Sentinel

Sentinel watches for Wi-Fi attacks in the background while no other scan is running. It reports deauth floods, evil twins, handshake and PMKID capture, beacon and probe floods, jamming, and disruption of your own mesh channel. It also finds other Meshtastic and MeshCore radios nearby and lists the devices that join the node's own access point. When it recognizes the tool behind a deauth frame or a forged beacon, it names it.

How it works

Sentinel listens on Wi-Fi and matches each frame against a set of detectors. Each detector looks for one attack pattern, such as a burst of deauth frames from one source, or two access points claiming the same network name on different channels. A detection is written to the incident log on SD and, for most detectors, sent to the mesh. Every detection records what triggered it, on the serial console and in the log, so you can check it.

The detectors are grouped. You turn a whole group on or off with one command.

Group	Detectors
DoS	Evil twin, SAE DoS, association-sleep
Rogue AP	Evil twin, OWE abuse, Karma / MANA
Recon	PMKID harvest, probe flood, forced handshake, Pwnagotchi
Physical	FragAttacks, two-channel twin, jamming, jamming baseline
Mesh	Mesh channel disruption (self-spoof, channel flood, command audit)
Devices	Meshtastic and MeshCore radios

Deauth flood, deauth forge, beacon flood, and auth flood run alongside these.

Tool attribution

For a deauth frame, Sentinel names the tool it recognizes: Marauder and a Michael TKIP attack by their frame fingerprint, and MDK4, an ESP Deauther, aireplay-ng, and bettercap by their behavior. For a forged beacon, it names the pattern, such as a Karma or Bruce beacon.

A Pwnagotchi is found by its advertisement and logged. Because a Pwnagotchi deauthenticates clients and captures handshakes, a sighting counts toward the Deauth and PMKID totals rather than a counter of its own. Its sightings are listed in the Recon card.

Start

• Web UI: Sentinel tab → Start Sentinel.
• Over mesh: @ALL SENTINEL_ON. @ALL SENTINEL_OFF stops it.

Command	What it does
@ALL SENTINEL_ON / SENTINEL_OFF	Starts or stops Sentinel
@ALL SENTINEL_BOOT:1	Starts Sentinel at every power-on. An explicit stop clears this until you set it again
@ALL SENTINEL_MODE:scan	Watches all channels. defend watches only the node's own channel. Headless defaults to scan on boot
@ALL GROUP:recon:on	Turns a detector group on or off: dos, rogue, recon, physical, mesh, devices, or all
@AH01 DETECT_CFG:{"meshradio":true}	Changes one detector setting

Activity cards

Three cards on the Sentinel tab show what the node is seeing right now:

• AP Clients — the devices that have joined this node's Wi-Fi access point, with how many times each one connected.
• Mesh Radios Nearby — the Meshtastic and MeshCore radios the node hears. A radio you mark as known never raises an alert and shows a known badge.
• Mesh command audit — every command seen on your own Meshtastic channel, with the radio that sent it. The node logs the source instead of alerting, because a command on a shared channel cannot be told apart from a real one.

Marking a radio as known

Your own Meshtastic and MeshCore radios will show up in Mesh Radios Nearby. Mark them known so they stop raising alerts.

Command	Alias	What it does
@AH01 RADIO_KNOWN_ADD:AA:BB:CC:DD:EE:FF:Meshtastic:MyRadio	RKA	Adds a radio to the known list, by MAC, type, and an optional name
@AH01 RADIO_KNOWN_DEL:AA:BB:CC:DD:EE:FF	RKD	Removes one radio
@AH01 RADIO_KNOWN_CLEAR	RKX	Clears the known list

A radio with a fixed address is matched by its MAC. A radio that rotates its address is matched by its type and advertised name. The list holds up to 32 radios.

Options that are off until you turn them on

• Attack response triangulates, captures packets, or starts a scan after a confirmed attack. See Attack response.
• Karma bait sends one probe request every 8 seconds to lure fake access points. It is the only detector that transmits.
• Meshtastic / MeshCore detection adds a Bluetooth scan. It also finds your own radios, so mark them known.
• Interference baseline alerts when a busy channel suddenly goes silent in defend mode.

Wi-Fi interference is on by default. It alerts when a channel's noise level jumps. If you move the node, turn it off and on so it relearns the noise level.

If Sentinel alerts on your own gear

Mark your own radios known (above), and add your own access points and devices to the allowlist. In defend mode on a busy channel, the interference baseline can fire when the channel goes quiet; turn it off if that is normal for your site.

Reference

The mesh command reference lists every Sentinel command, detector setting, and alert.