Fix FRP payload detection, byte accounting, and cloud-IP correlation in flock_tap #1

2026-07-20T05:51:38Z

Trilltechnician commented

2026-07-20 05:51:38 +00:00

Fixes several detection and accounting bugs in flock_tap.py, rebased onto current main.

FRP payload detection: moved the FRP auth-payload scan out of the SYN-only branch. SYN packets carry no payload, so payload-based FRP detection never fired; it now runs on every TCP segment where the frp/auth/proxy_type bytes actually appear.
Byte accounting: removed the per-packet bytes_up += 64 approximation in on_tcp_connect, which double-counted against real ip.len accounting and corrupted bandwidth stats.
Cloud-IP correlation: correlate connections against known Flock cloud IPs (static seed list + IPs learned from DNS answers) so cameras that reach cloud IPs without their own DNS/SNI are classified CLOUD_CONNECTED.
auth0 tenant: match the Flock auth0 tenant in DNS detection, consistent with the SNI path.
Clean shutdown: install a SIGINT handler so the report is always produced on Ctrl+C.
Cleanup: drop unused scapy TLS imports (SNI is parsed manually).

Rebased onto the latest main; preserves the new modules/ work, DNS-query extraction, and S3-URL reporting. Single-file change (flock_tap.py), compiles clean.

Fixes several detection and accounting bugs in `flock_tap.py`, rebased onto current `main`. - **FRP payload detection**: moved the FRP auth-payload scan out of the SYN-only branch. SYN packets carry no payload, so payload-based FRP detection never fired; it now runs on every TCP segment where the `frp`/`auth`/`proxy_type` bytes actually appear. - **Byte accounting**: removed the per-packet `bytes_up += 64` approximation in `on_tcp_connect`, which double-counted against real `ip.len` accounting and corrupted bandwidth stats. - **Cloud-IP correlation**: correlate connections against known Flock cloud IPs (static seed list + IPs learned from DNS answers) so cameras that reach cloud IPs without their own DNS/SNI are classified `CLOUD_CONNECTED`. - **auth0 tenant**: match the Flock auth0 tenant in DNS detection, consistent with the SNI path. - **Clean shutdown**: install a SIGINT handler so the report is always produced on Ctrl+C. - **Cleanup**: drop unused scapy TLS imports (SNI is parsed manually). Rebased onto the latest `main`; preserves the new `modules/` work, DNS-query extraction, and S3-URL reporting. Single-file change (`flock_tap.py`), compiles clean.

Trilltechnician added 1 commit 2026-07-20 05:51:38 +00:00

Fix FRP payload detection, byte accounting, and cloud-IP correlation in flock_tap 20d30815a3

- Move the FRP auth-payload scan out of the SYN-only branch. SYN packets carry
  no payload, so payload-based FRP detection never fired; it now runs on every
  TCP segment where the frp/auth/proxy_type bytes actually appear.
- Remove the per-packet `bytes_up += 64` approximation in on_tcp_connect, which
  double-counted against real ip.len accounting and corrupted bandwidth stats.
- Correlate connections against known Flock cloud IPs (static seed list + IPs
  learned from DNS answers) so cameras that reach cloud IPs without their own
  DNS/SNI are classified CLOUD_CONNECTED.
- Match the Flock auth0 tenant in DNS detection, consistent with the SNI path.
- Install a SIGINT handler so the report is always produced on Ctrl+C.
- Drop unused scapy TLS imports (SNI is parsed manually).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ek0ms savi0r merged commit 0817ab9713 into main

2026-07-20 06:05:02 +00:00

Trilltechnician referenced this pull request

2026-07-20 15:58:30 +00:00

Add flock_tap test suite and .gitignore #2

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: ek0mssavi0r/Flock_SCAN#1

Allow edits from maintainers