|
|
a24beaf316
|
feat(dpi): Phase 2 - MITM double buffer + LuCI dashboard
MITM Double Buffer (dpi_buffer.py):
- Compiled regex patterns for 6 threat categories
- Scanner detection (sqlmap, nikto, nmap, etc.)
- Optional blocking mode for high-score threats
- Request replay queue for forensic analysis
- Rate limiting detection
- Stats: buffer entries, threat distribution, top hosts
LuCI Dashboard (luci-app-dpi-dual):
- RPCD handler with 10 methods
- KISS-themed overview with stream status cards
- LED indicators for MITM/TAP/Correlation
- Threats table with score and blocked status
- Protocol distribution from netifyd
- Manual IP correlation trigger
Streamlit Control Panel:
- Added DPI Dual card with flows/threats/blocked metrics
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
|
2026-03-15 12:21:50 +01:00 |
|
|
|
58a51eb271
|
feat(dpi): Implement Phase 1 of Dual-Stream DPI architecture
- secubox-dpi-dual package with parallel MITM + Passive TAP analysis
- TAP stream: tc mirred port mirroring to dummy interface for netifyd
- Flow collector: Stats aggregation from netifyd, cleanup, JSON output
- Correlation engine: Matches MITM WAF events with TAP flow data
- Watches CrowdSec decisions and WAF alerts for threat enrichment
- CLI: dpi-dualctl with start/stop/status/flows/threats/mirror commands
- Procd service: manages flow-collector + correlator instances
- MITM double buffer: dpi_buffer.py mitmproxy addon (Phase 2 prep)
- UCI config: dual/mitm-only/tap-only mode selection
Architecture: package/secubox/DUAL-STREAM-DPI.md
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
|
2026-03-15 12:15:17 +01:00 |
|
