EFForg / EFForg/rayhunter

[Feature Request]: Adjustable tresholds, yellow line, periodical restart and showing warnings net to the line

Open
#334 9 comments 0 reactions 1 assignee Claimed by @untitaker View on GitHub
enhancement ui
Dominant language
Rust
Stars
5.8k
Forks
490
Avg merge
3d 10h
Merged PRs (30d)
23

Description

### What problem does this feature solve or what does it enhance?

A friend of mine is capturing packets with Rayhunter on TP-Link v4 in one Asian country. However, many times he starts the device, he gets red line. I is a false alarm (the "first 150 packets" problem) and he needs to go to Rayhunter's WebUI, press "stop recording" and then "start recording" again, so red line disappears.

### Proposed Solution

I propose to have **adjustable thresholds for showing red line** and to **add yellow line**.

In WebUI there should be a configuration with a list of all hevristics/detections. And for each of them there should be an option to select what kind of line should be shown. Example:
- IMSI requested: (red / yellow / no alarm)
- 2G downgrade: (red / yellow / no alarm)
- Null cipher: (red / yellow / no alarm)
- silent SMS received: (red / yellow / no alarm)

In that case user will be able to select to show red line only if there are events with higher probability that IMSI catcher was detected. Yellow line would be triggered by suspicious events but with lower probability that IMSI catcher was detected. This should help to filter out false alarms.

Another proposal is also to **delay starting the Rayhunter when device is turned on**. This also should be configurable in options. In that case we will avoid false alarm known as the "first 150 packets" problem.

Third proposal is to **reload/restart Rayhunter periodically**, let's say each hour. Why? If you get the alarm (red line) in the morning, and are running device the whole day, the red line would stay for the whole day. This is a little bit misleading. So Rayhunter should be restarted so red line would stay for let's say just one hour an then it will dissapear.

Fourth proposal is to **show number of events next to the line**. So if red line dissapears (as described in previous proposal), user will still see number of red and yellow warnings. However in WebUI there should be an option to reset those warnings completely.

So if you are using the device for the whole week and will get an alarm at the morning of the second day, you will:
- get red line for one hour at the morning of the second day
- after that, line would be green, but you will see that there was one red alarm
- when you will log into the Rayhunter after let's say one week, you will be able to reset this "red counter"

### Alternatives Considered

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.