Cobra 91a84b9d6f Add interface flap detection and env var for infrastructure IPs in net_alerter
- Fix 1: Interface flap detection suppresses departure storms when wlan0 briefly loses association and triggers simultaneous RTM_DELNEIGH events for all cached neighbors
  - Tracks 3-second window of departure MACs
  - Locks recovery state for 60 seconds if 3+ departures occur in rapid succession
  - Prevents false positive alerts during interface recovery

- Fix 2: Additional infrastructure IPs via NET_ALERTER_INFRA_IPS env var
  - Allows operator to suppress alerts for devices like access points that cycle regularly
  - Comma-separated list of IP addresses to be seeded as infrastructure at startup
  - Example: NET_ALERTER_INFRA_IPS=10.0.0.0,10.0.0.0

Addresses DevTrack #467 (net_alerter false positive alerts)
2026-04-10 22:45:15 -04:00
S
Description
Network drop implant — passive SOC + active exploitation. Deploy on any Debian host.
4.3 MiB
Languages
Python 89.2%
Shell 8.5%
HTML 1.1%
C 0.9%
Jinja 0.3%