gojosix.eye net

Initializing DecentralRadar v0.2.0...
STATUS: Illuminating the invisible. 🎃
LAYER: Shadowing the grid. 🥷
RESULT: Maximum signal. 💥

                  ┌──────────────────────────────────────────────────────────┐
                  │SYSTEM::NODE_SCAN   [▓▓▓▓▓▓▓▓░░] 80%   (🛰️)  LOC: PRIVATE │
                  ├──────────────────────────────────────────────────────────┤
                  │                                                          │
                  │          ◢◤                        ◥◣                    │
                  │        ◢◤     ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄     ◥◣                   │
                  │       █      █                 █      █                  │
                  │       █      █     ◢█████◣     █      █    TRK: 5.0 GHz  │
                  │       █      █    █   ◉   █    █      █    SIG: STABLE   │
                  │       █      █     ◥█████◤     █      █    BUF: CLEAR    │
                  │       █      █_________________█      █                  │
                  │        ◥◣                            ◢◤                  │
                  │          ◥◣       GOJOSIX.EYE      ◢◤                    │
                  │            ◥◣____________________◢◤                      │
                  │                                                          │
                  ├──────────────────────────────────────────────────────────┤
                  │[!] Illuminating the invisible. | [!] Shadowing the grid. │
                  └──────────────────────────────────────────────────────────┘

gojosix.eye net is the identity and presentation layer for this repository's desktop app. The Cargo package name is decentral-radar, but the app itself is presented as a highly stylized signal observatory.

---

📡 What is this project?

This project is a Linux desktop application that scans nearby WiFi networks and transforms them into a live, radar-like observatory.

It synthesizes:

• 🦀 Rust for the UI, state modeling, multi-threading, and spatial heuristics.
• ⚡ Zig for high-performance, low-level nl80211 WiFi scanning through a dynamically linked shared library.
• 🎨 egui/eframe for the buttery-smooth, animated dashboard and radar panel.
• 🐧 Linux Utils (nmcli and ip neigh) for network context and LAN-neighbor visibility.

The result is a local-first tool for visualizing RF visibility in your physical space, unlocking:

• 📍 Nearby SSIDs & BSSIDs tracking
• 📊 Signal strength (RSSI) historical graphing
• 🚦 Spatially-aware channel congestion mapping
• 🏷️ Vendor/OUI hints for unknown signals
• 🕵️ Connected-device awareness & role hints
• 🚶 RSSI-based presence and motion heuristics
• 🏠 Room fingerprinting and health summaries
• 🔍 Automated network reconnaissance (self-running nmap scans)
• 🛡️ WiFi attack detection (evil twin / rogue AP / deauth & jamming)
• 🤖 AI behavioral anomaly analysis
• ⚠️ Consolidated threat scoring across security, recon, and AI findings

👁️ Why it was created (and why it's unique)

Most WiFi tools fall into two extremes: purely technical, text-heavy CLI outputs, or disconnected web dashboards. gojosix.eye net bridges this gap.

It exists to explore a more tactile, visual, and honest way of looking at the WiFi spectrum. It feels like a rich lab instrument—giving you dark control-room energy without relying on black-box "smart" systems.

✨ Key Differentiators:

• Desktop First: Not a web app. Built raw and close to the metal.
• Direct Kernel Access: The Zig scanner talks directly to Linux interfaces via nl80211.
• Commodity Hardware: Requires NO custom sensor nodes; it runs on standard Linux WiFi gear.
• Environmental Context: Fuses raw WiFi visibility with heuristics for motion, posture drift, signal health, and room fingerprinting.

✨ New in v0.2.0 — Recon, Security & Threats

v0.2.0 upgrades the observatory from pure visualization into a network awareness & security suite with three new engine modules and three new GUI tabs.

🔍 Recon (Self-Running Network Reconnaissance)

The app now automatically fingerprints every LAN peer it discovers (ip neigh) and schedules tiered nmap scans (XML output parsed via quick-xml):

• Tiered scanning — Fast (-sV -T4 --top-ports 100), Deep (-sV -sC -p- -T3), Stealth (-sS -Pn)
• Port risk classification — 50+ ports mapped to Safe / Info / Suspicious / Critical (SSH safe; Telnet, SMBv1, VNC critical; RDP & admin panels suspicious)
• Vulnerability correlator — matches results against built-in CVEs (EternalBlue CVE-2017-0144, BlueKeep CVE-2019-0708, anonymous FTP, plaintext Telnet, weak SNMP, UPnP…)
• Structured report generator — ASCII report + JSON export with prioritized recommendations
• Privilege-aware scans — detected via effective UID; unprivileged runs automatically drop root-only flags (-O, -sS), so scans never fail on a non-root session
• Manual target queueing + auto-scheduling (quick/deep cadence)

🛡️ Security (WiFi Attack Detection)

• Evil twin / rogue AP — same SSID on multiple vendors, security downgrades (open APs), high-signal hidden APs, new BSSIDs on known SSIDs
• Deauth / jamming detection — EMA signal baselines that flag simultaneous multi-AP drops (jamming) and repeated single-AP drops (targeted deauth)

🤖 AI (Behavioral Anomaly Analysis)

• New device arrival, IP changes (spoofing), subnet-scan activity spikes, unusual-hour activity, RSSI variance anomalies, and disappeared devices

⚠️ Threats (Consolidated Threat Scoring)

A unified threat score composites high-severity AI anomalies, recon risk, and critical security alerts, with per-device and network-health framing.

New UI Tabs

• 🔍 Recon — scan controls, per-device results, report generation/export
• 🛡 Security — ranked alert feed with evidence & recommendations
• ⚠ Threats — composite score, AI anomalies, critical findings, network health

Requirement: nmap must be installed for auto-scanning (sudo apt install nmap). The Recon tab shows a warning banner if it's missing.

---

⚠️ Safety & Reality Check

This project intentionally keeps expectations realistic.

• It uses WiFi RSSI heuristics, not dedicated body sensors.
• Words like "Pose", "vitals", "presence", and "motion" are interpretive estimates based on RF signal behavior.
• 🛑 Disclaimer: Treat this as an experimental observatory tool, not as a medical, safety, surveillance, or security system.

---

🏗️ Architecture

Linux WiFi / NetworkManager / neighbor table
        │
        ├── Zig scanner (.so) ──> nl80211 kernel path
        │
        └── nmcli / ip neigh  ──> local network context
        │
        ▼
Rust app state ──> monitoring heuristics ──> egui observatory & radar
        ▲
        │  (background threads, each sharing Arc<Mutex<T>> state)
        ├── recon::    nmap XML parsing + vulnerability correlation + reports
        ├── security:: evil twin / rogue AP / deauth / jamming detection
        └── ai::       behavioral anomaly analysis

Key moving parts:

• build.rs: Automatically invokes zig build -Doptimize=ReleaseSafe (falls back to a prebuilt libwifi_scan.so when the Zig toolchain is unavailable).
• native/src/scanner.zig: Builds the fast, low-level shared scanner library.
• src/scanner/: Handles Rust FFI and scan data parsing.
• src/gui/: Renders the immersive dashboard, tabs, and sweeping radar.
• src/monitoring/, src/pose/, src/vitals/: Computes heuristics and summaries.
• src/recon/: Self-running nmap scans, port-risk database, CVE correlator, report/JSON export.
• src/security/: RF-attack detection (evil twin, deauth, jamming).
• src/ai/: Behavioral anomaly analysis (subnet scans, spoofing, unusual activity).

---

🚀 Setup & Installation

1. Platform Support & Prerequisites

This project is currently Linux-first and targeted at Ubuntu-style desktop environments.

Note: It expects a graphical session for eframe/winit. Headless or compositor-less runs may fail with WaylandError. Scan depth depends on your adapter's capabilities.

Required Tooling:

• rustc & cargo (1.94.0+)
• zig (0.13.0) - Use version 0.13.0 to prevent build API drift.
• nmap (for the Recon feature's automated scanning) - sudo apt install nmap

2. Install Toolchains

🦀 Install Rust:

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
source "$HOME/.cargo/env"

⚡ Install Zig (0.13.0):

mkdir -p ~/opt && cd ~/opt
# Download the Zig release archive manually from ziglang.org/download -> Linux x86_64
tar -xf zig-linux-x86_64-0.13.0.tar.xz
echo 'export PATH="$PATH:$HOME/opt/zig-linux-x86_64-0.13.0"' >> ~/.zshrc
source ~/.zshrc

3. Build & Run

git clone https://github.com/zang7777/six-eye gojosix-eye
cd gojosix-eye
cargo run

Behind the scenes: Cargo builds the Rust front-end, triggers build.rs to compile the Zig library in native/, links them, and launches the UI.

---

🛠️ Development Cheatsheet

Task	Command
Run App	cargo run
Test Rust	cargo test
Test Zig	cd native && zig build test
Format Rust	cargo fmt

📂 Project Layout

gojosix-eye/
├── build.rs                  # Rust build script (runs Zig / prebuilt .so fallback)
├── native/                   # Zig codebase
│   ├── build.zig             # Zig build definition
│   ├── src/scanner.zig       # nl80211 WiFi scanner core
│   └── zig-out/lib/          # Prebuilt libwifi_scan.so (build fallback)
├── src/                      # Rust codebase
│   ├── gui/                  # UI components (dashboard, radar, tabs, export)
│   ├── monitoring/           # Observatory summary logic
│   ├── pose/                 # Posture estimation heuristics
│   ├── vitals/               # Vitals-like RSSI drop/spike analysis
│   ├── scanner/              # Rust FFI wrapper for Zig scanner
│   ├── signal_health.rs      # Environmental health & fingerprinting
│   ├── recon/                # nmap scanning, port risk, CVE correlator, reports
│   ├── security/             # evil twin / rogue AP / deauth / jamming detection
│   ├── ai/                   # behavioral anomaly analysis
│   └── models/               # Shared domain data models
└── assets/                   
    ├── oui/oui.txt           # Vendor MAC lookup data
    └── gojosix-eye-net.svg   # Original SVG assets

---

📸 Snapshots

The app can export JSON snapshots of the current observatory state for external analysis.

gojosix_eye_net_export_YYYYMMDD_HHMMSS.json

🗺️ Roadmap Ideas

• Richer radar animation and decaying target trails
• Stronger per-band filtering (2.4GHz / 5GHz / 6GHz)
• Spectrum-style frequency overlays
• Better Linux packaging (AppImage / Flatpak / DEB)
• Saved sessions and historical replay mode
• Temporal diffing between saved room fingerprints
• Export recon reports to Markdown/HTML
• Historical threat timeline & alert dedup across reboots
• Integration with nmap OS detection when run as root

📜 Licensing & Credits

Licensing Dual-licensed under either:

• MIT License
• Apache License 2.0

Credits

• Inspired by the legendary RuView aesthetic.
• Built locally by builders, for RF experimenters, and systems-minded tinkerers.