[Gerrrt]

Refs #437. This does not close it: the issue closes on the reboot proof in build-the-sensor-guest.md §7, after fenrir is built.

The decision: tc, not Open vSwitch

The issue says port mirroring needs OVS. It doesn't.

Saruman's vmbr0 is a Linux bridge on eno1, and tc is already installed. A clsact + matchall + mirred egress mirror filter on each port's ingress, plus one on vmbr0 egress, copies every frame on the bridge exactly once. So vmbr0 isn't converted, 10.0.30.110 never moves, and no VLAN-capable bridge goes under the attack segment.

ADR-0064 records this and rejects four alternatives: OVS, a SPAN from neo or the CRS326, hub mode, and Zeek on odin. ADR-0039 gets a NOTE; roadmap.md and security.md are updated.

What ships

• scripts/zeek-mirror.sh plus a one-minute timer on the hypervisor. It keeps every port mirrored to tap190i1, matched by name. When the sensor is absent it removes the filters.

• scripts/collect-zeek-mirror-state.sh plus a five-minute timer. This is the read-only collector behind homelab_zeek_mirror_active. It reads 1 only when all four hold:

  • the sensor VM is running;
  • its tap is up;
  • every port is mirrored;
  • the packet counter moved since the last run.

  If VM 190 doesn't exist, it publishes nothing. That way installing it before the guest is built can't page.

• Installer: both are rows in install-agent-collectors.sh. - in the .prom column marks the non-collector.

• ZeekMirrorInactive and ZeekMirrorStateStale in host.rules.yaml, each with a firing and a quiet promtool case. The alert counts are updated where check_docs.py asserts them.

• stacks/sensor:

  • zeek/zeek:9.0.0 with host networking, NET_RAW/NET_ADMIN only and a read-only root, capturing on fenrir's second NIC, which sits alone on a port-less vmbr1;
  • Alloy tailing JSON logs into alexander's Loki as job="zeek", one stream per log_type;
  • no secrets, so it isn't make up (recorded in security.md and .sops.yaml, like media).

• docs/runbooks/build-the-sensor-guest.md and a fenrir row marked Not built yet in architecture.md.

Found while building it

A sensor restart recreates tap190i1 with a new ifindex. Every existing filter then shows as Egress Mirror to device * and mirrors nothing, with no error anywhere. That's why the ensurer runs every minute and matches the tap by name rather than just checking that a filter exists. It's also why the gauge checks that packets actually moved.

Verification

• End-to-end in a throwaway network namespace on Saruman (not on vmbr0). This covered:
  • apply, then an idempotent re-run;
  • active=1 with traffic flowing, and active=0 with a flat counter;
  • a sensor restart, which showed mirrored=0/3 with the dangling *;
  • repair on the next run, then teardown.
• self-tests.sh: 223 fixtures across 17 suites, including 20 new collector fixtures and 5 ensurer fixtures.
• promtool check rules and promtool test rules on the observability stack (v3.15.0, the pinned version).
• Passing: check_docs.py, check_sops_rules.py, check_image_pins.py, check_compose_health.py, yamllint --strict, shellcheck, markdownlint-cli2.
• Not run locally, because this host has no Docker: docker compose config and the image probes. CI covers both. local.zeek was checked against Zeek v9.0.0's script tree, and the runbook parses it on the pinned image (zeek -a) before first start.

Left for the build

• Create vmbr1 and VM 190, deploy the stack, install both units.
• The §7 reboot proof: disable the ensurer, reboot, the gauge falls to 0 and ZeekMirrorInactive fires.
• JA3/JA4 fingerprints aren't in the stock Zeek image. They're a follow-up.

🤖 Generated with Claude Code