Function updateInterfaceScanState

web/scripts/ragnar_modern.js:8728–8766

(interfaceName, enable, button)

        const d = await fetchAPI('/api/net/mac-watch?scan=' + (scan ? '1' : '0') + (iface ? '&interface=' + encodeURIComponent(iface) : ''));
        if (!d || d.success === false) {
            out.innerHTML = '<p class="text-sm text-red-400">Error: ' + escapeHtml((d && d.error) || 'failed') + '</p>';
            return;
        }
        _ndLastMacWatch = d;
        const [cls, label] = _MACWATCH_VERDICT_STYLE[d.verdict] || _MACWATCH_VERDICT_STYLE.unknown;
        const s = d.summary || {};
        let html = `<div class="mb-3 px-3 py-2 rounded border ${cls} text-sm">${label}</div>`;
        html += `<p class="text-xs text-gray-500 mb-2">Source: ${escapeHtml(d.source || '—')}</p>`;

        // Summary chips
        const chip = (n, txt, bad) =>
            `<span class="inline-flex items-center gap-1 px-2 py-1 rounded bg-slate-800 border border-slate-700 text-xs ${bad && n ? 'text-red-300' : 'text-gray-300'}">
                <span class="font-mono font-semibold">${n}</span>${escapeHtml(txt)}</span>`;
        html += '<div class="flex flex-wrap gap-2 mb-3">' +
            chip(s.observed || 0, ' seen') +
            chip(s.spoofed || 0, ' spoofed', true) +
            chip(s.clones || 0, ' cloned', true) +
            chip(s.past_events || 0, ' past events', true) +
            chip(s.randomized || 0, ' randomized') +
            chip(s.virtual || 0, ' virtual') +
            chip(s.tracks || 0, ' tracked devices') +
            '</div>';

        // Spoofed / disguised-vendor MACs
        if (d.spoofed && d.spoofed.length) {
            html += '<p class="text-xs uppercase text-red-400 mt-3 mb-1">Spoofed (vendor OUI + locally-administered bit)</p>' +
                '<ul class="text-xs text-gray-300 list-disc pl-5">' +
                d.spoofed.map(c => `<li class="font-mono">${escapeHtml(c.mac)} <span class="text-gray-500">(${escapeHtml(c.vendor || '?')})</span> → ${escapeHtml((c.ips || []).join(', ') || 'unknown IP')}</li>`).join('') +
                '</ul>';
        }
        // Cloned MACs (one MAC, many IPs)
        if (d.clones && d.clones.length) {
            html += '<p class="text-xs uppercase text-red-400 mt-3 mb-1">Cloned (one MAC, several IPs)</p>' +
                '<ul class="text-xs text-gray-300 list-disc pl-5">' +
                d.clones.map(c => `<li class="font-mono">${escapeHtml(c.mac)} → ${escapeHtml((c.ips || []).slice(0, 6).join(', '))}${(c.ips || []).length > 6 ? '…' : ''}</li>`).join('') +
                '</ul>';
        }
        // Tracked devices (rotating randomized MACs)
        if (d.tracks && d.tracks.length) {
            html += '<p class="text-xs uppercase text-amber-400 mt-3 mb-1">Tracked devices (rotating randomized MACs)</p>';
            html += d.tracks.map(t =>
                `<div class="mb-2 pl-3 border-l-2 border-amber-700/60">