26 lines
1.2 KiB
Markdown
26 lines
1.2 KiB
Markdown
# Task 2 Report: Enrich Scan Associations and APs
|
|
|
|
## Status
|
|
|
|
Implemented and verified. The Task 2 changes are committed as `feat: associate recon clients with confirmed networks`.
|
|
|
|
## Changes
|
|
|
|
- Added scan-scoped handshake and optional `hostap_client` evidence queries.
|
|
- Added deterministic association deduplication keyed by client, BSSID, and SSID.
|
|
- Kept directed probe (`ssid.type = 5`) records out of associations.
|
|
- Added AP `device_identity`, `clients`, and unique `client_count` fields.
|
|
- Added client `vendor` and `associations` fields, including empty associations for unassociated clients.
|
|
- Preserved SSID-only `hostap_client` evidence without assigning a BSSID.
|
|
- Added fixture coverage for duplicate evidence, a second AP/client pair, directed probes, missing optional tables, identity fields, and timestamps.
|
|
|
|
## Verification
|
|
|
|
- Focused tests: `python3 -m unittest tests.test_recon.ReconDataTest -v` -> 7/7 passed.
|
|
- Complete Recon tests: `python3 -m unittest tests.test_recon -v` -> 121/121 passed.
|
|
- Diff validation: `git diff --check` -> clean.
|
|
|
|
## Concerns
|
|
|
|
- The working tree contains pre-existing unstaged HTML report signal-order changes and untracked `loot/` and certificate files; these were intentionally preserved and excluded from the Task 2 commit.
|