poc4 wit rust

deploy-routeros.env.example

@@ -17,17 +17,33 @@ CONTAINER_SUBNET=172.31.255.0/30
 CONTAINER_BRIDGE=br-ids
 CONTAINER_VETH=veth-ids
 
-# Packet Sniffer -> TZSP
-VLAN_ID=100
+# RouterOS -> TZSP hybrid capture.
+# Routed IPv4 uses /ip firewall mangle action=sniff-tzsp for high throughput.
+# Packet Sniffer is kept only for non-IPv4 Ethernet frames (ARP, IPv6, LLDP,
+# PPPoE discovery, etc.) using filter-mac-protocol=!ip.
 TZSP_PORT=37008
-CONFIGURE_SNIFFER=true
-START_SNIFFER=true
+CONFIGURE_TZSP_CAPTURE=true
+CONFIGURE_IPV4_MANGLE=true
+CONFIGURE_L2_SNIFFER=true
+START_L2_SNIFFER=true
+# Empty means all RouterOS interfaces. Set a real interface/bridge name only
+# when you intentionally want to constrain the low-volume non-IPv4 stream.
+TZSP_L2_INTERFACE=
+TZSP_L2_MAC_PROTOCOL=!ip
+
+# Rust receive-path tuning. RouterOS may cap the kernel socket buffer; the
+# userspace batch queue is the primary burst buffer for high-throughput mirrors.
+TZSP_RCVBUF_BYTES=33554432
+TZSP_BATCH_SIZE=256
+TZSP_QUEUE_MB=64
+TZSP_DATAGRAM_BYTES=12288
 
 # Suricata/app
 SURICATA_HOME_NET=[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]
 SURICATA_LOG_MAX_MB=512
-# Forensic PCAP: blocks (default), alerts, all, off
-FORENSIC_PCAP_MODE=blocks
+# Forensic PCAP: alerts (default), all, off. Legacy "blocks" is accepted but
+# falls back to alert capture so Python never returns to the per-packet path.
+FORENSIC_PCAP_MODE=alerts
 FORENSIC_PCAP_WINDOW_SECONDS=60
 FORENSIC_PCAP_MEMORY_MB=64
 FORENSIC_PCAP_MAX_FILES=32