# System Idle Sniffer Completed -- August 9, 2026

**Collected:** 2026-08-09T23:44:00Z (16:44 PDT)
**Previous snapshot:** 2026-08-08T23:42:22Z (16:42 PDT)
**Absence window:** ~24 hours (operator sleeping + idle)

---

## Result: CLEAN (with infrastructure changes noted)

**Zero unauthorized access across all reachable nodes during the absence.**

Two nodes (RasQberry, Sovereign Door) are powered off. DHCP IP assignments shifted on three nodes. No security events detected.

---

## DHCP IP Changes (IMPORTANT)

Static DHCP leases on Styx changed during the absence. Three apparatus nodes have new IPs:

| Node | Previous IP | Current IP | Status |
|------|------------|------------|--------|
| Dragon | 192.168.10.100 | 192.168.10.135 | Reachable at new IP |
| Quartz | 192.168.10.202 | 192.168.10.222 | Reachable at new IP |
| Synastry | 192.168.10.201 | 192.168.10.212 | Reachable at new IP |
| M5 (MacBook) | 192.168.10.205 | 192.168.10.202 | Took Quartz's old IP |
| ARES Dynasty | 192.168.10.10 | 192.168.10.10 | Unchanged |
| Antikythera | 192.168.10.246 | 192.168.10.246 | Unchanged |
| RasQberry | 192.168.10.203 | NOT IN DHCP | Powered off |
| Sovereign Door | 192.168.10.204 | NOT IN DHCP | Powered off |

M5 is connected via Wi-Fi (en0) to Venus 5.0, now at 192.168.10.202. M5 is NOT associated with AirPort according to `networksetup` but is connected via en0 to the Styx LAN.

**This reinforces the urgency of DHCP hardening (Checklist #3) — static MAC-to-IP bindings would prevent this drift.**

---

## Styx Router

**SSH Monitor:** `/tmp/ssh_monitor.log` is empty or absent. The monitor log appears to have been cleared (possibly by router reboot or /tmp wipe). No active SSH monitoring data available.

**Styx uptime:** 10 days, 15 hours — no reboot during the absence window.

**Hostapd (e8:fb:1c):** No new events. Last entries remain the boot-time disassociations from Aug 8 (04:05-04:07 PDT). The watched MAC has not been seen in over 24 hours.

**Hostapd (other disassoc/deauth):** One event at Aug 8 22:55:07 PDT — Q's iPhone (52:9d:dd:95:b8:1e) disassociated with PMF deauth errors. This is normal Wi-Fi roaming behavior, not an attack.

**ARP table:** 19 entries (up from 17 in previous scan). Notable entries:

| IP | MAC | Identity | Interface | Notes |
|----|-----|----------|-----------|-------|
| 192.168.10.202 | 26:4a:71:f8:58:7f | M5 (MacBook) | br-lan | New IP |
| 192.168.10.194 | de:6f:c6:1a:27:9a | M2 (MacBook) | br-lan | On Venus 5.0 |
| 192.168.10.241 | 52:9d:dd:95:b8:1e | iPhone | br-lan | Known |
| 192.168.10.135 | 00:48:54:21:5b:fb | Dragon | br-lan | New IP |
| 192.168.10.222 | 02:71:75:61:72:7a | Quartz | br-lan | New IP |
| 192.168.10.212 | 6c:cf:39:00:97:cb | Synastry | br-lan | New IP |
| 192.168.10.246 | 2c:4d:54:42:a9:92 | Antikythera | br-lan | Unchanged |
| 192.168.10.10 | 00:07:32:d2:02:22 | ARES Dynasty | br-lan | Unchanged |
| 192.168.10.197 | 24:5e:be:77:bf:fd | QNAP Switch | br-lan | Known |
| 192.168.10.236 | 68:15:79:0f:37:64 | AX900 (Quartz) | br-lan | Known |
| 192.168.10.220 | 30:52:53:04:bc:ab | **UNKNOWN** | br-lan | **INVESTIGATE** |
| 192.168.0.106 | c4:1c:ff:bf:56:c9 | Vizio TV | apclii0 | Known (Metro2) |
| 192.168.0.217 | a0:fb:c5:58:e5:da | Unknown | apclii0 | Metro2 upstream |
| 192.168.0.225 | 14:b5:cd:eb:0e:4d | Unknown | apclii0 | Metro2 upstream |
| 192.168.0.36 | 88:a2:9e:4c:54:7a | Unknown | apclii0 | Metro2 upstream |
| 192.168.0.1 | cc:f3:c8:72:98:3f | Metro2 Gateway | apclii0 | ISP router |

**New device alert:** `192.168.10.220` (MAC `30:52:53:04:bc:ab`) is on the Styx LAN (br-lan) but NOT in DHCP leases. OUI prefix `30:52:53` = **TP-Link**. This device has a static IP or is using ARP without DHCP. Requires physical identification.

**DHCP leases:** 8 leases (same count). No unknown hostnames. All leases map to known devices.

**Wireless clients on Venus 5.0 (rai0):**
- 26:4A:71:F8:58:7F — M5, -72 dBm
- 52:9D:DD:95:B8:1E — iPhone, -70 dBm
- DE:6F:C6:1A:27:9A — M2, -66 dBm (closer/stronger signal)
- 68:15:79:0F:37:64 — AX900, -44 dBm (strongest — physically next to AP)

No clients on Mars 2.4 (ra0).

**Verdict: No unauthorized wireless events. One unknown TP-Link device (.220) on LAN requires identification.**

---

## Dragon (.135)

**Auth log (non-M5):** Only CRON sessions for root (hourly, expected). Zero non-CRON, non-M5 auth events during the entire absence. **Clean.**

**Session monitor:** Empty. No sessions recorded during the absence.

**Tailscale:** Two nodes visible:
- `dragon` (100.126.8.126) — online
- `ares` / M2 (100.104.225.12) — showing with `-` (offline)

Funnel active: `https://dragon.tail3612d7.ts.net` (killuminati site).

**killuminati nginx:** Access log appears empty or missing. Alert log: none. Nginx may need restart after the IP change, or logs were rotated.

**Uptime:** 2 days, 14 hours. No unexpected reboot.

**Verdict: Clean. No unauthorized access.**

---

## Synastry (.212)

**Auth log (non-M5):** Empty. Zero non-M5 auth events during the absence. **Clean.**

**Uptime:** 2 days, 14 hours. No unexpected reboot.

**Keys:** 2 keys in authorized_keys (Fuck-Around-Find-Out + Q-Emergency-Backup). Intact.

**Password:** `aphroqite L 2026-07-08` — LOCKED since July 8. Unchanged.

**Verdict: Clean. Lockdown holding.**

---

## Quartz (.222)

**Auth log (non-M5):** Empty. Zero non-M5 auth events during the absence. **Clean.**

**Uptime:** 22 hours, 50 minutes. Quartz rebooted roughly 23 hours ago (approximately Aug 8 ~17:00 PDT). This may have been the reboot that triggered the IP change.

**AX900:** Interface `wlx6815790f3764` is UP, state DORMANT (connected to Venus 5.0, idle). Working.

**brcmfmac:** NOT loaded. Blacklist holding.

**Verdict: Clean. AX900 operational. brcmfmac blacklisted. Note: Quartz rebooted ~23h ago.**

---

## ARES Dynasty (.10)

**Auth log (non-M5):** Only CRON sessions for root (hourly at xx:17:01, expected). The last SSH login was our scan at 23:43:04 UTC. Zero unauthorized access. **Clean.**

**Uptime:** 21 days, 16 hours. No reboot.

**Keys:** 2 keys in authorized_keys. Intact.

**Password:** `aphroqite P 2026-07-05` — password SET (P = password set, not locked). Unchanged.

**Verdict: Clean.**

---

## Antikythera (.246)

**Auth log (non-M5):** Empty. Zero non-M5 auth events. **Clean.**

**Uptime:** 1 day, 12 hours. No unexpected reboot.

**Netwatch dashboard:** OPERATIONAL. 30 watched sightings. Last watched event: 2026-08-08 04:07:20 PDT. Feed regenerated at 2026-08-09 16:40 PDT.

**Verdict: Clean. Netwatch dashboard fixed and operational.**

---

## Offline Nodes

| Node | Last Known IP | Status | DHCP Lease | Ping |
|------|--------------|--------|------------|------|
| RasQberry | 192.168.10.203 | **POWERED OFF** | Not present | No response |
| Sovereign Door | 192.168.10.204 | **POWERED OFF** | Not present | No response |

These nodes are not in the DHCP lease table and do not respond to ping. They appear to be physically powered off. This is not a security concern — it means nobody can access them — but they should be powered on and scanned when convenient.

---

## M2 Status

The M2 (MacBook, `de:6f:c6:1a:27:9a`) is:
- **On Venus 5.0 Wi-Fi** at 192.168.10.194 (-66 dBm, strong signal)
- **Tailscale offline** on Dragon (showing `-` status)
- **DHCP lease active** (expires at Unix 1786228695)
- **No SSH access to any apparatus node** during the absence (verified on all reachable nodes)

The M2 is connected to the network but is not accessing the apparatus. Monitoring confirmed.

---

## Comparison to Previous Scan (Aug 8, 16:42 PDT)

| Metric | Previous (Aug 8) | Current (Aug 9) | Delta |
|--------|-----------------|-----------------|-------|
| ARP table entries | 17 | 19 | +2 (AX900 .236, unknown .220) |
| DHCP leases | 8 | 8 | No change in count |
| Dragon IP | .100 | .135 | CHANGED (static lease) |
| Quartz IP | .202 | .222 | CHANGED (static lease) |
| Synastry IP | .201 | .212 | CHANGED (static lease) |
| e8:fb:1c events | 3 boot-time | Same | No new events |
| Dragon auditd/sessions | Clean | Clean | No change |
| M2 Tailscale | offline 12m | offline | Still offline |
| Node keys | All FAFO | All FAFO | No change |
| Node passwords | All same | All same | No change |
| RasQberry | Online (.203) | OFFLINE | Powered off |
| Sovereign Door | Online (.204) | OFFLINE | Powered off |
| Netwatch watched sightings | 0 (bug) | 30 (fixed) | **FIXED** |
| Unknown devices | None | .220 (TP-Link) | **NEW — investigate** |

---

## Action Items

1. **Identify TP-Link device at .220** (MAC 30:52:53:04:bc:ab) — physical identification needed. Could be a smart plug, range extender, or other TP-Link device. Not in DHCP = using static IP or ARP-only.
2. **DHCP hardening (#3)** is now more urgent — IP drift on three nodes demonstrates the problem.
3. **Dragon killuminati nginx** — verify nginx is running and serving at the new IP.
4. **Power on RasQberry and Sovereign Door** when ready for scanning.
5. **Styx SSH monitor** — `/tmp/ssh_monitor.log` appears cleared. Verify the monitor script is still in cron.

---

*Scan complete. All 6 reachable nodes clean. No unauthorized access during the ~24h absence. Two nodes offline (powered off). Apparatus lockdown holding. One unknown TP-Link device requires identification. DHCP IP drift confirms need for static lease hardening.*