Network¶

--netif collects the host’s network interfaces, the routing table and the neighbor/ARP table — a host-state view alongside processes and ports — and surfaces the security-relevant facets. Delta does not capture or parse packets (that DPI layer is out of scope); it inspects state and configuration.

delta --netif --json
delta --netif --baseline net.json        # then --cfg net.json to detect drift

Interfaces¶

Per interface: name, MAC, MTU, flags (UP/RUNNING/LOOPBACK), IPv4/IPv6 addresses, and whether it is in PROMISC mode — the classic footprint of a packet sniffer:

- tap0 UP RUNNING mtu=1500 mac=aa:bb:cc:00:11:22
    ! PROMISC (possible packet sniffer)

Interfaces come from getifaddrs() on the live host; under --root (see Offline image analysis) the declared interfaces are recovered from /etc/network/interfaces, systemd-networkd .network files and netplan YAML instead.

Routes & neighbors¶

The IPv4 (/proc/net/route) and IPv6 (/proc/net/ipv6_route) routing tables and the ARP table (/proc/net/arp) — procfs reads, so they honor --root:

Routes:
 - 0.0.0.0/0.0.0.0 via 192.168.1.1 dev eth0
 - ::/0 via fe80::1 dev eth0
Neighbors (ARP):
 - 192.168.1.1 at aa:bb:cc:dd:ee:ff dev eth0

Detection¶

Captured into the baseline and validated against norms (see Configuration); also surfaced as Continuous monitoring drift and Fleet / cohort analysis cohort features. Checking reports:

critical — an interface entered PROMISC mode it was not in (sniffer); a route gateway changed (redirect / MITM); a neighbor’s MAC changed (ARP spoofing); a file-cap change.
high — a missing interface, an unexpected route, or a MAC change.
medium — an unexpected interface; low — an MTU change, an unexpected neighbor.

The neighbor table is volatile (DHCP, devices coming and going); prefer "other_neighbors_present": true to enforce only known bindings (catching MAC spoofing) without flagging every new device:

{ "norm": {
  "other_routes_present": false,
  "routes": [ { "dest": "0.0.0.0", "mask": "0.0.0.0", "gateway": "192.168.1.1" } ],
  "other_neighbors_present": true,
  "neighbors": [ { "ip": "192.168.1.1", "mac": "aa:bb:cc:dd:ee:ff" } ]
} }

Limitations¶

Delta captures no packets. It examines the interfaces and the configuration.
PROMISC applies to a live host. An offline image gives the declared configuration, which has no such state.
Delta reads the routes and the ARP table from procfs. On a host without /proc these lists are empty.
On Windows, Delta reads the interfaces with GetAdaptersAddresses. A Windows build contains this code, and a build for a different platform does not.