{"id":47851946,"url":"https://github.com/arelius-d/openwrt-netaudit","last_synced_at":"2026-04-03T22:03:26.478Z","repository":{"id":339605391,"uuid":"1162624332","full_name":"Arelius-D/openwrt-netaudit","owner":"Arelius-D","description":"Forensic WiFi and wired network audit tools for OpenWrt on MediaTek hardware — RF site survey, client health, firewall inspection and more.","archived":false,"fork":false,"pushed_at":"2026-02-20T14:53:30.000Z","size":39,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-02-20T18:45:35.538Z","etag":null,"topics":["gl-mt6000","glinet","mediatek","network-audit","networking","openwrt"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Arelius-D.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-02-20T13:51:34.000Z","updated_at":"2026-02-20T14:54:09.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/Arelius-D/openwrt-netaudit","commit_stats":null,"previous_names":["arelius-d/openwrt-netaudit"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/Arelius-D/openwrt-netaudit","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Arelius-D%2Fopenwrt-netaudit","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Arelius-D%2Fopenwrt-netaudit/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Arelius-D%2Fopenwrt-netaudit/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Arelius-D%2Fopenwrt-netaudit/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Arelius-D","download_url":"https://codeload.github.com/Arelius-D/openwrt-netaudit/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Arelius-D%2Fopenwrt-netaudit/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31379453,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-03T21:40:47.592Z","status":"ssl_error","status_checked_at":"2026-04-03T21:40:05.436Z","response_time":107,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["gl-mt6000","glinet","mediatek","network-audit","networking","openwrt"],"created_at":"2026-04-03T22:03:21.456Z","updated_at":"2026-04-03T22:03:26.462Z","avatar_url":"https://github.com/Arelius-D.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# OpenWrt Net Audit\n\nA suite of forensic network audit and RF management tools for OpenWrt routers running on **MediaTek hardware** (GL.iNet GL-MT6000 and compatible). Built for operators who want real diagnostic depth from the shell — no GUI, no guesswork.\n\n---\n\n## Tools\n\n| Script | Purpose |\n|---|---|\n| `rf-survey.sh` | Full-spectrum WiFi site survey with channel ranking and interactive channel switching |\n| `wifi-audit.sh` | Forensic WiFi health audit — clients, signal, SNR, PHY rates, traffic, WAN egress |\n| `wired-audit.sh` | Forensic wired network audit — topology, firewall exposure, client reachability, hardware health |\n\n---\n\n## Hardware \u0026 Software Requirements\n\n| Requirement | Detail |\n|---|---|\n| **Router SoC** | MediaTek MT7986 (Filogic 830) or similar MediaTek platform |\n| **Firmware** | OpenWrt 21.02-SNAPSHOT or later |\n| **Config System** | UCI (Unified Configuration Interface) |\n| **Shell** | `/bin/ash` (BusyBox) |\n| **WiFi Tools** | `iwinfo`, `iwpriv` (MediaTek-specific — required for site survey) |\n| **Network Tools** | `ip`, `ping`, `nslookup`, `awk`, `grep`, `bridge` (standard OpenWrt) |\n\n\u003e **Important:** `rf-survey.sh` uses `iwpriv SiteSurvey` which is a **MediaTek driver-specific command**. It will not function on Qualcomm Atheros (ath9k/ath10k/ath11k) or Broadcom hardware. `wifi-audit.sh` and `wired-audit.sh` use standard `iwinfo` and sysfs and are more broadly portable, but have been tested primarily on MediaTek platforms.\n\n---\n\n## Installation\n\n```sh\n# SSH into your router\nssh root@192.168.8.1\n\n# Download scripts (adjust filenames/paths as needed)\nwget -O /root/rf-survey.sh https://raw.githubusercontent.com/Arelius-D/openwrt-netaudit/main/rf-survey.sh\nwget -O /root/wifi-audit.sh https://raw.githubusercontent.com/Arelius-D/openwrt-netaudit/main/wifi-audit.sh\nwget -O /root/wired-audit.sh https://raw.githubusercontent.com/Arelius-D/openwrt-netaudit/main/wired-audit.sh\n\n# Make executable\nchmod +x /root/rf-survey.sh /root/wifi-audit.sh /root/wired-audit.sh\n```\n\nNo package dependencies beyond what ships with a standard OpenWrt image.\n\n---\n\n## rf-survey.sh — Full Spectrum Site Survey\n\nScans all detected WiFi radios simultaneously using MediaTek's `SiteSurvey` engine, ranks every valid channel by neighbor density, and lets you apply a new channel immediately from the same session.\n\n### Usage\n\n```sh\n./rf-survey.sh            # Interactive: survey + channel switcher\n./rf-survey.sh -s|--scan  # Scan-only: print results and exit (no interaction)\n./rf-survey.sh -h|--help  # Show help\n```\n\n### What It Does\n\n1. **Auto-discovers all radios** dynamically from UCI — no hardcoded interface names\n2. **Triggers a hardware-level scan** on each radio via `iwpriv SiteSurvey=1`\n3. **Ranks every valid channel** on each band by number of neighbouring networks:\n\n| Rating | Neighbours |\n|---|---|\n| `EXCELLENT` | 0 |\n| `GOOD` | 1–2 |\n| `FAIR` | 3–5 |\n| `CROWDED` | 6+ |\n\n4. **Marks DFS channels** (52–144) so you know what you're selecting\n5. **Marks your current channel** with `*` in the results table\n6. **Applies the change live** via `uci set` + `wifi reload` if you select a new channel\n\n### Example Output\n\n```\n=== Full Spectrum Site Survey ===\nScanning all radios... please wait (approx 10s)...\n\n  \u003e Scanning 2.4GHz (ra0)... Done.\n  \u003e Scanning 5GHz (rax0)... Done.\n\n=== SURVEY RESULTS ===\n\nRadio 1: 2.4GHz (ra0) | Current: Channel 6\n---------------------------------------------------------\nRank  Channel    Neighbors  Status\n---------------------------------------------------------\n #1   Channel 1    [0]      EXCELLENT\n #2   Channel 11   [1]      GOOD\n*#3   Channel 6    [4]      FAIR\n...\n\nRadio 2: 5GHz (rax0) | Current: Channel 36\n---------------------------------------------------------\n #1   Channel 149  [0]      EXCELLENT\n #2   Channel 36   [1]      GOOD     (DFS)\n...\n```\n\n---\n\n## wifi-audit.sh — WiFi Forensic Audit\n\nA structured health check for your WiFi stack. Runs through radio state, client associations, signal quality, traffic flow, and WAN reachability in a single pass.\n\n### Usage\n\n```sh\n./wifi-audit.sh                   # Default: 45s traffic measurement window\n./wifi-audit.sh -t 15             # Custom traffic window (15 seconds)\n./wifi-audit.sh -h                # Help\n```\n\n### Audit Stages\n\n**1. Radio Detection \u0026 State**\nDetects all AP-mode interfaces via `iwinfo`. Confirms each radio is up and beaconing. Reports the current channel.\n\n**2. Client Association**\nCounts associated clients per radio. Validates that association entries include negotiated RX/TX rates — missing rates can indicate driver issues.\n\n**3. Traffic Flow**\nRecords per-interface byte counters, waits for the configured window, then calculates delta. Flags interfaces with less than 5KB of movement as idle — useful for catching silent failures where clients are associated but not passing traffic.\n\n**4. Hardware TX Health**\nChecks `TX failed` counters via `iwinfo` (with sysfs fallback). Any non-zero value is flagged as a potential interference or hardware issue.\n\n**5. Client Reachability (50% Random Sample)**\nBuilds a MAC→IP map from the ARP table, then pings a random 50% sample of associated clients. Reports hostname from DHCP leases where available. This catches the common failure mode where clients are associated at L2 but broken at L3.\n\n**6. RSSI Audit**\nChecks signal strength for all associated clients. Flags any client below −75 dBm as weak. Useful for catching clients that are technically connected but too far away for reliable performance.\n\n**7. SNR Audit**\nReads the noise floor from the driver and calculates SNR per client. Clients below 20 dB SNR are flagged. Low SNR often explains poor throughput even when RSSI looks acceptable.\n\n**8. PHY Rate Audit**\nChecks negotiated link speeds. Clients negotiating below 50 Mbps are flagged — this surfaces issues like a 5GHz client falling back to legacy rates due to driver negotiation problems or physical distance.\n\n**9. WAN Egress Test**\nPings 8.8.8.8 sourced from the bridge IP. This specifically tests that bridge-sourced traffic is routing correctly to WAN — catches misconfigured PBR/VPN policy that would let router-sourced traffic through but silently break client traffic.\n\n### Example Output\n\n```\n=== WiFi Network Forensic Audit ===\n[OK] Detected AP interfaces: ra0 rax0\n\n[OK] ra0 radio up | Channel: 6 (2.437 GHz) HT Mode: HE20\n[OK] rax0 radio up | Channel: 44 (5.220 GHz) HT Mode: HE80\n\n[Success] ra0: 7 client(s) associated\n[Success] rax0: 8 client(s) associated\n  [Info] Total associated clients: 15\n\n[OK] WiFi bridged to br-lan1\n  [Info] Initial counters recorded - waiting 45s for traffic\n\n[Success] ra0 traffic flow: +68395 RX / +21009 TX bytes\n[Success] rax0 traffic flow: +350072 RX / +243445 TX bytes\n\n--- Hardware Transmission Health (TX Errors) ---\n[OK] ra0: Clean transmission (0 hardware errors)\n[OK] rax0: Clean transmission (0 hardware errors)\n\n--- [ra0] Local Client Reachability ---\n  \u003e Client: 10.10.0.192 [KP105] ... [OK] (ra0)\n  \u003e Client: 10.10.0.155 [LGwebOSTV] ... [OK] (ra0)\n[Success] ra0: 4/4 random clients responded\n\n--- Physical Link Quality (RSSI) ---\n[Success] ra0: 7/7 clients have strong signal (\u003e-75dBm)\n[Success] rax0: 8/8 clients have strong signal (\u003e-75dBm)\n\n--- Signal-to-Noise Ratio (SNR) ---\n[Success] ra0: All clients have healthy SNR (\u003e20dB) | Floor: -63dBm\n[Success] rax0: All clients have healthy SNR (\u003e20dB) | Floor: -63dBm\n\n--- PHY Rate Quality (Negotiated Speed) ---\n[Warning] ra0: 7/14 clients negotiating \u003c 50Mbps\n[Warning] rax0: 1/16 clients negotiating \u003c 50Mbps\n\n[Success] WAN egress OK: bridge-sourced traffic reaches internet\n=== Audit Complete ===\n```\n\n### Signal Thresholds Reference\n\n| Metric | Threshold | Flag |\n|---|---|---|\n| RSSI | \u003c −75 dBm | Weak signal |\n| SNR | \u003c 20 dB | Poor noise environment |\n| PHY Rate | \u003c 50 Mbps | Legacy/degraded negotiation |\n| Traffic Delta | \u003c 5 KB | Idle / possible failure |\n\n---\n\n## wired-audit.sh — Wired Forensic Audit\n\nA deep inspection of your wired topology, firewall posture, client connectivity, and physical port health.\n\n### Usage\n\n```sh\n./wired-audit.sh                  # Standard run (30s traffic window)\n./wired-audit.sh -t 60            # Custom traffic window\n./wired-audit.sh -v               # Verbose: adds speedtest + raw kernel firewall dump\n./wired-audit.sh -h               # Help\n```\n\n### Example Output\n\n```\n=== Wired Network Forensic Audit ===\n\n--- System Configuration \u0026 Policy Context ---\n[!] Policy Routing / VPN Logic Detected:\n    1:    from all iif lo lookup 16800\n    1101: not from all fwmark 0x8000/0xc000 lookup 8000\n\n[Firewall Zones]\n  Zone 'wan': Networks=[wan wan6] | Input=DROP / Forward=REJECT (NAT)\n  Zone 'lan1': Networks=[lan1] | Input=ACCEPT / Forward=ACCEPT\n\n[Firewall Audit: All Explicit Rules \u0026 Port Forwards]\n  [RULE]  Block-WAN-SSH: Allow wan -\u003e Port 22 (tcp) -\u003e DROP\n  [RULE]  lan1_to_ui: Allow lan1 -\u003e Port 80 443 (tcp) -\u003e ACCEPT\n  [NAT]   Forward-SSH-to-Device: wan:1010 -\u003e LAN 10.10.0.100:22\n\n--- Physical \u0026 Logical Interface Audit ---\nLogical: lan1 -\u003e Device: br-lan1\n    [Info] IP: 10.10.0.1 | MAC: 1e:ac:25:94:2e:9e\n    [ON]    DHCP Server Active (Limit: 100 hosts)\n    [UP]    Physical Port: lan2 | Speed: 1000Mbps (full) | Clean\n\nLogical: wan -\u003e Device: eth1\n    [Info] IP: 83.252.60.209 | MAC: 94:83:c4:a9:31:7f\n    [Info] DHCP: Disabled\n    [UP]    Physical Port: eth1 | Speed: 1000Mbps (full) | History: 74 PhyErrors (Monitor if increasing)\n\n--- Wired Client Reachability ---\nScanning lan1 (br-lan1)...\n  [Info] Detected 5 wired client(s). Testing reachability...\n  \u003e Client: 10.10.0.177 (c8:d0:83:b1:a2:27) [Vardagsrum] [REACHABLE] ... [OK]\n  \u003e Client: 10.10.0.100 (2c:cf:67:bf:9e:6d) [pi5] [REACHABLE] ... [OK]\n  \u003e Client: 10.10.0.158 (00:05:cd:fd:4b:48) [Marantz-SR6013] [REACHABLE] ... [OK]\n  \u003e [WAN Gateway] 83.252.60.1 (00:00:5e:00:01:1e) ... [Ping: Blocked] [Internet: OK] [DNS: OK]\n\n--- Active Traffic \u0026 Hardware Health (30s Sample) ---\n  [ACTIVE] lan1 (br-lan1): RX: 10 KB/s | TX: 37 KB/s\n  [ACTIVE] wan (eth1): RX: 87 KB/s | TX: 11 KB/s\n\n=== Audit Complete ===\n```\n\n### Audit Stages\n\n**Stage 0 — System Configuration \u0026 Policy Context**\n\n*Routing \u0026 Policies:* Dumps the main routing table. Detects any policy routing rules (VPN kill-switches, guest network isolation, multi-WAN) and surfaces them explicitly — these are invisible in the GL.iNet UI but directly affect traffic behaviour.\n\n*Firewall Zones:* Lists all UCI firewall zones with their bound networks, input/forward policies, and NAT status.\n\n*Firewall Rules \u0026 Port Forwards:* Iterates every explicit `firewall.rule` and `firewall.redirect` in UCI. All active rules and DNAT port forwards are printed. This gives you a complete picture of what is actually exposed, independent of the GUI representation.\n\n**Stage 1 — Physical \u0026 Logical Interface Audit**\n\nFor every configured network interface, reports: IP address, MAC address, DHCP server status and pool size, physical port link state, negotiated speed/duplex, and historical RX error count. Bridge members are walked individually so each physical port gets its own line.\n\nAlso runs `bridge vlan show` for DSA-capable hardware to display the hardware switch VLAN map.\n\n**Stage 2 — Wired Client Reachability**\n\nReads the ARP table for each network. Filters out WiFi clients (cross-references against `iwinfo assoclist`) to report only genuinely wired neighbours. For each wired client: resolves hostname from DHCP leases, pings for reachability, reports ARP neighbour state.\n\nThe WAN gateway gets special treatment: its entry triggers a three-part check — gateway ping, internet ping (8.8.8.8), and DNS resolution — giving you a layered connectivity diagnosis in one line.\n\n**Stage 3 — Active Traffic \u0026 Hardware Health**\n\nRecords byte counters at start, sleeps for the measurement window, then calculates throughput per interface in KB/s. Simultaneously monitors physical port RX error counters — if errors *increase* during the window, it's flagged as a critical cable or hardware failure, not just historical noise.\n\n**Stage 4 (Verbose) — Internet Speed Test**\n\nRuns `speedtest-cli` or `speedtest` if available. Handles the common Ookla 403 block gracefully rather than dumping a confusing error.\n\n**Stage 5 (Verbose) — Raw Kernel Firewall Dump**\n\nDetects whether the router is running `fw4`/`nftables` (OpenWrt 22.03+) or legacy `fw3`/`iptables` and dumps the full kernel ruleset to `/tmp/raw_firewall_dump.txt`. Useful when you need to verify that UCI configuration has actually been applied to the kernel.\n\n---\n\n## Tested On\n\n| Hardware | Firmware |\n|---|---|\n| GL.iNet GL-MT6000 (Flint 2) | OpenWrt 21.02-SNAPSHOT (Oct 2025 build) |\n\nCommunity reports of working configurations on other MediaTek OpenWrt platforms are welcome.\n\n---\n\n## Known Limitations\n\n- `rf-survey.sh` requires MediaTek `iwpriv` driver support. It will fail silently or with an error on non-MediaTek hardware.\n- Speed test in `wired-audit.sh -v` requires `python3-speedtest-cli` to be installed via `opkg`.\n- PHY rate and SNR parsing depends on driver reporting quality — some MediaTek driver versions report partial data. Scripts handle this gracefully with `[Info]` messages rather than false failures.\n- DHCP hostname resolution requires `/tmp/dhcp.leases` to be populated (standard `dnsmasq` behaviour on OpenWrt).\n\n---\n\n## License\n\nMIT — do what you want, attribution appreciated.\n\n---\n\n## Contributing\n\nIssues and PRs welcome. If you're testing on hardware other than the GL-MT6000, please include your device model and OpenWrt version in any bug reports.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Farelius-d%2Fopenwrt-netaudit","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Farelius-d%2Fopenwrt-netaudit","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Farelius-d%2Fopenwrt-netaudit/lists"}