{% from "partials/_macros.html" import card_header %} {% set verdict_cls = { 'malicious': 'bg-red-900/40 text-red-300 border border-red-900/60', 'suspicious': 'bg-amber-900/40 text-amber-300 border border-amber-900/60', 'unknown': 'bg-slate-700/40 text-slate-300 border border-slate-600', 'benign': 'bg-emerald-900/30 text-emerald-300 border border-emerald-900/50', } %}
{{ card_header("network flows — tcpdump aggregator (by destination)") }} {% if flows.rows %} {# ----- aggregate summary: sum + counts ----- #}
{% set s = flows.summary %}
{{ s.destinations }}
destinations
{{ s.flows }}
flows
{{ "{:,}".format(s.packets) }}
packets
{{ s.malicious }}
malicious
{{ s.suspicious }}
suspicious
{# ----- one row per destination IP (grouped / summed) ----- #} {% for f in flows.rows %} {% endfor %}
verdict destination interface proto ports flows packets why
{% if f.verdict %} {{ f.verdict }}{% if f.confidence is not none %} {{ "%.0f"|format(f.confidence * 100) }}% {% endif %} {% else %} {% endif %} {{ f.dst_ip }} {{ f.iface }} {{ f.proto }} {{ f.ports }} {{ f.flows }} {{ "{:,}".format(f.packets) }} {{ f.reasoning }}
{% else %}
no network flows yet — the tcpdump aggregator needs root (run the monitor with sudo) and a capture window to elapse.
{% endif %}