Method _record_flow_sample

traffic_analyzer.py:1210–1220

Append one outbound packet to the per-flow ring buffer. Called from the packet parser for every outbound packet from an internal host to an external destination on a non-denylisted port.

(self, src_ip: str, dst_ip: str, dst_port: int,
                            ts: float, bytes_out: int)

            self._create_alert(
                level=TrafficAlertLevel.MEDIUM,
                category=AlertCategory.SUSPICIOUS_PORT.value,
                message=(f"Suspicious port {suspicious_port}/{proto_lc or '?'} "
                         f"({port_description}): {src_ip} -> {dst_ip}"),
                src_ip=src_ip,
                dst_ip=dst_ip,
                details={
                    'port': suspicious_port,
                    'port_description': port_description,
                    'protocol': proto_lc or 'unknown',
                    'broadcast': is_broadcast,
                    'direction': 'outbound' if dst_port == suspicious_port else 'inbound'
                }
            )