Bridge pcap collector: opt-in per-episode wiring #6

New issue

Closed

opened 2026-04-30 00:10:54 -05:00 by max · 0 comments

max commented

2026-04-30 00:10:54 -05:00

Owner

collectors/pcap.py + vm/setup_bridge.sh are in place but not yet wired into EpisodeRunner. The current launchers default to SLIRP usermode; bridge-mode is an unset env var on vm/launch_target.sh.

Needed for source 4 to actually populate network.pcap + netflow.jsonl per episode:

EpisodeConfig.bridge_iface field (default None)
Spawn pcap.run_capture() at run() start, pcap.stop_capture() at run() end, pcap.bucketize() post-stop
Update vm/launch_target.sh (and optionally launch_demo.sh) to support BRIDGE=br-malware mode that creates a tap and attaches it
Document the iptmonads + bridge prereqs

Goal: tools/run_fleet.py produces network.pcap + netflow.jsonl per episode automatically when br-malware exists.

`collectors/pcap.py` + `vm/setup_bridge.sh` are in place but not yet wired into `EpisodeRunner`. The current launchers default to SLIRP usermode; bridge-mode is an unset env var on `vm/launch_target.sh`. Needed for source 4 to actually populate `network.pcap` + `netflow.jsonl` per episode: - `EpisodeConfig.bridge_iface` field (default None) - Spawn `pcap.run_capture()` at run() start, `pcap.stop_capture()` at run() end, `pcap.bucketize()` post-stop - Update `vm/launch_target.sh` (and optionally `launch_demo.sh`) to support `BRIDGE=br-malware` mode that creates a tap and attaches it - Document the iptmonads + bridge prereqs Goal: `tools/run_fleet.py` produces network.pcap + netflow.jsonl per episode automatically when br-malware exists.