- Inbound attack detection
- Planned detection for TCP SYN, UDP, ICMP and connection floods, port scans, reflection indicators and connection-tracking pressure, with the evidence and target address shown when measurable.
- Planned
- Outbound abuse detection
- Planned detection for port scanning, unusual SMTP connection patterns, outbound floods, suspicious destination patterns and sudden traffic changes. Frabs will not read messages or email content.
- Planned
- Traffic analytics and exposure
- Planned bandwidth, packet rates, protocol and port distribution, top network peers, IPv4/IPv6 visibility and listening-port changes. A listening port is a possible exposure, not proof of public reachability.
- Planned
- Host resources and infrastructure health
- Planned CPU, memory, swap, disk throughput/IOPS, interface errors, conntrack pressure, uptime and telemetry freshness. High use alone is not abuse.
- Planned
- Safe response and incident evidence
- Planned allowlists, temporary scoped actions, expiry and rollback only after compatibility checks. Incidents will separate detected, blocked and mitigated activity. Upstream-saturated attacks still need provider or upstream DDoS controls.
- Planned