feat: associate recon clients with confirmed networks

2026-08-21 08:26:58 -05:00
parent 2c9fa8d137
commit a67faecee9
3 changed files with 149 additions and 14 deletions
@@ -0,0 +1,25 @@
+# Task 2 Report: Enrich Scan Associations and APs
+
+## Status
+
+Implemented and verified. The Task 2 changes are committed as `feat: associate recon clients with confirmed networks`.
+
+## Changes
+
+- Added scan-scoped handshake and optional `hostap_client` evidence queries.
+- Added deterministic association deduplication keyed by client, BSSID, and SSID.
+- Kept directed probe (`ssid.type = 5`) records out of associations.
+- Added AP `device_identity`, `clients`, and unique `client_count` fields.
+- Added client `vendor` and `associations` fields, including empty associations for unassociated clients.
+- Preserved SSID-only `hostap_client` evidence without assigning a BSSID.
+- Added fixture coverage for duplicate evidence, a second AP/client pair, directed probes, missing optional tables, identity fields, and timestamps.
+
+## Verification
+
+- Focused tests: `python3 -m unittest tests.test_recon.ReconDataTest -v` -> 7/7 passed.
+- Complete Recon tests: `python3 -m unittest tests.test_recon -v` -> 121/121 passed.
+- Diff validation: `git diff --check` -> clean.
+
+## Concerns
+
+- The working tree contains pre-existing unstaged HTML report signal-order changes and untracked `loot/` and certificate files; these were intentionally preserved and excluded from the Task 2 commit.