Interceptor - CyberMind-FR/secubox-deb GitHub Wiki

Interceptor — supervision of traffic inspection 🟡

EN | FR | 🟡 WALL | package secubox-interceptor

What it is for

Interceptor shows, in read-only mode, the real state of the inspection chain: the TLS interception engine sbxmitm, the web application firewall sbxwaf, what they have seen, and what they deliberately leave alone. It inspects nothing itself. Since version 2.0.0 the former mock-up (flows, rules and records that nothing ever fed) is gone.

Interceptor

Demonstration capture (fictitious data). Panel: /interceptor/ · API: /api/v1/interceptor/. It ships in the secubox-lite profile (see Modules-by-Profile).

What the page shows

Block	Content
Engines	systemd state and listening port of the `sbxmitm` workers (`[email protected]`, on the `wg-toolbox` tunnel) and of `sbxwaf`
Activity	TLS client-hellos seen, hosts (SNI) and JA4 fingerprints, per minute, drawn from the `sbxmitm` journal (read off the event loop, cached)
Inspection levels	inspection level per WireGuard peer, and the split of Toolbox levels
nDPI classes (2.1.0)	protocols, applications and categories recognised by the DPI engine, with total, outgoing and incoming volumes, from `/api/v1/dpi/pub/stats`
Output and input maps (2.1.0)	outputs: country of the destinations (DPI); inputs: country of the visitors over 7 days (Metrics). Same dot map as the Metrics view
Exclusions	hosts in bypass and in splice (not decrypted)

A source that cannot be read gives an empty map and "—": nothing is invented. ?demo=1 shows a demonstration (a banner says so) and ?embed=1 embeds the page.

API

Read-only, guarded by require_lecture (token, or the dashboard mode from the LAN when the operator has enabled it; the default is closed). Health probes are public.

Route	Content
`GET /health`	module health
`GET /status`	summary (active engines, connections over 60 min, peers)
`GET /moteurs`	systemd state and port of `sbxmitm` 1..4 and `sbxwaf`
`GET /activite?minutes=60`	connections, hosts, JA4, per-minute series (5 to 240 min)
`GET /niveaux`	inspection level per peer and cumulative split
`GET /exclusions`	bypass and splice lists, disabled filters

An unreadable source returns null, never an invented zero. There is no write route.

Upgrading from 1.x

The API is incompatible with 1.x: the mock-up routes are removed. The old daemon (run as root, inactive) and the creation of the unused CA are gone; an upgrade disables the daemon. The package recommends secubox-waf-ng and secubox-toolbox-ng, the two engines it supervises.