Cobra 7d87f29a47 Fix arrival suppression when device returns during departure debounce
Watchdog-triggered departures set departing=True after 15 min of silence.
If the device returned during the 15-min debounce window, on_arrival()
treated it as a rapid flap and suppressed the ARRIVED alert — even though
the device had been genuinely absent for 15+ minutes.

Store depart_initiated timestamp when setting departing=True. On re-arrival,
check the gap: < 120s = true rapid flap (transient Netlink/DHCP event),
suppress as before. >= 120s = real absence confirmed by watchdog, pop the
device from known_devices and let it fall through to the new-device path
so the ARRIVED alert fires.

Also removes debug traceback instrumentation left in _update_last_seen
from the prior investigation session.
2026-04-14 19:49:33 -04:00
S
Description
Network drop implant — passive SOC + active exploitation. Deploy on any Debian host.
4.3 MiB
Languages
Python 89.2%
Shell 8.5%
HTML 1.1%
C 0.9%
Jinja 0.3%