Class ServerCapabilities

server_capabilities.py:61–346

Detect system capabilities and manage server-mode features. Server mode is enabled when: - Architecture is AMD64 or ARM64 (or armv8l in 32-bit mode on 64-bit Pi) - System has at least 7.5GB RAM (allows for system reserved) - Not running on Pi Zero

    advanced_vuln_enabled: bool = False
    parallel_scanning_enabled: bool = False
    local_ai_enabled: bool = False
    large_dictionaries_enabled: bool = False
    
    # Tool availability
    available_tools: Dict[str, bool] = field(default_factory=dict)
    
    def to_dict(self) -> Dict[str, Any]:
        return asdict(self)


class ServerCapabilities:
    """
    Detect system capabilities and manage server-mode features.
    
    Server mode is enabled when:
    - Architecture is AMD64 or ARM64 (or armv8l in 32-bit mode on 64-bit Pi)
    - System has at least 7.5GB RAM (allows for system reserved)
    - Not running on Pi Zero
    """
    
    # Minimum requirements for server mode
    # Use 7.5GB to account for system reserved memory on 8GB devices
    MIN_RAM_GB = 7.5
    MIN_CORES = 2
    # The on-screen kiosk drives a full Chromium, which needs ~1GB resident on
    # its own. A Pi Zero 2 W has 512MB total, so the kiosk there thrashes swap
    # and the whole box crawls — Ragnar's own scanning included. Chromium runs
    # fine from 2GB up, so the kiosk floor is its own bar rather than full
    # server mode (a 4GB Pi 4/5 with a screen is a perfectly good kiosk host).
    # 1.8 rather than 2.0 for the same reason MIN_RAM_GB is 7.5 rather than 8:
    # firmware/kernel reservations mean a real 2GB Pi 4 reports ~1.9GB.
    KIOSK_MIN_RAM_GB = 1.8
    KIOSK_MIN_CORES = 2
    # Traffic Analysis is a tcpdump pipe read line by line in Python. Measured
    # on a Pi 5 against a live LAN at ~90 packets/sec: 0.4% of one core, 18MB
    # RSS for the analyzer and 8MB for tcpdump. That is a Pi Zero 2 W workload,
    # not a server one - so it gets its own floor rather than server mode's
    # 7.5GB. Kept above zero only to fail closed when RAM cannot be read; a
    # 512MB Zero 2 W reports ~0.42GB after the GPU split.
    TRAFFIC_MIN_RAM_GB = 0.3
    TRAFFIC_MIN_CORES = 1
    # The JA3 and IRC sidecars are the exception: each spawns a full tshark
    # dissector (measured ~290MB RSS each, plus a ~155MB dumpcap child), so the
    # pair costs more than a Zero has in total. They stay a big-board feature
    # while the tcpdump core runs everywhere.
    TRAFFIC_SIDECAR_MIN_RAM_GB = 3.5
    # Include armv8l which is 32-bit userspace on 64-bit ARM (Pi 4/5 with 32-bit OS)
    SUPPORTED_ARCHS = ['x86_64', 'amd64', 'aarch64', 'arm64', 'armv8l', 'armv7l']
    
    # Tool definitions for advanced features
    TRAFFIC_ANALYSIS_TOOLS = {
        'tcpdump': {'package': 'tcpdump', 'critical': True},
        'tshark': {'package': 'tshark', 'critical': False},
        'ngrep': {'package': 'ngrep', 'critical': False},
        'iftop': {'package': 'iftop', 'critical': False},
        'nethogs': {'package': 'nethogs', 'critical': False},
        'ss': {'package': 'iproute2', 'critical': True},
    }