Run/stop a built-in iperf3 server so another device can throughput-test *against* this box. Returns the addresses to point the other end at.
(action)
| 1270 | for t in tracks[:6]: |
| 1271 | reasons.append(f"device at {t['ip']} rotated through {len(t['macs'])} " |
| 1272 | f"randomized MACs — tracked across its address changes") |
| 1273 | |
| 1274 | if spoofed or clones or hi_events: |
| 1275 | verdict = 'spoofed' |
| 1276 | elif tracks or randomized: |
| 1277 | verdict = 'suspicious' if tracks else 'randomization' |
| 1278 | |
| 1279 | return { |
| 1280 | 'success': True, 'verdict': verdict, |
| 1281 | 'summary': { |
| 1282 | 'observed': len(current), |
| 1283 | 'spoofed': len(spoofed), |
| 1284 | 'clones': len(clones), |
| 1285 | 'past_events': len(hi_events), |
| 1286 | 'randomized': len(randomized), |
| 1287 | 'virtual': len(virtual), |
| 1288 | 'tracks': len(tracks), |
| 1289 | }, |
| 1290 | 'spoofed': spoofed, |
| 1291 | 'clones': clones, |
| 1292 | # Every MAC seen this pass, worst class first, so the UI can list them. |
| 1293 | 'observed_macs': sorted( |
| 1294 | current, |
| 1295 | key=lambda c: ({'spoofed_vendor_oui': 0, 'universal': 1, |
| 1296 | 'randomized': 2, 'virtual_laa': 3}.get(c['klass'], 4), |
| 1297 | c['ips'][0] if c['ips'] else '', c['mac'])), |
| 1298 | 'events': [dict(e, ago=_fmt_ago(now - e['ts'])) for e in recent_events[-20:]][::-1], |
| 1299 | 'randomization': randomization, |
| 1300 | 'tracks': tracks, |
| 1301 | 'gateway': {'ip': gw, 'mac': gw_mac}, |
| 1302 | 'interface': scan_iface, |
| 1303 | 'scanned': scanned, |
| 1304 | 'source': (f'arp-scan sweep on {scan_iface}' if scanned |
| 1305 | else 'neighbour table (all interfaces)'), |
| 1306 | 'oui_db': bool(len(_load_oui_db()) > len(_MAC_VENDOR_SEED)), |
| 1307 | 'reasons': reasons, |
| 1308 | } |
| 1309 |
no test coverage detected