User Traffic Monitoring
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- rust
- Domain
- backend, networking, observability, security
Research direction
Start by mapping the existing gateway session handling, ACL logging, activity-log streaming, UI, notification, and export entry points. Define the data model and boundaries for sessions, dashboards, active-session controls, SIEM streaming, alerts, and reports, then verify that all nine requirements have tests and an end-to-end completion path.
Written by the indexing model from the issue text.
Description
- The gateway records L3/L4 sessions (start/stop time, src/dst IP, port, protocol, bytes in/out, VPN location), enriched with user, device, and group.
- Each session entry includes the ACL rule that allowed or blocked the traffic and the action taken (allow/deny).
- The logging level is configurable per ACL rule or location: none, denied only, or all sessions.
- The UI provides a session list filterable by user, device, group, location, IP/port, ACL rule, action, and time range.
- A dashboard shows top users, devices, destinations, ports/services, and ACL rules by traffic volume and session count, with drill-down to the session list.
- An active sessions view shows currently connected devices, their public IP, connection time, and current throughput, with the ability to disconnect or block a device.
- Flow logs can be streamed to external SIEM systems alongside the existing activity log streaming.
- Alerts can be configured for thresholds such as transfer volume, number of denied connections, or connections to specific destinations, delivered via notifications or webhooks.
- Periodic activity reports per user or group can be generated and exported to CSV/PDF.
- Dominant language
- Rust
- Stars
- 2.9k
- Forks
- 119
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 57
Getting set up
- Ships a Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from DefGuard/defguard
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
Maintainers usually reply within 1 day
-
bug
Difficulty 1/5 Under an hour Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day
All issues in DefGuard/defguard
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
akitaonrails/ai-memory#1225 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
acsandmann/rift#577 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
[Bug]: rerank on the huggingface provider (TEI) always costs $0, configured input_cost_per_query is ignoredPossibly taken A pull request linked to this issue is open or already merged. Openllm translation
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day