Sensor

Updates

Current version 0.8.0 · 17 Oct 2026

Every Release

Resource Abuse0.8.0 · 17 Oct 2026

Each VPS's CPU, disk throughput, disk operations and memory are read every 10 seconds from its control group on the node, on KVM and LXC. Nothing runs inside the VPS.
Sustained High CPU, Heavy Disk Throughput and Heavy Disk Operations, judged over hours: High needs three hours at 95% of the VPS's own vCPUs.
CPU Limit and Disk Limit cap a VPS for an hour, renewed while the heavy use lasts, and are put back exactly when they end or the Frabs service stops.
A limit only applies when the node itself is under pressure: its CPUs at least 70% busy, or the VPS's disk busy at least 60% of the time. Proxmox backups, migrations and snapshots never count.
Network Abuse and Resource Abuse can each be switched on or off per account or per node, run at set daily hours, or changed at a set time.
Any time-limited control is renewed while the abuse it was applied for carries on.

Measured per protocol and per target0.7.1 · 17 Oct 2026

Replies coming back to each VPS are sampled, so an address on a threat list only counts once it actually answers. A scanner's unanswered probes no longer match lists.
Host sweeps count only hosts probed on a server port or by ping, each protocol on its own. Web, mail, DNS, NTP and BitTorrent traffic is no longer counted.
Port scans count ports tried on each destination, TCP and UDP apart, instead of every port across every host.
TCP Connection Flood measures connections to the single busiest destination. SMTP Connection Flood counts mail ports only.
Logins to servers on the VPS's own network (a cluster, backups, deployment tools) count against brute force.
On nodes that cannot count replies to VPSes (kernels before 5.16), stronger evidence is needed before a finding is confirmed. The node page shows Reply Counters on or off.

Fewer false positives on busy hosts0.7.0 · 17 Oct 2026

Service scanning counts server ports only (SSH, RDP, databases and the like), not web, mail or random high ports.
Peer-to-peer traffic, many hosts on random high ports, is ruled out of every scanning type.
Addresses on threat lists that a scan happened to hit are treated as chance, not as contact with a mining pool or an exfiltration server.
Mining needs the Stratum protocol or two signs that are about mining. Exfiltration needs a large upload to a listed address.
Limits and blocks are only applied on confirmed evidence, and duration alone can no longer make a finding High.

Slow scanners reach High0.6.9 · 16 Oct 2026

A slow, steady scan, mostly refused and kept up for hours, now counts as breadth, so it is confirmed and contained under the default rules.
Mail abuse is contained by blocking the mail port instead of a bandwidth limit.

Built for nodes with hundreds of VPSes0.6.1–0.6.8 · 10 Oct 2026

Releases reach every node within 15 minutes. A version that rolled back is tried again after 24 hours.
Several workers process samples, so a node with hundreds of busy VPSes keeps up.
Quiet VPSes get their IP from Proxmox cloud-init settings and from the VPS's own ARP replies.
A network device the kernel refuses is left out for five minutes instead of holding up every VPS's rules.
The sensor reports its connection to Frabs honestly through an outage.
When an account ends, the sensor lifts every control and stops. It resumes by itself if the account comes back.
Virtualizor and SolusVM interface names are recognised, so their VPSes are named correctly.

The evidence engine0.6.0 · 10 Oct 2026

Every finding is weighed on evidence for and against, for all 19 protection types, with coverage, confidence and a minimum-evidence gate before anything acts.
Replies to VPSes are counted on kernels 5.16 and later: one-way floods and unanswered connections are measured directly.
Amplification is judged on bytes out for each byte in. Subnet sweeps, repeated logins to one server and mail-server lookups are new measurements.
Short-lived findings with weak evidence stay on the node and are never shown as incidents.

Attacks have to last0.5.0–0.5.2 · 10 Oct 2026

A short burst never raises an incident. Confidence is earned when activity lasts, runs far over its threshold or other detectors agree.
Every VPS's outgoing traffic is sampled to learn its address, including VPSes that mostly answer requests.
All of a VPS's addresses are reported in order, with the primary first.

Four levels and a storm guard0.4.0–0.4.4 · 9 Oct 2026

Findings are graded Low, Medium, High or Critical.
libvirt VPSes are read from their files, so virsh is not needed.
Storm guard: when many VPSes on one node trip at once, automatic controls are held, because that points to a threshold or host-wide problem, not many attackers.
The sensor keeps time with Frabs, and learns each VPS's own address from its traffic when the platform has none (spoofed sources are ignored).
Update Now from the panel, and one protection switch: turning protection back on in the panel turns it on at the node too.

Every platform read reliably0.3.0–0.3.11 · 9 Oct 2026

Each platform reports whether its VPS list was read or failed. A failed read never empties the list; the last good one is kept and the node shows Degraded.
Permanent VPS IDs for libvirt, Xen and Virtuozzo, Proxmox clusters, XCP-ng told apart from Xen, and passthrough, SR-IOV and macvlan network cards flagged.
No automatic action is ever taken against traffic that cannot be tied to one VPS.
The installer shows numbered steps and live progress, and the sensor retries when Frabs is briefly unavailable.

First release0.2.0–0.2.9 · 7 Oct 2026

Detection and enforcement on the node itself with nftables, from sampled packet headers. Traffic contents are never read.
One incident per behaviour, signed policies and threat intelligence, an encrypted queue for reports, and a command-line tool.
Signed releases, a one-line installer that checks the signature and checksum, and self-update with automatic rollback.
VirtFusion recognised, nodes with no VPSes yet accepted, and fast inventory on large nodes.