Function do_locate_port

network_diagnostics.py:1334–1378

Physically locate which switch port this device is plugged into by flapping the link in a timed pattern (link LED blinks). Managed switches already report the port via LLDP/CDP (Switch Discovery) -- this is the fallback for unmanaged switches. Runs in the background and returns at once.

(interface, count=6, on_ms=800, off_ms=800, force=False)

    for e in hi_events[-8:]:
        reasons.append(f"IP {e['ip']} changed MAC {e['old_mac']} → {e['new_mac']} "
                       f"({_fmt_ago(now - e['ts'])}) — possible spoof/clone in the past")

    # (4) Randomization inventory (aggregate, not per-MAC).
    randomized = [c for c in current if c['klass'] == 'randomized']
    virtual = [c for c in current if c['klass'] == 'virtual_laa']
    with _mac_watch_lock:
        macs_store = (_mac_watch_load().get('macs') or {})
    ephemeral = 0
    for mac, rec in macs_store.items():
        if rec.get('klass') != 'randomized':
            continue
        life = rec.get('last', 0) - rec.get('first', 0)
        if 0 <= life < _MAC_EPHEMERAL_S and rec.get('count', 0) >= 1:
            ephemeral += 1
    randomization = {
        'count': len(randomized),
        'ephemeral': ephemeral,
        'virtual': len(virtual),
        'macs': [c['mac'] for c in randomized],
        'virtual_macs': [{'mac': c['mac'], 'vendor': c['vendor']} for c in virtual],
    }
    if randomized:
        note = (f"{len(randomized)} randomized (privacy) MAC(s) on the segment"
                + (f", {ephemeral} short-lived (active rotation)" if ephemeral else ""))
        reasons.append(note)

    # (5) Tracking — an IP that cycled through >=2 randomized MACs is one device
    # rotating to hide. Group its randomized addresses into a followable track.
    tracks = []
    with _mac_watch_lock:
        ip_hist = (_mac_watch_load().get('ip_history') or {})
    for ip, hist in ip_hist.items():
        rand_macs, first, last = [], None, None
        for h in hist:
            if _classify_mac(h['mac'])['klass'] == 'randomized':
                rand_macs.append(h['mac'])
                first = h['first'] if first is None else min(first, h['first'])
                last = h['last'] if last is None else max(last, h['last'])
        uniq = sorted(set(rand_macs))
        if len(uniq) >= 2 and last and now - last <= _MAC_WATCH_WINDOW_S:
            tracks.append({'ip': ip, 'macs': uniq, 'changes': len(uniq) - 1,
                           'first': first, 'last': last,
                           'span': _fmt_ago(now - first) if first else None})
    tracks.sort(key=lambda t: len(t['macs']), reverse=True)
    for t in tracks[:6]:
        reasons.append(f"device at {t['ip']} rotated through {len(t['macs'])} "
                       f"randomized MACs — tracked across its address changes")