Repository navigation
Interceptor
EN | FR | 🟡 WALL | package secubox-interceptor
Interceptor shows, in read-only mode, the real state of the inspection chain: the TLS interception engine sbxmitm, the web application firewall sbxwaf, what they have seen, and what they deliberately leave alone. It inspects nothing itself. Since version 2.0.0 the former mock-up (flows, rules and records that nothing ever fed) is gone.
Demonstration capture (fictitious data). Panel: /interceptor/ · API: /api/v1/interceptor/. It ships in the secubox-lite profile (see Modules-by-Profile).
| Block | Content |
|---|---|
| Engines | systemd state and listening port of the sbxmitm workers (secubox-toolbox-ng-worker@1..4, on the wg-toolbox tunnel) and of sbxwaf
|
| Activity | TLS client-hellos seen, hosts (SNI) and JA4 fingerprints, per minute, drawn from the sbxmitm journal (read off the event loop, cached) |
| Inspection levels | inspection level per WireGuard peer, and the split of Toolbox levels |
| nDPI classes (2.1.0) | protocols, applications and categories recognised by the DPI engine, with total, outgoing and incoming volumes, from /api/v1/dpi/pub/stats
|
| Output and input maps (2.1.0) | outputs: country of the destinations (DPI); inputs: country of the visitors over 7 days (Metrics). Same dot map as the Metrics view |
| Exclusions | hosts in bypass and in splice (not decrypted) |
A source that cannot be read gives an empty map and "—": nothing is invented. ?demo=1 shows a demonstration (a banner says so) and ?embed=1 embeds the page.
Read-only, guarded by require_lecture (token, or the dashboard mode from the LAN when the operator has enabled it; the default is closed). Health probes are public.
| Route | Content |
|---|---|
GET /health |
module health |
GET /status |
summary (active engines, connections over 60 min, peers) |
GET /moteurs |
systemd state and port of sbxmitm 1..4 and sbxwaf
|
GET /activite?minutes=60 |
connections, hosts, JA4, per-minute series (5 to 240 min) |
GET /niveaux |
inspection level per peer and cumulative split |
GET /exclusions |
bypass and splice lists, disabled filters |
An unreadable source returns null, never an invented zero. There is no write route.
The API is incompatible with 1.x: the mock-up routes are removed. The old daemon (run as root, inactive) and the creation of the unused CA are gone; an upgrade disables the daemon. The package recommends secubox-waf-ng and secubox-toolbox-ng, the two engines it supervises.
WAF · DPI-Vivant · ToolBox · Metrics · SOC · Modules-by-Profile · Admin-Panels-Gallery