Fix/sniffer ip byte order#127
Merged
Merged
Conversation
…l camino eBPF DEBT-SNIFFER-IP-BYTE-ORDER-001. sniffer.bpf.c:232 ensambla las IPs a mano como enteros en orden de HOST. ring_consumer.cpp:844 se las pasaba a inet_ntop sin deshacer la conversion, asi que el CSV de bronce escribia 1.56.168.192 donde el cable llevaba 192.168.56.1 — y el community_id se calculaba sobre esos mismos bytes invertidos. Consecuencia: los community_id de aRGus no podian coincidir con los de Suricata para el mismo flujo. La misma conversion estaba escrita dos veces en el fichero (:844 sin htonl, :1235 con htonl). Se extrae a ip_format.hpp como punto unico y los cuatro llamantes pasan por ella, de modo que la duplicacion que causo el fallo desaparece. El criterio de HECHO anterior de la deuda (recomputar community_id desde las IPs de la propia fila) NO discriminaba: pasaba en verde con el bug presente, porque hash y cadena beben de la misma fuente. test_ip_format ancla la verificacion en un oraculo externo (aritmetica de la RFC) y reproduce el fallo de produccion en 0,02 s. Medido: RED 3/6 -> GREEN 6/6; ctest del sniffer 12/12; test_ring_consumer_protobuf 4/4. Base: main fb08e8f. PENDIENTE: verificacion E2E sobre un CSV de bronce nuevo.
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (8)
📝 WalkthroughWalkthroughThe sniffer centralizes host-order IPv4 formatting, adds unit-test coverage, provisions a shared adapter toolchain on three sensor VMs, starts Suricata in EMECAS setup, and updates continuity and backlog documentation. ChangesIPv4 formatting
Sensor VM provisioning
Estimated code review effort: 3 (Moderate) | ~20 minutes ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Merged
alonsoir
added a commit
that referenced
this pull request
Jul 25, 2026
## feat: Suricata → bronce → grafo Kuzu Integra el segundo productor del pipeline (Suricata) de extremo a extremo: - `suricata-adapter/`: eve.json → bronce correlation_v1 (2.870 filas validadas). - Bronce plano multi-sensor con prefijo de sensor. - `bronze_to_gold_converter`, `parquet_to_kuzu_loader`, `kuzu_query`. - DAY 228: Suricata en el grafo (2.870 TelemetryEvent / 775 NetworkFlow), consultable vía kuzu_query. Rebasada sobre main (PR #127), así que hereda el arreglo del byte order del sniffer (`ip_host_to_buffer`, DEBT-SNIFFER-IP-BYTE-ORDER-001). ### Alcance / lo que este merge NO cierra EMECAS+++ verde = build + provisioning + circuito SINTÉTICO (fixture, clave constante), ciego al byte order. La verificación E2E del bronce con IPs reales (147.32.84.x) y la convergencia aRGus↔Suricata en el mismo NetworkFlow se hará provocando tráfico real al grafo (paso 2 del plan de cierre, script MITRE).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Bug Fixes
Tests