7d87f29a47b0eb231f183bec5093e847c5732171
Watchdog-triggered departures set departing=True after 15 min of silence. If the device returned during the 15-min debounce window, on_arrival() treated it as a rapid flap and suppressed the ARRIVED alert — even though the device had been genuinely absent for 15+ minutes. Store depart_initiated timestamp when setting departing=True. On re-arrival, check the gap: < 120s = true rapid flap (transient Netlink/DHCP event), suppress as before. >= 120s = real absence confirmed by watchdog, pop the device from known_devices and let it fall through to the new-device path so the ARRIVED alert fires. Also removes debug traceback instrumentation left in _update_last_seen from the prior investigation session.
Description
Network drop implant — passive SOC + active exploitation. Deploy on any Debian host.
Languages
Python
89.2%
Shell
8.5%
HTML
1.1%
C
0.9%
Jinja
0.3%