The non-negotiables
Five rules define what sloth is allowed to do. They are not preferences and they are not negotiable per feature. They are what makes sloth trustworthy to run on a sensitive segment: the bytes it observes are bytes that were already there. Lose that and the tool is just another offensive fork.
Sloth never crafts and sends a frame onto a network it is monitoring — no injected packets, no probe requests, no deauthentication, no beacons, no ARP poisoning, no port scans. That is the one absolute: no flag, build option or deployment mode turns it off. What it observes, it observes passively.
What it offers, it may offer over the network, opt-in
and announced. Nothing below is on by default:
--allow-active sends a reverse-DNS query for an
address it already saw and asks the kernel for a passive scan;
--hop retunes sloth's own monitor interface; a
routable --data-socket serves observations to
whoever connects and is advertised over mDNS.
--strict locks the first and last of those off for
the run. One write is neither opt-in nor announced, because it
is inherent to capturing at all: libpcap sets promiscuous mode
when the handle opens, which changes what sloth's own NIC
accepts and never what the segment carries.
MISSION.md
§2 is the authority.
Monitor-mode interfaces must be set up externally by
the operator before sloth starts (using iw,
airmon-ng, or the tool of your choice). Sloth
attaches to whatever interface is already in monitor mode and
starts watching. It never asks the kernel to change link state
on its behalf.
Sloth never runs a passphrase against a captured handshake.
It never calls hashcat, aircrack-ng,
John, or any cracking library. It never decrypts a
frame it captured.
It does capture EAPOL / PMKID material and export it in hashcat-22000 format — so the operator can run a crack themselves, offline, on hardware they own, against a target they're authorised to test. That step is the operator's responsibility, on the operator's clock, with the operator's legal cover — not sloth's.
Sloth detects a wide vocabulary of weak / hostile patterns, emits an alert, and (optionally) writes a per-flow pcap snippet. It never follows up with an active step — no MITM, no session hijack, no replay, no credential harvesting.
Sloth is built for:
It is not built for surveillance of third parties, harassment, stalking, or any operation against a network the operator does not have explicit written authority to observe.
Sloth surfaces information. What the operator does with that information — file an incident, reconfigure an AP, brief a client, walk away — is outside sloth's scope.
The tool is honest about what it sees and silent about what to do.
If you're tempted to add a feature because it would be useful — port scanning the LAN, sending a deauth to test detection, auto-cracking the captured handshake — stop. That feature belongs in a different tool. Sloth's value is being trusted to be passive: an operator can run sloth on a sensitive segment without changing the segment.
“Sloth is a passive, white-hat SIGINT console: it watches, it flags, it never attacks.”