Tactical Signals Intelligence (SIGINT) Dashboard
CYT Touch is a professional-grade, touch-optimized interface for real-time wireless surveillance. Designed for the Raspberry Pi 5, it sits on top of the Kismet wireless intrusion detection system to provide actionable intelligence, behavioral profiling, and forensic tracking of Wi-Fi and Bluetooth devices in the field.
- Multi-Spectrum: Detects Wi-Fi Access Points, Clients, Bluetooth, and BLE devices simultaneously.
- Tracker Detection: Specifically identifies Apple AirTags, Tile trackers, and similar devices operating on BLE.
- Visual Identification: Instantly distinguishes between Infrastructure (Routers) and Clients (Phones/Laptops) with distinct iconography.
- High-Performance: Streaming architecture handles 400+ active devices on a Raspberry Pi without lag.
- Behavioral Tracking: Automatically flags devices that persist near you for extended periods (>15 mins).
- Movement Correlation: Elevates threats to "Chasing" status only if they follow you across significant distances (>500m), filtering out stationary neighbors.
- MAC Address Randomization Defeat: Intelligently identifies and tracks devices that frequently change their MAC address. If a new device appears with a similar signal strength, vendor, and probed SSIDs as a recently seen device, the system merges them, preserving the device's history under the new MAC.
- Covert Tracker Detection: The application has a specific category for known trackers like Tile and Apple AirTags. Here's how it works:
- Detection: It identifies potential trackers by looking for
Bluetooth LEdevices whose manufacturer is listed asAppleorTile. - Alert Level: When a match is found, the device is automatically assigned a
ThreatLevel.SUSPICIOUSstatus. - UI Indication: In the dashboard, these devices will be highlighted with a yellow border and label, making them easy to spot. This does not trigger the full-screen "Red Alert," which is reserved for
ThreatLevel.HIGHdevices like hacking hardware.
- Detection: It identifies potential trackers by looking for
- GPS History: Records a breadcrumb trail of coordinates for every device to visualize its movement path relative to yours.
- Auto-Save: Continuously saves your device list to a local database (IndexedDB), ensuring you never lose tracking data if the browser refreshes or the Pi reboots.
- Session History: Tracks scan duration and device counts across multiple sessions.
- Statistics Dashboard: View total unique devices seen, tracking history, and session longevity.
- Immediate Threat Detection: Triggers a full-screen, pulsing red overlay when a known "High Threat" device (e.g., Flipper Zero, WiFi Pineapple) comes within close proximity (Signal > -65dBm).
- Haptic Feedback: Vibrates mobile devices to alert you even if the screen is not in focus.
- Tactical Options: One-tap "ENGAGE" button to immediately lock tracking on the target.
- Device Type Isolation: Filter the view to show only Wi-Fi devices or only Bluetooth/BLE devices, allowing you to focus on a specific spectrum.
- Deep Search: Instantly find devices by MAC, Vendor, SSID, or even Probed Networks.
- Tail All: One-tap "Stealth Mode" to ignore all currently visible non-threats, clearing the deck to focus on new arrivals.
- Dynamic Sort: Cycle through sorting by Activity, Signal, or Age to prioritize your view.
- Deep Profiling: Integrates Google Gemini AI to analyze device signatures.
- Probe Analysis: Feeds the AI a list of Probed SSIDs (networks a device is searching for) to detect "Home Base" networks, corporate affiliations, or aggressive surveillance tools.
- Spectacular KML: Exports to Google Earth with:
- Tracking Paths:
<LineString>visualization connecting historical GPS points. - Rich Balloons: HTML popups showing full device details and probe lists.
- Threat Coloring: Red/Magenta/Green coding based on threat level.
- Tracking Paths:
- Surveillance Reports: Generates professional Markdown summaries of all tracked targets for documentation.
- Raspberry Pi 4 or 5 (Recommended).
- Touchscreen (7" recommended) or Mobile Device (via browser).
- Wi-Fi Adapter supporting Monitor Mode.
- GPS Module (USB/Serial) - Optional but required for tracking logic.
- OS: Raspberry Pi OS (Bookworm/Bullseye) or Kali Linux.
- Core: Kismet, Python 3.11+, Node.js v18+.
- API: Google Cloud API Key (for Gemini AI features).
-
System Setup
sudo apt update && sudo apt install -y kismet python3 python3-pip nodejs npm # Ensure Kismet is configured and running sudo systemctl enable --now kismet
Note: For the "Purge Kismet DB" feature to work, the user running the app must be able to run
sudo systemctlcommands without a password. To configure this:sudo visudo # Add the following line at the end (replace 'pi' with your username): pi ALL=(ALL) NOPASSWD: /usr/bin/systemctl start kismet, /usr/bin/systemctl stop kismet -
Clone Repository
git clone https://github.com/gottapro/CYT_Touch.git cd CYT_Touch -
Install Dependencies
npm install
-
Configuration Create a
.envfile in the root directory for AI features:echo "VITE_API_KEY=your_google_gemini_api_key" > .env
Use the included launcher script to start the Python Bridge (Port 5000) and Web UI (Port 3000):
./start_cyt.shAccess the dashboard at http://<PI_IP>:3000 on your phone or tablet.
- Sanitize: Tap Tail All (Shield Icon) to ignore current safe traffic, or tap TAIL on individual devices.
- Isolate: Use the Wi-Fi and Bluetooth filter buttons to focus on the desired spectrum.
- Scan: Watch the "Nearby" list. Devices probing for networks will reveal their intentions.
- Sort & Search: Use the new Sort button to cycle through display orders (Activity, Signal, Age) and the search bar to filter by MAC, Vendor, SSID, or Probes.
- Red Alert! If a High Threat device comes into close proximity (-65dBm), a full-screen Red Alert will trigger. Respond by Tapping "ENGAGE" to track or "DISMISS".
- Move: As you travel, the Smart Logic will monitor for persistent signals.
- Yellow Border: Device is lingering (>15 mins).
- Red Border/Eye Icon: Device is Chasing (lingering + moving >500m with you).
- The system will automatically track devices that attempt to evade detection by changing their MAC address.
- Analyze: Tap the Activity Pulse icon on a suspicious device to run an AI threat assessment.
- Review Stats: Check the Database icon to see session longevity and total tracked devices.
- Export:
- Go to Settings.
- Tap Download KML Map for Google Earth analysis.
- Tap Report (MD) for a text summary.
- Reset:
- Use Purge Kismet DB in Settings to wipe the underlying database and restart the Kismet service. This is recommended when moving to a completely new physical location to ensure your "Stalker Logic" starts fresh.
- Frontend: React + Vite + TailwindCSS (Touch-Optimized).
- Backend: Python Bridge (
cyt_bridge.py) - Proxies Kismet API, filters fields, streams JSON. - Persistence: IndexedDB (Client-side storage).
- Data Source: Kismet (local instance).
- Refresh Rate: Defaults to 8000ms (8s) for stability.
This tool is for educational and defensive security research purposes only. Users are responsible for complying with all local, state, and federal laws regarding radio surveillance and privacy.