ID is a safety system. Reading it is its purpose; forging it injects false data into aviation safety and is treated accordingly.
- When unsure, stay passive. The passive-scan modules (
axeoff, PCAP, BLE-Sniff) are the safest default.
10.6 Head-to-head — OUI-SPY vs SquachWatch vs Nyan Box vs HaleHound
The four nearest tools in the hub all answer “is a surveillance device near me?”, but they are built on very different philosophies. OUI-SPY is narrow, deep, and minimalist; the others trade some depth for breadth, screens, and integration.
10.6.1 The matrix
Table 6 — 6.1 The matrix
| Axis | OUI-SPY | SquachWatch | Nyan Box | HaleHound |
|---|---|---|---|---|
| Hardware | XIAO ESP32-S3 (~$7.50) | ESP32 “Cheap Yellow Display” (~$15) + ~15 boards | ESP32-WROOM-32U + 3× NRF24L01+ | multi-board ESP32 family |
| UI | headless: buzzer + optional web/Flask | color touchscreen HUNT gauge | 0.96″ OLED | varies by board |
| Signature style | forensic IE-fingerprint tiering, firmware-dump-extracted OUIs/GATT | broad named-signature catalogue, confidence-graded | OUI/named + triple-NRF24 2.4 GHz sniff | packaged detector modules |
| Flock detection | upstream origin of the technique (flock-you) | yes (named-signature) | — | “Flock You” module (shared technique) |
| Direction finding | yes — RSSI Foxhunter (walk to emitter) | no | no (NRF24 channel sniff ≠ DF) | no |
| Drone Remote ID | yes — Sky-Spy + map | yes (named-signature) | yes (RemoteID) | — |
| Hidden-camera focus | via Detector filters | some | yes (native) | some |
| LoRa / GPS wardriving | host-side (Flask GPS/KML) | yes (on-device, T-Watch variant) | — | some variants |
| BLE mesh messaging | no | yes (SquachMesh) | — | — |
| Raw capture (Wireshark) | yes (PCAP + BLE-Sniff) | no | no | no |
| Offensive edge | stated Red edition (fenced off) | no | no | no |
| Licence | mixed (MIT + “open source” + Apache) | GPL-3.0 | open source (MIT) | — |
| One-line identity | depth, DF, forensics, minimalism | breadth + screen + mesh | multi-radio + drone + cameras | packaged all-in-one |
10.6.2 How to read it
- OUI-SPY wins on depth and direction finding. The IE-fingerprint tier model (Vol 4), the firmware-dump-sourced OUIs and GATT UUIDs, the RSSI Foxhunter (Vol 8), and Wireshark-grade raw capture (PCAP / BLE-Sniff) are capabilities the others do not match. It is the forensic and localising tool of the group.
- SquachWatch wins on turnkey breadth and UX. A color touchscreen HUNT gauge, a broad named-signature catalogue, on-device LoRa/GPS wardriving, and encrypted BLE mesh make it the single integrated gadget you hand to someone with no appetite for config. GPL-3.0, one box, screen included.
- Nyan Box wins on multi-radio reach and native camera/drone focus. Its three NRF24 radios enable parallel-channel 2.4 GHz sniffing, and drone Remote ID plus hidden-camera detection are first-class features.
- HaleHound is the packaged all-in-one that bundles a “Flock You” detector module among many.
Callout — the HaleHound / OUI-SPY relationship is “shared technique,” not a confirmed code fork. OUI-SPY / flock-you is the upstream, single-purpose, open-source origin of the Flock-detection technique. HaleHound packages a “Flock You” detector module among many features. Whether HaleHound forks the flock-you code or reimplements the signatures is unverified — frame the relationship as “shared technique / upstream origin,” not a confirmed fork.
10.6.3 Which to reach for
Need to WALK TO the emitter in real time........... OUI-SPY (Foxhunter)
Need FORENSIC evidence / Wireshark captures........ OUI-SPY (PCAP / BLE-Sniff)
Need the DEEPEST Flock detection (tiered IE)....... OUI-SPY (flock-you)
Need a turnkey SCREEN + broad catalogue............ SquachWatch
Need on-device LoRa/GPS wardriving + mesh.......... SquachWatch
Need multi-radio 2.4 GHz + native camera/drone..... Nyan Box
Need one packaged all-in-one box................... HaleHound
Need the CHEAPEST capable detector ($7.50)......... OUI-SPY (XIAO S3)The honest summary: OUI-SPY is the specialist’s kit — cheapest hardware, deepest methodology, the only one that direction-finds and the only one that exports Wireshark captures — at the cost of a screen and turnkey breadth. The others are better first tools for someone who wants a finished gadget; OUI-SPY is the better tool for someone who wants to understand and localise exactly what is transmitting.
10.7 Quick-reference cards
10.7.1 Pins (XIAO ESP32-S3)
GPIO3 buzzer (passive piezo, LEDC PWM; optional 100 Ω series)
GPIO4 NeoPixel (optional)
GPIO21 onboard LED (inverted logic: LOW = ON)
GPIO0 BOOT button (hold 1.5 s = return to selector / clear burn-in lock)
GPIO43 Serial1 TX mirror
U.FL external antenna (directional/Yagi for Foxhunting)10.7.2 flock-you 5-tier model (from Vol 4, for the pocket card)
Table 7 — 7.2 flock-you 5-tier model (from Vol 4, for the pocket card)
| Tier | Method | Gate | Buzzer |
|---|---|---|---|
| 4 | wifi_wildcard_probe_ie_sig | OUI + wildcard SSID + IE fingerprint | 2-note 2000→2800 Hz |
| 3 | wifi_wildcard_probe | OUI + wildcard SSID, IE no-match | 2-note 1400→1800 Hz |
| 2 | wifi_oui_addr2 / ble_* | transmitter OUI or any BLE firmware-sig | 1200 Hz blip |
| 1 | wifi_oui_addr1/addr3 | OUI in addr1/BSSID (README: “do misfire”) | 800 Hz blip |
| 0 | wifi_ssid | SSID keyword (OFF by default) | 600 Hz blip |
10.7.3 Foxhunter cadence (from Vol 8)
≥ -35 dBm 10–25 ms INSANE -75..-65 250–400 ms MEDIUM
-45..-35 25–75 ms ULTRA FAST -85..-75 400–600 ms SLOW
-55..-45 75–150 ms VERY FAST ≤ -85 800 ms VERY SLOW
-65..-55 150–250 ms FAST10.7.4 Flash in 20 seconds
1. desktop Chrome/Edge/Opera → the repo's github.io flasher
2. DATA USB-C cable → Connect & Flash
3. power-cycle → join the mode's AP (see §3.2 map)
4. browse to 192.168.4.1Glossary
ALPR — Automatic Licence-Plate Recognition; the camera class flock-you detects (Flock Safety).
ASTM F3411 — the standard defining drone Remote ID message formats; implemented by OpenDroneID.
BLE — Bluetooth Low Energy. The ecosystem’s second radio; adverts are the primary passive target.
Blue Edition — the all-passive, shipping firmware family (detectors, DF, drone RX).
Burn-in mode — Detector mode that locks config and boots straight into scanning (no AP), for unattended use; BOOT 1.5 s clears it.
CID (Company ID) — a 16-bit Bluetooth SIG company identifier in a BLE advert
(e.g. 0x034D = TASER/Axon, 0x09C8 = XUNTONG).
Duty cycle — fraction of time a scan is actively listening; Foxhunter runs 95%.
Foxhunting / ARDF — radio direction finding; the amateur-radio sport the Foxhunter firmware is named for.
GATT / service UUID — BLE attribute profile; specific service UUIDs are
firmware signatures (e.g. Flock accessory e8ccbb38-…, Nordic DFU 00001530-…,
Raven 0x3100–0x3500).
IE (Information Element) — a tagged field inside an 802.11 management frame; the wildcard-probe IE fingerprint is flock-you’s highest-confidence Wi-Fi signature.
LittleFS — the on-flash filesystem holding the web dashboard assets (~2 MB).
MAC randomisation — generating a fresh radio MAC per boot so the detector is not itself a stable track.
mesh-mapper — Sky-Spy’s Flask/Socket.IO host app that plots drones + pilots on an offline MBTiles map.
NimBLE — the lightweight BLE stack the firmware uses for scanning.
NVS — ESP32 non-volatile storage; holds mode selection, filters, aliases, history, credentials.
OpenDroneID — the open-source Remote-ID implementation (Apache-2.0) Sky-Spy links.
OUI — Organizationally Unique Identifier; the 24-bit vendor prefix of a MAC address, and the brand’s namesake.
Passive scan — a BLE scan that does not transmit SCAN_REQ (vs active scan, which does). axeoff/BLE-Sniff are passive; Detector/Foxhunter are active.
PCAP — the packet-capture file format; two repos export it to Wireshark.
Penguin — the Flock Safety battery-pack BLE signature (name Penguin-NNNN…,
FS Ext Battery, CID 0x09C8).
Promiscuous mode — 802.11 receive mode that captures all frames, not just those addressed to the device; the Wi-Fi detection path.
Raven — SoundThinking/ShotSpotter acoustic gunshot sensor; BLE GATT signature
0x3100–0x3500.
Red Edition — the stated-in-development offensive side (Remote-ID-Spoofer, Oui-Spy-UniPwn); category level only in this dive.
Remote ID — the “digital licence plate” broadcast standard for drones.
RSSI — Received Signal Strength Indicator (dBm, negative; nearer zero = stronger); Foxhunter’s distance proxy.
Tier model — flock-you’s 5-level confidence grading, highest tier per MAC wins and never drops back (Vol 4).
U.FL — the miniature coax connector on the XIAO for an external/directional antenna.
Unified Blue — the boot-selector firmware that packs seven Blue modes into one image.
Wildcard probe — an 802.11 probe request with a zero-length (broadcast) SSID; Flock cameras emit them ~every 0.125 s.
XIAO ESP32-S3 — Seeed’s thumbnail-sized ESP32-S3R8 board (8 MB flash / 8 MB PSRAM, U.FL), the default target.
10.8 Figure-slot index
Every FIGURE SLOT across the dive, for the photo/screenshot acquisition pass.
(Real figures that exist in figs/ are the four listed first; everything else is
a slot to be filled.)
Existing figures (figs/):
Table 8 — Existing figures (`figs/`):
| File | Used in | Credit |
|---|---|---|
os-flock-you-logo.png | Vol 6 hero (flock-you) | Image: colonelpanichacks (GitHub). |
os-ouispy-logo.png | Vols 1, 7, 8 (ecosystem logo) | Image: colonelpanichacks (GitHub). |
os-skyspy-eagle.png | Vol 9 hero (Sky-Spy) | Image: colonelpanichacks (GitHub). |
os-xiao-s3-hero.png | Vol 3 (XIAO board) | Photo: Seeed Studio. |
Figure slots (to acquire):
Table 9 — Figure slots (to acquire):
| Slot | What is needed |
|---|---|
| Vol 7 §3.1 | Unified Blue selector page at 192.168.4.1 (seven mode tiles, buzzer toggle) |
| Vol 7 §4.4 | Detector vendor-card database (META/RAY-BAN, AXON presets, ”+ Add”) |
| Vol 8 §3.1 | Foxhunter portal MAC-entry + tracking-mode confirmation |
| Vol 8 §5.2 | XIAO ESP32-S3 with a 2.4 GHz Yagi on U.FL (community mini-Yagi build) |
| Vol 9 §3.3 | A Sky-Spy build and/or decoded serial JSON for a captured Remote-ID frame |
| — | OUI-SPY board + Earrings variant (hardware, for Vol 3) |
| — | Flask flockyou.py dashboard with a GPS-tagged detection map (for Vol 6) |
This closes the OUI-SPY deep dive. The arc: what it is and where it fits (Vol 1), the threats it detects (Vol 2), the XIAO hardware (Vol 3), the Wi-Fi and BLE methodology that is its real differentiator (Vols 4–5), the flagship in depth (Vol 6), the module family (Vol 7), direction finding (Vol 8), drones and the fenced-off Red edge (Vol 9), and this build/operate/compare cheatsheet (Vol 10). The one sentence to carry away: OUI-SPY is the cheapest, deepest, most forensic surveillance-detector ecosystem in the hub — the only one that direction-finds and the only one that exports Wireshark captures — and it is passive by default, with an offensive edge that is deliberately kept at arm’s length.
Comments (0)