71cd3332d2fa22922e428bd6ce4d11d1957af5b5
When on_departure popped the device from known_devices, rapid RTM_NEWNEIGH events during ARP cache rebuild each triggered on_arrival as if the device was brand new, flooding the Matrix room with 5-10+ duplicate ARRIVED alerts. Fix: keep device in known_devices with departing=True flag. on_arrival silently cancels pending departure timers and returns without alerting when it sees this flag. Timer callback checks flag before sending the alert and only pops the device when departure is confirmed after 15 minutes.
Description
Network drop implant — passive SOC + active exploitation. Deploy on any Debian host.
Languages
Python
89.2%
Shell
8.5%
HTML
1.1%
C
0.9%
Jinja
0.3%