Run Zeek on a mirror port, and see the VLAN 30 traffic the firewall never will #437

docs/security.md states Suricata's three limits plainly: alert-only, two
segments, and plaintext only. ADR-0006
put it on morpheus because the firewall is the only device that sees IoT and
guest — which is right, and which is also why it cannot see the traffic this
issue is about.

Every technique ADR-0029
built the domain to exercise is layer 2 or intra-segment. LLMNR and NBT-NS
poisoning, NTLM relay, Kerberoasting, ARP spoofing — none of it crosses the
router, so morpheus never sees a packet of it. This is
ADR-0014's
own argument for why ifrit is layer-2 adjacent to its targets, applied to
detection instead of attack.

Zeek is not a second Suricata. It is a protocol logger — conn, dns, http,
ssl, files, x509. Two things follow that matter here:

• It reads TLS metadata without decrypting — SNI, JA3/JA3S, certificate
  subjects and issuers. That is precisely the ground Suricata's "plaintext only"
  limit gives up, and where C2 detection actually lives.
• It sees east-west traffic between the six domain guests, which nothing in
  this estate currently observes at all.

What this needs on the hypervisor, and it is the awkward part

Saruman's lab bridge is a Linux bridge. Port mirroring needs Open
vSwitch. Converting it touches the box whose own firewall ADR-0014 leans on,
so it is a decision in its own right and belongs in this issue's discussion
rather than in a commit.

The trap, and the estate's own answer to it

A mirror port does not survive a reboot of the hypervisor. A systemd unit
recreates it — but a unit that silently stopped is exactly the
"healthy-looking metric with nothing underneath it" failure this repository
keeps finding one level up each time
(#62,
#63,
#305, the UPS pack).

So the unit ships with a homelab_zeek_mirror_active textfile gauge, in the
exporter-less pattern scripts/run-scheduled.sh and scripts/collect-*.sh
already establish: no new service, no new image, no new port, no new privilege.
Then reboot Saruman and confirm the gauge goes to zero and an alert fires.
If it does not, the unit is decorative.

Where the logs go

The lab's Loki on alexander, never 10.0.99.20. ADR-0007's "lab telemetry
stays in the lab" governs, and #88's
amendment covers the hypervisor's own agent only.

What it waits on

#414. A sensor pointed at a
segment with one guest on it has nothing to say; the six-guest domain is what
makes east-west traffic exist.

Purchases this needs

None. A guest on Saruman, roughly 4 vCPU / 8 GB, plus a data disk.

Corrected 2026-09-19

Two things settled after filing that lived only in a comment:

• This issue owns Zeek's absence detection, inherited from Alert on a sensor that stops logging: absence rules for Suricata and Zeek #441 when it closed 2026-09-17 — and the answer is the homelab_zeek_mirror_active gauge with a promtool test and the reboot proof, not a Loki rule. docs/security.md and roadmap.md already say so.
• It does not depend on Swap the MokerLink for the CRS326 (ADR-0041) #444. The mirror here is an Open vSwitch mirror on Saruman's own bridge, not a SPAN from neo (ADR-0039 says so in terms); ADR-0041 keeps the CRS326's mirroring disabled per ADR-0006. The new switch changes nothing here.

Gate stays #414. The Ubuntu template #440 would build for this guest is a Wave-later item; this guest can be built by hand first.