marfrit/besser
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Phase 5 review: BES2600 WiFi-stability campaign artifact #3

Merged
marfrit merged 1 commits from claude-noether into main 2026-05-06 13:37:16 +00:00
Conversation 1 Commits 1 Files Changed 1
+217
marfrit commented 2026-05-06 13:35:14 +00:00
Owner
Copy Link
Copy Source

Phase 5 hand-off artifact for the BES2600 WiFi-stability investigation, submitted as a branch on the besser umbrella for second-model review.

(Re-opens #2 on the correctly-named claude-noether branch — original PR had a typo'd branch name and could not be merged.)

Summary

  • Phase 1 metric locked: rate of WSM_STATUS_DECRYPTFAILURE bursts (≥4 events / 60 s) per hour, plus conditional probability of an AP-side unprotected-deauth-reason-6 within 30 s.
  • Three Pattern-P1 events captured on hardware (ohm, srcversion 461AFB36...).
  • Rig: dynamic_debug + journal + iw-event + tcpdump-filtered + 60 s snap loop + netcat 1 MB/s load probe.
  • Headline finding: under sustained load, decrypt-failure burst rate elevates ~35x but stops escalating to AP-deauth (100% idle / 0% load conditional escalation).
  • Open contradictions and small-N caveats stated as-is.

Asks

  1. Is the Phase 1 metric the right discriminator? Should we also count AP-deauth-6 with no preceding burst (the Event-3 / post-resume path)?
  2. Is N=1 idle / N=12 load enough to report the escalation flip, or do we need N≥3 in each bin?
  3. Cheap Phase 3 additions before Phase 4: enable ftrace mac80211/cfg80211, widen tcpdump to ring EAPOL with a moving 5-min window?
  4. Is missing AP-side capture (no Fritz!Box logs) a blocking gap?

Where the receipts live

  • Artifact in this PR: notes/phase5-2026-05-06.md
  • Raw run dir on ohm: /root/bes2600-samples/run-20260506-0659-fresh/
  • Source pins: bes2600/txrx.c:1696, bes2600/wsm.h:620, bes2600/wsm.c:1484

🤖 Generated with Claude Code

Phase 5 hand-off artifact for the BES2600 WiFi-stability investigation, submitted as a branch on the besser umbrella for second-model review. *(Re-opens [#2](https://git.reauktion.de/marfrit/besser/pulls/2) on the correctly-named `claude-noether` branch — original PR had a typo'd branch name and could not be merged.)* ## Summary - Phase 1 metric locked: rate of `WSM_STATUS_DECRYPTFAILURE` bursts (≥4 events / 60 s) per hour, plus conditional probability of an AP-side unprotected-deauth-reason-6 within 30 s. - Three Pattern-P1 events captured on hardware (ohm, srcversion `461AFB36...`). - Rig: dynamic_debug + journal + iw-event + tcpdump-filtered + 60 s snap loop + netcat 1 MB/s load probe. - Headline finding: under sustained load, decrypt-failure burst rate elevates ~35x but stops escalating to AP-deauth (100% idle / 0% load conditional escalation). - Open contradictions and small-N caveats stated as-is. ## Asks 1. Is the Phase 1 metric the right discriminator? Should we also count AP-deauth-6 with no preceding burst (the Event-3 / post-resume path)? 2. Is N=1 idle / N=12 load enough to report the escalation flip, or do we need N≥3 in each bin? 3. Cheap Phase 3 additions before Phase 4: enable ftrace mac80211/cfg80211, widen tcpdump to ring EAPOL with a moving 5-min window? 4. Is missing AP-side capture (no Fritz!Box logs) a blocking gap? ## Where the receipts live - Artifact in this PR: `notes/phase5-2026-05-06.md` - Raw run dir on ohm: `/root/bes2600-samples/run-20260506-0659-fresh/` - Source pins: `bes2600/txrx.c:1696`, `bes2600/wsm.h:620`, `bes2600/wsm.c:1484` 🤖 Generated with [Claude Code](https://claude.com/claude-code)
marfrit added 1 commit 2026-05-06 13:35:14 +00:00
notes: phase 5 review artifact for BES2600 wifi-stability campaign 1a21212744 
Captures Phase 0-3 receipts as of 2026-05-06: three Pattern-P1 events
reproduced (07:13, 11:03, yesterday 22:33), decrypt-failure metric locked
as Phase 1 with source pins (txrx.c:1696, wsm.h:620, wsm.c:1484), rig built
(snap loop + tcpdump filtered ring + iw event + dynamic_debug + netcat 1MB/s),
idle-vs-load comparison shows 35x burst-rate elevation under load with
conditional-escalation flip (100% idle / 0% load).

Pending Phase 5 second-model review before Phase 4 plan.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
marfrit commented 2026-05-06 13:37:02 +00:00
Author
Owner
Copy Link
Copy Source

Please take comments from PR #2

Please take comments from PR #2
marfrit merged commit 07a7d4b3af into main 2026-05-06 13:37:16 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
claude-noether (Claude (noether)) marfrit (Markus Fritsche)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: marfrit/besser#3
Delete Branch "claude-noether"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?