airdetect.py

#!/usr/bin/env python3
"""
Wi-Fi AP Security Scanner (passive)

Detects WLAN security characteristics without associating to the AP by
sniffing beacon and probe response frames (and optionally observing EAPOL
handshakes if they happen on-air). Reports:
  • SSID / BSSID
  • WPA/WPA2/WPA3/OWE vs WEP/Open (based on RSN & WPA IEs)
  • Pairwise & group ciphers
  • AKM suites (PSK, 802.1X, SAE, FT, OWE, …)
  • PMF/802.11w: capable/required
  • 802.11r presence (via FT AKMs)
  • Whether a 4-Way Handshake was OBSERVED (passively) for that BSSID

Requirements:
  • Linux with a wireless interface in monitor mode (e.g. wlan0mon)
  • Python 3.8+
  • scapy 2.5+  (pip install scapy)

Usage examples:
  sudo ./wifi_ap_security_scanner.py -i wlan0mon -t 30
  sudo ./wifi_ap_security_scanner.py -i wlan0mon --eapol --channel 36 -t 60
  ./wifi_ap_security_scanner.py -r capture.pcap

Notes:
  • This tool is passive. It does not transmit or attempt to authenticate.
  • "Handshake observed" becomes true only if a client happens to (re)connect
    while you are listening — this is informational and not required to
    assess AP capabilities.
  • For best results, scan several tens of seconds across relevant channels.
"""
from __future__ import annotations
import argparse
import binascii
import os
import struct
import sys
from collections import defaultdict
from dataclasses import dataclass, field
from typing import Dict, List, Optional, Set, Tuple

# Version
VERSION = "1.0.1"

try:
    from scapy.all import (  # type: ignore
        Dot11,
        Dot11Beacon,
        Dot11ProbeResp,
        Dot11Elt,
        EAPOL,
        RadioTap,
        sniff,
        rdpcap,
    )
except Exception as e:  # pragma: no cover
    print("[!] Failed to import scapy. Install with: pip install scapy", file=sys.stderr)
    raise

# Try to import CoreWLAN for macOS support
COREWLAN_AVAILABLE = False
if sys.platform == 'darwin':
    try:
        import CoreWLAN
        import CoreLocation
        COREWLAN_AVAILABLE = True
    except ImportError:
        pass  # CoreWLAN not available, will fall back to Scapy

# ------------------------------
# ANSI Color Codes
# ------------------------------
class Colors:
    """ANSI color codes for terminal output."""
    HEADER = '\033[95m'
    OKBLUE = '\033[94m'
    OKCYAN = '\033[96m'
    OKGREEN = '\033[92m'
    WARNING = '\033[93m'
    FAIL = '\033[91m'
    ENDC = '\033[0m'
    BOLD = '\033[1m'
    UNDERLINE = '\033[4m'

    # Signal strength colors (for row-based coloring)
    STRONG_SIGNAL = '\033[92m'  # Green (≥-60dBm)
    MEDIUM_SIGNAL = '\033[93m'  # Yellow (-60 to -70dBm)
    POOR_SIGNAL = '\033[95m'    # Purple/Magenta (-70 to -80dBm)
    WEAK_SIGNAL = '\033[91m'    # Red (<-80dBm)

    # Security colors
    WPA3 = '\033[92m'           # Green - most secure
    WPA2 = '\033[96m'           # Cyan - secure
    WPA = '\033[93m'            # Yellow - less secure
    WEP = '\033[91m'            # Red - insecure
    OPEN = '\033[91m'           # Red - insecure
    OWE = '\033[92m'            # Green - enhanced open

    # Feature colors
    VENDOR = '\033[95m'         # Magenta
    SSID = '\033[96m'           # Cyan
    BSSID = '\033[94m'          # Blue

    # Visibility colors
    GRAY = '\033[90m'           # Gray - for invisible/offline APs
    DIM = '\033[2m'             # Dim text

# ------------------------------
# Helpers: Suite decoding
# ------------------------------
IEEE_OUI = b"\x00\x0F\xAC"  # 00-0F-AC
MS_OUI = b"\x00\x50\xF2"    # 00-50-F2 (legacy WPA v1 vendor IE)
WPS_OUI = b"\x00\x50\xF2\x04"  # WPS Vendor IE

# Load vendor OUI database from external JSON file
def load_vendor_oui() -> Tuple[Dict[str, str], Dict[str, str]]:
    """Load the vendor database from oui-vendors.json (generated by getvendors.py).

    Returns a tuple ``(vendor_db, prefix_db)`` where ``vendor_db`` maps 24-bit
    OUIs (``XX:XX:XX``) to vendor names and ``prefix_db`` maps 28/36-bit
    sub-block prefixes (hex nibbles, length encodes the mask) to vendor names.
    """
    vendor_db = {}
    prefix_db = {}

    # Try to load from new comprehensive JSON file first
    json_path = os.path.join(os.path.dirname(__file__), 'oui-vendors.json')

    if os.path.exists(json_path):
        try:
            import json
            with open(json_path, 'r') as f:
                data = json.load(f)
                # Skip metadata/private keys; get all 24-bit OUI entries
                vendor_db = {k: v for k, v in data.items() if not k.startswith('_')}
                # 28/36-bit sub-blocks live under _prefixes (may be absent)
                prefix_db = data.get('_prefixes', {}) or {}
        except Exception as e:
            print(f"[!] Warning: Could not load oui-vendors.json: {e}", file=sys.stderr)

    # Fallback to minimal built-in database if no file found
    if not vendor_db:
        vendor_db = {
            "00:0C:43": "MediaTek",
            "08:55:31": "Ubiquiti",
            "0C:8E:29": "Cisco Meraki",
            "18:A6:F7": "TP-Link",
            "2C:91:AB": "TP-Link",
            "84:A1:D1": "Sagemcom",
            "A0:B5:49": "Cisco Meraki",
            "B8:27:EB": "Raspberry Pi",
        }

    return vendor_db, prefix_db

# Load vendor database at module load time
VENDOR_OUI, VENDOR_PREFIXES = load_vendor_oui()

CIPHER_TYPES = {
    # Per IEEE 802.11 (subset of the most common values)
    0: "USE-GROUP",
    1: "WEP-40",
    2: "TKIP",
    3: "WRAP",
    4: "CCMP-128",
    5: "WEP-104",
    6: "BIP-CMAC-128",   # management frame integrity (group mgmt)
    8: "GCMP-128",
    9: "GCMP-256",
    10: "CCMP-256",
    11: "BIP-GMAC-128",
    12: "BIP-GMAC-256",
}

AKM_TYPES = {
    # OUI 00-0F-AC (standards)
    1: "802.1X",
    2: "PSK",
    3: "FT-802.1X",       # 802.11r FT over 802.1X
    4: "FT-PSK",          # 802.11r FT over PSK
    5: "802.1X-SHA256",
    6: "PSK-SHA256",
    7: "TDLS",
    8: "SAE",             # WPA3-Personal
    9: "FT-SAE",          # WPA3-Personal with FT
    11: "802.1X-SuiteB-128",
    12: "802.1X-SuiteB-192",
    13: "802.1X-FT-SHA384",
    18: "OWE",            # Enhanced Open
    # There are more; unknown values will be shown as numeric
}

# ------------------------------
# NEW: Helper functions
# ------------------------------

def get_row_color_by_rssi(rssi: Optional[int], is_visible: bool = True) -> str:
    """Get row color code based on RSSI strength for entire row coloring.

    Returns ANSI color code for the entire row:
    - Gray: AP not visible in last scan
    - Green: Strong signal (≥ -60 dBm)
    - Yellow: Good signal (-60 to -70 dBm)
    - Purple: Weak signal (-70 to -80 dBm)
    - Red: Very weak signal (< -80 dBm)
    """
    if not is_visible:
        return Colors.GRAY

    if rssi is None:
        return Colors.GRAY

    if rssi >= -60:
        return Colors.STRONG_SIGNAL  # Green
    elif rssi >= -70:
        return Colors.MEDIUM_SIGNAL  # Yellow
    elif rssi >= -80:
        return Colors.POOR_SIGNAL  # Purple/Magenta
    else:
        return Colors.WEAK_SIGNAL  # Red


def colorize_rssi(rssi: Optional[int], min_rssi: Optional[int] = None, max_rssi: Optional[int] = None) -> str:
    """Colorize RSSI value - now simplified for row-based coloring.

    Format: -45dBm (without range, as it will go in separate column)
    """
    if rssi is None:
        return "-"

    # Build base RSSI string (no range here - goes in separate Avg column)
    rssi_str = f"{rssi}dBm"

    return rssi_str


def colorize_security(sec_type: str) -> str:
    """Colorize security type based on security level."""
    if "WPA3" in sec_type:
        return f"{Colors.WPA3}{sec_type}{Colors.ENDC}"
    elif "WPA2" in sec_type:
        return f"{Colors.WPA2}{sec_type}{Colors.ENDC}"
    elif "WPA" in sec_type:
        return f"{Colors.WPA}{sec_type}{Colors.ENDC}"
    elif sec_type == "WEP":
        return f"{Colors.WEP}{sec_type}{Colors.ENDC}"
    elif sec_type == "Open":
        return f"{Colors.OPEN}{sec_type}{Colors.ENDC}"
    elif sec_type == "OWE":
        return f"{Colors.OWE}{sec_type}{Colors.ENDC}"
    else:
        return sec_type


def colorize_vendor(vendor: str) -> str:
    """Colorize vendor name."""
    return f"{Colors.VENDOR}{vendor}{Colors.ENDC}"


def colorize_ssid(ssid: str, hidden: bool = False) -> str:
    """Colorize SSID."""
    if hidden:
        return f"{Colors.WARNING}<hidden>{Colors.ENDC}"
    return f"{Colors.SSID}{ssid}{Colors.ENDC}"


def colorize_bssid(bssid: str) -> str:
    """Colorize BSSID."""
    return f"{Colors.BSSID}{bssid}{Colors.ENDC}"


def get_vendor(bssid: str) -> str:
    """Lookup vendor from a BSSID using longest-prefix match.

    Prefers 36-bit then 28-bit IEEE sub-block assignments (MA-S/MA-M) before
    falling back to the 24-bit OUI, so sub-block owners resolve to the correct
    vendor instead of the shared 24-bit registrant.
    """
    hexb = ''.join(c for c in bssid if c in '0123456789abcdefABCDEF').upper()
    # 36-bit (9 nibbles) then 28-bit (7 nibbles) sub-blocks, longest first
    for n in (9, 7):
        if len(hexb) >= n:
            vendor = VENDOR_PREFIXES.get(hexb[:n])
            if vendor:
                return vendor
    if len(hexb) >= 6:
        return VENDOR_OUI.get(f"{hexb[0:2]}:{hexb[2:4]}:{hexb[4:6]}", "Unknown")
    return "Unknown"


def get_band(channel: Optional[int]) -> Optional[str]:
    """Determine frequency band from channel number."""
    if channel is None:
        return None
    if channel <= 14:
        return "2.4 GHz"
    elif channel <= 177:
        return "5 GHz"
    return "6 GHz"


def parse_wps_ie(payload: bytes) -> Dict:
    """Parse WPS vendor IE (ID 221, OUI 00:50:F2:04).
    Returns dict with: enabled, locked, version, config_methods
    """
    out = {"enabled": False, "locked": None, "version": None, "config_methods": None}
    try:
        if len(payload) < 4:
            return out
        if payload[:4] != WPS_OUI:
            return out

        out["enabled"] = True
        pos = 4

        # WPS uses TLV format: Type(2) + Length(2) + Value(Length)
        while pos + 4 <= len(payload):
            wps_type = struct.unpack(">H", payload[pos:pos+2])[0]
            wps_len = struct.unpack(">H", payload[pos+2:pos+4])[0]
            pos += 4

            if pos + wps_len > len(payload):
                break

            wps_value = payload[pos:pos+wps_len]
            pos += wps_len

            # Type 0x1044 = WPS State
            if wps_type == 0x1044 and wps_len == 1:
                # 1 = Not configured, 2 = Configured
                state = wps_value[0]
                out["locked"] = (state == 2)

            # Type 0x104A = Version
            elif wps_type == 0x104A and wps_len == 1:
                ver = wps_value[0]
                out["version"] = f"{ver >> 4}.{ver & 0x0F}"

            # Type 0x1008 = Config Methods
            elif wps_type == 0x1008 and wps_len == 2:
                methods = struct.unpack(">H", wps_value)[0]
                out["config_methods"] = methods

    except Exception:
        pass
    return out

@dataclass
class APInfo:
    bssid: str
    ssid: str = ""
    channel: Optional[int] = None
    privacy_bit: bool = False
    rsn_present: bool = False
    wpa1_present: bool = False
    group_cipher: Optional[str] = None
    pairwise_ciphers: Set[str] = field(default_factory=set)
    akms: Set[str] = field(default_factory=set)
    pmf_capable: Optional[bool] = None
    pmf_required: Optional[bool] = None
    ft_present: bool = False
    owe_present: bool = False
    handshake_observed: bool = False
    # NEW FIELDS
    rssi: Optional[int] = None  # Current RSSI value
    min_rssi: Optional[int] = None  # Weakest RSSI seen
    max_rssi: Optional[int] = None  # Strongest RSSI seen
    vendor: Optional[str] = None
    wps_enabled: bool = False
    wps_locked: Optional[bool] = None
    wps_version: Optional[str] = None
    hidden: bool = False
    band: Optional[str] = None
    channel_width: Optional[int] = None
    rrm_enabled: bool = False  # 802.11k
    bss_transition: bool = False  # 802.11v
    beacon_interval: Optional[int] = None
    deauth_count: int = 0
    disassoc_count: int = 0
    mode: Optional[str] = None  # Infrastructure, Ad-hoc, etc.
    rate: Optional[float] = None  # Max rate in Mbit/s
    # Tracking fields
    ap_id: Optional[int] = None  # Unique ID assigned at discovery
    first_seen: Optional[float] = None  # Timestamp when first discovered
    last_seen: Optional[float] = None  # Timestamp when last seen
    currently_visible: bool = True  # Whether AP is visible in current scan
    rssi_history: List[Tuple[float, int]] = field(default_factory=list)  # [(timestamp, rssi), ...]

    def security_label(self) -> str:
        """Return simplified, user-friendly security label."""
        if self.rsn_present:
            # Determine security type based on AKMs
            if "SAE" in self.akms or "FT-SAE" in self.akms:
                if "PSK" in self.akms or "FT-PSK" in self.akms:
                    return "WPA3-Transition"
                return "WPA3-Personal"
            elif any(a.startswith("802.1X") or a == "FT-802.1X" or "SHA256" in a for a in self.akms):
                return "WPA2-Enterprise"
            elif "OWE" in self.akms:
                return "OWE"
            elif "PSK" in self.akms or "FT-PSK" in self.akms:
                return "WPA2-Personal"
            else:
                return "WPA2"
        elif self.wpa1_present:
            return "WPA"
        else:
            if self.privacy_bit:
                return "WEP"
            return "Open"

# ------------------------------
# IE parsing
# ------------------------------

def _parse_suite(selector: bytes) -> Tuple[str, int]:
    """Return (OUI_string, suite_type)."""
    if len(selector) != 4:
        return (binascii.hexlify(selector).decode(), -1)
    oui = selector[:3]
    stype = selector[3]
    return (":".join(f"{b:02x}" for b in oui), stype)


def _cipher_name(oui: bytes, stype: int) -> str:
    if oui == IEEE_OUI:
        return CIPHER_TYPES.get(stype, f"UNKNOWN({stype})")
    elif oui == MS_OUI and stype == 2:
        return "TKIP"  # legacy mapping
    return f"OUI-{binascii.hexlify(oui).decode()}:{stype}"


def _akm_name(oui: bytes, stype: int) -> str:
    if oui == IEEE_OUI:
        return AKM_TYPES.get(stype, f"AKM-{stype}")
    return f"OUI-{binascii.hexlify(oui).decode()}:{stype}"


def parse_rsn_ie(payload: bytes) -> Dict:
    """Parse RSN (ID 48) information element.
    Returns a dict with keys: group_cipher, pairwise_ciphers (set), akms (set),
    pmf_capable(bool|None), pmf_required(bool|None), group_mgmt_cipher(optional)
    """
    out = {
        "group_cipher": None,
        "pairwise_ciphers": set(),
        "akms": set(),
        "pmf_capable": None,
        "pmf_required": None,
        "group_mgmt_cipher": None,
    }
    try:
        # Minimum: version(2) + group cipher(4) + pairwise count(2)
        if len(payload) < 8:
            return out
        pos = 0
        version, = struct.unpack_from("<H", payload, pos)
        pos += 2
        if version != 1:
            return out
        # Group cipher
        gc_sel = payload[pos:pos+4]
        pos += 4
        oui, stype = gc_sel[:3], gc_sel[3]
        out["group_cipher"] = _cipher_name(oui, stype)
        # Pairwise cipher list
        (pc_count,) = struct.unpack_from("<H", payload, pos)
        pos += 2
        for _ in range(pc_count):
            sel = payload[pos:pos+4]
            pos += 4
            out["pairwise_ciphers"].add(_cipher_name(sel[:3], sel[3]))
        # AKM list
        if pos + 2 <= len(payload):
            (akm_count,) = struct.unpack_from("<H", payload, pos)
            pos += 2
            for _ in range(akm_count):
                sel = payload[pos:pos+4]
                pos += 4
                out["akms"].add(_akm_name(sel[:3], sel[3]))
        # RSN Capabilities (2 bytes) — contains PMF bits
        if pos + 2 <= len(payload):
            (rsn_caps,) = struct.unpack_from("<H", payload, pos)
            pos += 2
            # Per Cisco/IEEE: bit6 = MFPR (required), bit7 = MFPC (capable)
            out["pmf_required"] = bool(rsn_caps & (1 << 6))
            out["pmf_capable"] = bool(rsn_caps & (1 << 7))
        # PMKID count + list (optional)
        if pos + 2 <= len(payload):
            (pmkid_count,) = struct.unpack_from("<H", payload, pos)
            pos += 2 + (16 * pmkid_count)
        # Group Management Cipher (optional)
        if pos + 4 <= len(payload):
            sel = payload[pos:pos+4]
            out["group_mgmt_cipher"] = _cipher_name(sel[:3], sel[3])
    except Exception:
        pass
    return out


def parse_wpa1_vendor_ie(payload: bytes) -> Dict:
    """Parse old WPA v1 vendor IE (ID 221, OUI 00:50:F2, type=1)."""
    out = {"present": False, "akms": set(), "pairwise_ciphers": set(), "group_cipher": None}
    try:
        # Expect: OUI(3) + type(1) == 1 + version(2) + group(4) + pairwise count(2) + list + akm count(2) + list
        if len(payload) < 8:
            return out
        if payload[:3] != MS_OUI or payload[3] != 1:
            return out
        pos = 4
        version, = struct.unpack_from("<H", payload, pos)
        pos += 2
        if version != 1:
            return out
        sel = payload[pos:pos+4]
        pos += 4
        out["group_cipher"] = _cipher_name(sel[:3], sel[3])
        (pc_count,) = struct.unpack_from("<H", payload, pos)
        pos += 2
        for _ in range(pc_count):
            sel = payload[pos:pos+4]
            pos += 4
            out["pairwise_ciphers"].add(_cipher_name(sel[:3], sel[3]))
        if pos + 2 <= len(payload):
            (akm_count,) = struct.unpack_from("<H", payload, pos)
            pos += 2
            for _ in range(akm_count):
                sel = payload[pos:pos+4]
                pos += 4
                out["akms"].add(_akm_name(sel[:3], sel[3]))
        out["present"] = True
    except Exception:
        pass
    return out

# ------------------------------
# Sniffing / Processing
# ------------------------------

def extract_channel(pkt) -> Optional[int]:
    # Try DS Parameter Set (ID 3) first; for 5/6GHz vendors often include HT/VHT/HE ops IEs, which we skip here.
    ch = None
    elt = pkt.firstlayer()
    while elt and isinstance(elt, Dot11Elt):
        if elt.ID == 3 and elt.len == 1:
            ch = elt.info[0]
            break
        elt = elt.payload if isinstance(elt.payload, Dot11Elt) else None
    return ch


def process_mgmt_frame(pkt, aps: Dict[str, APInfo]):
    if not (pkt.haslayer(Dot11Beacon) or pkt.haslayer(Dot11ProbeResp)):
        return
    bssid = pkt[Dot11].addr3 or pkt[Dot11].addr2
    if not bssid:
        return
    if bssid not in aps:
        aps[bssid] = APInfo(bssid=bssid, vendor=get_vendor(bssid))
    ap = aps[bssid]

    # NEW: Extract RSSI from RadioTap
    if pkt.haslayer(RadioTap):
        try:
            if hasattr(pkt[RadioTap], 'dBm_AntSignal'):
                rssi = pkt[RadioTap].dBm_AntSignal
                # Update RSSI (keep strongest signal)
                if ap.rssi is None or rssi > ap.rssi:
                    ap.rssi = rssi
                    # Record RSSI history
                    ap.rssi_history.append((time.time(), rssi))
                    # Keep history limited to last 100 entries
                    if len(ap.rssi_history) > 100:
                        ap.rssi_history = ap.rssi_history[-100:]
        except Exception:
            pass

    # SSID & channel
    ssid = None
    channel = extract_channel(pkt)

    # NEW: Extract beacon interval
    if pkt.haslayer(Dot11Beacon):
        try:
            ap.beacon_interval = pkt[Dot11Beacon].beacon_interval
        except Exception:
            pass

    elt = pkt[Dot11Elt]
    while isinstance(elt, Dot11Elt):
        if elt.ID == 0:  # SSID
            try:
                ssid = elt.info.decode(errors="ignore")
                # NEW: Detect hidden SSID
                if ssid == "" or len(elt.info) == 0:
                    ap.hidden = True
            except Exception:
                ssid = ""
                ap.hidden = True

        elif elt.ID == 48:  # RSN
            ap.rsn_present = True
            rsn = parse_rsn_ie(bytes(elt.info))
            ap.group_cipher = rsn.get("group_cipher") or ap.group_cipher
            ap.pairwise_ciphers.update(rsn.get("pairwise_ciphers", []))
            ap.akms.update(rsn.get("akms", []))
            ap.pmf_capable = rsn.get("pmf_capable")
            ap.pmf_required = rsn.get("pmf_required")
            if "OWE" in ap.akms:
                ap.owe_present = True
            if any(a.startswith("FT-") for a in ap.akms):
                ap.ft_present = True

        elif elt.ID == 70:  # RRM Enabled Capabilities (802.11k)
            ap.rrm_enabled = True

        elif elt.ID == 127:  # Extended Capabilities (contains 802.11v BSS Transition)
            try:
                if len(elt.info) >= 3:
                    # Bit 19 (byte 2, bit 3) = BSS Transition
                    ap.bss_transition = bool(elt.info[2] & 0x08)
            except Exception:
                pass

        elif elt.ID == 61:  # HT Operation (channel width for 2.4/5GHz)
            try:
                if len(elt.info) >= 1:
                    # Bit 2 of byte 1: 0=20MHz, 1=40MHz
                    ap.channel_width = 40 if (elt.info[1] & 0x04) else 20
            except Exception:
                pass

        elif elt.ID == 192:  # VHT Operation (80/160MHz for 5GHz)
            try:
                if len(elt.info) >= 1:
                    ch_width = elt.info[0]
                    if ch_width == 1:
                        ap.channel_width = 80
                    elif ch_width in [2, 3]:
                        ap.channel_width = 160
            except Exception:
                pass

        elif elt.ID == 221:  # Vendor specific
            payload = bytes(elt.info)

            # Check for WPA v1
            wpa = parse_wpa1_vendor_ie(payload)
            if wpa.get("present"):
                ap.wpa1_present = True
                ap.group_cipher = ap.group_cipher or wpa.get("group_cipher")
                ap.pairwise_ciphers.update(wpa.get("pairwise_ciphers", []))
                ap.akms.update(wpa.get("akms", []))

            # NEW: Check for WPS
            wps = parse_wps_ie(payload)
            if wps.get("enabled"):
                ap.wps_enabled = True
                ap.wps_locked = wps.get("locked")
                ap.wps_version = wps.get("version")

        elt = elt.payload if isinstance(elt.payload, Dot11Elt) else None

    ap.channel = ap.channel or channel
    # NEW: Set band based on channel
    if ap.channel:
        ap.band = get_band(ap.channel)

    # Capability privacy bit (WEP indicator if RSN/WPA absent)
    cap = None
    if pkt.haslayer(Dot11Beacon):
        cap = pkt[Dot11Beacon].cap
    elif pkt.haslayer(Dot11ProbeResp):
        cap = pkt[Dot11ProbeResp].cap
    if cap is not None:
        ap.privacy_bit = bool(cap & 0x0010)

    if ssid is not None:
        ap.ssid = ssid


def process_eapol(pkt, aps: Dict[str, APInfo]):
    # Mark handshake observed for BSSID if we see EAPOL-Key frames
    if not pkt.haslayer(EAPOL):
        return
    # Guess the BSSID as the transmitter or receiver if they are AP MACs
    # In infrastructure BSS, addr2 is transmitter, addr1 is receiver, addr3 is BSSID.
    bssid = pkt[Dot11].addr3
    if bssid and bssid in aps:
        aps[bssid].handshake_observed = True


def process_deauth_disassoc(pkt, aps: Dict[str, APInfo]):
    """Count deauth and disassociation frames (potential attack indicator)."""
    if not pkt.haslayer(Dot11):
        return

    # Type 0 = Management, Subtype 12 = Deauth, Subtype 10 = Disassoc
    if pkt.type == 0:
        bssid = pkt[Dot11].addr3
        if bssid and bssid in aps:
            if pkt.subtype == 12:  # Deauth
                aps[bssid].deauth_count += 1
            elif pkt.subtype == 10:  # Disassoc
                aps[bssid].disassoc_count += 1


# ------------------------------
# CLI
# ------------------------------

def clear_screen():
    """Clear the terminal screen."""
    os.system('clear' if os.name == 'posix' else 'cls')


def move_cursor_up(lines: int):
    """Move terminal cursor up by N lines."""
    print(f"\033[{lines}A", end='')


def clear_line():
    """Clear current line in terminal."""
    print("\033[2K", end='')


def save_cursor_position():
    """Save current cursor position."""
    print("\033[s", end='', flush=True)


def restore_cursor_position():
    """Restore saved cursor position."""
    print("\033[u", end='', flush=True)


def get_report_line_count(aps: Dict[str, APInfo]) -> int:
    """Calculate how many lines the report will occupy."""
    if not aps:
        return 1  # "No APs discovered."

    # Header lines: timestamp (1) + blank (1) + separator (1) + header (1) + separator (1) = 5
    # AP entries: len(aps)
    # Footer: separator (1) + blank (1) + Total APs (1) + WPS (1) + PMF (1) + WPA3 (1) + Hidden (1) = 7
    # Potential deauth warning: 1 (if present)

    base_lines = 5 + len(aps) + 7

    # Check if deauth warning will be shown
    deauth_aps = [ap for ap in aps.values() if ap.deauth_count > 10]
    if deauth_aps:
        base_lines += 1

    return base_lines


def print_report(aps: Dict[str, APInfo], show_timestamp: bool = False, show_ids: bool = False, term_width: int = None, selected_index: int = -1, column_settings: dict = None, viewport_offset: int = 0, viewport_limit: int = None):
    if not aps:
        print("No APs discovered.")
        return

    # Default column settings if not provided
    if column_settings is None:
        column_settings = {
            'bssid': True, 'rssi': True, 'avg': True, 'ch': True, 'band': True,
            'rate_max': True, 'rate_real': True, 'ssid': True, 'vendor': True,
            'security': True, 'features': True
        }

    # Sort by visibility first (visible APs first), then by RSSI (strongest signal first)
    # Gray/invisible APs go to the bottom of the list
    # Keep internal ID tracking for navigation, but always sort by visibility + RSSI strength
    sorted_aps = sorted(
        aps.items(),
        key=lambda kv: (
            not getattr(kv[1], 'currently_visible', True),  # False (visible) sorts before True (invisible)
            -(kv[1].rssi or -100),  # Then by RSSI strength (strongest first)
            kv[1].ssid,  # Then by SSID
            kv[0]  # Finally by BSSID
        )
    )

    # Show timestamp if in permanent mode
    if show_timestamp:
        import datetime
        timestamp = datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S")
        print(f"\n{Colors.BOLD}Last updated: {Colors.OKCYAN}{timestamp}{Colors.ENDC}")

    # Calculate dynamic column widths based on terminal size
    import shutil
    if term_width is None:
        terminal_width = shutil.get_terminal_size(fallback=(120, 24)).columns
    else:
        terminal_width = term_width

    # Fixed column widths (ID column removed from display)
    col_widths = {
        'bssid': 17,
        'rssi': 8,
        'avg': 8,
        'ch': 3,
        'band': 8,
        'rate_max': 10,
        'rate_real': 10,
        'security': 18
    }

    # Count enabled columns and calculate fixed space
    enabled_cols = [k for k, v in column_settings.items() if v and k in col_widths]
    num_separators = len(enabled_cols) + 2  # +2 for ssid, vendor (always count for spacing)
    fixed_space = sum(col_widths[k] for k in enabled_cols) + (num_separators * 2)

    # Available space for SSID, Vendor, and Features
    available = max(40, terminal_width - fixed_space - 10)  # Min 40, reserve 10 for features

    # Distribute available space intelligently
    if available >= 70:
        # Large terminal - give full space
        ssid_width = 32
        vendor_width = 30
        features_min = available - ssid_width - vendor_width
    elif available >= 50:
        # Medium terminal - balanced
        ssid_width = 24
        vendor_width = 20
        features_min = available - ssid_width - vendor_width
    elif available >= 35:
        # Small terminal - prioritize SSID
        ssid_width = 20
        vendor_width = 15
        features_min = max(10, available - ssid_width - vendor_width)
    else:
        # Very small terminal - minimal
        ssid_width = 15
        vendor_width = 12
        features_min = max(8, available - ssid_width - vendor_width)

    # Use full terminal width minus borders (1 char │ + 1 space on each side)
    content_width = terminal_width - 4  # Leave space for "│ " and " │"

    # Check if CoreWLAN is available (macOS) to show Rate (real) column
    show_rate_real = COREWLAN_AVAILABLE and column_settings.get('rate_real', True)

    # Build column header dynamically based on enabled columns
    header_parts = []
    col_names = {
        'bssid': 'bssid',
        'rssi': 'rssi',
        'avg': 'avg',
        'ch': 'ch',
        'band': 'band',
        'rate_max': 'rate(max)',
        'rate_real': 'rate(real)',
        'ssid': 'ssid',
        'vendor': 'vendor',
        'security': 'security',
        'features': 'features'
    }

    # Add headers for enabled columns
    for col_key, col_name in col_names.items():
        if not column_settings.get(col_key, True):
            continue
        if col_key == 'rate_real' and not COREWLAN_AVAILABLE:
            continue
        if col_key in col_widths:
            header_parts.append(f"{col_name:<{col_widths[col_key]}}")
        elif col_key == 'ssid':
            header_parts.append(f"{col_name:<{ssid_width}}")
        elif col_key == 'vendor':
            header_parts.append(f"{col_name:<{vendor_width}}")
        elif col_key == 'features':
            header_parts.append(col_name)

    header = "  ".join(header_parts)

    # Truncate or pad header to fit content width
    if len(header) > content_width:
        header = header[:content_width - 3] + "..."
    header_padding = max(0, content_width - len(header))
    print(f"{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC} {Colors.BOLD}{header}{Colors.ENDC}{' ' * header_padding} {Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}")

    # Separator line
    print(f"{Colors.BOLD}{Colors.OKGREEN}├{'─' * (terminal_width - 2)}┤{Colors.ENDC}")

    # Calculate viewport range
    total_aps = len(sorted_aps)
    if viewport_limit is not None:
        viewport_end = min(viewport_offset + viewport_limit, total_aps)
        viewport_aps = sorted_aps[viewport_offset:viewport_end]
    else:
        viewport_aps = sorted_aps
        viewport_offset = 0

    for viewport_idx, (bssid, ap) in enumerate(viewport_aps):
        # Calculate actual index in the full list
        idx = viewport_offset + viewport_idx
        # Check if this line is selected
        is_selected = (idx == selected_index and selected_index >= 0)

        # Background highlight for selected line
        bg_highlight = "\033[48;5;240m" if is_selected else ""  # Medium gray background (color 240)
        bg_reset = "\033[49m" if is_selected else ""  # Reset background

        # Check if AP is currently visible - if not, gray out the entire line
        is_visible = getattr(ap, 'currently_visible', True)  # Default to True for backward compatibility

        # Get row color based on RSSI (for entire row)
        row_color = get_row_color_by_rssi(ap.rssi, is_visible)

        # BSSID - simple text, row color will be applied to entire line
        bssid_str = bssid

        # RSSI - just current value
        rssi_str = colorize_rssi(ap.rssi) if ap.rssi else "-"

        # AVG - average/min RSSI value
        if ap.min_rssi is not None and ap.min_rssi != ap.rssi:
            avg_str = f"{ap.min_rssi}dBm"
        else:
            avg_str = "-"

        # Channel
        ch_str = str(ap.channel) if ap.channel else "-"

        # Band
        band_str = ap.band or "-"

        # Rate (max) - theoretical maximum from PHY mode
        if ap.rate:
            rate_max_str = f"{int(ap.rate)} Mbit"
        else:
            rate_max_str = "-"

        # Rate (real) - RSSI-based estimate (only for macOS/CoreWLAN)
        if show_rate_real and ap.rate and ap.rssi:
            # Calculate estimated actual rate based on RSSI
            if ap.rssi >= -50:
                rate_factor = 1.0  # Excellent: 100%
            elif ap.rssi >= -60:
                rate_factor = 0.75  # Very good: 75%
            elif ap.rssi >= -67:
                rate_factor = 0.50  # Good: 50%
            elif ap.rssi >= -70:
                rate_factor = 0.35  # Fair: 35%
            elif ap.rssi >= -80:
                rate_factor = 0.20  # Poor: 20%
            else:
                rate_factor = 0.10  # Very poor: 10%

            estimated_rate = ap.rate * rate_factor
            rate_real_str = f"{int(estimated_rate)} Mbit"
        else:
            rate_real_str = "-"

        # SSID with proper truncation (using dynamic width)
        if ap.hidden:
            ssid_str = "<hidden>"
        elif len(ap.ssid) > ssid_width:
            ssid_str = ap.ssid[:ssid_width-3] + "..."
        else:
            ssid_str = ap.ssid

        # Vendor with proper truncation (using dynamic width)
        if ap.vendor and len(ap.vendor) > vendor_width:
            vendor_str = ap.vendor[:vendor_width-3] + "..."
        else:
            vendor_str = ap.vendor or "Unknown"

        # Security label
        sec_str = ap.security_label()

        # Features column - plain text, row color will be applied
        features = []
        if ap.wps_enabled:
            wps_status = "WPS!" if ap.wps_locked is False else "WPS"
            features.append(wps_status)
        if ap.pmf_required:
            features.append("PMF:req")
        elif ap.pmf_capable:
            features.append("PMF:cap")
        if ap.ft_present:
            features.append("FT")
        if ap.rrm_enabled:
            features.append("RRM")
        if ap.bss_transition:
            features.append("BSS-T")
        if ap.channel_width:
            features.append(f"{ap.channel_width}MHz")
        if ap.handshake_observed:
            features.append("4WH")
        if ap.deauth_count > 10:
            features.append(f"⚠️DA:{ap.deauth_count}")

        features_str = " ".join(features) if features else "-"

        # Build line content dynamically based on enabled columns
        line_parts = []
        col_data = {
            'bssid': (bssid_str, col_widths['bssid']),
            'rssi': (rssi_str, col_widths['rssi']),
            'avg': (avg_str, col_widths['avg']),
            'ch': (ch_str, col_widths['ch']),
            'band': (band_str, col_widths['band']),
            'rate_max': (rate_max_str, col_widths['rate_max']),
            'rate_real': (rate_real_str, col_widths['rate_real']),
            'ssid': (ssid_str, ssid_width),
            'vendor': (vendor_str, vendor_width),
            'security': (sec_str, col_widths['security']),
            'features': (features_str, 0)  # No width for features (last column)
        }

        # Add columns in order if enabled
        for col_key in col_names.keys():
            if not column_settings.get(col_key, True):
                continue
            if col_key == 'rate_real' and not show_rate_real:
                continue

            data, width = col_data[col_key]
            if col_key == 'features':
                line_parts.append(data)  # Features is last, no padding
            else:
                line_parts.append(f"{data:<{width}}")

        line_content = "  ".join(line_parts)

        # Calculate visual length (without ANSI codes) for proper padding
        import re
        ansi_escape = re.compile(r'\x1B(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~])')
        line_visual_length = len(ansi_escape.sub('', line_content))
        line_padding = max(0, content_width - line_visual_length)

        # Apply row color to entire line
        colored_line = f"{row_color}{line_content}{Colors.ENDC}"

        # If selected, also apply background highlight
        if is_selected:
            # Replace Colors.ENDC with ENDC + bg_highlight to maintain background
            colored_line = colored_line.replace(Colors.ENDC, f"{Colors.ENDC}{bg_highlight}")
            print(f"{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC} {bg_highlight}{colored_line}{' ' * line_padding}{bg_reset} {Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}")
        else:
            print(f"{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC} {colored_line}{' ' * line_padding} {Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}")



def scan_with_corewlan(timeout: int) -> Dict[str, APInfo]:
    """Scan for WiFi networks using macOS CoreWLAN (no monitor mode needed)."""
    if not COREWLAN_AVAILABLE:
        print("[!] CoreWLAN not available")
        return {}

    print(f"[*] Scanning with CoreWLAN for {timeout}s...")
    aps: Dict[str, APInfo] = {}

    try:
        # Get WiFi client and interface
        client = CoreWLAN.CWWiFiClient.sharedWiFiClient()
        interface = client.interface()

        if not interface:
            print("[!] No WiFi interface found")
            return {}

        # Perform scan
        networks, error = interface.scanForNetworksWithName_error_(None, None)

        if error:
            print(f"[!] Scan error: {error}")
            return {}

        if not networks or len(networks) == 0:
            print("[!] No networks found")
            return {}

        print(f"[*] Found {len(networks)} networks")

        # Process each network
        for network in networks:
            bssid = network.bssid()
            if not bssid:
                continue

            ssid = network.ssid() or ""
            channel = network.wlanChannel().channelNumber() if network.wlanChannel() else None
            rssi = network.rssiValue()

            # Get vendor from BSSID
            vendor = get_vendor(bssid)

            # Get mode (Infrastructure vs Ad-hoc)
            mode = "Ad-hoc" if (hasattr(network, 'ibss') and network.ibss()) else "Infra"

            # Get max rate (in Mbit/s) - estimated from PHY mode (macOS only)
            # Note: On Linux with monitor mode, rate is extracted from RadioTap headers
            rate = None

            # Try to get the fastest supported PHY mode
            if hasattr(network, 'fastestSupportedPHYMode'):
                try:
                    phy_mode = network.fastestSupportedPHYMode()

                    # Estimate max rate based on PHY mode
                    # These are approximate maximum theoretical rates
                    if phy_mode == CoreWLAN.kCWPHYMode11ax:  # WiFi 6/6E
                        rate = 9608.0  # 9.6 Gbit/s theoretical max
                    elif phy_mode == CoreWLAN.kCWPHYMode11ac:  # WiFi 5
                        rate = 6933.0  # ~7 Gbit/s theoretical max
                    elif phy_mode == CoreWLAN.kCWPHYMode11n:  # WiFi 4
                        rate = 600.0  # 600 Mbit/s with 4 spatial streams
                    elif phy_mode == CoreWLAN.kCWPHYMode11a:  # 5 GHz legacy
                        rate = 54.0
                    elif phy_mode == CoreWLAN.kCWPHYMode11g:  # 2.4 GHz
                        rate = 54.0
                    elif phy_mode == CoreWLAN.kCWPHYMode11b:  # 2.4 GHz legacy
                        rate = 11.0
                except Exception as e:
                    pass  # If PHY mode detection fails, rate stays None

            # Create AP info
            ap = APInfo(
                bssid=bssid,
                ssid=ssid,
                channel=channel,
                rssi=rssi,
                vendor=vendor,
                hidden=(ssid == ""),
                band=get_band(channel) if channel else None,
                mode=mode,
                rate=rate
            )

            # Parse security settings from CoreWLAN
            # WPA/WPA2/WPA3 detection
            if hasattr(network, 'supportsSecurity_'):
                # Check for different security types
                if network.supportsSecurity_(CoreWLAN.kCWSecurityWPA2Personal):
                    ap.rsn_present = True
                    ap.akms.add("PSK")
                elif network.supportsSecurity_(CoreWLAN.kCWSecurityWPA2Enterprise):
                    ap.rsn_present = True
                    ap.akms.add("802.1X")
                elif network.supportsSecurity_(CoreWLAN.kCWSecurityWPAPersonal):
                    ap.wpa1_present = True
                    ap.akms.add("PSK")
                elif network.supportsSecurity_(CoreWLAN.kCWSecurityWPAEnterprise):
                    ap.wpa1_present = True
                    ap.akms.add("802.1X")
                elif network.supportsSecurity_(CoreWLAN.kCWSecurityWPA3Personal):
                    ap.rsn_present = True
                    ap.akms.add("SAE")
                elif network.supportsSecurity_(CoreWLAN.kCWSecurityWPA3Enterprise):
                    ap.rsn_present = True
                    ap.akms.add("802.1X-SHA256")

            # Check for WEP or Open
            if network.supportsSecurity_(CoreWLAN.kCWSecurityWEP):
                ap.privacy_bit = True
            elif network.supportsSecurity_(CoreWLAN.kCWSecurityNone):
                ap.privacy_bit = False

            # Get information elements data if available
            if hasattr(network, 'informationElementData'):
                ie_data = network.informationElementData()
                if ie_data:
                    # Parse IEs for additional info (WPS, PMF, etc.)
                    # This would require parsing the raw IE data
                    pass

            aps[bssid] = ap

    except Exception as e:
        print(f"[!] CoreWLAN scan error: {e}")

    return aps


def sniff_live(iface: str, timeout: int, observe_eapol: bool, channel: Optional[int] = None) -> Dict[str, APInfo]:
    aps: Dict[str, APInfo] = {}

    def _cb(pkt):
        if pkt.haslayer(Dot11):
            if pkt.type == 0 and pkt.subtype in (8, 5):  # Beacon or ProbeResp
                process_mgmt_frame(pkt, aps)
            if observe_eapol and pkt.haslayer(EAPOL):
                process_eapol(pkt, aps)
            # NEW: Track deauth/disassoc frames
            if pkt.type == 0 and pkt.subtype in (10, 12):
                process_deauth_disassoc(pkt, aps)

    # Optionally, you can lock to a channel externally (iw set channel)
    print(f"[*] Sniffing on {iface} for {timeout}s…")
    try:
        sniff(iface=iface, prn=_cb, store=False, timeout=timeout)
    except PermissionError:
        print(f"\n[!] ERROR: Permission denied on interface '{iface}'")
        print(f"[!] Try running with sudo: sudo python3 {sys.argv[0]} -i {iface}")
        sys.exit(1)
    except OSError as e:
        if "No such device" in str(e):
            print(f"\n[!] ERROR: Interface '{iface}' not found")
            print(f"[!] Make sure the interface exists and is in monitor mode")
            print(f"[!] List available interfaces with: ip link show")
        else:
            print(f"\n[!] ERROR: Cannot access interface '{iface}': {e}")
        sys.exit(1)
    except KeyboardInterrupt:
        print(f"\n[*] Capture interrupted by user")
    except Exception as e:
        print(f"\n[!] ERROR: Unexpected error during capture: {e}")
        sys.exit(1)
    return aps


def read_pcap(path: str, observe_eapol: bool) -> Dict[str, APInfo]:
    aps: Dict[str, APInfo] = {}

    # Validate file exists
    if not os.path.isfile(path):
        print(f"\n[!] ERROR: PCAP file not found: {path}")
        print(f"[!] Please check the file path and try again")
        sys.exit(1)

    # Check file extension
    if not path.endswith(('.pcap', '.pcapng', '.cap')):
        print(f"\n[!] WARNING: File '{path}' may not be a valid PCAP file")
        print(f"[!] Expected extensions: .pcap, .pcapng, .cap")

    print(f"[*] Reading {path}…")
    try:
        packets = rdpcap(path)
        if len(packets) == 0:
            print(f"[!] WARNING: PCAP file is empty (0 packets)")
            return aps

        print(f"[*] Processing {len(packets)} packets…")
        for pkt in packets:
            if pkt.haslayer(Dot11):
                if pkt.type == 0 and pkt.subtype in (8, 5):
                    process_mgmt_frame(pkt, aps)
                if observe_eapol and pkt.haslayer(EAPOL):
                    process_eapol(pkt, aps)
                # NEW: Track deauth/disassoc frames
                if pkt.type == 0 and pkt.subtype in (10, 12):
                    process_deauth_disassoc(pkt, aps)
    except FileNotFoundError:
        print(f"\n[!] ERROR: PCAP file not found: {path}")
        sys.exit(1)
    except PermissionError:
        print(f"\n[!] ERROR: Permission denied reading file: {path}")
        sys.exit(1)
    except Exception as e:
        print(f"\n[!] ERROR: Failed to read PCAP file: {e}")
        print(f"[!] Make sure the file is a valid PCAP/PCAPNG file")
        sys.exit(1)

    return aps


def enable_monitor_mode(iface: str) -> bool:
    """Enable monitor mode on interface (cross-platform)."""
    import subprocess

    print(f"\n[*] Attempting to enable monitor mode on {iface}...")

    try:
        if sys.platform == 'darwin':  # macOS
            # macOS: Monitor mode requires special drivers or tools
            # Standard macOS doesn't support traditional monitor mode anymore
            print(f"[!] Native monitor mode is not supported on modern macOS")
            print(f"[!] Options:")
            print(f"    1. Use Wireshark with Remote Packet Capture (requires admin)")
            print(f"    2. Install nexmon drivers (for supported devices)")
            print(f"    3. Use a USB WiFi adapter with Linux drivers")
            print(f"\n[*] Attempting basic channel hopping mode...")

            # Try to at least disconnect from network
            airport_paths = [
                '/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport',
                '/usr/sbin/airport'
            ]

            for airport_path in airport_paths:
                if os.path.exists(airport_path):
                    print(f"[*] Disassociating from current network...")
                    result = subprocess.run(['sudo', airport_path, '-z'],
                                          capture_output=True, text=True, timeout=30)
                    if result.returncode == 0:
                        print(f"[+] Disconnected from network")
                    break

            print(f"\n[!] macOS does not support true monitor mode via standard tools")
            print(f"[*] You can capture WiFi traffic with Wireshark or similar tools")
            return False

        elif sys.platform.startswith('linux'):  # Linux
            # Check if airmon-ng is available
            if os.path.exists('/usr/sbin/airmon-ng') or os.path.exists('/usr/local/sbin/airmon-ng'):
                print(f"[*] Using airmon-ng to enable monitor mode...")
                result = subprocess.run(['sudo', 'airmon-ng', 'start', iface],
                                      capture_output=True, text=True, timeout=30)

                if result.returncode == 0:
                    # airmon-ng typically creates a new interface (e.g., wlan0mon)
                    output = result.stdout
                    if 'monitor mode enabled' in output.lower() or 'mon' in output:
                        print(f"[+] Monitor mode enabled")
                        # Try to extract the new interface name
                        for line in output.split('\n'):
                            if 'monitor mode' in line.lower() and 'enabled on' in line.lower():
                                print(f"[*] {line.strip()}")
                        return True
                    else:
                        print(f"[!] airmon-ng output: {output}")
                        return False
                else:
                    print(f"[!] airmon-ng failed: {result.stderr}")
                    return False
            else:
                # Try manual method using iwconfig
                print(f"[*] airmon-ng not found, trying manual method...")

                # First, bring interface down
                subprocess.run(['sudo', 'ip', 'link', 'set', iface, 'down'],
                             capture_output=True, timeout=10)

                # Try iwconfig method
                result = subprocess.run(['sudo', 'iwconfig', iface, 'mode', 'monitor'],
                                      capture_output=True, text=True, timeout=10)

                # Bring interface back up
                subprocess.run(['sudo', 'ip', 'link', 'set', iface, 'up'],
                             capture_output=True, timeout=10)

                if result.returncode == 0:
                    print(f"[+] Monitor mode enabled on {iface}")
                    return True
                else:
                    # Try iw command as fallback
                    subprocess.run(['sudo', 'ip', 'link', 'set', iface, 'down'],
                                 capture_output=True, timeout=10)
                    result = subprocess.run(['sudo', 'iw', 'dev', iface, 'set', 'type', 'monitor'],
                                          capture_output=True, text=True, timeout=10)
                    subprocess.run(['sudo', 'ip', 'link', 'set', iface, 'up'],
                                 capture_output=True, timeout=10)

                    if result.returncode == 0:
                        print(f"[+] Monitor mode enabled on {iface}")
                        return True
                    else:
                        print(f"[!] Failed to enable monitor mode: {result.stderr}")
                        return False

    except subprocess.TimeoutExpired:
        print(f"[!] Command timed out")
        return False
    except Exception as e:
        print(f"[!] Error enabling monitor mode: {e}")
        return False


def disable_monitor_mode(iface: str) -> bool:
    """Disable monitor mode on interface (cross-platform)."""
    import subprocess

    print(f"\n[*] Disabling monitor mode on {iface}...")

    try:
        if sys.platform == 'darwin':  # macOS
            # macOS doesn't have true monitor mode to disable
            print(f"[*] No monitor mode to disable on macOS")
            print(f"[*] You may need to reconnect to your WiFi network manually")
            return True

        elif sys.platform.startswith('linux'):  # Linux
            # Check if airmon-ng is available
            if os.path.exists('/usr/sbin/airmon-ng') or os.path.exists('/usr/local/sbin/airmon-ng'):
                print(f"[*] Using airmon-ng to disable monitor mode...")
                result = subprocess.run(['sudo', 'airmon-ng', 'stop', iface],
                                      capture_output=True, text=True, timeout=30)

                if result.returncode == 0:
                    print(f"[+] Monitor mode disabled")
                    return True
                else:
                    print(f"[!] airmon-ng failed: {result.stderr}")

            # Try manual method
            print(f"[*] Reverting to managed mode...")

            # Bring interface down
            subprocess.run(['sudo', 'ip', 'link', 'set', iface, 'down'],
                         capture_output=True, timeout=10)

            # Try iwconfig method
            result = subprocess.run(['sudo', 'iwconfig', iface, 'mode', 'managed'],
                                  capture_output=True, text=True, timeout=10)

            # Bring interface back up
            subprocess.run(['sudo', 'ip', 'link', 'set', iface, 'up'],
                         capture_output=True, timeout=10)

            if result.returncode == 0:
                print(f"[+] Managed mode restored on {iface}")
                return True
            else:
                # Try iw command as fallback
                subprocess.run(['sudo', 'ip', 'link', 'set', iface, 'down'],
                             capture_output=True, timeout=10)
                result = subprocess.run(['sudo', 'iw', 'dev', iface, 'set', 'type', 'managed'],
                                      capture_output=True, text=True, timeout=10)
                subprocess.run(['sudo', 'ip', 'link', 'set', iface, 'up'],
                             capture_output=True, timeout=10)

                if result.returncode == 0:
                    print(f"[+] Managed mode restored on {iface}")
                    return True
                else:
                    print(f"[!] Failed to disable monitor mode: {result.stderr}")
                    return False

    except Exception as e:
        print(f"[!] Error disabling monitor mode: {e}")
        return False


def check_monitor_mode(iface: str) -> bool:
    """Check if interface is in monitor mode."""
    import subprocess

    try:
        if sys.platform == 'darwin':  # macOS
            result = subprocess.run(['ifconfig', iface],
                                  capture_output=True, text=True, timeout=5)
            if result.returncode == 0:
                return 'monitor' in result.stdout.lower()
        elif sys.platform.startswith('linux'):
            result = subprocess.run(['iwconfig', iface],
                                  capture_output=True, text=True, timeout=5)
            if result.returncode == 0:
                return 'Mode:Monitor' in result.stdout
    except Exception:
        pass

    return False


def format_runtime(seconds: float) -> str:
    """Format runtime in human-readable format (days, hours, minutes, seconds)."""
    days = int(seconds // 86400)
    hours = int((seconds % 86400) // 3600)
    minutes = int((seconds % 3600) // 60)
    secs = int(seconds % 60)

    if days > 0:
        return f"{days}d {hours}h {minutes}m {secs}s"
    elif hours > 0:
        return f"{hours}h {minutes}m {secs}s"
    elif minutes > 0:
        return f"{minutes}m {secs}s"
    else:
        return f"{secs}s"


def permanent_scan_mode(interval: int, observe_eapol: bool, iface: Optional[str] = None, channel: Optional[int] = None):
    """
    Permanent scan mode - continuously scan and update results in real-time.
    Maintains a pool of APs and updates display as networks come and go.

    Args:
        interval: Scan and display refresh interval in seconds (used for both scanning and display updates)
        observe_eapol: Whether to observe EAPOL frames
        iface: Interface to use (for Linux monitor mode)
        channel: Channel hint
    """
    import time
    import datetime
    import threading

    # AP pool - continuously updated
    ap_pool: Dict[str, APInfo] = {}
    ap_pool_lock = threading.Lock()
    scan_active = threading.Event()
    scan_active.set()

    # ID management
    next_ap_id = 1
    ap_id_lock = threading.Lock()

    previous_line_count = 0
    first_display = True
    last_change_time = datetime.datetime.now()  # When AP pool actually changed
    last_scan_time = datetime.datetime.now()    # When last scan completed
    last_scan_duration = 0.0  # Duration of last scan in seconds
    popup_active = threading.Event()  # Flag to prevent display updates while popup is shown
    selected_index = 0  # Currently selected AP index (0-based)
    navigation_enabled = False  # Toggle navigation mode
    scroll_offset = 0  # Scroll offset for table viewport (0-based)

    # Column visibility settings (all enabled by default)
    column_settings = {
        'bssid': True,
        'rssi': True,
        'avg': True,
        'ch': True,
        'band': True,
        'rate_max': True,
        'rate_real': True,
        'ssid': True,
        'vendor': True,
        'security': True,
        'features': True
    }

    # Statistics tracking
    start_time = datetime.datetime.now()
    total_scans = 0
    total_aps_discovered = 0  # Total unique APs ever seen
    total_scan_time = 0.0  # Cumulative scan duration
    fastest_scan = float('inf')
    slowest_scan = 0.0

    # Clear screen before starting
    os.system('clear' if os.name == 'posix' else 'cls')

    # Hide cursor
    print("\033[?25l", end='', flush=True)

    print(f"{Colors.BOLD}{Colors.OKGREEN}[*] Continuous scan mode activated{Colors.ENDC}")
    print(f"[*] Start time: {start_time.strftime('%Y-%m-%d %H:%M:%S')}")
    print(f"[*] Scan and display interval: every {interval}s")
    print(f"[*] Press Ctrl+C to exit\n")
    time.sleep(1)

    # Display update function
    def update_display():
        """Update the terminal display with current AP pool."""
        nonlocal previous_line_count, first_display, scroll_offset

        # Don't update if popup is active
        if popup_active.is_set():
            return

        # Get snapshot of current AP pool
        with ap_pool_lock:
            current_aps = dict(ap_pool)

        # Build output in a string buffer
        import io
        output_buffer = io.StringIO()

        # Redirect stdout temporarily to capture output
        import sys as sys_module
        old_stdout = sys_module.stdout
        sys_module.stdout = output_buffer

        try:
            import shutil
            term_size = shutil.get_terminal_size(fallback=(120, 24))
            term_width = term_size.columns
            term_height = term_size.lines

            # Build content first to calculate how many lines we need
            content_lines = []

            # Top border
            content_lines.append(f"{Colors.BOLD}{Colors.OKGREEN}┌{'─' * (term_width - 2)}┐{Colors.ENDC}")

            # Title line
            title = f"AirDetect v{VERSION}"
            title_padding = (term_width - 2 - len(title)) // 2
            content_lines.append(f"{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}{' ' * title_padding}{Colors.BOLD}{Colors.FAIL}{title}{Colors.ENDC}{' ' * (term_width - 2 - title_padding - len(title))}{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}")

            # Separator
            content_lines.append(f"{Colors.BOLD}{Colors.OKGREEN}├{'─' * (term_width - 2)}┤{Colors.ENDC}")

            # Calculate runtime
            runtime_seconds = (datetime.datetime.now() - start_time).total_seconds()
            runtime_str = format_runtime(runtime_seconds)
            scan_duration_str = f"{last_scan_duration:.2f}s" if last_scan_duration > 0 else "N/A"

            # Calculate available height for scroll indicator
            header_lines_estimate = 6
            footer_lines = 3
            table_header_lines = 2
            available_height = term_height - header_lines_estimate - footer_lines - table_header_lines
            viewport_limit_info = max(5, available_height)

            # Build AP info with scroll indicator if needed
            total_aps = len(current_aps)
            if total_aps > viewport_limit_info:
                # Show scroll indicator
                viewport_start = scroll_offset + 1
                viewport_end = min(scroll_offset + viewport_limit_info, total_aps)
                ap_info = f"APs: {total_aps} (showing {viewport_start}-{viewport_end})"
            else:
                ap_info = f"APs: {total_aps}"

            # Info line 1: Runtime on left, Last Scan on right
            info_left = f"Runtime: {runtime_str}  |  {ap_info}  |  Interval: {interval}s"

            time_diff = abs((last_scan_time - last_change_time).total_seconds())
            if time_diff > 2:
                info_right = f"Last Scan: {last_scan_time.strftime('%H:%M:%S')} ({scan_duration_str})  |  Last Change: {last_change_time.strftime('%H:%M:%S')}"
            else:
                info_right = f"Last Scan: {last_scan_time.strftime('%H:%M:%S')} ({scan_duration_str})"

            # Calculate spacing between left and right info
            info_spacing = term_width - 4 - len(info_left) - len(info_right)
            if info_spacing < 2:
                # If not enough space, use two lines
                info1_padding = term_width - 4 - len(info_left)
                content_lines.append(f"{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC} {info_left}{' ' * info1_padding} {Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}")
                info2_padding = term_width - 4 - len(info_right)
                content_lines.append(f"{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC} {info_right}{' ' * info2_padding} {Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}")
            else:
                # Both on same line
                content_lines.append(f"{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC} {info_left}{' ' * info_spacing}{info_right} {Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}")

            # Separator before table
            content_lines.append(f"{Colors.BOLD}{Colors.OKGREEN}├{'─' * (term_width - 2)}┤{Colors.ENDC}")

            # Calculate available height for table (needed for both empty and non-empty cases)
            # Header: top border (1) + title (1) + separator (1) + info lines (1-2) + separator (1) = 5-6 lines
            # Footer: separator (1) + footer (1) + bottom border (1) = 3 lines
            # Table header: header line (1) + separator (1) = 2 lines
            header_lines = len(content_lines)  # Current header lines
            footer_lines = 3
            table_header_lines = 2
            available_height = term_height - header_lines - footer_lines - table_header_lines

            # Calculate viewport limit (max APs to display)
            viewport_limit = max(5, available_height)  # At least 5 lines

            # Display results
            if len(current_aps) == 0:
                # No APs message with border
                msg = "[!] No access points detected yet... (scanning)"
                msg_padding = term_width - 4 - len(msg)
                content_lines.append(f"{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC} {Colors.WARNING}{msg}{Colors.ENDC}{' ' * msg_padding} {Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}")
            else:

                # Capture table output
                table_buffer = io.StringIO()
                old_stdout_temp = sys_module.stdout
                sys_module.stdout = table_buffer
                # Pass selected_index if navigation is enabled
                current_selection = selected_index if navigation_enabled else -1
                print_report(current_aps, show_timestamp=False, show_ids=True, term_width=term_width, selected_index=current_selection, column_settings=column_settings, viewport_offset=scroll_offset, viewport_limit=viewport_limit)
                sys_module.stdout = old_stdout_temp
                content_lines.extend(table_buffer.getvalue().rstrip('\n').split('\n'))

            # Calculate padding lines to push footer to bottom
            # Footer takes 3 lines: separator, footer content, bottom border
            footer_lines = 3
            used_lines = len(content_lines)
            padding_lines = max(0, term_height - used_lines - footer_lines)

            # Add padding empty lines with borders
            for _ in range(padding_lines):
                content_lines.append(f"{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC} {' ' * (term_width - 4)} {Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}")

            # Separator before footer
            content_lines.append(f"{Colors.BOLD}{Colors.OKGREEN}├{'─' * (term_width - 2)}┤{Colors.ENDC}")

            # Footer with scroll indicators if needed
            footer_right = "Enter: menu  |  s: setup  |  h: help  |  q: exit"

            # Add scroll indicators if there are more APs than fit in viewport
            if len(current_aps) > viewport_limit:
                can_scroll_up = scroll_offset > 0
                can_scroll_down = scroll_offset + viewport_limit < len(current_aps)

                if can_scroll_up and can_scroll_down:
                    scroll_indicator = "↑↓"
                elif can_scroll_up:
                    scroll_indicator = "↑ "
                elif can_scroll_down:
                    scroll_indicator = " ↓"
                else:
                    scroll_indicator = ""

                if scroll_indicator.strip():
                    footer_left = f"{Colors.BOLD}{Colors.OKCYAN}{scroll_indicator}{Colors.ENDC}"
                    # Calculate padding between left and right
                    # -4 for borders and spaces, -2 for scroll indicator visual length
                    footer_padding = term_width - 4 - 2 - len(footer_right)
                    content_lines.append(f"{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC} {footer_left}{' ' * footer_padding}{Colors.GRAY}{footer_right}{Colors.ENDC} {Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}")
                else:
                    footer_padding = term_width - 4 - len(footer_right)
                    content_lines.append(f"{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC} {' ' * footer_padding}{Colors.GRAY}{footer_right}{Colors.ENDC} {Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}")
            else:
                footer_padding = term_width - 4 - len(footer_right)
                content_lines.append(f"{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC} {' ' * footer_padding}{Colors.GRAY}{footer_right}{Colors.ENDC} {Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}")

            # Bottom border
            content_lines.append(f"{Colors.BOLD}{Colors.OKGREEN}└{'─' * (term_width - 2)}┘{Colors.ENDC}")

            # Print all content
            for line in content_lines:
                print(line)
        finally:
            sys_module.stdout = old_stdout

        # Get the complete output
        output = output_buffer.getvalue().rstrip('\n')

        # Count actual lines
        output_lines = output.split('\n')
        current_line_count = len(output_lines)

        # Move cursor to home position and clear screen
        sys_module.stdout.write("\033[H")  # Move cursor to top-left
        sys_module.stdout.write("\033[0J")  # Clear from cursor to end of screen

        # Print new output
        sys_module.stdout.write(output)
        sys_module.stdout.flush()

        # Store line count for next iteration
        previous_line_count = current_line_count
        first_display = False

    def adjust_scroll_offset():
        """Adjust scroll_offset to keep selected_index visible in the viewport."""
        nonlocal scroll_offset

        # Get terminal height and calculate viewport limit
        import shutil
        term_size = shutil.get_terminal_size(fallback=(120, 24))
        term_height = term_size.lines

        # Calculate available height for table (same calculation as in update_display)
        # Estimate header lines: 5-6 (top border, title, separator, info, separator)
        # We'll use a conservative estimate of 6
        header_lines = 6
        footer_lines = 3
        table_header_lines = 2
        available_height = term_height - header_lines - footer_lines - table_header_lines
        viewport_limit = max(5, available_height)

        # Get current AP count to validate scroll_offset
        with ap_pool_lock:
            ap_count = len(ap_pool)

        # Ensure scroll_offset is within valid range
        max_scroll = max(0, ap_count - viewport_limit)
        scroll_offset = min(scroll_offset, max_scroll)

        # Adjust scroll_offset to keep selected_index visible
        if selected_index < scroll_offset:
            # Selected item is above viewport, scroll up
            scroll_offset = selected_index
        elif selected_index >= scroll_offset + viewport_limit:
            # Selected item is below viewport, scroll down
            scroll_offset = selected_index - viewport_limit + 1

        # Ensure scroll_offset is non-negative
        scroll_offset = max(0, scroll_offset)

    def create_popup(title: str, content_lines: list, center_title: bool = True, left_padding: int = 2):
        """
        Create and display a popup with dynamic sizing.

        Args:
            title: Popup title (shown at top)
            content_lines: List of content lines to display
            center_title: Whether to center the title (default: True)
            left_padding: Left padding for content lines (default: 2)

        Returns:
            Tuple of (popup_lines, popup_width, popup_height, popup_x, popup_y)
        """
        import shutil
        import re
        term_size = shutil.get_terminal_size(fallback=(120, 24))
        term_width = term_size.columns
        term_height = term_size.lines

        # Helper function to get visual length (strips ANSI codes)
        def visual_len(text):
            # Remove all ANSI escape sequences (including CSI sequences)
            ansi_escape = re.compile(r'\x1b\[[0-9;]*[a-zA-Z]|\x1b\][^\x07]*\x07')
            clean_text = ansi_escape.sub('', text)
            return len(clean_text)

        # Calculate dynamic width based on content
        max_line_len = max(visual_len(line) for line in content_lines) if content_lines else 20
        title_len = visual_len(title)
        # Width calculation: content + left_padding + left_space (1) + right_space (1) + borders (2)
        # = content + left_padding + 4
        # But we also add left_space and left_padding in line_text, so just add content + 4 here
        popup_width = max(max_line_len + left_padding + 4, title_len + 4, 40)  # min 40
        popup_width = min(popup_width, term_width - 4)  # Don't exceed terminal width

        # Calculate height
        popup_height = len(content_lines) + 4  # +4 for title, borders, padding

        # Calculate centered position
        popup_x = (term_width - popup_width) // 2
        popup_y = max(1, (term_height - popup_height) // 2)

        popup_lines = []

        # Top border (green like table borders)
        popup_lines.append(f"\033[{popup_y};{popup_x}H{Colors.BOLD}{Colors.OKGREEN}┌{'─' * (popup_width - 2)}┐{Colors.ENDC}")

        # Title line
        if center_title:
            title_padding = (popup_width - 2 - visual_len(title)) // 2
            remaining = popup_width - 2 - visual_len(title) - title_padding
            popup_lines.append(f"\033[{popup_y + 1};{popup_x}H{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}{' ' * title_padding}{Colors.BOLD}{title}{Colors.ENDC}{' ' * remaining}{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}")
        else:
            title_text = f" {title} "
            remaining = popup_width - 2 - visual_len(title_text)
            popup_lines.append(f"\033[{popup_y + 1};{popup_x}H{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}{Colors.BOLD}{title_text}{Colors.ENDC}{' ' * remaining}{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}")

        # Separator
        popup_lines.append(f"\033[{popup_y + 2};{popup_x}H{Colors.BOLD}{Colors.OKGREEN}├{'─' * (popup_width - 2)}┤{Colors.ENDC}")

        # Content lines (left-aligned with extra space on both sides)
        for i, line in enumerate(content_lines):
            row = popup_y + 3 + i
            # Build content with left space and padding
            line_text = ' ' + (' ' * left_padding) + line
            content_len = visual_len(line_text)

            # Total space inside borders: popup_width - 2 (for the two │ characters)
            # We need: content + padding + 1 space on right = popup_width - 2
            inner_width = popup_width - 2
            padding_needed = inner_width - content_len - 1  # -1 for right space

            if padding_needed < 0:
                # Content is too long, truncate it
                padding_needed = 0
                # Truncate line_text to fit
                line_text = line_text[:inner_width - 1]

            # Build the complete line: content + padding + right space
            # Strip any trailing ANSI codes from line_text before adding padding
            # to prevent them from affecting the padding area
            line_content = f"{line_text}{Colors.ENDC}{' ' * padding_needed} "

            # Debug: Check if line has embedded ENDC that might cause issues
            # Count actual visual characters vs total to detect issues
            actual_visual = visual_len(line_content)
            expected_visual = content_len + padding_needed + 1  # content + padding + right space

            # Calculate where the right border should be
            right_border_x = popup_x + popup_width - 1

            popup_lines.append(
                f"\033[{row};{popup_x}H"  # Position cursor at left edge
                f"{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}"  # Left border with reset
                f"{line_content}"  # Content with padding
                f"\033[{row};{right_border_x}H"  # Position cursor at right border
                f"{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}"  # Right border with reset
            )

        # Bottom border
        popup_lines.append(f"\033[{popup_y + popup_height - 1};{popup_x}H{Colors.BOLD}{Colors.OKGREEN}└{'─' * (popup_width - 2)}┘{Colors.ENDC}")

        return popup_lines, popup_width, popup_height, popup_x, popup_y

    def show_help_popup():
        """Display help popup with keyboard shortcuts."""
        # Set flag to prevent background display updates
        popup_active.set()

        try:
            # Help content
            help_lines = [
                "Navigation:",
                "  ↑/↓        - Move selection up/down (1 line)",
                "  Page Up    - Jump up 5 lines",
                "  Page Down  - Jump down 5 lines",
                "  Home       - Jump to first AP",
                "  End        - Jump to last AP",
                "",
                "Actions:",
                "  Enter      - Open AP menu (Statistics/Info/Signal)",
                "  s          - Setup menu (Column visibility)",
                "  h          - Show this help",
                "  q / ESC    - Quit/Exit",
                "  Ctrl+C     - Quit/Exit",
                "",
                "Display:",
                "  r          - Refresh display",
                "  Ctrl+L     - Refresh display",
                "",
                "Note: Display auto-refreshes on window resize",
                "",
                "Press any key to close..."
            ]

            # Create popup with dynamic sizing
            popup_lines, popup_width, popup_height, popup_x, popup_y = create_popup(
                "KEYBOARD SHORTCUTS",
                help_lines,
                center_title=True,
                left_padding=0
            )

            # Display popup
            for line in popup_lines:
                print(line, end='', flush=True)

            # Wait for keypress
            import sys as sys_main
            if sys_main.stdin.isatty():
                sys_main.stdin.read(1)

        finally:
            # Clear flag to allow display updates again
            popup_active.clear()

            # Refresh display to clear popup
            update_display()

    def show_setup_menu():
        """Display setup menu with settings configuration."""
        nonlocal column_settings, interval
        popup_active.set()

        try:
            import sys as sys_main
            import select

            # Setup menu options
            setup_menu_items = [
                "Columns",
                f"Interval: {interval}s"
            ]
            selected_setup_index = 0
            needs_table_redraw = True

            while True:
                # Only redraw table when needed (first time or after submenu)
                if needs_table_redraw:
                    print("\033[2J\033[H", end='', flush=True)

                    # Temporarily clear popup_active to allow update_display to render
                    popup_active.clear()
                    update_display()
                    popup_active.set()

                    # Small delay to ensure display is rendered before popup
                    import time
                    time.sleep(0.05)

                    needs_table_redraw = False

                # Update menu items with current values
                setup_menu_items[1] = f"Interval: {interval}s"

                # Build setup menu
                setup_lines = []
                for i, item in enumerate(setup_menu_items):
                    if i == selected_setup_index:
                        setup_lines.append(f"▶ {item}")
                    else:
                        setup_lines.append(f"  {item}")

                setup_lines.append("")
                setup_lines.append("↑/↓: navigate  Enter: select  ESC/q: close")

                # Display setup menu
                popup_lines, popup_width, popup_height, popup_x, popup_y = create_popup(
                    "SETUP",
                    setup_lines,
                    center_title=True,
                    left_padding=0
                )

                for line in popup_lines:
                    print(line, end='', flush=True)

                # Wait for input
                if sys_main.stdin.isatty():
                    key = sys_main.stdin.read(1)

                    if key == '\x1b':  # ESC or arrow key
                        # Try to read the next character with a short timeout
                        import termios
                        import fcntl
                        import os

                        # Save current terminal settings
                        fd = sys_main.stdin.fileno()
                        oldflags = fcntl.fcntl(fd, fcntl.F_GETFL)

                        # Set non-blocking
                        fcntl.fcntl(fd, fcntl.F_SETFL, oldflags | os.O_NONBLOCK)

                        try:
                            # Try to read more characters (arrow key sequence)
                            time.sleep(0.05)  # Small delay to let sequence arrive
                            next_char = sys_main.stdin.read(1)
                            if next_char == '[':
                                arrow = sys_main.stdin.read(1)
                                if arrow == 'A':  # Up arrow
                                    selected_setup_index = (selected_setup_index - 1) % len(setup_menu_items)
                                elif arrow == 'B':  # Down arrow
                                    selected_setup_index = (selected_setup_index + 1) % len(setup_menu_items)
                                # Continue after arrow key
                            else:
                                # ESC with unknown sequence - exit
                                break
                        except (IOError, TypeError):
                            # No more input available - pure ESC key
                            break
                        finally:
                            # Restore blocking mode
                            fcntl.fcntl(fd, fcntl.F_SETFL, oldflags)
                    elif key == '\r' or key == '\n':  # Enter
                        if selected_setup_index == 0:  # Columns
                            result = show_column_settings()
                            # If user wants to exit completely, break (but currently always returns 'back')
                            if result == 'exit':
                                break
                            # Trigger table redraw after returning from submenu
                            needs_table_redraw = True
                        elif selected_setup_index == 1:  # Interval
                            new_interval = show_interval_input()
                            if new_interval is not None:
                                interval = new_interval
                            # Trigger table redraw after input
                            needs_table_redraw = True
                    elif key == 'q' or key == 'Q':
                        break

        finally:
            popup_active.clear()
            # Clear screen completely and redraw display when exiting setup menu
            print("\033[2J\033[H", end='', flush=True)
            update_display()

    def show_interval_input():
        """Show input dialog for changing scan interval.

        Returns:
            New interval value (int) or None if cancelled
        """
        import sys as sys_main

        input_value = ""

        while True:
            # Build input dialog
            input_lines = [
                "Enter new scan interval in seconds (1-999):",
                "",
                f"> {input_value}_",
                "",
                "Enter: confirm  ESC/q: cancel"
            ]

            # Display input dialog
            popup_lines, popup_width, popup_height, popup_x, popup_y = create_popup(
                "SCAN INTERVAL",
                input_lines,
                center_title=True,
                left_padding=0
            )

            # Clear screen and redraw
            print("\033[2J\033[H", end='', flush=True)
            popup_active.clear()
            update_display()
            popup_active.set()

            for line in popup_lines:
                print(line, end='', flush=True)

            # Wait for input
            if sys_main.stdin.isatty():
                key = sys_main.stdin.read(1)

                if key == '\x1b':  # ESC
                    return None
                elif key == '\r' or key == '\n':  # Enter
                    if input_value.isdigit() and len(input_value) > 0:
                        value = int(input_value)
                        if 1 <= value <= 999:
                            return value
                    # Invalid input, continue
                elif key == '\x7f' or key == '\b':  # Backspace
                    input_value = input_value[:-1]
                elif key.isdigit() and len(input_value) < 3:
                    input_value += key
                elif key == 'q' or key == 'Q':
                    return None

        return None

    def show_column_settings():
        """Display and edit column visibility settings.

        Returns:
            'exit' if user wants to exit all menus
            'back' if user wants to return to previous menu
        """
        nonlocal column_settings

        import sys as sys_main
        import select

        # Column names in display order
        column_names = [
            ('bssid', 'BSSID'),
            ('rssi', 'RSSI'),
            ('avg', 'Avg'),
            ('ch', 'Channel'),
            ('band', 'Band'),
            ('rate_max', 'Rate (max)'),
            ('rate_real', 'Rate (real)'),
            ('ssid', 'SSID'),
            ('vendor', 'Vendor'),
            ('security', 'Security'),
            ('features', 'Features')
        ]

        selected_col_index = 0
        needs_table_redraw = True

        while True:
            # Only redraw table when needed (first time or after column toggle)
            if needs_table_redraw:
                print("\033[2J\033[H", end='', flush=True)

                # Temporarily clear popup_active to allow update_display to render
                popup_active.clear()
                update_display()
                popup_active.set()

                # Small delay to ensure display is rendered before popup
                import time
                time.sleep(0.05)

                needs_table_redraw = False

            # Build column settings menu
            col_lines = []
            for i, (col_key, col_display) in enumerate(column_names):
                checkbox = "[x]" if column_settings[col_key] else "[ ]"
                if i == selected_col_index:
                    col_lines.append(f"▶ {checkbox} {col_display}")
                else:
                    col_lines.append(f"  {checkbox} {col_display}")

            col_lines.append("")
            col_lines.append("↑/↓: navigate  Space: toggle  ESC/q: back")

            # Display column settings menu
            popup_lines, popup_width, popup_height, popup_x, popup_y = create_popup(
                "COLUMN VISIBILITY",
                col_lines,
                center_title=True,
                left_padding=0
            )

            for line in popup_lines:
                print(line, end='', flush=True)

            # Wait for input
            if sys_main.stdin.isatty():
                key = sys_main.stdin.read(1)

                if key == '\x1b':  # ESC or arrow key
                    # Try to read the next character with a short timeout
                    import termios
                    import fcntl
                    import os

                    # Save current terminal settings
                    fd = sys_main.stdin.fileno()
                    oldflags = fcntl.fcntl(fd, fcntl.F_GETFL)

                    # Set non-blocking
                    fcntl.fcntl(fd, fcntl.F_SETFL, oldflags | os.O_NONBLOCK)

                    try:
                        # Try to read more characters (arrow key sequence)
                        time.sleep(0.05)  # Small delay to let sequence arrive
                        next_char = sys_main.stdin.read(1)
                        if next_char == '[':
                            arrow = sys_main.stdin.read(1)
                            if arrow == 'A':  # Up arrow
                                selected_col_index = (selected_col_index - 1) % len(column_names)
                            elif arrow == 'B':  # Down arrow
                                selected_col_index = (selected_col_index + 1) % len(column_names)
                            # Continue after arrow key
                        else:
                            # ESC with unknown sequence - go back to previous menu
                            return 'back'
                    except (IOError, TypeError):
                        # No more input available - pure ESC key - go back to previous menu
                        return 'back'
                    finally:
                        # Restore blocking mode
                        fcntl.fcntl(fd, fcntl.F_SETFL, oldflags)
                elif key == ' ':  # Space - toggle checkbox
                    col_key, _ = column_names[selected_col_index]
                    column_settings[col_key] = not column_settings[col_key]
                    # Trigger table redraw to show updated columns
                    needs_table_redraw = True
                elif key == 'q' or key == 'Q':
                    return 'back'

        return 'back'

    def show_ap_menu(ap_bssid: str):
        """Show action menu for selected AP."""
        popup_active.set()

        try:
            # Get AP info - make a copy to avoid holding lock
            with ap_pool_lock:
                if ap_bssid not in ap_pool:
                    popup_active.clear()
                    return
                # Create a copy of the AP object to avoid holding lock during display
                from copy import copy
                ap = copy(ap_pool[ap_bssid])

            import shutil
            term_size = shutil.get_terminal_size(fallback=(120, 24))
            term_width = term_size.columns
            term_height = term_size.lines

            # Menu options
            menu_items = [
                "Statistics",
                "Information",
                "Signal Strength"
            ]

            selected_menu_index = 0
            popup_width = 40
            popup_height = len(menu_items) + 6  # Title + items + padding

            # Calculate centered position
            popup_x = (term_width - popup_width) // 2
            popup_y = (term_height - popup_height) // 2

            # Menu loop
            while True:
                popup_lines = []

                # Main app right border position
                main_right_border = term_width

                # Top border (green like table borders)
                popup_lines.append(
                    f"\033[{popup_y};{popup_x}H{Colors.BOLD}{Colors.OKGREEN}┌{'─' * (popup_width - 2)}┐{Colors.ENDC}\033[K"
                    f"\033[{popup_y};{main_right_border}H{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}"
                )

                # Title
                title = f"AP: {ap.ssid or ap_bssid[:17]}"
                title_padding = (popup_width - 2 - len(title)) // 2
                remaining = popup_width - 2 - len(title) - title_padding
                popup_lines.append(
                    f"\033[{popup_y + 1};{popup_x}H{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}"
                    f"{' ' * title_padding}{Colors.BOLD}{title}{Colors.ENDC}{' ' * remaining}"
                    f"{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}\033[K"
                    f"\033[{popup_y + 1};{main_right_border}H{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}"
                )

                # Separator
                popup_lines.append(
                    f"\033[{popup_y + 2};{popup_x}H{Colors.BOLD}{Colors.OKGREEN}├{'─' * (popup_width - 2)}┤{Colors.ENDC}\033[K"
                    f"\033[{popup_y + 2};{main_right_border}H{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}"
                )

                # Empty line
                popup_lines.append(
                    f"\033[{popup_y + 3};{popup_x}H{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}"
                    f"{' ' * (popup_width - 2)}"
                    f"{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}\033[K"
                    f"\033[{popup_y + 3};{main_right_border}H{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}"
                )

                # Menu items (with space on left and right)
                for i, item in enumerate(menu_items):
                    row = popup_y + 4 + i
                    is_selected = (i == selected_menu_index)

                    if is_selected:
                        # Highlight selected item
                        item_text = f" ▶ {item}"
                        bg = "\033[48;5;240m"
                        bg_reset = "\033[49m"
                    else:
                        item_text = f"   {item}"
                        bg = ""
                        bg_reset = ""

                    item_padding = popup_width - 4 - len(item_text)  # -4 for borders + 2 spaces
                    popup_lines.append(
                        f"\033[{row};{popup_x}H{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}"
                        f" {bg}{item_text}{' ' * item_padding}{bg_reset} "
                        f"{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}\033[K"
                        f"\033[{row};{main_right_border}H{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}"
                    )

                # Empty line
                popup_lines.append(
                    f"\033[{popup_y + 4 + len(menu_items)};{popup_x}H{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}"
                    f"{' ' * (popup_width - 2)}"
                    f"{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}\033[K"
                    f"\033[{popup_y + 4 + len(menu_items)};{main_right_border}H{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}"
                )

                # Footer
                footer = "↑/↓: navigate  Enter: select  ESC: close"
                footer_padding = (popup_width - 2 - len(footer)) // 2
                remaining = popup_width - 2 - len(footer) - footer_padding
                popup_lines.append(
                    f"\033[{popup_y + 5 + len(menu_items)};{popup_x}H{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}"
                    f"{' ' * footer_padding}{Colors.GRAY}{footer}{Colors.ENDC}{' ' * remaining}"
                    f"{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}\033[K"
                    f"\033[{popup_y + 5 + len(menu_items)};{main_right_border}H{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}"
                )

                # Bottom border
                popup_lines.append(
                    f"\033[{popup_y + popup_height - 1};{popup_x}H{Colors.BOLD}{Colors.OKGREEN}└{'─' * (popup_width - 2)}┘{Colors.ENDC}\033[K"
                    f"\033[{popup_y + popup_height - 1};{main_right_border}H{Colors.BOLD}{Colors.OKGREEN}│{Colors.ENDC}"
                )

                # Display popup
                for line in popup_lines:
                    print(line, end='', flush=True)

                # Wait for input
                import sys as sys_main
                if sys_main.stdin.isatty():
                    # Read input
                    import fcntl
                    import os as os_module

                    fd = sys_main.stdin.fileno()
                    flags = fcntl.fcntl(fd, fcntl.F_GETFL)
                    fcntl.fcntl(fd, fcntl.F_SETFL, flags | os_module.O_NONBLOCK)

                    # Wait for input
                    readable, _, _ = select.select([sys_main.stdin], [], [], 10)
                    if readable:
                        try:
                            input_chars = sys_main.stdin.read()
                        except:
                            input_chars = ''
                        finally:
                            fcntl.fcntl(fd, fcntl.F_SETFL, flags)

                        if input_chars == '\x1b[A':  # Up arrow
                            selected_menu_index = max(0, selected_menu_index - 1)
                        elif input_chars == '\x1b[B':  # Down arrow
                            selected_menu_index = min(len(menu_items) - 1, selected_menu_index + 1)
                        elif input_chars == '\n' or input_chars == '\r':  # Enter
                            # Execute selected action
                            if selected_menu_index == 0:
                                show_statistics_popup(ap)
                            elif selected_menu_index == 1:
                                show_information_popup(ap)
                            elif selected_menu_index == 2:
                                show_signal_strength_popup(ap)
                            break
                        elif input_chars == '\x1b':  # ESC
                            break
                    else:
                        fcntl.fcntl(fd, fcntl.F_SETFL, flags)

        finally:
            popup_active.clear()
            update_display()

    def show_statistics_popup(ap):
        """Show statistics for selected AP."""
        popup_active.set()

        try:
            import datetime

            # Build statistics
            stats_lines = [
                f"BSSID: {ap.bssid}",
                f"SSID: {ap.ssid or '(hidden)'}",
                "",
                "Signal Statistics:",
                f"  Current RSSI: {ap.rssi}dBm" if ap.rssi else "  Current RSSI: N/A",
                f"  Min RSSI: {ap.min_rssi}dBm" if ap.min_rssi else "  Min RSSI: N/A",
                f"  Max RSSI: {ap.max_rssi}dBm" if ap.max_rssi else "  Max RSSI: N/A",
                f"  Range: {ap.max_rssi - ap.min_rssi}dB" if (ap.max_rssi and ap.min_rssi) else "  Range: N/A",
                "",
                "Visibility:",
                f"  Currently Visible: {'Yes' if ap.currently_visible else 'No'}",
                f"  First Seen: {datetime.datetime.fromtimestamp(ap.first_seen).strftime('%H:%M:%S')}" if ap.first_seen else "  First Seen: N/A",
                f"  Last Seen: {datetime.datetime.fromtimestamp(ap.last_seen).strftime('%H:%M:%S')}" if ap.last_seen else "  Last Seen: N/A",
                "",
                "Activity:",
                f"  Deauth Frames: {ap.deauth_count}",
                f"  Disassoc Frames: {ap.disassoc_count}",
                f"  Handshake Observed: {'Yes' if ap.handshake_observed else 'No'}",
                "",
                "Press any key to close..."
            ]

            # Create popup with dynamic sizing
            popup_lines, popup_width, popup_height, popup_x, popup_y = create_popup(
                "AP STATISTICS",
                stats_lines,
                center_title=True,
                left_padding=0
            )

            # Display popup
            for line in popup_lines:
                print(line, end='', flush=True)

            # Wait for keypress
            import sys as sys_main
            if sys_main.stdin.isatty():
                sys_main.stdin.read(1)

        finally:
            popup_active.clear()
            update_display()

    def show_information_popup(ap):
        """Show detailed information for selected AP."""
        popup_active.set()

        try:
            # Build security features checklist
            security_features = []
            if ap.rsn_present:
                security_features.append("[X] WPA2/WPA3 (RSN)")
            else:
                security_features.append("[ ] WPA2/WPA3 (RSN)")

            if ap.wpa1_present:
                security_features.append("[X] WPA1")
            else:
                security_features.append("[ ] WPA1")

            if ap.privacy_bit:
                security_features.append("[X] Privacy/Encryption")
            else:
                security_features.append("[ ] Privacy/Encryption")

            if ap.pmf_required:
                security_features.append("[X] PMF Required (802.11w)")
            elif ap.pmf_capable:
                security_features.append("[X] PMF Capable (802.11w)")
            else:
                security_features.append("[ ] PMF (802.11w)")

            if ap.ft_present:
                security_features.append("[X] Fast Transition (802.11r)")
            else:
                security_features.append("[ ] Fast Transition (802.11r)")

            # Build features checklist
            other_features = []
            if ap.wps_enabled:
                wps_status = "Unlocked" if ap.wps_locked is False else "Locked" if ap.wps_locked else "Unknown"
                other_features.append(f"[X] WPS ({wps_status})")
            else:
                other_features.append("[ ] WPS")

            if ap.rrm_enabled:
                other_features.append("[X] RRM (802.11k)")
            else:
                other_features.append("[ ] RRM (802.11k)")

            if ap.bss_transition:
                other_features.append("[X] BSS Transition (802.11v)")
            else:
                other_features.append("[ ] BSS Transition (802.11v)")

            # Build info lines
            info_lines = [
                "Basic Information:",
                f"  BSSID: {ap.bssid}",
                f"  SSID: {ap.ssid or '(hidden)'}",
            ]

            # Add conditional fields properly
            info_lines.append(f"  Channel: {ap.channel}" if ap.channel else "  Channel: N/A")
            info_lines.append(f"  Band: {ap.band}" if ap.band else "  Band: N/A")
            info_lines.append(f"  Mode: {ap.mode}" if ap.mode else "  Mode: N/A")

            # Rate with RSSI-based estimation (macOS only)
            if ap.rate:
                # Calculate estimated actual rate based on RSSI
                if ap.rssi:
                    # RSSI-based throughput estimation
                    if ap.rssi >= -50:
                        rate_factor = 1.0  # Excellent: 100%
                    elif ap.rssi >= -60:
                        rate_factor = 0.75  # Very good: 75%
                    elif ap.rssi >= -67:
                        rate_factor = 0.50  # Good: 50%
                    elif ap.rssi >= -70:
                        rate_factor = 0.35  # Fair: 35%
                    elif ap.rssi >= -80:
                        rate_factor = 0.20  # Poor: 20%
                    else:
                        rate_factor = 0.10  # Very poor: 10%

                    estimated_rate = ap.rate * rate_factor
                    info_lines.append(f"  Rate: {ap.rate} Mbit/s (max), ~{estimated_rate:.0f} Mbit/s (est.)")
                else:
                    info_lines.append(f"  Rate: {ap.rate} Mbit/s (max)")
            else:
                info_lines.append("  Rate: N/A")

            info_lines.append(f"  Vendor: {ap.vendor}" if ap.vendor else "  Vendor: Unknown")

            info_lines.extend([
                "",
                f"Security Type: {ap.security_label()}",
                "",
                "Security Features:",
            ])
            info_lines.extend([f"  {f}" for f in security_features])
            info_lines.append("")
            info_lines.append("Other Features:")
            info_lines.extend([f"  {f}" for f in other_features])
            info_lines.append("")
            info_lines.append("Ciphers:")
            if ap.pairwise_ciphers:
                info_lines.append(f"  Pairwise: {', '.join(ap.pairwise_ciphers)}")
            if ap.group_cipher:
                info_lines.append(f"  Group: {ap.group_cipher}")
            if ap.akms:
                info_lines.append(f"  AKMs: {', '.join(ap.akms)}")
            info_lines.append("")
            info_lines.append("Press any key to close...")

            # Create popup with dynamic sizing
            popup_lines, popup_width, popup_height, popup_x, popup_y = create_popup(
                "AP INFORMATION",
                info_lines,
                center_title=True,
                left_padding=0
            )

            # Display popup
            for line in popup_lines:
                print(line, end='', flush=True)

            # Wait for keypress
            import sys as sys_main
            if sys_main.stdin.isatty():
                sys_main.stdin.read(1)

        finally:
            popup_active.clear()
            update_display()

    def show_signal_strength_popup(ap):
        """Show signal strength history visualization."""
        popup_active.set()

        try:
            # Get RSSI history
            history = ap.rssi_history[-50:] if ap.rssi_history else []

            # Build visualization
            vis_lines = [
                f"AP: {ap.ssid or ap.bssid[:17]}",
                f"Current: {ap.rssi}dBm  |  Min: {ap.min_rssi}dBm  |  Max: {ap.max_rssi}dBm" if ap.rssi else "No data available",
                "",
            ]

            if history:
                # Create ASCII graph
                # Determine scale
                rssi_values = [rssi for _, rssi in history]
                min_val = min(rssi_values)
                max_val = max(rssi_values)
                range_val = max_val - min_val if max_val != min_val else 1

                # Graph height
                graph_height = 15
                graph_width = min(60, len(history))

                # Create graph
                for row in range(graph_height):
                    threshold = max_val - (row * range_val / graph_height)
                    line = "  "

                    for i in range(graph_width):
                        if i < len(history):
                            _, rssi = history[-(graph_width - i)]
                            if rssi >= threshold:
                                line += "█"
                            else:
                                line += " "
                        else:
                            line += " "

                    # Add scale
                    line += f"  {int(threshold)}dBm"
                    vis_lines.append(line)

                # Time axis
                vis_lines.append("  " + "─" * graph_width)
                if len(history) > 1:
                    import datetime
                    first_time = datetime.datetime.fromtimestamp(history[0][0])
                    last_time = datetime.datetime.fromtimestamp(history[-1][0])
                    vis_lines.append(f"  {first_time.strftime('%H:%M:%S')}" + " " * (graph_width - 18) + f"{last_time.strftime('%H:%M:%S')}")
            else:
                vis_lines.append("  No signal history data available yet.")

            vis_lines.append("")
            vis_lines.append("Press any key to close...")

            # Create popup with dynamic sizing
            popup_lines, popup_width, popup_height, popup_x, popup_y = create_popup(
                "SIGNAL STRENGTH HISTORY",
                vis_lines,
                center_title=True,
                left_padding=0
            )

            # Display popup
            for line in popup_lines:
                print(line, end='', flush=True)

            # Wait for keypress
            import sys as sys_main
            if sys_main.stdin.isatty():
                sys_main.stdin.read(1)

        finally:
            popup_active.clear()
            update_display()

    # Background scanning thread for CoreWLAN (or continuous Scapy)
    def background_scanner():
        """Background thread that continuously scans and updates display."""
        nonlocal ap_pool, last_change_time, last_scan_time, last_scan_duration
        import sys as sys_module  # Import locally to avoid scope issues

        # For CoreWLAN, we need a separate client instance for thread safety
        if sys_module.platform == 'darwin' and COREWLAN_AVAILABLE:
            try:
                client = CoreWLAN.CWWiFiClient.sharedWiFiClient()
                interface = client.interface()
                if not interface:
                    print(f"[!] Background scanner: No WiFi interface found")
                    return
            except Exception as e:
                print(f"[!] Background scanner: CoreWLAN init failed: {e}")
                return

        while scan_active.is_set():
            try:
                if sys_module.platform == 'darwin' and COREWLAN_AVAILABLE:
                    # CoreWLAN: Quick scan using thread-local interface
                    scan_start = time.time()
                    networks, error = interface.scanForNetworksWithName_error_(None, None)
                    scan_end = time.time()

                    # Calculate scan duration and update timestamps
                    last_scan_duration = scan_end - scan_start
                    last_scan_time = datetime.datetime.now()

                    # Update scan statistics
                    nonlocal total_scans, total_scan_time, fastest_scan, slowest_scan
                    total_scans += 1
                    total_scan_time += last_scan_duration
                    fastest_scan = min(fastest_scan, last_scan_duration)
                    slowest_scan = max(slowest_scan, last_scan_duration)

                    if error:
                        # Ignore "Resource busy" errors (happens during concurrent scans)
                        if "16" not in str(error):  # Error code 16 = EBUSY
                            print(f"[!] Background scan error: {error}")
                    elif networks:
                        # Mark all APs as not visible before this scan
                        with ap_pool_lock:
                            for ap in ap_pool.values():
                                ap.currently_visible = False

                        new_aps = {}
                        for network in networks:
                            bssid = network.bssid()
                            if not bssid:
                                continue

                            ssid = network.ssid() or ""
                            channel = network.wlanChannel().channelNumber() if network.wlanChannel() else None
                            rssi = network.rssiValue()
                            vendor = get_vendor(bssid)

                            # Get mode
                            mode = "Ad-hoc" if (hasattr(network, 'ibss') and network.ibss()) else "Infra"

                            # Get max rate (in Mbit/s) - estimated from PHY mode (macOS only)
                            rate = None
                            if hasattr(network, 'fastestSupportedPHYMode'):
                                try:
                                    phy_mode = network.fastestSupportedPHYMode()
                                    # Estimate max rate based on PHY mode
                                    if phy_mode == CoreWLAN.kCWPHYMode11ax:  # WiFi 6/6E
                                        rate = 9608.0
                                    elif phy_mode == CoreWLAN.kCWPHYMode11ac:  # WiFi 5
                                        rate = 6933.0
                                    elif phy_mode == CoreWLAN.kCWPHYMode11n:  # WiFi 4
                                        rate = 600.0
                                    elif phy_mode == CoreWLAN.kCWPHYMode11a:  # 5 GHz legacy
                                        rate = 54.0
                                    elif phy_mode == CoreWLAN.kCWPHYMode11g:  # 2.4 GHz
                                        rate = 54.0
                                    elif phy_mode == CoreWLAN.kCWPHYMode11b:  # 2.4 GHz legacy
                                        rate = 11.0
                                except:
                                    pass

                            ap = APInfo(
                                bssid=bssid,
                                ssid=ssid,
                                channel=channel,
                                rssi=rssi,
                                vendor=vendor,
                                hidden=(ssid == ""),
                                band=get_band(channel) if channel else None,
                                mode=mode,
                                rate=rate
                            )

                            # Parse security
                            if hasattr(network, 'supportsSecurity_'):
                                if network.supportsSecurity_(CoreWLAN.kCWSecurityWPA2Personal):
                                    ap.rsn_present = True
                                    ap.akms.add("PSK")
                                elif network.supportsSecurity_(CoreWLAN.kCWSecurityWPA2Enterprise):
                                    ap.rsn_present = True
                                    ap.akms.add("802.1X")
                                elif network.supportsSecurity_(CoreWLAN.kCWSecurityWPAPersonal):
                                    ap.wpa1_present = True
                                    ap.akms.add("PSK")
                                elif network.supportsSecurity_(CoreWLAN.kCWSecurityWPAEnterprise):
                                    ap.wpa1_present = True
                                    ap.akms.add("802.1X")
                                elif network.supportsSecurity_(CoreWLAN.kCWSecurityWPA3Personal):
                                    ap.rsn_present = True
                                    ap.akms.add("SAE")
                                elif network.supportsSecurity_(CoreWLAN.kCWSecurityWPA3Enterprise):
                                    ap.rsn_present = True
                                    ap.akms.add("802.1X-SHA256")

                            if network.supportsSecurity_(CoreWLAN.kCWSecurityWEP):
                                ap.privacy_bit = True
                            elif network.supportsSecurity_(CoreWLAN.kCWSecurityNone):
                                ap.privacy_bit = False

                            new_aps[bssid] = ap

                        # Merge into pool
                        pool_changed = False
                        with ap_pool_lock:
                            # Check for visibility changes (APs that disappeared)
                            for existing_ap in ap_pool.values():
                                if existing_ap.currently_visible and existing_ap.bssid not in new_aps:
                                    pool_changed = True
                                    break

                            for bssid, ap in new_aps.items():
                                current_time = time.time()
                                if bssid in ap_pool:
                                    old_ap = ap_pool[bssid]
                                    # Check if AP was invisible and is now visible again
                                    if not old_ap.currently_visible:
                                        pool_changed = True
                                    # Keep existing ID and first_seen
                                    ap.ap_id = old_ap.ap_id
                                    ap.first_seen = old_ap.first_seen
                                    # Update last_seen
                                    ap.last_seen = current_time
                                    # Mark as currently visible
                                    ap.currently_visible = True
                                    # Track RSSI: current, min, and max
                                    if ap.rssi:
                                        # Keep current RSSI as-is (latest scan value)
                                        # Record RSSI history
                                        ap.rssi_history = old_ap.rssi_history.copy()
                                        ap.rssi_history.append((time.time(), ap.rssi))
                                        # Keep history limited to last 100 entries
                                        if len(ap.rssi_history) > 100:
                                            ap.rssi_history = ap.rssi_history[-100:]
                                        # Update min/max RSSI
                                        if old_ap.min_rssi is None:
                                            ap.min_rssi = ap.rssi
                                        else:
                                            ap.min_rssi = min(ap.rssi, old_ap.min_rssi)

                                        if old_ap.max_rssi is None:
                                            ap.max_rssi = ap.rssi
                                        else:
                                            ap.max_rssi = max(ap.rssi, old_ap.max_rssi)
                                    else:
                                        # No RSSI in new scan, keep old values
                                        ap.rssi = old_ap.rssi
                                        ap.min_rssi = old_ap.min_rssi
                                        ap.max_rssi = old_ap.max_rssi
                                        ap.rssi_history = old_ap.rssi_history.copy()
                                    # Update channel and band (can change)
                                    if ap.channel:
                                        old_ap.channel = ap.channel
                                        old_ap.band = ap.band
                                    # Merge other properties
                                    ap.handshake_observed = ap.handshake_observed or old_ap.handshake_observed
                                    ap.deauth_count += old_ap.deauth_count
                                    ap.disassoc_count += old_ap.disassoc_count
                                else:
                                    # New AP - assign ID
                                    pool_changed = True
                                    with ap_id_lock:
                                        nonlocal next_ap_id, total_aps_discovered
                                        ap.ap_id = next_ap_id
                                        next_ap_id += 1
                                        total_aps_discovered += 1
                                    ap.first_seen = current_time
                                    ap.last_seen = current_time
                                    # New APs are visible
                                    ap.currently_visible = True
                                    # Initialize min/max RSSI for new AP
                                    if ap.rssi:
                                        ap.min_rssi = ap.rssi
                                        ap.max_rssi = ap.rssi
                                ap_pool[bssid] = ap

                        # Update change time if pool changed
                        if pool_changed:
                            last_change_time = datetime.datetime.now()

                        # Update display immediately after scan
                        update_display()

                    time.sleep(interval)  # Wait between CoreWLAN scans

                elif iface:
                    # Scapy: Continuous packet capture
                    # Use callback to update pool in real-time
                    def packet_callback(pkt):
                        if not scan_active.is_set():
                            return

                        temp_aps = {}
                        if pkt.haslayer(Dot11):
                            if pkt.type == 0 and pkt.subtype in (8, 5):  # Beacon or ProbeResp
                                process_mgmt_frame(pkt, temp_aps)
                            if observe_eapol and pkt.haslayer(EAPOL):
                                process_eapol(pkt, temp_aps)
                            if pkt.type == 0 and pkt.subtype in (10, 12):
                                process_deauth_disassoc(pkt, temp_aps)

                        # Merge into main pool
                        if temp_aps:
                            pool_changed = False
                            with ap_pool_lock:
                                for bssid, ap in temp_aps.items():
                                    current_time = time.time()
                                    if bssid in ap_pool:
                                        old_ap = ap_pool[bssid]
                                        # Keep existing ID and first_seen
                                        ap.ap_id = old_ap.ap_id
                                        ap.first_seen = old_ap.first_seen
                                        # Update last_seen
                                        ap.last_seen = current_time
                                        # Merge RSSI history from old AP
                                        ap.rssi_history = old_ap.rssi_history.copy()
                                        if ap.rssi and old_ap.rssi:
                                            ap.rssi = max(ap.rssi, old_ap.rssi)
                                            # Record RSSI history
                                            ap.rssi_history.append((time.time(), ap.rssi))
                                            # Keep history limited to last 100 entries
                                            if len(ap.rssi_history) > 100:
                                                ap.rssi_history = ap.rssi_history[-100:]
                                        elif ap.rssi:
                                            # New RSSI but no old RSSI
                                            ap.rssi_history.append((time.time(), ap.rssi))
                                            if len(ap.rssi_history) > 100:
                                                ap.rssi_history = ap.rssi_history[-100:]
                                        ap.handshake_observed = ap.handshake_observed or old_ap.handshake_observed
                                        ap.deauth_count += old_ap.deauth_count
                                    else:
                                        # New AP - assign ID
                                        pool_changed = True
                                        with ap_id_lock:
                                            nonlocal next_ap_id
                                            ap.ap_id = next_ap_id
                                            next_ap_id += 1
                                        ap.first_seen = current_time
                                        ap.last_seen = current_time
                                    ap_pool[bssid] = ap

                            # Update timestamps (outside of loop but inside lock is ok here)
                            last_scan_time = datetime.datetime.now()
                            if pool_changed:
                                last_change_time = last_scan_time

                    # Continuous sniff
                    sniff(iface=iface, prn=packet_callback, store=False, stop_filter=lambda x: not scan_active.is_set())

            except Exception as e:
                if scan_active.is_set():  # Only print if not shutting down
                    try:
                        if not popup_active.is_set():  # Only print if no popup is active
                            print(f"\n[!] Background scanner error: {e}")
                    except:
                        pass  # Silently ignore print errors during popup display
                break

    # Display refresh timer thread - updates display every second for runtime counter
    def display_refresh_timer():
        """Refresh display every second to update runtime counter."""
        while scan_active.is_set():
            time.sleep(1)
            if not popup_active.is_set():
                update_display()

    # Start background scanner (now also handles display)
    scanner_thread = threading.Thread(target=background_scanner, daemon=True)
    scanner_thread.start()

    # Start display refresh timer
    refresh_timer_thread = threading.Thread(target=display_refresh_timer, daemon=True)
    refresh_timer_thread.start()

    # Setup keyboard input handling for refresh
    import select
    import tty
    import termios
    import signal
    import sys as sys_main

    # Flag to trigger display refresh on terminal resize
    resize_flag = threading.Event()

    def handle_resize(signum, frame):
        """Handle terminal resize signal."""
        resize_flag.set()

    # Register signal handler for terminal resize
    signal.signal(signal.SIGWINCH, handle_resize)

    # Save terminal settings
    if sys_main.stdin.isatty():
        old_settings = termios.tcgetattr(sys_main.stdin)
        tty.setcbreak(sys_main.stdin.fileno())

    try:
        # Main thread handles keyboard input and resize events
        while scanner_thread.is_alive():
            # Check if terminal was resized
            if resize_flag.is_set():
                resize_flag.clear()
                update_display()

            if sys_main.stdin.isatty():
                # Check for keyboard input with timeout
                readable, _, _ = select.select([sys_main.stdin], [], [], 0.1)
                if readable:
                    # Read available input (may be multiple chars for escape sequences)
                    import fcntl
                    import os as os_module

                    # Set non-blocking temporarily to read all available
                    fd = sys_main.stdin.fileno()
                    flags = fcntl.fcntl(fd, fcntl.F_GETFL)
                    fcntl.fcntl(fd, fcntl.F_SETFL, flags | os_module.O_NONBLOCK)

                    try:
                        input_chars = sys_main.stdin.read()
                    except:
                        input_chars = ''
                    finally:
                        fcntl.fcntl(fd, fcntl.F_SETFL, flags)

                    if not input_chars:
                        continue

                    # Check for escape sequences (arrow keys, page up/down, home/end)
                    if input_chars == '\x1b[A':  # Up arrow
                        navigation_enabled = True
                        with ap_pool_lock:
                            ap_count = len(ap_pool)
                        if ap_count > 0:
                            selected_index = max(0, selected_index - 1)
                            adjust_scroll_offset()
                            update_display()
                    elif input_chars == '\x1b[B':  # Down arrow
                        navigation_enabled = True
                        with ap_pool_lock:
                            ap_count = len(ap_pool)
                        if ap_count > 0:
                            selected_index = min(ap_count - 1, selected_index + 1)
                            adjust_scroll_offset()
                            update_display()
                    elif input_chars == '\x1b[5~':  # Page Up
                        navigation_enabled = True
                        with ap_pool_lock:
                            ap_count = len(ap_pool)
                        if ap_count > 0:
                            selected_index = max(0, selected_index - 5)
                            adjust_scroll_offset()
                            update_display()
                    elif input_chars == '\x1b[6~':  # Page Down
                        navigation_enabled = True
                        with ap_pool_lock:
                            ap_count = len(ap_pool)
                        if ap_count > 0:
                            selected_index = min(ap_count - 1, selected_index + 5)
                            adjust_scroll_offset()
                            update_display()
                    elif input_chars == '\x1b[H' or input_chars == '\x1b[1~':  # Home
                        navigation_enabled = True
                        with ap_pool_lock:
                            ap_count = len(ap_pool)
                        if ap_count > 0:
                            selected_index = 0
                            adjust_scroll_offset()
                            update_display()
                    elif input_chars == '\x1b[F' or input_chars == '\x1b[4~':  # End
                        navigation_enabled = True
                        with ap_pool_lock:
                            ap_count = len(ap_pool)
                        if ap_count > 0:
                            selected_index = ap_count - 1
                            adjust_scroll_offset()
                            update_display()
                    elif input_chars == '\n' or input_chars == '\r':  # Enter
                        # Show AP menu for selected item
                        if navigation_enabled and selected_index >= 0:
                            ap_bssid = None
                            with ap_pool_lock:
                                sorted_aps = sorted(ap_pool.items(), key=lambda x: x[1].ap_id or 0)
                                if 0 <= selected_index < len(sorted_aps):
                                    ap_bssid = sorted_aps[selected_index][0]
                            # Call show_ap_menu OUTSIDE the lock
                            if ap_bssid:
                                show_ap_menu(ap_bssid)
                    elif input_chars == '\x1b' or input_chars.lower() == 'q':
                        # ESC or q - quit
                        break
                    elif input_chars.lower() == 'h':
                        # Show help popup
                        show_help_popup()
                    elif input_chars.lower() == 's':
                        # Show setup menu
                        show_setup_menu()
                    elif input_chars.lower() == 'r' or input_chars == '\x0c':  # r or Ctrl+L
                        # Trigger immediate display update
                        update_display()
            else:
                # If not a tty, just wait
                time.sleep(0.1)

    except KeyboardInterrupt:
        pass

    # Block display updates immediately (before stopping scan)
    popup_active.set()

    # Stop the scan and display refresh to prevent overwrites
    scan_active.clear()

    # Wait a moment for threads to finish
    time.sleep(0.3)

    # Clear screen completely before showing statistics
    print("\033[2J\033[H", end='', flush=True)

    # Restore terminal settings and show cursor
    if sys_main.stdin.isatty():
        termios.tcsetattr(sys_main.stdin, termios.TCSADRAIN, old_settings)
    print("\033[?25h", end='', flush=True)  # Show cursor

    # Calculate final statistics
    stop_time = datetime.datetime.now()
    total_runtime = (stop_time - start_time).total_seconds()
    runtime_str = format_runtime(total_runtime)

    # Count visible vs disappeared APs
    visible_aps = sum(1 for ap in ap_pool.values() if ap.currently_visible)
    disappeared_aps = len(ap_pool) - visible_aps

    print(f"\n\n{Colors.BOLD}{Colors.OKGREEN}================================================================{Colors.ENDC}")
    print(f"{Colors.BOLD}{Colors.OKGREEN}          AirDetect Scan Session Summary                      {Colors.ENDC}")
    print(f"{Colors.BOLD}{Colors.OKGREEN}================================================================{Colors.ENDC}\n")

    # Time statistics
    print(f"{Colors.BOLD}[Time Statistics]{Colors.ENDC}")
    print(f"   Start time:    {start_time.strftime('%Y-%m-%d %H:%M:%S')}")
    print(f"   Stop time:     {stop_time.strftime('%Y-%m-%d %H:%M:%S')}")
    print(f"   Total runtime: {runtime_str}")
    print()

    # Scan statistics
    avg_scan_duration = total_scan_time / total_scans if total_scans > 0 else 0
    scans_per_minute = (total_scans / total_runtime * 60) if total_runtime > 0 else 0
    print(f"{Colors.BOLD}[Scan Statistics]{Colors.ENDC}")
    print(f"   Total scans:      {total_scans}")
    print(f"   Average duration: {avg_scan_duration:.2f}s")
    print(f"   Fastest scan:     {fastest_scan if fastest_scan != float('inf') else 0:.2f}s")
    print(f"   Slowest scan:     {slowest_scan:.2f}s")
    print(f"   Scans per minute: {scans_per_minute:.1f}")
    print()

    # AP discovery statistics
    print(f"{Colors.BOLD}[AP Discovery]{Colors.ENDC}")
    print(f"   Total APs discovered: {total_aps_discovered}")
    print(f"   Currently visible:    {Colors.OKGREEN}{visible_aps}{Colors.ENDC}")
    print(f"   Disappeared:          {Colors.FAIL if disappeared_aps > 0 else Colors.ENDC}{disappeared_aps}{Colors.ENDC}")
    print()

    # Signal statistics
    visible_ap_list = [ap for ap in ap_pool.values() if ap.currently_visible and ap.rssi]
    if visible_ap_list:
        avg_rssi = sum(ap.rssi for ap in visible_ap_list) / len(visible_ap_list)
        strongest_ap = max(visible_ap_list, key=lambda ap: ap.rssi)
        weakest_ap = min(visible_ap_list, key=lambda ap: ap.rssi)

        print(f"{Colors.BOLD}[Signal Statistics (Visible APs)]{Colors.ENDC}")
        print(f"   Average RSSI:   {avg_rssi:.0f}dBm")
        print(f"   Strongest:      {strongest_ap.rssi}dBm ({strongest_ap.ssid or 'Hidden'} - {strongest_ap.bssid})")
        print(f"   Weakest:        {weakest_ap.rssi}dBm ({weakest_ap.ssid or 'Hidden'} - {weakest_ap.bssid})")
        print()

    # Channel utilization statistics
    from collections import Counter
    band_counts = Counter(ap.band for ap in visible_ap_list if ap.band)
    channel_counts = Counter(ap.channel for ap in visible_ap_list if ap.channel)

    print(f"{Colors.BOLD}[Channel Utilization (Visible APs)]{Colors.ENDC}")
    print(f"   2.4 GHz:  {band_counts.get('2.4 GHz', 0)} APs")
    print(f"   5 GHz:    {band_counts.get('5 GHz', 0)} APs")
    print(f"   6 GHz:    {band_counts.get('6 GHz', 0)} APs")

    if channel_counts:
        # Find most congested channels
        most_congested = channel_counts.most_common(3)
        print(f"   Most congested channels:")
        for channel, count in most_congested:
            congestion_color = Colors.FAIL if count >= 5 else Colors.WARNING if count >= 3 else Colors.ENDC
            print(f"     Ch {channel}: {congestion_color}{count} APs{Colors.ENDC}")
    print()

    # Security overview statistics
    security_counts = Counter(ap.security_label() for ap in visible_ap_list)
    insecure_count = sum(count for sec_type, count in security_counts.items() if sec_type in ('Open', 'WEP'))
    wps_enabled_count = sum(1 for ap in visible_ap_list if ap.wps_enabled)
    wps_unlocked_count = sum(1 for ap in visible_ap_list if ap.wps_enabled and ap.wps_locked is False)
    deauth_attacks = sum(1 for ap in ap_pool.values() if ap.deauth_count > 5)

    print(f"{Colors.BOLD}[Security Overview (Visible APs)]{Colors.ENDC}")
    if security_counts:
        for sec_type, count in security_counts.most_common():
            sec_color = Colors.FAIL if sec_type in ('Open', 'WEP') else Colors.WARNING if sec_type == 'WPA' else Colors.OKGREEN
            print(f"   {sec_color}{sec_type:18s}{Colors.ENDC}: {count}")

    if insecure_count > 0:
        print(f"   {Colors.FAIL}[!] Insecure networks:{Colors.ENDC} {insecure_count}")
    if wps_enabled_count > 0:
        print(f"   WPS enabled: {wps_enabled_count} ({wps_unlocked_count} unlocked)")
    if deauth_attacks > 0:
        print(f"   {Colors.FAIL}[!] Possible deauth attacks:{Colors.ENDC} {deauth_attacks} APs")
    print()

    # Vendor distribution statistics
    vendor_counts = Counter(ap.vendor for ap in visible_ap_list if ap.vendor and ap.vendor != "Unknown")

    print(f"{Colors.BOLD}[Vendor Distribution (Visible APs)]{Colors.ENDC}")
    if vendor_counts:
        print(f"   Unique vendors: {len(vendor_counts)}")
        print(f"   Top 5 vendors:")
        for vendor, count in vendor_counts.most_common(5):
            percentage = (count / len(visible_ap_list)) * 100 if visible_ap_list else 0
            print(f"     {vendor:20s}: {count:2d} ({percentage:4.1f}%)")
    print()

    # Performance statistics
    try:
        import sys
        pool_size_bytes = sys.getsizeof(ap_pool)
        pool_size_kb = pool_size_bytes / 1024
        updates_per_second = total_scans / total_runtime if total_runtime > 0 else 0

        print(f"{Colors.BOLD}[Performance Statistics]{Colors.ENDC}")
        print(f"   AP pool size:      {pool_size_kb:.1f} KB")
        print(f"   Update rate:       {updates_per_second:.2f} scans/sec")
        print()
    except Exception:
        pass  # Skip if performance stats fail

    print(f"{Colors.OKCYAN}[*] Scan session ended{Colors.ENDC}\n")

    # Stop background scanner
    scan_active.clear()
    scanner_thread.join(timeout=2)


def list_interfaces():
    """List all available wireless interfaces on the system."""
    print("[*] Scanning for wireless interfaces...\n")

    interfaces = []

    try:
        # Try using scapy's get_if_list
        from scapy.arch import get_if_list
        all_ifaces = get_if_list()

        # Filter for wireless interfaces
        for iface in all_ifaces:
            # Check if it's a wireless interface by checking for common patterns
            if 'wlan' in iface.lower() or 'wifi' in iface.lower() or 'en' in iface.lower():
                # Try to get more info using iwconfig or airport on macOS
                mode = "Unknown"
                status = "Unknown"

                # Check if interface is in monitor mode
                if 'mon' in iface.lower():
                    mode = "Monitor"
                else:
                    mode = "Managed"

                interfaces.append({
                    'name': iface,
                    'mode': mode,
                    'status': status
                })

        # Also try to get info from system commands
        if sys.platform == 'darwin':  # macOS
            import subprocess
            try:
                # Use networksetup to get WiFi interface info
                result = subprocess.run(['networksetup', '-listallhardwareports'],
                                      capture_output=True, text=True, timeout=5)
                if result.returncode == 0:
                    lines = result.stdout.split('\n')
                    wifi_interfaces_from_system = []

                    for i, line in enumerate(lines):
                        if 'Wi-Fi' in line or 'AirPort' in line:
                            # Next lines contain Device info
                            if i + 1 < len(lines):
                                device_line = lines[i + 1]
                                if 'Device:' in device_line:
                                    iface_name = device_line.split('Device:')[1].strip()
                                    wifi_interfaces_from_system.append(iface_name)

                    # Update or add WiFi interfaces with proper type
                    for wifi_iface in wifi_interfaces_from_system:
                        existing = next((x for x in interfaces if x['name'] == wifi_iface), None)
                        if existing:
                            existing['status'] = 'WiFi Adapter'
                        else:
                            interfaces.append({
                                'name': wifi_iface,
                                'mode': 'Managed',
                                'status': 'WiFi Adapter'
                            })

                    # Remove non-WiFi en interfaces from list
                    interfaces = [i for i in interfaces if i['name'] in wifi_interfaces_from_system or 'mon' in i['name'].lower() or 'wlan' in i['name'].lower()]

            except Exception:
                pass

        elif sys.platform.startswith('linux'):  # Linux
            import subprocess
            try:
                # Use iwconfig to list wireless interfaces
                result = subprocess.run(['iwconfig'], capture_output=True, text=True, timeout=5)
                if result.returncode == 0:
                    lines = result.stdout.split('\n')
                    for line in lines:
                        if 'IEEE 802.11' in line or 'ESSID' in line:
                            iface_name = line.split()[0]
                            if iface_name and not any(x['name'] == iface_name for x in interfaces):
                                # Check mode
                                if 'Mode:Monitor' in line:
                                    mode = 'Monitor'
                                else:
                                    mode = 'Managed'

                                interfaces.append({
                                    'name': iface_name,
                                    'mode': mode,
                                    'status': 'Available'
                                })
            except Exception:
                pass

    except Exception as e:
        print(f"[!] Error scanning interfaces: {e}")
        return

    # Display results
    if not interfaces:
        print("[!] No wireless interfaces found")
        print("[!] Make sure you have a WiFi adapter installed")
        if sys.platform.startswith('linux'):
            print("[*] Try: iwconfig  # to list wireless interfaces")
        elif sys.platform == 'darwin':
            print("[*] Try: networksetup -listallhardwareports")
    else:
        print("="*70)
        print(f"{'Interface':<20} {'Mode':<15} {'Status'}")
        print("="*70)
        for iface in interfaces:
            print(f"{iface['name']:<20} {iface['mode']:<15} {iface['status']}")
        print("="*70)
        print(f"\nTotal interfaces found: {len(interfaces)}")

        # Show hints
        monitor_ifaces = [i for i in interfaces if i['mode'] == 'Monitor']
        if monitor_ifaces:
            print(f"\n[*] Monitor mode interfaces: {', '.join([i['name'] for i in monitor_ifaces])}")
            print(f"[*] Use with: sudo python3 {sys.argv[0]} -i {monitor_ifaces[0]['name']}")
        else:
            print("\n[!] No monitor mode interfaces found")
            if sys.platform.startswith('linux'):
                print("[*] Enable monitor mode with: sudo airmon-ng start wlan0")
            elif sys.platform == 'darwin':
                print("[*] macOS requires special tools for monitor mode")
                print("[*] Check: https://github.com/seemoo-lab/nexmon")


def main():
    p = argparse.ArgumentParser(description="Passive Wi-Fi AP security analyzer (beacons/probe responses/optional EAPOL)")
    src = p.add_mutually_exclusive_group(required=False)
    src.add_argument("-i", "--iface", help="Monitor-mode interface (e.g. wlan0mon)")
    src.add_argument("-r", "--read", help="Read from pcap instead of live capture")
    src.add_argument("-l", "--list-interfaces", action="store_true", help="List all available wireless interfaces and exit")
    p.add_argument("-t", "--timeout", type=int, default=30, help="Sniffing duration in seconds (non-permanent mode only)")
    p.add_argument("-I", "--interval", type=int, default=5, help="Scan and display refresh interval in seconds (permanent mode only, default: 5s)")
    p.add_argument("--eapol", action="store_true", help="Also mark if a 4-Way Handshake was observed (EAPOL frames)")
    p.add_argument("--channel", type=int, help="Hint: channel to scan (set with iw/airmon externally; this is informational only)")
    p.add_argument("-p", "--permanent", action="store_true", help="Continuous scan mode - maintains AP pool and updates display in real-time")

    args = p.parse_args()

    # Handle list-interfaces
    if args.list_interfaces:
        list_interfaces()
        sys.exit(0)

    # Now require either -i or -r if not listing
    # Exception: macOS with CoreWLAN doesn't need -i
    if not args.iface and not args.read:
        if sys.platform == 'darwin' and COREWLAN_AVAILABLE:
            # macOS with CoreWLAN can scan without interface argument
            pass
        else:
            p.error("one of the arguments -i/--iface -r/--read is required")
            sys.exit(1)

    # Validate timeout value
    if args.timeout and args.timeout <= 0:
        print(f"[!] ERROR: Timeout must be a positive number (got: {args.timeout})")
        sys.exit(1)

    # Validate interval
    if args.interval and args.interval <= 0:
        print(f"[!] ERROR: Interval must be a positive number (got: {args.interval})")
        sys.exit(1)

    # Permanent mode not allowed with pcap file
    if args.permanent and args.read:
        print(f"[!] ERROR: Permanent mode (-p) cannot be used with pcap file (-r)")
        sys.exit(1)

    monitor_enabled_by_us = False

    try:
        if args.read:
            # PCAP file mode
            aps = read_pcap(args.read, args.eapol)
            if len(aps) == 0:
                print("\n[!] No access points detected")
                print("[!] Possible reasons:")
                print("    • PCAP file contains no 802.11 beacon/probe response frames")
                print("    • PCAP was captured on a non-WiFi interface")
            else:
                print_report(aps)

        elif args.permanent:
            # Permanent scan mode
            if sys.platform == 'darwin' and COREWLAN_AVAILABLE:
                print(f"[*] macOS detected - using CoreWLAN (no monitor mode required)")
                permanent_scan_mode(args.interval, args.eapol)
            else:
                # Linux - check monitor mode first
                if not check_monitor_mode(args.iface):
                    print(f"\n[!] Interface '{args.iface}' is not in monitor mode")
                    print(f"[?] Do you want to enable monitor mode on {args.iface}? (y/n): ", end='', flush=True)
                    response = input().strip().lower()

                    if response == 'y':
                        if enable_monitor_mode(args.iface):
                            monitor_enabled_by_us = True
                            print(f"[*] Monitor mode enabled. Starting permanent scan...")
                        else:
                            print(f"[!] Could not enable monitor mode automatically.")
                            if sys.platform.startswith('linux'):
                                print(f"[*] Try manually:")
                                print(f"    sudo airmon-ng start {args.iface}")
                            sys.exit(1)
                    else:
                        print("[!] Monitor mode is required for live capture. Exiting.")
                        sys.exit(0)

                permanent_scan_mode(args.interval, args.eapol, args.iface, args.channel)

        else:
            # Single scan mode
            if sys.platform == 'darwin' and COREWLAN_AVAILABLE:
                print(f"[*] macOS detected - using CoreWLAN (no monitor mode required)")
                aps = scan_with_corewlan(args.timeout)
            else:
                # Linux or macOS without CoreWLAN: Use Scapy (requires monitor mode)
                # Check if interface is in monitor mode before sniffing
                if not check_monitor_mode(args.iface):
                    print(f"\n[!] Interface '{args.iface}' is not in monitor mode")

                    # Ask user if they want to enable monitor mode
                    print(f"[?] Do you want to enable monitor mode on {args.iface}? (y/n): ", end='', flush=True)
                    response = input().strip().lower()

                    if response == 'y':
                        if enable_monitor_mode(args.iface):
                            monitor_enabled_by_us = True
                            print(f"[*] Monitor mode enabled. Starting capture...")
                        else:
                            print(f"[!] Could not enable monitor mode automatically.")
                            if sys.platform.startswith('linux'):
                                print(f"[*] Try manually:")
                                print(f"    sudo airmon-ng start {args.iface}")
                            sys.exit(1)
                    else:
                        print("[!] Monitor mode is required for live capture. Exiting.")
                        sys.exit(0)

                aps = sniff_live(args.iface, args.timeout, args.eapol, args.channel)

            if len(aps) == 0:
                print("\n[!] No access points detected")
                print("[!] Possible reasons:")
                print(f"    • No WiFi traffic on the current channel")
                print(f"    • Timeout ({args.timeout}s) too short")
                print(f"    • Try increasing timeout with -t option")
            else:
                print_report(aps)
    except KeyboardInterrupt:
        print("\n[*] Interrupted by user")
    except Exception as e:
        print(f"\n[!] FATAL ERROR: {e}")
        import traceback
        traceback.print_exc()
    finally:
        # Cleanup: Disable monitor mode if we enabled it
        if monitor_enabled_by_us and args.iface:
            print(f"\n[?] Disable monitor mode on {args.iface}? (y/n): ", end='', flush=True)
            try:
                response = input().strip().lower()
                if response == 'y':
                    disable_monitor_mode(args.iface)
                    print(f"[*] You can now use WiFi normally.")
                else:
                    print(f"[*] Monitor mode still active on {args.iface}")
                    if sys.platform.startswith('linux'):
                        print(f"[*] To disable later: sudo airmon-ng stop {args.iface}")
                        print(f"[*] Or: sudo iwconfig {args.iface} mode managed")
            except (KeyboardInterrupt, EOFError):
                print(f"\n[*] Keeping monitor mode active on {args.iface}")


if __name__ == "__main__":
    main()