The non-negotiables
Five rules define what sloth is allowed to do. They are not preferences and they are not negotiable per feature. They are what makes sloth trustworthy to run on a sensitive segment: the bytes it observes are bytes that were already there. Lose that and the tool is just another offensive fork.
Sloth never injects packets, never sends probes, never
deauthenticates, never beacons, never ARP-poisons, never
port-scans, never resolves hosts it didn't already see, and
never modifies kernel state — no iw set, no
ip link set, no iptables, no monitor-mode
toggling. It reads. It never writes to the wire.
Monitor-mode interfaces must be set up externally by
the operator before sloth starts (using iw,
airmon-ng, or the tool of your choice). Sloth
attaches to whatever interface is already in monitor mode and
starts watching. It never asks the kernel to change link state
on its behalf.
Sloth never runs a passphrase against a captured handshake.
It never calls hashcat, aircrack-ng,
John, or any cracking library. It never decrypts a
frame it captured.
It does capture EAPOL / PMKID material and export it in hashcat-22000 format — so the operator can run a crack themselves, offline, on hardware they own, against a target they're authorised to test. That step is the operator's responsibility, on the operator's clock, with the operator's legal cover — not sloth's.
Sloth detects a wide vocabulary of weak / hostile patterns, emits an alert, and (optionally) writes a per-flow pcap snippet. It never follows up with an active step — no MITM, no session hijack, no replay, no credential harvesting.
Sloth is built for:
It is not built for surveillance of third parties, harassment, stalking, or any operation against a network the operator does not have explicit written authority to observe.
Sloth surfaces information. What the operator does with that information — file an incident, reconfigure an AP, brief a client, walk away — is outside sloth's scope.
The tool is honest about what it sees and silent about what to do.
If you're tempted to add a feature because it would be useful — port scanning the LAN, sending a deauth to test detection, auto-cracking the captured handshake — stop. That feature belongs in a different tool. Sloth's value is being trusted to be passive: an operator can run sloth on a sensitive segment without changing the segment.
“Sloth is a passive, white-hat SIGINT console: it watches, it flags, it never attacks.”