Unusual traffic, reported, measured, 2026-10-19¶
XGS: Settings - Watch for unusual traffic. Off until it is turned on, and it never blocks: it
says, in the XGS log, what no normal day looks like. Every minute scripts/xgs/anomaly.py (cron)
reads pf's state table every ten seconds through a window of fifty, keeps every connection any reading
saw, and for each host that opened connections works out what it did in the window - bytes sent and
received, connections opened, new addresses reached, and the most ports it tried on any one address.
Then:
The whole page, with how it was taken and what it does not show: Unusual traffic, reported, measured, 2026-10-19.
The discussion of this page is held in the project's GitHub Discussions. Showing it here loads giscus from giscus.app and GitHub, and writing in it needs a GitHub account - what that means.