Decoy Network — build packet

# PACKET-7 — Decoy Network · config plan (TEMPLATE ONLY — NOTHING DEPLOYED)
**Horizon Works · Q-Branch Item 7 · 2026-10-31 · Theme: "Honeypot Amber"**
**Status: PAPER PACKET. No network was configured, started, or broadcast in the making of this item. This packet configures nothing.**

## 1. The concept

On **spare hardware only** — a retired router, a spare Pi-class board, an old laptop radio — run a fake **open** hotspot that exists to be noticed and logged, never used. Curious radios probe for it and devices may try to associate; the decoy records *that attempts happened* and nothing more. It is a tripwire with a logbook: if something is enumerating or joining networks on the owner's premises, the decoy hears about it first because it is the loudest, emptiest door on the street.

What it is for: awareness on the owner's own premises. What it is not: a trap for traffic, a credential harvester, or an impersonation of anyone's real network (see §4 — the fence is the packet).

## 2. Hardware & placement plan (when — and only when — the owner commissions a run)

- **Spare hardware only.** Never the house router, never a daily-driver device, never anything Mircy's or Rin's traffic touches.
- A dedicated radio/interface that carries **no route to the house LAN** — the decoy is an island: no bridge, no NAT into the home network, no upstream at all beyond (optionally) a dead-end sink with no internet.
- Physically on the **owner's premises**, powered from a labeled outlet, with a dated "DECOY — Q-Branch Item 7" tag on the box so no future session mistakes it for house infrastructure.
- A named stop: unplug = off. No remote management, no persistence tricks.

## 3. hostapd-style config TEMPLATE

> **TEMPLATE — placeholders throughout. This file excerpt starts nothing. Values in `REPLACE-…` form must be replaced by the owner at a future, separately approved sitting — and this packet does not approve one.**

```ini
# === DECOY HOTSPOT — CONFIG TEMPLATE — DO NOT DEPLOY FROM THIS PACKET ===
# hostapd-style template for a SPARE radio on the owner's own premises only.
interface=REPLACE-WITH-SPARE-INTERFACE        # e.g. the spare USB radio — never the house router
driver=nl80211
ssid=xfinitywifi-decoy                        # PLACEHOLDER in the style requested for the template.
                                              # FENCE: before any owner-approved run this MUST be
                                              # replaced with an invented name the house owns the
                                              # idea of — never a real network's name (see §4.4).
hw_mode=g
channel=REPLACE-WITH-LOCAL-SCAN-PICK          # choose at sitting time from a passive scan
auth_algs=1                                   # open network — the decoy offers no real service
wpa=0                                         # no WPA: no password exists, so none can be captured
macaddr_acl=0
ignore_broadcast_ssid=0                       # it advertises; that is its whole job
logger_syslog=-1
logger_stdout=-1
# Metadata log — local file on the spare box only. Nothing leaves the box.
# (hostapd logs association events; the run plan pairs it with a local
#  probe/association logger writing the same file. See §5 for what is kept.)
ctrl_interface=REPLACE-WITH-LOCAL-ADMIN-DIR
```

No DHCP-to-LAN, no forwarding rules, no captive portal, and **no portal page of any kind** — a page that asks anyone for anything is outside this design entirely.

## 4. THE FENCE — printed in the packet, binding on any future run

1. **Metadata only.** What gets logged: **probe requests and association attempts — metadata only** (timestamp, requesting MAC as broadcast, SSID probed for / association target, signal strength if the driver reports it). That list is the ceiling, not the floor.
2. **No traffic interception.** No packet capture of payloads, no MITM position, no DNS spoofing, no routing of any joined device's traffic anywhere for inspection. The decoy has nothing to intercept *with*: no upstream, no bridge.
3. **No credential capture.** Open network, no password, no portal, no form. There is no field in this design in which a credential could be typed, and none may be added.
4. **No evil-twin impersonation of a real network the house doesn't own.** The decoy never copies the SSID (or SSID+BSSID pairing) of a real network — not a carrier hotspot, not a neighbor's AP, not a venue's network — to lure its users. The template's placeholder SSID is a drafting placeholder in a requested style; a real run uses an invented name and this fence governs the choice.
5. **Spare hardware only, owner's premises only** (see §6 legal note).
6. **A log line is evidence of an attempt, not of intent or identity.** A probe request means a radio asked a question — phones probe automatically, constantly, innocently. Findings grade as FLAG / noted, never as accusations (the house canary discipline: a trigger proves access/attempt, not intent).

## 5. What gets logged — the whole schema

| Field | Example (synthetic) | Why kept |
|---|---|---|
| `ts` | `2026-10-31T21:04:11-04:00` | When |
| `event` | `probe` / `assoc` | Probe request vs. association attempt |
| `mac` | `aa:bb:cc:dd:ee:ff` (as broadcast; modern phones randomize — noted, not defeated) | Which radio asked |
| `ssid` | the probed-for or joined name | What it was looking for / joined |
| `rssi` | `-67` (if reported) | Rough nearness, nothing more |

Nothing else. No payloads, no hostnames beyond the probed SSID itself, no device fingerprinting beyond what the broadcast frame already states. Retention: the local file lives on the spare box; the owner reviews and rotates it like any house log; it is never uploaded anywhere by this design.

## 6. Legal note (plain words, not legal advice)

Run **only on the owner's own premises, on the owner's own hardware**. The design's lawfulness rests on three legs, all printed above: it impersonates no one (§4.4), it intercepts nothing (§4.2), and it collects no credentials or content (§§4.1, 4.3) — it records connection *attempts* to a network the owner operates, the way any access point's own log does. Laws on interception and unauthorized access vary and bite on exactly the behaviors this fence forbids; any future run that wanted to step outside §4 would need a Defender read first — and stepping outside §§4.2–4.4 is a redesign, not a configuration change. This note is the packet author's plain summary, **UNVERIFIED as legal advice**; the Defender desk reads before any real run, per house practice.

## 7. The viewer (this folder's page)

`index.html` is a read-only viewer prototype over **synthetic SAMPLE rows** in exactly the §5 schema: a log table, a filter box, and a "what am I looking at" explainer. It demonstrates how a future log would be *read*. It reads no real log, because no real log exists.