sudo apt install wireshark kismet aircrack-ng bettercap tshark
pip install scapy
git clone https://github.com/greatscottgadgets/ubertooth.git
git clone https://github.com/srlabs/gsm-arfcn-freq-map.git

tshark -r capture.pcapng -Y "wlan.fc.type == 0" -T fields \
  -e frame.number -e wlan.fc.type_subtype -e wlan.sa -e wlan.da \
  -e wlan.bssid -e wlan.ssid -e wlan_radio.channel \
  -e wlan.rssi -e wlan_mgt.fixed.capabilities.privacy \
  > management_frames.csv

tshark -r capture.pcapng -Y "wlan.fc.type_subtype == 0x08" -T fields \
  -e frame.number -e wlan.bssid -e wlan.ssid \
  -e wlan_mgt.fixed.beacon_interval \
  -e wlan_mgt.ds.current_channel \
  -e wlan_mgt.rsn.akm.type \
  -e wlan_mgt.rsn.pairwise.cipher.type \
  > beacon_frames.csv

tshark -r capture.pcapng -Y "eapol" -T fields \
  -e frame.number -e wlan.sa -e wlan.da \
  -e eapol.keydes.type -e eapol.keydes.key_info \
  -e eapol.keydes.key_length -e eapol.keydes.replay_counter \
  -e eapol.keydes.nonce -e eapol.keydes.mic \
  > eapol_handshake.csv

aircrack-ng -w rockyou.txt -b AA:BB:CC:DD:EE:FF capture.cap

tshark -r wpa3_capture.pcapng -Y "wlan.fc.type_subtype == 0x0b || (wlan.fc.type == 1 && wlan.fc.type_subtype == 0x1b)" \
  -T fields \
  -e frame.number -e wlan.fc.type_subtype -e wlan.sa -e wlan.da \
  -e wlan_mgt.fixed.auth_algorithm -e wlan_mgt.fixed.auth_seq \
  > sae_auth.csv

tshark -r suspect.pcapng -Y "wlan.fc.type_subtype == 0x0c || wlan.fc.type_subtype == 0x0a" \
  -T fields \
  -e frame.number -e frame.time_relative \
  -e wlan.sa -e wlan.da -e wlan.bssid \
  -e wlan.fc.type_subtype \
  > deauth_events.csv

cat deauth_events.csv | awk -F'\t' '{print $6}' | sort | uniq -c | sort -rn | head -20

wlan.fc.type_subtype == 0x04

tshark -r passive_scan.pcapng -Y "wlan.fc.type_subtype == 0x04" -T fields \
  -e frame.number -e wlan.sa -e wlan_mgt.ssid \
  -e wlan_radio.channel -e wlan.rssi \
  > probe_requests.csv

cat probe_requests.csv | awk -F'\t' '{print $2}' | sort | uniq -c | sort -rn | head -30

tshark -r hidden_ssid.pcapng \
  -Y "wlan_mgt.ssid == \"\" && wlan.fc.type_subtype == 0x08" \
  -T fields -e wlan.bssid -e wlan_radio.channel \
  -e wlan_mgt.rsn.akm.type -e wlan_mgt.rsn.pairwise.cipher.type \
  | sort -u > hidden_ssids_bssid.txt

tshark -r bt_hci_log.cfa -Y "btcommon" -T fields \
  -e frame.number -e btcommon.opcode -e btcommon.opcode_mnemonic \
  -e bthci_cmd.bd_addr -e bthci_evt.status \
  > bt_hci_analysis.csv

tshark -r ble_capture.pcapng -Y "btle" -T fields \
  -e frame.number -e frame.time_relative \
  -e btle.advertising_address -e btle.data_header.length \
  -e btle.advertising_header.pdu_type \
  -e btle.advertising_header.target_address_type \
  -e btgatt.advertising_data.service_uuid_16 \
  -e btgatt.advertising_data.local_name \
  -e btle_rf.channel_number \
  > ble_advertising.csv

ubertooth-util -v
ubertooth-btle -f -t AA:BB:CC:DD:EE:FF
ubertooth-btle -c -t AA:BB:CC:DD:EE:FF

btcommon.opcode == 0x15 && bthci_cmd.encryption_key_size < 7

bthci_evt.code == 0x03 && bthci_evt.auth_complete.status == 0x00 && btcommon.l2cap_cid == 0x0001

tshark -r ble_scan.pcapng -Y "btle.advertising_header.pdu_type == 0x00 || btle.advertising_header.pdu_type == 0x01" \
  -T fields \
  -e frame.number -e frame.time_epoch \
  -e btle.advertising_address -e btle_rf.channel_number \
  -e btgatt.advertising_data.local_name \
  -e btgatt.advertising_data.service_uuid_16 \
  -e btle_rf.signal_power_dbm \
  | sort -t',' -k2,2 -k5,5 | uniq > ble_device_timeline.csv

cat ble_device_timeline.csv | awk -F',' '{
  mac=$3; rssi=$8;
  if(mac in count) { count[mac]++; sum[mac]+=rssi }
  else { count[mac]=1; sum[mac]=rssi }
} END {
  for(m in count) printf "%s: avg_rssi=%.1f, count=%d\n", m, sum[m]/count[m], count[m]
}' | sort -t= -k2 -n

ubertooth-rx -c -t AA:BB:CC:DD:EE:FF
ubertooth-follow -t AA:BB:CC:DD:EE:FF -l
ubertooth-dump -f -t AA:BB:CC:DD:EE:FF

python3 nrf_sniffer_bluetooth_le.py --port /dev/ttyACM0 --baudrate 115200 --output ble_traffic.pcapng

rtl_sdr -f 935e6 -s 2.4e6 -g 40 -b 8 -c gsm_capture.cfile

gqrx -i 0

hackrf_transfer -r gsm_capture.raw -f 935000000 -s 2000000 -a 1 -l 32 -g 40

grgsm_decode -c gsm_capture.raw -C -s 935000000 -g 40 -a 1

kal -s GSM850 -g 40 -e

tshark -r v2x_capture.pcapng -Y "wlan.fc.type == 0x02" \
  -T fields \
  -e frame.number -e wlan.sa -e wlan.da \
  -e wlan_radio.channel -e wlan.rssi \
  > v2x_messages.csv

proxmark3 /dev/ttyACM0 -c "hf 14a reader"
proxmark3 /dev/ttyACM0 -c "hf mf dump"
proxmark3 /dev/ttyACM0 -c "lf em 410x reader"

tshark -r wireless_scan.pcapng -Y "wlan.fc.type_subtype == 0x08" -T fields \
  -e wlan.bssid -e wlan.ssid -e wlan_radio.channel \
  -e wlan.rssi -e wlan_mgt.rsn.akm.type \
  | sort -t$'\t' -k2,2 | uniq -f1 -D | sort -t$'\t' -k2,2 > potential_evil_twins.csv

cat potential_evil_twins.csv | awk -F'\t' '
{
  ssid=$2;
  if(ssid in bssids) {
    if(index(bssids[ssid], $1) == 0) {
      bssids[ssid] = bssids[ssid] "," $1
      count[ssid]++
    }
  } else {
    bssids[ssid] = $1
    count[ssid] = 1
  }
} END {
  for(s in count) if(count[s] > 1) printf "SSID: %s | BSSIDs: %s\n", s, bssids[s]
}'

kismet -c wlan1 --dumpfile kismet_logs --useGPSD

tshark -r kismet_logs.pcapng -Y "wlan.fc.type_subtype == 0x08" -T fields \
  -e wlan.bssid -e wlan.ssid -e wlan_radio.channel \
  -e wlan.rssi -e wlan_mgt.rsn.akm.type \
  -e wlan_mgt.vendor_specific.element_id \
  > kismet_beacon_analysis.csv

grep -i "rogue\|evil\|deauth\|flood\|unauthorized" /var/log/wids/wids.log \
  | awk '{print $1, $2, $3, $NF}' > wids_alerts.csv

fluxion -i wlan0 -c 6 -E "Corporate-WiFi" --portal login --language zh

tshark -r p2p_capture.pcapng -Y "wlan.fc.type_subtype == 0x0d || wlan.fc.type_subtype == 0x0e" \
  -T fields \
  -e frame.number -e wlan.sa -e wlan.da \
  -e wlan_mgt.action_code -e wlan_mgt.ssid \
  > wifi_direct_analysis.csv

tshark -r suspicious_wifi.pcapng \
  -Y "tcp.flags.syn == 1 && tcp.flags.ack == 0" \
  -T fields \
  -e ip.src -e ip.dst -e tcp.dstport \
  -e tcp.window_size_value -e tcp.options.mss.value \
  | sort | uniq -c | sort -rn | head -30 > syn_scan_analysis.csv

tshark -r wifi_traffic.pcapng -Y "dns.qry.name.len > 150 && dns.flags.response == 0" \
  -T fields \
  -e frame.number -e ip.src -e ip.dst \
  -e dns.qry.name -e dns.qry.type \
  > dns_tunnel_candidates.csv

tshark -r wifi_traffic.pcapng -Y "dns.flags.response == 1 && dns.flags.rcode == 3" \
  -T fields -e ip.src -e dns.qry.name \
  | awk '{print $2}' | cut -d'.' -f1 | sort | uniq -c | sort -rn | head -20

tshark -r wireless_c2_suspect.pcapng \
  -Y "tcp.len > 0 && tcp.len < 100 && http.request.method == POST" \
  -T fields \
  -e ip.src -e ip.dst -e tcp.dstport \
  -e http.host -e http.request.uri -e http.content_length \
  > c2_http_candidates.csv

tshark -r enterprise_wifi.pcapng \
  -Y "wlan.fc.type == 2" -T fields \
  -e wlan.sa -e wlan.da -e ip.src -e ip.dst \
  -e ip.proto -e tcp.dstport -e udp.dstport \
  | awk -F'\t' '{
    proto=$5;
    if(proto == "6") port=$6;
    else if(proto == "17") port=$7;
    else port="other";
    key=$1"|"proto"|"port;
    count[key]++;
  } END {
    for(k in count) if(count[k] > 100) print count[k], k
  }' | sort -rn | head -30 > enterprise_traffic_analysis.csv

python3 << 'EOF'
import csv
from datetime import datetime

events = []
with open('combined_evidence.csv', 'r') as f:
    reader = csv.DictReader(f)
    for row in reader:
        events.append({
            'time': datetime.fromisoformat(row['timestamp']),
            'type': row['event_type'],
            'severity': row['severity'],
            'source': row['source_ip'],
            'detail': row['detail']
        })

events.sort(key=lambda x: x['time'])

severity_colors = {'🔴': 'red', '🟡': 'orange', '🟢': 'green'}
for e in events:
    print(f"[{e['time'].strftime('%Y-%m-%d %H:%M:%S')}] {e['severity']} {e['type']}: {e['detail']} (src={e['source']})")
EOF

title: Suspicious WiFi Client Association Pattern
id: 5f3a2b1c-8d4e-4f5a-9b6c-7d8e9f0a1b2c
status: experimental
description: Detects a client device associating with an unusual number of different APs within a short time window, which may indicate Evil Twin victim or automated attack
references:
  - https://attack.mitre.org/techniques/T1557/009/
author: x7peeps
date: 2026/07/06
tags:
  - attack.t1557.009
  - attack.discovery
logsource:
  category: wireless
  product: custom
detection:
  selection_event_type:
    EventID: 10021
    EventType: AssociationRequest
  selection_unusual:
    UniqueAPCount:
      condition: greater_than
      value: 10
  timeframe: 10m
  condition: selection_event_type and selection_unusual
falsepositives:
  - Legitimate roaming in high-density wireless environments
level: medium

title: Potential Evil Twin Access Point Detected
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects the presence of multiple BSSIDs broadcasting the same SSID with different vendor OUIs, which is a strong indicator of Evil Twin attack
references:
  - https://attack.mitre.org/techniques/T1557/009/
author: x7peeps
date: 2026/07/06
tags:
  - attack.t1557.009
  - attack.credential_access
logsource:
  category: wireless
  product: custom
detection:
  selection_wids_alert:
    WIDS_EventType: RogueAP
    OR:
      WIDS_EventType: EvilTwin
  selection_multiple_vendor:
    VendorOUI:
      condition: count_unique
      group_by: SSID
      min_unique: 3
  timeframe: 30m
  condition: selection_wids_alert or selection_multiple_vendor
falsepositives:
  - Large campus environments with managed multi-vendor deployments
  - Temporary event WiFi setups
level: high

title: WiFi Deauthentication Flood Attack
id: 9c0d1e2f-3a4b-5c6d-7e8f-0a1b2c3d4e5f
status: experimental
description: Detects high-rate deauthentication frames targeting specific clients, indicative of deauth flooding attack used for Evil Twin or DoS
references:
  - https://attack.mitre.org/techniques/T1557/003/
author: x7peeps
date: 2026/07/06
tags:
  - attack.t1557.003
  - attack.disruption
logsource:
  category: wireless
  product: custom
detection:
  selection_deauth:
    FrameType: Deauthentication
    OR:
      FrameType: Disassociation
  selection_rate:
    FrameCount:
      condition: greater_than
      value: 50
      group_by: TargetMAC
  timeframe: 1m
  condition: selection_deauth and selection_rate
falsepositives:
  - Legitimate AP firmware issues causing periodic deauth
level: critical

#!/bin/bash

INTERFACE="${1:-wlan0}"
OUTPUT_DIR="/tmp/wifi_audit_$(date +%Y%m%d_%H%M%S)"
REPORT_FILE="${OUTPUT_DIR}/report.txt"

mkdir -p "${OUTPUT_DIR}"

echo "=========================================" > "${REPORT_FILE}"
echo " WiFi Security Audit Report" >> "${REPORT_FILE}"
echo " Generated: $(date '+%Y-%m-%d %H:%M:%S')" >> "${REPORT_FILE}"
echo " Interface: ${INTERFACE}" >> "${REPORT_FILE}"
echo "=========================================" >> "${REPORT_FILE}"

echo "[*] Phase 1: Passive wireless scan..." >> "${REPORT_FILE}"
timeout 30 airodump-ng "${INTERFACE}" \
  --write "${OUTPUT_DIR}/scan_results" \
  --output-format csv \
  --encrypt opn,wep,wpa,wpa2,wpa3 2>/dev/null

echo "[*] Phase 2: Analyzing scan results..." >> "${REPORT_FILE}"
if [ -f "${OUTPUT_DIR}/scan_results-01.csv" ]; then
  echo "" >> "${REPORT_FILE}"
  echo "--- Open Networks (No Encryption) ---" >> "${REPORT_FILE}"
  grep "OPN" "${OUTPUT_DIR}/scan_results-01.csv" | \
    awk -F',' '{printf "  BSSID: %-20s CH: %-4s Power: %-6s SSID: %s\n", $1, $4, $8, $14}' >> "${REPORT_FILE}"

  echo "" >> "${REPORT_FILE}"
  echo "--- WEP Networks (Weak Encryption) ---" >> "${REPORT_FILE}"
  grep " WEP " "${OUTPUT_DIR}/scan_results-01.csv" | \
    awk -F',' '{printf "  BSSID: %-20s CH: %-4s Power: %-6s SSID: %s\n", $1, $4, $8, $14}' >> "${REPORT_FILE}"

  echo "" >> "${REPORT_FILE}"
  echo "--- Potential Evil Twin (Multiple BSSIDs per SSID) ---" >> "${REPORT_FILE}"
  awk -F',' 'NR>1 && $14 != "" && $1 != "" {
    ssid=$14; bssid=$1;
    if(ssid in seen && seen[ssid] != bssid) {
      dup[ssid]=1
    }
    seen[ssid]=bssid
  } END {
    for(s in dup) printf "  SSID: %s (multiple BSSIDs detected)\n", s
  }' "${OUTPUT_DIR}/scan_results-01.csv" >> "${REPORT_FILE}"

  echo "" >> "${REPORT_FILE}"
  echo "--- Client Devices Detected ---" >> "${REPORT_FILE}"
  grep -A 1000 "Station MAC" "${OUTPUT_DIR}/scan_results-01.csv" | \
    tail -n +2 | awk -F',' '$1 != "" {printf "  MAC: %-20s Connected: %s\n", $1, $6}' >> "${REPORT_FILE}"
fi

echo "" >> "${REPORT_FILE}"
echo "[*] Phase 3: Channel-hopping Deauth detection..." >> "${REPORT_FILE}"
DEAUTH_COUNT=$(tshark -r "${OUTPUT_DIR}/scan_results-01.cap" \
  -Y "wlan.fc.type_subtype == 0x0c" 2>/dev/null | wc -l)
echo "  Deauth frames detected: ${DEAUTH_COUNT}" >> "${REPORT_FILE}"

if [ "${DEAUTH_COUNT}" -gt 100 ]; then
  echo "  [!] WARNING: High deauth rate detected!" >> "${REPORT_FILE}"
  echo "  [!] This may indicate an active deauth attack." >> "${REPORT_FILE}"
fi

echo "" >> "${REPORT_FILE}"
echo "=========================================" >> "${REPORT_FILE}"
echo " Audit Complete. Report: ${REPORT_FILE}" >> "${REPORT_FILE}"

cat "${REPORT_FILE}"

#!/usr/bin/env python3
import sys
import json
from collections import defaultdict, Counter
from datetime import datetime

try:
    from scapy.all import *
    from scapy.layers.dot11 import Dot11, Dot11Beacon, Dot11ProbeReq, Dot11ProbeResp, Dot11Auth, Dot11AssoReq, Dot11Deauth, Dot11Disas, RadioTap
except ImportError:
    print("Please install scapy: pip install scapy")
    sys.exit(1)

class WirelessForensicsAnalyzer:
    def __init__(self):
        self.ap_registry = defaultdict(dict)
        self.client_registry = defaultdict(set)
        self.deauth_events = []
        self.probe_requests = []
        self.auth_events = []
        self.ssid_bssid_map = defaultdict(set)
        self.anomalies = []

    def analyze_pcap(self, pcap_file):
        print(f"[*] Loading capture file: {pcap_file}")
        packets = PcapReader(pcap_file)
        count = 0

        for pkt in packets:
            count += 1
            if count % 10000 == 0:
                print(f"    Processed {count} packets...")

            if not pkt.haslayer(Dot11):
                continue

            dot11 = pkt.getlayer(Dot11)
            frame_type = dot11.type
            frame_subtype = dot11.subtype

            if frame_type == 0:
                self._process_management_frame(pkt, dot11, frame_subtype)
            elif frame_type == 2:
                self._process_data_frame(pkt, dot11)

        print(f"[*] Total packets analyzed: {count}")
        return self._generate_report()

    def _process_management_frame(self, pkt, dot11, subtype):
        if subtype == 8:
            self._process_beacon(pkt, dot11)
        elif subtype == 4:
            self._process_probe_request(pkt, dot11)
        elif subtype in (0, 2):
            self._process_association(pkt, dot11, subtype)
        elif subtype == 11:
            self._process_auth(pkt, dot11)
        elif subtype == 12:
            self._process_deauth(pkt, dot11)
        elif subtype == 10:
            self._process_disassoc(pkt, dot11)

    def _process_beacon(self, pkt, dot11):
        bssid = dot11.addr2
        if not bssid or bssid == "ff:ff:ff:ff:ff:ff":
            return

        ssid = ""
        if pkt.haslayer(Dot11Beacon):
            beacon = pkt.getlayer(Dot11Beacon)
            if hasattr(beacon, 'info'):
                try:
                    ssid = beacon.info.decode('utf-8', errors='ignore')
                except:
                    ssid = "<hidden>"

        channel = 0
        if pkt.haslayer(RadioTap):
            radiotap = pkt.getlayer(RadioTap)
            if hasattr(radiotap, 'ChannelFrequency'):
                freq = radiotap.ChannelFrequency
                if 2412 <= freq <= 2484:
                    channel = (freq - 2407) // 5
                elif 5170 <= freq <= 5825:
                    channel = (freq - 5000) // 5

        rssi = -100
        if pkt.haslayer(RadioTap):
            radiotap = pkt.getlayer(RadioTap)
            if hasattr(radiotap, 'dBm_AntSignal'):
                rssi = radiotap.dBm_AntSignal

        self.ap_registry[bssid] = {
            'ssid': ssid,
            'channel': channel,
            'rssi': rssi,
            'last_seen': float(pkt.time)
        }

        if ssid:
            self.ssid_bssid_map[ssid].add(bssid)

    def _process_probe_request(self, pkt, dot11):
        client = dot11.addr2
        if not client:
            return

        ssid = ""
        if pkt.haslayer(Dot11ProbeReq):
            probe = pkt.getlayer(Dot11ProbeReq)
            if hasattr(probe, 'info'):
                try:
                    ssid = probe.info.decode('utf-8', errors='ignore')
                except:
                    ssid = ""

        self.probe_requests.append({
            'time': float(pkt.time),
            'client': client,
            'ssid': ssid
        })
        self.client_registry[client].add(ssid)

    def _process_deauth(self, pkt, dot11):
        self.deauth_events.append({
            'time': float(pkt.time),
            'src': dot11.addr1,
            'dst': dot11.addr2,
            'bssid': dot11.addr3
        })

    def _process_disassoc(self, pkt, dot11):
        self.deauth_events.append({
            'time': float(pkt.time),
            'src': dot11.addr1,
            'dst': dot11.addr2,
            'bssid': dot11.addr3
        })

    def _process_auth(self, pkt, dot11):
        self.auth_events.append({
            'time': float(pkt.time),
            'src': dot11.addr2,
            'dst': dot11.addr1,
            'status': getattr(pkt, 'status', 'unknown')
        })

    def _process_association(self, pkt, dot11, subtype):
        client = dot11.addr2
        ap = dot11.addr3
        if client and ap:
            self.client_registry[client].add(ap)

    def _detect_evil_twin(self):
        findings = []
        for ssid, bssids in self.ssid_bssid_map.items():
            if len(bssids) > 2:
                findings.append({
                    'type': 'EVIL_TWIN',
                    'severity': 'CRITICAL',
                    'ssid': ssid,
                    'bssids': list(bssids),
                    'description': f'SSID "{ssid}" has {len(bssids)} different BSSIDs - possible Evil Twin attack'
                })
        return findings

    def _detect_deauth_flood(self, threshold=50, window=60):
        findings = []
        if not self.deauth_events:
            return findings

        self.deauth_events.sort(key=lambda x: x['time'])
        target_counts = defaultdict(list)

        for event in self.deauth_events:
            target = event.get('bssid', 'unknown')
            target_counts[target].append(event['time'])

        for target, times in target_counts.items():
            for i in range(len(times)):
                window_end = times[i] + window
                count = sum(1 for t in times[i:] if t <= window_end)
                if count >= threshold:
                    findings.append({
                        'type': 'DEAUTH_FLOOD',
                        'severity': 'HIGH',
                        'target': target,
                        'count': count,
                        'window': f"{times[i]} - {window_end}",
                        'description': f'{count} deauth/disassoc frames targeting {target} within {window}s window'
                    })
                    break
        return findings

    def _detect_unusual_probes(self):
        findings = []
        client_probe_count = Counter()
        for pr in self.probe_requests:
            client_probe_count[pr['client']] += 1

        for client, count in client_probe_count.most_common(10):
            if count > 100:
                findings.append({
                    'type': 'EXCESSIVE_PROBING',
                    'severity': 'MEDIUM',
                    'client': client,
                    'probe_count': count,
                    'description': f'Client {client} sent {count} probe requests - possible reconnaissance'
                })
        return findings

    def _detect_client_hopping(self, threshold=5):
        findings = []
        for client, aps in self.client_registry.items():
            if len(aps) > threshold:
                findings.append({
                    'type': 'CLIENT_HOPPING',
                    'severity': 'MEDIUM',
                    'client': client,
                    'unique_aps': len(aps),
                    'ap_set': list(aps)[:10],
                    'description': f'Client {client} associated with {len(aps)} unique APs'
                })
        return findings

    def _generate_report(self):
        report = {
            'summary': {
                'total_aps': len(self.ap_registry),
                'total_clients': len(self.client_registry),
                'total_deauth_events': len(self.deauth_events),
                'total_probe_requests': len(self.probe_requests),
                'total_auth_events': len(self.auth_events),
                'unique_ssids': len(self.ssid_bssid_map),
            },
            'findings': [],
        }

        evil_twins = self._detect_evil_twin()
        deauth_floods = self._detect_deauth_flood()
        unusual_probes = self._detect_unusual_probes()
        client_hops = self._detect_client_hopping()

        report['findings'].extend(evil_twins)
        report['findings'].extend(deauth_floods)
        report['findings'].extend(unusual_probes)
        report['findings'].extend(client_hops)

        severity_counts = Counter(f['severity'] for f in report['findings'])
        report['summary']['findings_breakdown'] = dict(severity_counts)
        report['summary']['total_findings'] = len(report['findings'])

        return report

def main():
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <pcap_file>")
        sys.exit(1)

    pcap_file = sys.argv[1]
    analyzer = WirelessForensicsAnalyzer()
    report = analyzer.analyze_pcap(pcap_file)

    output_file = f"wireless_forensics_report_{datetime.now().strftime('%Y%m%d_%H%M%S')}.json"
    with open(output_file, 'w') as f:
        json.dump(report, f, indent=2, default=str)

    print(f"\n[*] Forensics Report Summary:")
    print(f"    APs Detected: {report['summary']['total_aps']}")
    print(f"    Clients Detected: {report['summary']['total_clients']}")
    print(f"    Deauth Events: {report['summary']['total_deauth_events']}")
    print(f"    Probe Requests: {report['summary']['total_probe_requests']}")
    print(f"    Total Findings: {report['summary']['total_findings']}")
    print(f"\n[*] Report saved to: {output_file}")

    for finding in report['findings']:
        severity_icon = {'CRITICAL': '🔴', 'HIGH': '🟠', 'MEDIUM': '🟡', 'LOW': '🟢'}
        icon = severity_icon.get(finding['severity'], '⚪')
        print(f"\n{icon} [{finding['severity']}] {finding['type']}")
        print(f"   {finding['description']}")

if __name__ == '__main__':
    main()