[Config]
ingress_ifname = "enp4s0f1"  # Ingress NIC Name
egress_ifname = "enp4s0f0"   # Egress NIC Name
geoip_db_name = "GeoLite2-City.mmdb"
deep_autoencoder_name = "deep_autoencoder.onnx"
models_config_name = "inference_config.json"

# NIC Combined Queue Count (ethtool -l <NIC>)
# If you will edit this, please enter ethtool -L <NIC> combined <combined number> at System Terminal.
# Then change this item.
combined_queue_count = 8
channel_size = 4096
fill_queue_size = 4096       # Umem Used (Should not modify)
comp_queue_size = 4096       # Umem Used (Should not modify)
tx_queue_size = 4096         # Umem Used (Should not modify)
rx_queue_size = 4096         # Umem Used (Should not modify)
frame_size = 4096            # Umem Used (Should not modify)
frame_count = 4096           # Umem Used (Should not modify)
http_server_bind_port = 8080 # Http Server Listen Port
refresh_interval = 5         # Statistics Refresh Time

max_concurrent_flows = 10000        # track up to N concurrent flows
inference_interval_secs = 5         # run ML inference every N seconds
aggregator_window_secs = 30
inference_batch_size = 200
flow_timeout_us = 60_000_000

traffic_logging_mode = false        # when true, disables ML inference and records packets to CSV
traffic_log_csv_path = "traffic_log.csv"

# tls_keylog_path = "/tmp/tls_keys.log"  # NSS key log file for TLS decryption (SSLKEYLOGFILE)

# CPU affinity (Linux only). Uncomment and tune for your hardware.
# Distribute XSK packet threads across a core range [start, end] (inclusive).
# Threads are assigned round-robin: core = start + (queue_id % (end - start + 1)).
xsk_cpu_set = [0, 3]

# Pin ML inference (ONNX spawn_blocking) to this core.
ml_cpu = 7

ae_threshold_method = "94"

# Auth system. Remove this entire section to disable auth.
[Config.auth]
jwt_secret = "change-me-jwt-secret-must-be-32-bytes-min"
db_key = "change-me-db-key-must-be-32-bytes-min-x"
token_ttl_secs = 86400

# Suricata rule engine. Remove this entire section to disable.
[Config.suricata]
home_net = ["140.130.34.0/24"]
worker_cpu_set = [4, 6]
management_cpu = 0
af_packet_threads = "auto"
af_packet_ring_size = 2048
af_packet_block_size = 131072

# Suppress known false positives — paste Suricata suppress lines directly.
# suppress = [
#   "suppress gen_id 1, sig_id 2001234",
#   "suppress gen_id 1, sig_id 2001234, track by_src, ip 192.168.1.0/24",
# ]