New Flock Safety WiFi Findings — "Flock Camera net." SSID + 5GHz Hotspot + Locally Administered MACs
Summary
Passive WiFi wardriving via WiGLE (Samsung SM-G990U2, WiGLE app v2.108, Android 14) captured a confirmed Flock Safety ALPR camera hotspot with three findings not currently documented in flock-you or the broader research community.
Finding 1 — New SSID Pattern: "Flock Camera net."
The known Flock hotspot SSID is Flock-XXXXXX. This camera was broadcasting Flock Camera net. — a completely different naming format.
This matters because jakeswiz searched WiGLE using Flock-* as the pattern and found zero results in his metro. A camera broadcasting Flock Camera net. would be completely invisible to that search. Any SSID-based detection logic that only matches the Flock- prefix will miss this variant.
Suggest adding Flock Camera as an additional SSID match pattern alongside the existing Flock- prefix.
Finding 2 — 5GHz Hotspot Confirmed on Channel 157
The camera was broadcasting its hotspot simultaneously on:
- 2.4GHz channel 1 (2412 MHz)
- 5GHz channel 157 (5785 MHz)
Using sequential MACs on each band — xx:xx:xx:9f:a2:de on 2.4GHz and xx:xx:xx:9f:a2:df on 5GHz — consistent with a dual-band WiFi module assigning adjacent MACs to each radio.
NSM-Barii's flock-back already documented a Flock probe request on 5GHz channel 149. This adds a second data point — a hotspot beacon on 5GHz channel 157 — confirming 5GHz operation across at least two different devices and two different channels.
Strongest signal readings:
- 2.4GHz: -46 dBm
- 5GHz: -59 dBm
Finding 3 — Locally Administered MACs on Hotspot Interface
The MAC prefix on both captured addresses has the locally administered bit set (bit 1 of first byte = 1). These are not IEEE-registered OUIs — they are intentionally assigned outside the standard OUI registry.
The sequential last bytes (:de and :df) rule out random MAC generation. This appears to be deliberately assigned locally administered addressing.
The standard flock-you pre-filter correctly skips locally administered MACs to eliminate MAC-randomizing phones. But this means that when a Flock camera has its hotspot active using locally administered MACs, it gets filtered out by that same logic — invisible to OUI-based WiFi detection when the hotspot is broadcasting.
This suggests Flock may be deliberately using locally administered MAC space for hotspot interfaces as an anti-fingerprinting measure. SSID pattern matching remains effective regardless of MAC addressing scheme.
Open question: is this consistent across Flock deployments or specific to this firmware version?
Raw WiGLE Data (Sample)
MAC,SSID,AuthMode,Channel,Frequency,RSSI,Latitude,Longitude
52:64:cf:9f:a2:de,Flock Camera net.,[WPA2-PSK-CCMP][RSN-PSK-CCMP][ESS],1,2412,-46,28.487477,-81.455815
52:64:cf:9f:a2:df,Flock Camera net.,[WPA2-PSK-CCMP][RSN-PSK-CCMP][ESS],157,5785,-59,28.487038,-81.455371
52:64:cf:9f:a2:df,Flock Camera net.,[WPA2-PSK-CCMP][RSN-PSK-CCMP][ESS],157,5785,-69,28.476589,-81.447107
52:64:cf:9f:a2:de,Flock Camera net.,[WPA2-PSK-CCMP][RSN-PSK-CCMP][ESS],1,2412,-76,28.476012,-81.446685
60+ total readings across approximately 5 minutes of highway driving past the camera location. Camera already logged on DeFlock at approximately 28.493, -81.458.
Pedro31 — May 2026
New Flock Safety WiFi Findings — "Flock Camera net." SSID + 5GHz Hotspot + Locally Administered MACs
Summary
Passive WiFi wardriving via WiGLE (Samsung SM-G990U2, WiGLE app v2.108, Android 14) captured a confirmed Flock Safety ALPR camera hotspot with three findings not currently documented in flock-you or the broader research community.
Finding 1 — New SSID Pattern: "Flock Camera net."
The known Flock hotspot SSID is
Flock-XXXXXX. This camera was broadcastingFlock Camera net.— a completely different naming format.This matters because jakeswiz searched WiGLE using
Flock-*as the pattern and found zero results in his metro. A camera broadcastingFlock Camera net.would be completely invisible to that search. Any SSID-based detection logic that only matches theFlock-prefix will miss this variant.Suggest adding
Flock Cameraas an additional SSID match pattern alongside the existingFlock-prefix.Finding 2 — 5GHz Hotspot Confirmed on Channel 157
The camera was broadcasting its hotspot simultaneously on:
Using sequential MACs on each band —
xx:xx:xx:9f:a2:deon 2.4GHz andxx:xx:xx:9f:a2:dfon 5GHz — consistent with a dual-band WiFi module assigning adjacent MACs to each radio.NSM-Barii's flock-back already documented a Flock probe request on 5GHz channel 149. This adds a second data point — a hotspot beacon on 5GHz channel 157 — confirming 5GHz operation across at least two different devices and two different channels.
Strongest signal readings:
Finding 3 — Locally Administered MACs on Hotspot Interface
The MAC prefix on both captured addresses has the locally administered bit set (bit 1 of first byte = 1). These are not IEEE-registered OUIs — they are intentionally assigned outside the standard OUI registry.
The sequential last bytes (
:deand:df) rule out random MAC generation. This appears to be deliberately assigned locally administered addressing.The standard flock-you pre-filter correctly skips locally administered MACs to eliminate MAC-randomizing phones. But this means that when a Flock camera has its hotspot active using locally administered MACs, it gets filtered out by that same logic — invisible to OUI-based WiFi detection when the hotspot is broadcasting.
This suggests Flock may be deliberately using locally administered MAC space for hotspot interfaces as an anti-fingerprinting measure. SSID pattern matching remains effective regardless of MAC addressing scheme.
Open question: is this consistent across Flock deployments or specific to this firmware version?
Raw WiGLE Data (Sample)
60+ total readings across approximately 5 minutes of highway driving past the camera location. Camera already logged on DeFlock at approximately 28.493, -81.458.
Pedro31 — May 2026