Attributed metadata history
Up to 100 retained publisher events per page for 88fdeb0f5250cba082e9ed3314ebdca1db1f57329b2708cf925bf25b0ae0035b. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_42bd4a24749d327e8d
observed · 2026-10-12 09:17:03 UTC
Four ways traffic could reach the sensor and never be inspected. All four are closed in this release. Nothing to do on upgrade — unlike 3.2, this one needs no configuration change. Traffic that was not being looked at Each of these was confirmed by replay before it was fixed: the packet arrived, and no event came out. IPv6 extension headers. A packet carrying a Hop-by-Hop, Routing or Destination-Options header reported protocol 0/43/60, so the transport header was never located — no port, no DNS name, no HTTP host, no TLS SNI. Eight bytes hid a packet from every payload-derived trail. The chain is walked now. Tunnels. A SPAN feed at a datacentre or corporate border is usually an overlay: the addresses on the mirror port are your own tunnel endpoints, and every host worth watching is inside. A DNS query for a listed domain inside VXLAN, GENEVE, GRE or ERSPAN produced zero events. Those, plus IP-in-IP, are decapsulated now, and outer-header matching is unchanged. Stacked VLAN tags. The Ethernet path skipped exactly one 0x8100 tag and dropped anything else — QinQ frames never reached detection at all. Multi-worker capture. CAPTURE_WORKERS defaulted to 1 because scaling out cos
Fingerprint: 31e1089e4683298891ef541841ca606ced7daaa5709b6a4fe5f9a753e7d692d2
intelligence_src_42bd4a24749d327e8d
observed · 2026-10-12 09:17:03 UTC
available
Fingerprint: a3b0c36a677e1deaa5104d098bcd3f49d623f73969b2ffbc57a48cc705a29c9f