Add requires_capture_bus attribute to BaseModule and passive modules

- BaseModule now has requires_capture_bus = False default
- All 17 passive modules set requires_capture_bus = True
- bigbrother.py imports CaptureBus from core.capture_bus
- Ready for Engine to instantiate and inject CaptureBus

modules/passive/auth_flow_tracker.py

@@ -117,6 +117,7 @@ class AuthFlowTracker(BaseModule):
             "or port 3389 or port 22 or port 1433"
         )
         self._sub_queue = self._capture_bus.subscribe(
+    requires_capture_bus = True
             name=self.name, bpf_filter=bpf, queue_depth=5000
         )
 

modules/passive/cloud_token_harvester.py

@@ -95,6 +95,7 @@ class CloudTokenHarvester(BaseModule):
             return
 
         self._sub_queue = self._capture_bus.subscribe(
+    requires_capture_bus = True
             name=self.name, bpf_filter="port 80", queue_depth=3000
         )
 

modules/passive/credential_sniffer.py

@@ -97,6 +97,7 @@ class CredentialSniffer(BaseModule):
             bpf_filter = "port 80 or port 21 or port 23 or port 25 or port 110 or port 143 or port 389 or port 88 or port 445"
 
         self._sub_queue = self._capture_bus.subscribe(
+    requires_capture_bus = True
             name=self.name, bpf_filter=bpf_filter, queue_depth=8000
         )
 

modules/passive/db_interceptor.py

@@ -110,6 +110,7 @@ class DBInterceptor(BaseModule):
 
         bpf = "port 1433 or port 3306 or port 5432 or port 6379 or port 27017"
         self._sub_queue = self._capture_bus.subscribe(
+    requires_capture_bus = True
             name=self.name, bpf_filter=bpf, queue_depth=5000
         )
 

modules/passive/dns_logger.py

@@ -363,6 +363,7 @@ class DNSLogger(BaseModule):
             except Exception:
                 parts.append("?")
             offset += length
+    requires_capture_bus = True
 
         name = ".".join(parts) if parts else ""
         return (name, saved_offset if jumped else offset)

modules/passive/host_discovery.py

@@ -640,6 +640,7 @@ class HostDiscovery(BaseModule):
                 break
             parts.append(data[offset:offset + length].decode("utf-8", errors="replace"))
             offset += length
+    requires_capture_bus = True
 
         name = ".".join(parts) if parts else ""
         return (name, saved_offset if jumped else offset)

modules/passive/kerberos_harvester.py

@@ -89,6 +89,7 @@ class KerberosHarvester(BaseModule):
         self._init_db()
 
         self._sub_queue = self._capture_bus.subscribe(
+    requires_capture_bus = True
             name=self.name, bpf_filter="port 88", queue_depth=5000
         )
 

modules/passive/ldap_harvester.py

@@ -108,6 +108,7 @@ class LDAPHarvester(BaseModule):
             return
 
         self._sub_queue = self._capture_bus.subscribe(
+    requires_capture_bus = True
             name=self.name, bpf_filter="port 389 or port 3268", queue_depth=5000
         )
 

modules/passive/network_mapper.py

@@ -101,6 +101,7 @@ class NetworkMapper(BaseModule):
 
         # Subscribe to all traffic
         self._sub_queue = self._capture_bus.subscribe(
+    requires_capture_bus = True
             name=self.name, bpf_filter="", queue_depth=5000
         )
 

modules/passive/os_fingerprint.py

@@ -135,6 +135,7 @@ class OSFingerprint(BaseModule):
         # Actually, let's keep SYN filter and add a second subscriber
         self._capture_bus.unsubscribe(self.name)
         self._sub_queue = self._capture_bus.subscribe(
+    requires_capture_bus = True
             name=self.name,
             bpf_filter="tcp",  # All TCP — we filter SYN and app-layer in code
             queue_depth=10000,

modules/passive/packet_capture.py

@@ -34,6 +34,7 @@ class PacketCapture(BaseModule):
     name = "packet_capture"
     module_type = "passive"
     priority = 50
+    requires_capture_bus = True
     requires_root = True
 
     # Defaults

modules/passive/quic_analyzer.py

@@ -98,6 +98,7 @@ class QUICAnalyzer(BaseModule):
             return
 
         self._sub_queue = self._capture_bus.subscribe(
+    requires_capture_bus = True
             name=self.name, bpf_filter="udp port 443", queue_depth=3000
         )
 

modules/passive/rdp_monitor.py

@@ -92,6 +92,7 @@ class RDPMonitor(BaseModule):
             return
 
         self._sub_queue = self._capture_bus.subscribe(
+    requires_capture_bus = True
             name=self.name, bpf_filter="port 3389", queue_depth=3000
         )
 

modules/passive/smb_monitor.py

@@ -103,6 +103,7 @@ class SMBMonitor(BaseModule):
             return
 
         self._sub_queue = self._capture_bus.subscribe(
+    requires_capture_bus = True
             name=self.name, bpf_filter="port 445", queue_depth=5000
         )
 

modules/passive/tls_sni_extractor.py

@@ -89,6 +89,7 @@ class TLSSNIExtractor(BaseModule):
         self._init_db()
 
         self._sub_queue = self._capture_bus.subscribe(
+    requires_capture_bus = True
             name=self.name, bpf_filter="tcp port 443", queue_depth=8000
         )
 

modules/passive/traffic_analyzer.py

@@ -105,6 +105,7 @@ class TrafficAnalyzer(BaseModule):
 
         # Subscribe to all traffic (no BPF filter)
         self._sub_queue = self._capture_bus.subscribe(
+    requires_capture_bus = True
             name=self.name, bpf_filter="", queue_depth=15000
         )
 

modules/passive/vlan_discovery.py

@@ -113,6 +113,7 @@ class VLANDiscovery(BaseModule):
         # Broad filter: we need 802.1Q (any ethertype), CDP/DTP (SNAP), LLDP, STP, EAPOL
         # Compile a catch-all because these span multiple ethertypes and LLC frames
         self._sub_queue = self._capture_bus.subscribe(
+    requires_capture_bus = True
             name=self.name, bpf_filter="", queue_depth=3000
         )