WiFi Network Scanning

Relevant source files

The following files were used as context for generating this wiki page:

• app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/service/CompleteScannerService.kt
• app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/service/ScannerService.kt
• app/src/main/kotlin/com/shadowcheck/mobile/service/NetworkMonitorService.kt
• app/src/main/kotlin/com/shadowcheck/mobile/models/WiFiFilters.kt
• app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/ui/screens/WiFiListScreen.kt
• app/src/main/kotlin/com/shadowcheck/mobile/ui/screens/security/RogueAPScreen.kt
• app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/ui/screens/SettingsScreen.kt

The WiFi Network Scanning module is a core component of the ShadowCheckMobile platform, designed for the comprehensive detection, analysis, and monitoring of IEEE 802.11 wireless networks. The system provides real-time signal intelligence (SIGINT) by aggregating data from Android's WifiManager, GPS location services, and specialized network callbacks to identify nearby access points, track signal strength over time, and detect potential security threats such as Rogue APs or deauthentication attacks.

This feature serves as the primary data ingestion engine for wardriving activities and surveillance detection. It captures extensive metadata for each network, including BSSID, SSID, frequency, capabilities (encryption), and precise geographic coordinates. Collected data is persisted in a local Room database for historical analysis and visualization on maps.

Core Scanning Architecture

The scanning logic is primarily hosted within foreground services to ensure continuous data collection even when the application is not in the active view. The system utilizes two primary implementation patterns: a basic ScannerService for transient monitoring and a CompleteScannerService for persistent, location-aware data logging.

Data Collection Flow

The scanning process follows a cyclical pattern where the service triggers a scan, receives results via a BroadcastReceiver, enriches the results with current GPS coordinates, and performs deduplication before database insertion.

Key Components

Component	Responsibility	Source File
CompleteScannerService	Manages the lifecycle of scanning, location updates, and database persistence.	CompleteScannerService.kt
NetworkMonitorService	Monitors active connections and detects events like deauthentication attacks.	NetworkMonitorService.kt
wifiScanReceiver	A BroadcastReceiver that processes SCAN_RESULTS_AVAILABLE_ACTION intents.	ScannerService.kt:37-52
WifiData / WifiNetwork	Data structures for representing scanned network attributes and sightings.	ScannerService.kt:153-160, WifiNetwork.kt

Threat Detection and Security Analysis

Beyond simple discovery, the system performs real-time security analysis on scanned networks to identify suspicious behavior or vulnerabilities.

Rogue AP Detection

The system evaluates networks against a "suspicion score" based on several indicators. This logic is implemented in the detectRogueAPs function, which groups networks by SSID to find "Evil Twins" and checks for suspicious hardware configurations.

• Hidden Networks: Strong signals from networks with no SSID.
• Evil Twins: Multiple BSSIDs sharing the same SSID.
• Encryption Weakness: Detection of Open or WEP-encrypted networks.
• OUI Analysis: Identification of suspicious MAC address prefixes.

Sources: RogueAPScreen.kt:127-175

Connection Event Monitoring

The NetworkMonitorService utilizes ConnectivityManager.NetworkCallback to track state changes in the device's own WiFi connection. It specifically looks for disconnection reason codes associated with deauthentication attacks (Reason 6: DEAUTH_LEAVING and Reason 7: DEAUTH_DISASSOC).

Data Management and Filtering

The application implements a robust filtering system to manage large volumes of scan data. The WiFiFilters model allows users to isolate specific networks based on technical criteria.

Filtering Criteria

Users can filter the network list using the following parameters:

• Frequency Bands: 2.4 GHz, 5 GHz, or 6 GHz.
• Security Protocols: WPA, WPA2, WPA3, WEP, or Open.
• WiFi Standards: Legacy standards up to WiFi 7 (802.11be).
• Signal Strength: Minimum/Maximum dBm thresholds.
• Spatial/Temporal: Only networks with location data or within a specific age range.

Sources: WiFiFilters.kt:25-75

Persistence Logic

The system applies a 30-second deduplication window for each BSSID to prevent database bloating while still capturing "sightings" over time.

// 30-second deduplication
if (existing == null || (now - existing.lastSeen) >= 30000) {
    wifiTotalCount++
    if (existing == null) wifiUniqueCount++
    database?.wifiNetworkDao()?.insert(WifiNetwork(...))
}

Sources: CompleteScannerService.kt:53-58

User Interface and Settings

The UI provides several views for interacting with scan data:

1. WiFiListScreen: Displays a real-time list of distinct networks and their sighting counts. WiFiListScreen.kt:39-55
2. NetworkDetailScreen: Shows signal strength history via a graph and technical metadata for a specific BSSID. NetworkDetailScreen.kt:128-154
3. SettingsScreen: Allows users to configure the scan_interval (ranging from 1 to 10 seconds) and manage database operations like purging sensor data or exporting results. SettingsScreen.kt:80-95

Scan Configuration

The scan interval is stored in encrypted preferences and controls the delay between successive scanning loops in the background services.
Sources: SettingsScreen.kt:81-95, ScannerService.kt:92

Summary

WiFi Network Scanning in ShadowCheckMobile is a multi-layered system that transitions from raw packet detection to sophisticated security intelligence. By combining background scanning services with real-time threat detection and flexible data filtering, the project enables users to map wireless landscapes and identify potential surveillance or network intrusions effectively.