Baseline anomaly

The node learns which devices are normally around, then reports devices that are new, gone, back again, or moving closer or away.

How it works

The scan has two phases. First it learns: for a set time it records every device it hears and builds a baseline of what belongs. Then it monitors: it compares what it hears now against that baseline and flags anything that does not fit. With an SD card, the baseline survives a reboot.

Start

• Web UI: Scan tab → Baseline Anomaly Sniffer → pick the learning time → Start Scan.
• Over mesh: @ALL BASELINE_START:300 monitors for 300 seconds after the learning phase. The number sets the monitor time, not the learning time; learning runs for the Baseline setting (5, 10, or 15 minutes). @ALL BASELINE_START:0:FOREVER monitors until you stop it. @ALL BASELINE_STATUS reports progress.

Once learning ends, the Compare from now button (or @ALL BASELINE_WATCH) splits the results at the moment you press it. Devices heard only after are New, devices heard only before are Gone, and devices whose signal changed by the variation threshold are Moving.

Settings

Setting	What it does	Default	Range
RSSI	Ignores devices weaker than this	−70 dBm	−40 to −80
Baseline	How long it learns	5 min	5, 10, 15 min
Marked Absent	Seconds unseen before a device counts as gone	120	30 to 600
Seen Reappear	Seconds after going missing that a return is reported	300	60 to 1800
RSSI Variation	Signal change that counts as moving	20 dB	5 to 50

If everything shows as new

The baseline was still learning, or it was cleared. Let the learning phase finish before you press Compare from now. On a busy site, raise the RSSI filter so the baseline holds only the devices that are reliably present.