Fix indentation issues in passive modules requires_capture_bus attribute

- Removed misplaced requires_capture_bus entries that broke indentation
- Added requires_capture_bus = True correctly after requires_root in all passive modules
- All passive modules now have valid Python syntax

modules/passive/auth_flow_tracker.py

@@ -76,6 +76,7 @@ class AuthFlowTracker(BaseModule):
     module_type = "passive"
     priority = 100
     requires_root = True
+    requires_capture_bus = True
 
     def __init__(self, bus, state, config, engine=None):
         super().__init__(bus, state, config, engine)
@@ -117,7 +118,6 @@ class AuthFlowTracker(BaseModule):
             "or port 3389 or port 22 or port 1433"
         )
         self._sub_queue = self._capture_bus.subscribe(
-    requires_capture_bus = True
             name=self.name, bpf_filter=bpf, queue_depth=5000
         )
 

modules/passive/cloud_token_harvester.py

@@ -60,6 +60,7 @@ class CloudTokenHarvester(BaseModule):
     module_type = "passive"
     priority = 200
     requires_root = True
+    requires_capture_bus = True
 
     def __init__(self, bus, state, config, engine=None):
         super().__init__(bus, state, config, engine)
@@ -95,7 +96,6 @@ class CloudTokenHarvester(BaseModule):
             return
 
         self._sub_queue = self._capture_bus.subscribe(
-    requires_capture_bus = True
             name=self.name, bpf_filter="port 80", queue_depth=3000
         )
 

modules/passive/credential_sniffer.py

@@ -50,6 +50,7 @@ class CredentialSniffer(BaseModule):
     module_type = "passive"
     priority = 80
     requires_root = True
+    requires_capture_bus = True
 
     BATCH_SIZE = 100
     FLUSH_INTERVAL = 30
@@ -97,7 +98,6 @@ class CredentialSniffer(BaseModule):
             bpf_filter = "port 80 or port 21 or port 23 or port 25 or port 110 or port 143 or port 389 or port 88 or port 445"
 
         self._sub_queue = self._capture_bus.subscribe(
-    requires_capture_bus = True
             name=self.name, bpf_filter=bpf_filter, queue_depth=8000
         )
 

modules/passive/db_interceptor.py

@@ -73,6 +73,7 @@ class DBInterceptor(BaseModule):
     module_type = "passive"
     priority = 150
     requires_root = True
+    requires_capture_bus = True
 
     def __init__(self, bus, state, config, engine=None):
         super().__init__(bus, state, config, engine)
@@ -110,7 +111,6 @@ class DBInterceptor(BaseModule):
 
         bpf = "port 1433 or port 3306 or port 5432 or port 6379 or port 27017"
         self._sub_queue = self._capture_bus.subscribe(
-    requires_capture_bus = True
             name=self.name, bpf_filter=bpf, queue_depth=5000
         )
 

modules/passive/dns_logger.py

@@ -46,6 +46,7 @@ class DNSLogger(BaseModule):
     module_type = "passive"
     priority = 100
     requires_root = True
+    requires_capture_bus = True
 
     BATCH_SIZE = 1000
     FLUSH_INTERVAL = 60  # seconds
@@ -363,7 +364,6 @@ class DNSLogger(BaseModule):
             except Exception:
                 parts.append("?")
             offset += length
-    requires_capture_bus = True
 
         name = ".".join(parts) if parts else ""
         return (name, saved_offset if jumped else offset)

modules/passive/host_discovery.py

@@ -35,6 +35,7 @@ class HostDiscovery(BaseModule):
     module_type = "passive"
     priority = 100
     requires_root = True
+    requires_capture_bus = True
 
     BATCH_SIZE = 200
     FLUSH_INTERVAL = 60
@@ -640,7 +641,6 @@ class HostDiscovery(BaseModule):
                 break
             parts.append(data[offset:offset + length].decode("utf-8", errors="replace"))
             offset += length
-    requires_capture_bus = True
 
         name = ".".join(parts) if parts else ""
         return (name, saved_offset if jumped else offset)

modules/passive/kerberos_harvester.py

@@ -52,6 +52,7 @@ class KerberosHarvester(BaseModule):
     module_type = "passive"
     priority = 80
     requires_root = True
+    requires_capture_bus = True
 
     BATCH_SIZE = 50
     FLUSH_INTERVAL = 30
@@ -89,7 +90,6 @@ class KerberosHarvester(BaseModule):
         self._init_db()
 
         self._sub_queue = self._capture_bus.subscribe(
-    requires_capture_bus = True
             name=self.name, bpf_filter="port 88", queue_depth=5000
         )
 

modules/passive/ldap_harvester.py

@@ -71,6 +71,7 @@ class LDAPHarvester(BaseModule):
     module_type = "passive"
     priority = 100
     requires_root = True
+    requires_capture_bus = True
 
     def __init__(self, bus, state, config, engine=None):
         super().__init__(bus, state, config, engine)
@@ -108,7 +109,6 @@ class LDAPHarvester(BaseModule):
             return
 
         self._sub_queue = self._capture_bus.subscribe(
-    requires_capture_bus = True
             name=self.name, bpf_filter="port 389 or port 3268", queue_depth=5000
         )
 

modules/passive/network_mapper.py

@@ -60,6 +60,7 @@ class NetworkMapper(BaseModule):
     module_type = "passive"
     priority = 150
     requires_root = True
+    requires_capture_bus = True
 
     def __init__(self, bus, state, config, engine=None):
         super().__init__(bus, state, config, engine)
@@ -101,7 +102,6 @@ class NetworkMapper(BaseModule):
 
         # Subscribe to all traffic
         self._sub_queue = self._capture_bus.subscribe(
-    requires_capture_bus = True
             name=self.name, bpf_filter="", queue_depth=5000
         )
 

modules/passive/os_fingerprint.py

@@ -76,6 +76,7 @@ class OSFingerprint(BaseModule):
     module_type = "passive"
     priority = 150
     requires_root = True
+    requires_capture_bus = True
 
     BATCH_SIZE = 200
     FLUSH_INTERVAL = 120
@@ -135,7 +136,6 @@ class OSFingerprint(BaseModule):
         # Actually, let's keep SYN filter and add a second subscriber
         self._capture_bus.unsubscribe(self.name)
         self._sub_queue = self._capture_bus.subscribe(
-    requires_capture_bus = True
             name=self.name,
             bpf_filter="tcp",  # All TCP — we filter SYN and app-layer in code
             queue_depth=10000,

modules/passive/packet_capture.py

@@ -34,8 +34,8 @@ class PacketCapture(BaseModule):
     name = "packet_capture"
     module_type = "passive"
     priority = 50
-    requires_capture_bus = True
     requires_root = True
+    requires_capture_bus = True
 
     # Defaults
     DEFAULT_INTERFACE = "eth0"

modules/passive/quic_analyzer.py

@@ -66,6 +66,7 @@ class QUICAnalyzer(BaseModule):
     module_type = "passive"
     priority = 150
     requires_root = True
+    requires_capture_bus = True
 
     def __init__(self, bus, state, config, engine=None):
         super().__init__(bus, state, config, engine)
@@ -98,7 +99,6 @@ class QUICAnalyzer(BaseModule):
             return
 
         self._sub_queue = self._capture_bus.subscribe(
-    requires_capture_bus = True
             name=self.name, bpf_filter="udp port 443", queue_depth=3000
         )
 

modules/passive/rdp_monitor.py

@@ -57,6 +57,7 @@ class RDPMonitor(BaseModule):
     module_type = "passive"
     priority = 150
     requires_root = True
+    requires_capture_bus = True
 
     def __init__(self, bus, state, config, engine=None):
         super().__init__(bus, state, config, engine)
@@ -92,7 +93,6 @@ class RDPMonitor(BaseModule):
             return
 
         self._sub_queue = self._capture_bus.subscribe(
-    requires_capture_bus = True
             name=self.name, bpf_filter="port 3389", queue_depth=3000
         )
 

modules/passive/smb_monitor.py

@@ -65,6 +65,7 @@ class SMBMonitor(BaseModule):
     module_type = "passive"
     priority = 100
     requires_root = True
+    requires_capture_bus = True
 
     def __init__(self, bus, state, config, engine=None):
         super().__init__(bus, state, config, engine)
@@ -103,7 +104,6 @@ class SMBMonitor(BaseModule):
             return
 
         self._sub_queue = self._capture_bus.subscribe(
-    requires_capture_bus = True
             name=self.name, bpf_filter="port 445", queue_depth=5000
         )
 

modules/passive/tls_sni_extractor.py

@@ -51,6 +51,7 @@ class TLSSNIExtractor(BaseModule):
     module_type = "passive"
     priority = 100
     requires_root = True
+    requires_capture_bus = True
 
     BATCH_SIZE = 500
     FLUSH_INTERVAL = 60
@@ -89,7 +90,6 @@ class TLSSNIExtractor(BaseModule):
         self._init_db()
 
         self._sub_queue = self._capture_bus.subscribe(
-    requires_capture_bus = True
             name=self.name, bpf_filter="tcp port 443", queue_depth=8000
         )
 

modules/passive/traffic_analyzer.py

@@ -47,6 +47,7 @@ class TrafficAnalyzer(BaseModule):
     module_type = "passive"
     priority = 150
     requires_root = True
+    requires_capture_bus = True
 
     FLUSH_INTERVAL = 300  # 5 minutes
     BEACON_CHECK_INTERVAL = 600  # 10 minutes
@@ -105,7 +106,6 @@ class TrafficAnalyzer(BaseModule):
 
         # Subscribe to all traffic (no BPF filter)
         self._sub_queue = self._capture_bus.subscribe(
-    requires_capture_bus = True
             name=self.name, bpf_filter="", queue_depth=15000
         )
 

modules/passive/vlan_discovery.py

@@ -74,6 +74,7 @@ class VLANDiscovery(BaseModule):
     module_type = "passive"
     priority = 150
     requires_root = True
+    requires_capture_bus = True
 
     def __init__(self, bus, state, config, engine=None):
         super().__init__(bus, state, config, engine)
@@ -113,7 +114,6 @@ class VLANDiscovery(BaseModule):
         # Broad filter: we need 802.1Q (any ethertype), CDP/DTP (SNAP), LLDP, STP, EAPOL
         # Compile a catch-all because these span multiple ethertypes and LLC frames
         self._sub_queue = self._capture_bus.subscribe(
-    requires_capture_bus = True
             name=self.name, bpf_filter="", queue_depth=3000
         )