anti/DECNET
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(bus): document ipv6_leak payload kind on ATTACKER_FINGERPRINTED

Browse Source 
Add inline documentation for all known kind= discriminators on the
fingerprinted topic including the new ipv6_leak variant so future
consumers know what fields to expect without reading the prober source.
This commit is contained in:
anti
2026-05-17 20:22:55 -04:00
parent 9056e33962
commit 11d9273c99
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
decnet/bus/topics.py
View File

@@ -114,9 +114,18 @@ DECKY_SERVICE_CONFIG_CHANGED = "service_config_changed"
# the wildcard ``attacker.>``. # the wildcard ``attacker.>``.
ATTACKER_OBSERVED = "observed" ATTACKER_OBSERVED = "observed"
ATTACKER_SCORED = "scored" ATTACKER_SCORED = "scored"
# Published once per successful active probe result (JARM/HASSH/TCPfp). # Published once per successful active probe result (JARM/HASSH/TCPfp/ipv6_leak).
# Distinct from ``observed`` which is the correlator's first-sight signal — # Distinct from ``observed`` which is the correlator's first-sight signal —
# a fingerprint is additional evidence about an already-observed attacker. # a fingerprint is additional evidence about an already-observed attacker.
# Known payload ``kind`` discriminators carried in this topic:
# "jarm" — JARM TLS server hash (prober)
# "hassh" — HASSHServer SSH key-exchange hash (prober)
# "tcpfp" — TCP/IP stack fingerprint hash (prober)
# "tls_cert" — leaf TLS certificate SHA-256 (prober)
# "ipv6_leak" — fe80:: link-local address observed via passive sniffer
# or active ICMPv6 solicitation (prober + sniffer);
# payload: {attacker_ip, addr, iid_kind, mac_oui, vector,
# on_iface, observed_at}
ATTACKER_FINGERPRINTED = "fingerprinted" ATTACKER_FINGERPRINTED = "fingerprinted"
# Published when the prober observes a NEW hash for an # Published when the prober observes a NEW hash for an
# (attacker_ip, port, probe_type) triple it has seen before — i.e. the # (attacker_ip, port, probe_type) triple it has seen before — i.e. the