fix(netflow): изолировать коллектор IPFIX и срезать раздувание базы

Co-authored-by: Cursor <cursoragent@cursor.com>
feat(traffic): классифицировать потоки по брендам и разгрузить ingest
2026-09-07 09:50:24 +07:00 · 2026-09-07 03:01:14 +07:00 · 2026-09-07 02:13:21 +07:00
38 changed files with 3589 additions and 495 deletions
@@ -19,11 +19,11 @@ import { useDataSource } from "@/lib/data-source"
 import { useTrafficLive } from "@/hooks/use-traffic-live"
 import { useFlowLive } from "@/hooks/use-flow-live"
 import { requestJson } from "@/shared/api/http-client"
-import { getFlowAnalytics, getFlowClients, getFlowExporters, getTrafficFlows } from "@/shared/api/traffic-flow"
+import { getFlowAnalytics, getFlowClients, getFlowExporters, getFlowMonthly, getTrafficFlows } from "@/shared/api/traffic-flow"
 import { listServers } from "@/shared/api/servers"
 import { FlowOverlaySheet } from "@/components/traffic/flow-overlay-sheet"
 import { FlowAnalyticsDetail, FlowEntityCardView } from "@/components/traffic/flow-analytics-panel"
-import type { FlowAnalyticsDto, FlowEntityCard, FlowStatsDto } from "@mmapp/contracts/traffic-flow"
+import type { FlowAnalyticsDto, FlowEntityCard, FlowMonthlyDto, FlowStatsDto } from "@mmapp/contracts/traffic-flow"
 import type { ServerRead } from "@mmapp/contracts/servers"
 import { Badge } from "@/components/reui/badge"
 import {
@@ -63,18 +63,52 @@ function flowIngestLine(stats: FlowStatsDto | null): string | null {
  return `Коллектор: ${listener} · пакеты ${stats.packetsReceived ?? 0} · последний ${last}${exporter}${err}`
 }

-function flowEmptyHint(stats: FlowStatsDto | null): string | undefined {
+function flowEmptyHint(stats: FlowStatsDto | null, collectorAlive?: boolean): string | undefined {
  if (!stats) return undefined
  if (stats.lastError) return stats.lastError
  if (stats.packetsReceived) {
-    return `IPFIX приходит (${stats.lastExporterIp ?? "экспортёр"}), но разговоры ещё не записаны.`
+    return `IPFIX приходит (${stats.lastExporterIp ?? "экспортёр"}), но сессии ещё не записаны.`
  }
-  if (stats.listenerBound === false) {
+  if (stats.listenerBound === false && !collectorAlive) {
    return "Коллектор UDP не слушает. Подключите JH ещё раз — ingest включится автоматически."
  }
+  if (stats.listenerBound || collectorAlive) {
+    return "Коллектор жив, IPFIX ещё не доходит. На jump-host у target Src должен быть 0.0.0.0 (авто)."
+  }
  return "IPFIX ещё не доходит до коллектора. На jump-host у target Src должен быть 0.0.0.0 (авто). На хосте MM проверьте bind 10.255.254.1:4739 после wg-flow."
 }

+function monthlyToAnalytics(m: FlowMonthlyDto): FlowAnalyticsDto {
+  const emptySeries = Array(60).fill(0) as number[]
+  return {
+    bpsNow: 0,
+    bytes: m.bytes,
+    packets: 0,
+    conversations: 0,
+    conversationsRaw: 0,
+    uniqueSrc: 0,
+    uniqueDst: 0,
+    topProto: "—",
+    topCategory: "—",
+    rxSeries: emptySeries,
+    txSeries: emptySeries,
+    applications: [],
+    protocols: [],
+    sources: [],
+    destinations: [],
+    interfaces: [],
+    asns: m.asns,
+    countries: m.countries,
+    categories: [],
+    services: m.services,
+    mapEdges: [],
+    conversationsList: [],
+    ifaces: [],
+    live: false,
+    degraded: false,
+  }
+}
+
 // ─── data model ───────────────────────────────────────────────────────────────

 interface BoundIfaceTraffic {
@@ -298,9 +332,9 @@ const userTraffic: UserTraffic[] = INIT_USERS.map((u) =>

 /** Ключи совпадают с `rangeToMinutes` в API (`/api/traffic/...`). */
 const TRAFFIC_RANGE_KEYS = ["5m", "15m", "1h", "4h", "24h"] as const
-type Range = (typeof TRAFFIC_RANGE_KEYS)[number]
+type Range = (typeof TRAFFIC_RANGE_KEYS)[number] | "30d"

-const TRAFFIC_RANGE_LABELS: Record<Range, string> = {
+const TRAFFIC_RANGE_LABELS: Record<(typeof TRAFFIC_RANGE_KEYS)[number], string> = {
  "5m": "5м",
  "15m": "15м",
  "1h": "1ч",
@@ -771,6 +805,7 @@ export default function TrafficPage() {
  const [flowClients, setFlowClients] = useState<FlowEntityCard[]>([])
  const [flowAnalytics, setFlowAnalytics] = useState<FlowAnalyticsDto | null>(null)
  const [flowIface, setFlowIface] = useState("__all__")
+  const [flowDedup, setFlowDedup] = useState(true)
  const [overlayOpen, setOverlayOpen] = useState(false)
  const [catalogServers, setCatalogServers] = useState<ServerRead[]>([])
  const effectiveMode: GroupMode = groupMode
@@ -780,7 +815,7 @@ export default function TrafficPage() {
    serverId: selectedId,
    iface: selectedIface,
  })
-  const flowLiveEnabled = isLive && effectiveMode === "flows" && Boolean(selectedId)
+  const flowLiveEnabled = isLive && effectiveMode === "flows" && Boolean(selectedId) && range === "5m"
  const { sample: flowLiveSample, error: flowLiveError } = useFlowLive({
    enabled: flowLiveEnabled,
    backendUrl,
@@ -788,6 +823,7 @@ export default function TrafficPage() {
    serverId: flowScope === "servers" ? selectedId : undefined,
    userId: flowScope === "users" ? selectedId : undefined,
    iface: flowIface,
+    dedup: flowDedup,
  })

  const toLiveServer = (s: LiveTrafficServer): ServerTraffic => {
@@ -833,7 +869,7 @@ export default function TrafficPage() {
    setLiveBusy(true)
    setLiveError(null)
    try {
-      const q = encodeURIComponent(targetRange)
+      const q = encodeURIComponent(targetRange === "30d" ? "24h" : targetRange)
      const [srvRes, usersRes, ifacesRes] = await Promise.all([
        apiFetch<{ servers: LiveTrafficServer[] }>(`/api/traffic/servers?range=${q}`),
        apiFetch<{ users: UserTraffic[] }>(`/api/traffic/users?range=${q}`),
@@ -900,8 +936,6 @@ export default function TrafficPage() {
  useEffect(() => {
    if (!isLive || effectiveMode !== "flows") return
    void loadFlows()
-    const t = window.setInterval(() => { void loadFlows() }, 5000)
-    return () => window.clearInterval(t)
  }, [isLive, effectiveMode, loadFlows])

  useEffect(() => {
@@ -909,13 +943,26 @@ export default function TrafficPage() {
      setFlowAnalytics(null)
      return
    }
+    if (range === "5m") {
+      setFlowAnalytics(null)
+      return
+    }
+    if (range === "30d") {
+      const month = new Date().toISOString().slice(0, 7)
+      void getFlowMonthly(backendUrl, {
+        month,
+        serverId: flowScope === "servers" ? selectedId : undefined,
+      }).then((m) => setFlowAnalytics(monthlyToAnalytics(m))).catch(() => setFlowAnalytics(null))
+      return
+    }
    void getFlowAnalytics(backendUrl, {
      range,
      serverId: flowScope === "servers" ? selectedId : undefined,
      userId: flowScope === "users" ? selectedId : undefined,
      iface: flowIface,
+      dedup: flowDedup,
    }).then(setFlowAnalytics).catch(() => setFlowAnalytics(null))
-  }, [isLive, effectiveMode, selectedId, range, flowScope, flowIface, backendUrl])
+  }, [isLive, effectiveMode, selectedId, range, flowScope, flowIface, flowDedup, backendUrl])

  useEffect(() => {
    setFlowIface("__all__")
@@ -966,12 +1013,19 @@ export default function TrafficPage() {

  const handleModeChange = (next: GroupMode) => {
    setGroupMode(next)
-    if (next === "servers") setSelectedId(activeServerTraffic[0]?.id ?? "srv1")
-    else if (next === "users") setSelectedId((isLive ? liveUsers : userTraffic)[0]?.id ?? "u1")
-    else if (next === "ifaces") setSelectedId((isLive ? liveBoundIfaces : boundIfaces)[0]?.id ?? "")
-    else if (next === "flows") {
+    if (next === "servers") {
+      setSelectedId(activeServerTraffic[0]?.id ?? "srv1")
+      if (range === "30d") setRange("1h")
+    } else if (next === "users") {
+      setSelectedId((isLive ? liveUsers : userTraffic)[0]?.id ?? "u1")
+      if (range === "30d") setRange("1h")
+    } else if (next === "ifaces") {
+      setSelectedId((isLive ? liveBoundIfaces : boundIfaces)[0]?.id ?? "")
+      if (range === "30d") setRange("1h")
+    } else if (next === "flows") {
      setFlowScope("servers")
      setFlowIface("__all__")
+      setRange("5m")
      setSelectedId(flowExporters[0]?.id ?? "")
    }
    setSortField("rx")
@@ -1061,7 +1115,10 @@ export default function TrafficPage() {

  const visibleSortFields = SORT_FIELDS.filter(s => !s.modesOnly || s.modesOnly.includes(effectiveMode))
  const ingestLine = flowIngestLine(flowStats)
-  const flowError = liveError || flowLiveError
+  const collectorAlive = Boolean(flowStats?.listenerBound || flowStats?.packetsReceived)
+  const flowError = liveError
+    || (flowLiveError && !(collectorAlive && /live HTTP 500/.test(flowLiveError)) ? flowLiveError : null)
+    || (displayedFlow?.degraded ? "Коллектор перегружен: упрощённая аналитика" : null)

  const flowKpiItems = [
    {
@@ -1255,7 +1312,7 @@ export default function TrafficPage() {
                    ))}
                    {sortedFlowCards.length === 0 ? (
                      <p className="text-xs text-muted-foreground">
-                        {flowEmptyHint(flowStats) ?? "Нет экспортёров IPFIX. Подключите jump-host."}
+                        {flowEmptyHint(flowStats, collectorAlive) ?? "Нет экспортёров IPFIX. Подключите jump-host."}
                      </p>
                    ) : null}
                  </div>
@@ -1269,8 +1326,10 @@ export default function TrafficPage() {
                      onRange={(r) => setRange(r as Range)}
                      selectedIface={flowIface}
                      onIface={setFlowIface}
+                      dedup={flowDedup}
+                      onDedup={setFlowDedup}
                      liveHint={displayedFlow?.live ? "live" : undefined}
-                      emptyHint={flowEmptyHint(flowStats)}
+                      emptyHint={flowEmptyHint(flowStats, collectorAlive)}
                    />
                  </FramePanel>
                </Frame>
@@ -14,7 +14,7 @@
    "test:auth": "tsx src/lib/permissions.test.ts && tsx src/plugins/auth.smoke.test.ts",
    "test:wireguard": "npx tsx src/services/wireguard-config.test.ts",
    "test:traffic-rate": "tsx src/services/traffic-rate.test.ts",
-    "test:traffic-flow": "tsx src/services/traffic-flow-parse.test.ts && tsx src/services/traffic-flow-map-exporter.test.ts && tsx src/services/traffic-flow-ifaces.test.ts && tsx src/services/traffic-flow-analytics.test.ts",
+    "test:traffic-flow": "tsx src/services/traffic-flow-parse.test.ts && tsx src/services/traffic-flow-map-exporter.test.ts && tsx src/services/traffic-flow-ifaces.test.ts && tsx src/services/traffic-flow-dedup.test.ts && tsx src/services/traffic-flow-classify.test.ts && tsx src/services/traffic-flow-ripe.test.ts && tsx src/services/traffic-flow-brands.test.ts && tsx src/services/traffic-flow-ingest.test.ts && tsx src/services/traffic-flow-analytics.test.ts && tsx src/services/traffic-flow-hardening.test.ts",
    "test:users": "tsx src/modules/users/iface-type.test.ts && tsx src/modules/users/bindings.test.ts"
  },
  "dependencies": {
@@ -7,11 +7,23 @@ import { drizzle } from "drizzle-orm/better-sqlite3"
 import { env } from "../config.js"
 import * as schema from "./schema.js"

-const sqlite = new Database(env.DATABASE_PATH)
+export const SQLITE_BUSY_TIMEOUT_MS = 5000
+
+export function applySqlitePragmas(handle: SqliteHandle): void {
+  handle.pragma("journal_mode = WAL")
+  handle.pragma("foreign_keys = ON")
+  handle.pragma(`busy_timeout = ${SQLITE_BUSY_TIMEOUT_MS}`)
+  handle.pragma("synchronous = NORMAL")
+}
+
+function openSqlite(): SqliteHandle {
+  const handle = new Database(env.DATABASE_PATH)
+  applySqlitePragmas(handle)
+  return handle
+}
+
+let sqlite = openSqlite()

-// WAL mode for better concurrent read performance
-sqlite.pragma("journal_mode = WAL")
-sqlite.pragma("foreign_keys = ON")
 sqlite.exec(`
 CREATE TABLE IF NOT EXISTS servers (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -162,6 +174,55 @@ CREATE UNIQUE INDEX IF NOT EXISTS idx_flow_buckets_unique
 CREATE INDEX IF NOT EXISTS idx_flow_buckets_server_time
  ON flow_buckets(server_id, bucket_at);

+CREATE TABLE IF NOT EXISTS flow_minute_stats (
+  server_id INTEGER NOT NULL,
+  bucket_at TEXT NOT NULL,
+  bytes INTEGER NOT NULL DEFAULT 0,
+  packets INTEGER NOT NULL DEFAULT 0,
+  unique_src INTEGER NOT NULL DEFAULT 0,
+  unique_dst INTEGER NOT NULL DEFAULT 0,
+  conversations INTEGER NOT NULL DEFAULT 0,
+  PRIMARY KEY (server_id, bucket_at)
+);
+
+CREATE TABLE IF NOT EXISTS flow_minute_dims (
+  server_id INTEGER NOT NULL,
+  bucket_at TEXT NOT NULL,
+  dim TEXT NOT NULL,
+  key TEXT NOT NULL,
+  bytes INTEGER NOT NULL DEFAULT 0,
+  packets INTEGER NOT NULL DEFAULT 0,
+  PRIMARY KEY (server_id, bucket_at, dim, key)
+);
+CREATE INDEX IF NOT EXISTS idx_flow_minute_dims_time ON flow_minute_dims(bucket_at, dim);
+
+CREATE TABLE IF NOT EXISTS flow_daily_dims (
+  server_id INTEGER NOT NULL,
+  day TEXT NOT NULL,
+  dim TEXT NOT NULL,
+  key TEXT NOT NULL,
+  bytes INTEGER NOT NULL DEFAULT 0,
+  packets INTEGER NOT NULL DEFAULT 0,
+  PRIMARY KEY (server_id, day, dim, key)
+);
+CREATE INDEX IF NOT EXISTS idx_flow_daily_dims_day ON flow_daily_dims(day, dim);
+
+CREATE TABLE IF NOT EXISTS flow_ip_meta (
+  prefix TEXT PRIMARY KEY,
+  asn INTEGER NOT NULL DEFAULT 0,
+  country TEXT NOT NULL DEFAULT '',
+  lat REAL,
+  lng REAL,
+  holder TEXT NOT NULL DEFAULT '',
+  ok INTEGER NOT NULL DEFAULT 1,
+  fetched_at TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS flow_asn_meta (
+  asn INTEGER PRIMARY KEY,
+  holder TEXT NOT NULL DEFAULT '',
+  fetched_at TEXT NOT NULL
+);
+
 CREATE TABLE IF NOT EXISTS uptime_settings (
  id INTEGER PRIMARY KEY,
  enabled INTEGER NOT NULL DEFAULT 1,
@@ -886,7 +947,18 @@ if (backupEntryCount.c === 0) {
  }
 }

-export const db = drizzle(sqlite, { schema })
+export let db = drizzle(sqlite, { schema })

 /** Прямой доступ к better-sqlite3 для сложных read-only запросов (напр. /api/alerts). */
-export const sqliteDatabase: SqliteHandle = sqlite
+export let sqliteDatabase: SqliteHandle = sqlite
+
+export function reopenSqlite(): void {
+  try {
+    sqlite.close()
+  } catch {
+    /* already closed */
+  }
+  sqlite = openSqlite()
+  sqliteDatabase = sqlite
+  db = drizzle(sqlite, { schema })
+}
@@ -182,6 +182,40 @@ export const trafficFlowSettings = sqliteTable("traffic_flow_settings", {
  updatedAt:       text("updated_at").notNull().default(sql`(datetime('now'))`),
 })

+export const flowMinuteStats = sqliteTable("flow_minute_stats", {
+  serverId:      integer("server_id").notNull(),
+  bucketAt:      text("bucket_at").notNull(),
+  bytes:         integer("bytes").notNull().default(0),
+  packets:       integer("packets").notNull().default(0),
+  uniqueSrc:     integer("unique_src").notNull().default(0),
+  uniqueDst:     integer("unique_dst").notNull().default(0),
+  conversations: integer("conversations").notNull().default(0),
+}, (t) => [
+  uniqueIndex("idx_flow_minute_stats_pk").on(t.serverId, t.bucketAt),
+])
+
+export const flowMinuteDims = sqliteTable("flow_minute_dims", {
+  serverId: integer("server_id").notNull(),
+  bucketAt: text("bucket_at").notNull(),
+  dim:      text("dim").notNull(),
+  key:      text("key").notNull(),
+  bytes:    integer("bytes").notNull().default(0),
+  packets:  integer("packets").notNull().default(0),
+}, (t) => [
+  uniqueIndex("idx_flow_minute_dims_pk").on(t.serverId, t.bucketAt, t.dim, t.key),
+])
+
+export const flowDailyDims = sqliteTable("flow_daily_dims", {
+  serverId: integer("server_id").notNull(),
+  day:      text("day").notNull(),
+  dim:      text("dim").notNull(),
+  key:      text("key").notNull(),
+  bytes:    integer("bytes").notNull().default(0),
+  packets:  integer("packets").notNull().default(0),
+}, (t) => [
+  uniqueIndex("idx_flow_daily_dims_pk").on(t.serverId, t.day, t.dim, t.key),
+])
+
 export const flowBuckets = sqliteTable("flow_buckets", {
  id:        integer("id").primaryKey({ autoIncrement: true }),
  serverId:  integer("server_id")
@@ -202,6 +236,23 @@ export const flowBuckets = sqliteTable("flow_buckets", {
  ),
 ])

+export const flowIpMeta = sqliteTable("flow_ip_meta", {
+  prefix:    text("prefix").primaryKey(),
+  asn:       integer("asn").notNull().default(0),
+  country:   text("country").notNull().default(""),
+  lat:       real("lat"),
+  lng:       real("lng"),
+  holder:    text("holder").notNull().default(""),
+  ok:        integer("ok").notNull().default(1),
+  fetchedAt: text("fetched_at").notNull(),
+})
+
+export const flowAsnMeta = sqliteTable("flow_asn_meta", {
+  asn:       integer("asn").primaryKey(),
+  holder:    text("holder").notNull().default(""),
+  fetchedAt: text("fetched_at").notNull(),
+})
+
 export const trafficSamples = sqliteTable("traffic_samples", {
  id:            integer("id").primaryKey({ autoIncrement: true }),
  serverId:      integer("server_id")
@@ -641,6 +692,8 @@ export type RecursiveRouteRow = typeof recursiveRoutes.$inferSelect
 export type TrafficSettingsRow = typeof trafficSettings.$inferSelect
 export type TrafficFlowSettingsRow = typeof trafficFlowSettings.$inferSelect
 export type FlowBucketRow = typeof flowBuckets.$inferSelect
+export type FlowIpMetaRow = typeof flowIpMeta.$inferSelect
+export type FlowAsnMetaRow = typeof flowAsnMeta.$inferSelect
 export type ServersApiPingSettingsRow = typeof serversApiPingSettings.$inferSelect
 export type TrafficSampleRow = typeof trafficSamples.$inferSelect
 export type UptimeSettingsRow = typeof uptimeSettings.$inferSelect
@@ -1,6 +1,7 @@
-import Fastify, { type FastifyInstance } from "fastify"
+import Fastify, { type FastifyError, type FastifyInstance } from "fastify"
 import cors from "@fastify/cors"
 import { serializerCompiler, validatorCompiler } from "@fastify/type-provider-zod"
+import { monitorEventLoopDelay } from "node:perf_hooks"
 import { env } from "./config.js"
 import authPlugin, { requireAuth } from "./plugins/auth.js"
 import serversRoutes from "./routes/servers.js"
@@ -28,7 +29,10 @@ import wireguardRoutes from "./routes/wireguard.js"
 import firewallRoutes from "./routes/firewall.js"
 import usersRoutes from "./routes/users.js"
 import { refreshScheduler, stopScheduler } from "./services/scheduler.js"
-import { startTrafficFlowListener, stopTrafficFlowListener } from "./services/traffic-flow-ingest.js"
+import { getFlowWorkerHealth, startTrafficFlowListener, stopTrafficFlowListener } from "./services/traffic-flow-ingest.js"
+
+const eventLoopDelay = monitorEventLoopDelay({ resolution: 20 })
+eventLoopDelay.enable()

 export async function buildApp(opts?: {
  logger?: boolean
@@ -37,7 +41,7 @@ export async function buildApp(opts?: {
  const usePrettyLogger =
    opts?.logger !== false && process.env.NODE_ENV !== "production"
  const app = Fastify({
-    bodyLimit: 512 * 1024 * 1024,
+    bodyLimit: 2 * 1024 * 1024,
    requestTimeout: 10 * 60 * 1000,
    logger:
      opts?.logger === false
@@ -59,6 +63,18 @@ export async function buildApp(opts?: {
  app.setValidatorCompiler(validatorCompiler)
  app.setSerializerCompiler(serializerCompiler)

+  app.setErrorHandler((error: FastifyError, request, reply) => {
+    const status = typeof error.statusCode === "number" && error.statusCode >= 400
+      ? error.statusCode
+      : 500
+    if (status >= 500) {
+      request.log.error(error)
+      return reply.status(status).send({ error: "Внутренняя ошибка сервера" })
+    }
+    const message = error instanceof Error ? error.message : "Ошибка запроса"
+    return reply.status(status).send({ error: message })
+  })
+
  await app.register(cors, {
    origin: env.CORS_ORIGIN,
    methods: ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"],
@@ -70,6 +86,8 @@ export async function buildApp(opts?: {
    status: "ok",
    timestamp: new Date().toISOString(),
    version: process.env.APP_VERSION ?? "dev",
+    eventLoopDelayMs: Math.round(eventLoopDelay.mean / 1e6),
+    flowWorker: getFlowWorkerHealth(),
  }))

  app.get("/api/auth/config", async () => ({
@@ -132,6 +150,29 @@ const isMain =
 if (isMain) {
  try {
    const app = await buildApp()
+    let shuttingDown = false
+    const shutdown = async (code: number) => {
+      if (shuttingDown) return
+      shuttingDown = true
+      try {
+        stopTrafficFlowListener()
+        await app.close()
+      } catch (err) {
+        console.error(err)
+      } finally {
+        process.exit(code)
+      }
+    }
+    process.on("SIGTERM", () => { void shutdown(0) })
+    process.on("SIGINT", () => { void shutdown(0) })
+    process.on("uncaughtException", (err) => {
+      console.error(err)
+      void shutdown(1)
+    })
+    process.on("unhandledRejection", (reason) => {
+      console.error(reason)
+      void shutdown(1)
+    })
    await app.listen({ port: env.PORT, host: "0.0.0.0" })
    console.log(
      `\n🚀 MikroTik Manager Backend running at http://localhost:${env.PORT}`,
@@ -18,13 +18,31 @@ import {
 } from "../services/traffic-flow-ingest.js"
 import {
  buildFlowAnalytics,
+  getFlowMonthly,
  listFlowClients,
  listFlowExporters,
+  safeBuildLiveFlowSample,
 } from "../services/traffic-flow-analytics.js"
 import { applyFlowOverlay } from "../services/traffic-flow-overlay.js"
 import { listTrafficFlowHostFiles } from "../services/traffic-flow-host-files.js"

 const LIVE_TICK_MS = 2000
+export const MAX_FLOW_LIVE_SUBSCRIBERS = 4
+let liveSubscribers = 0
+
+export function tryAcquireFlowLiveSlot(): boolean {
+  if (liveSubscribers >= MAX_FLOW_LIVE_SUBSCRIBERS) return false
+  liveSubscribers += 1
+  return true
+}
+
+export function releaseFlowLiveSlot(): void {
+  liveSubscribers = Math.max(0, liveSubscribers - 1)
+}
+
+export function resetFlowLiveSlotsForTests(): void {
+  liveSubscribers = 0
+}

 function rangeToMinutes(range: string | undefined): number {
  switch ((range ?? "5m").toLowerCase()) {
@@ -33,6 +51,7 @@ function rangeToMinutes(range: string | undefined): number {
    case "1h": return 60
    case "4h": return 240
    case "24h": return 1440
+    case "30d": return 1440
    default: return 5
  }
 }
@@ -43,13 +62,20 @@ function parseId(raw: unknown): number | undefined {
  return Number.isFinite(n) ? n : undefined
 }

+function parseDedup(raw: unknown): boolean {
+  if (raw == null || raw === "") return true
+  const s = String(raw).toLowerCase()
+  return s !== "0" && s !== "false" && s !== "off"
+}
+
 function analyticsQuery(req: FastifyRequest) {
-  const q = req.query as { range?: string; serverId?: string; userId?: string; iface?: string }
+  const q = req.query as { range?: string; serverId?: string; userId?: string; iface?: string; dedup?: string }
  return {
    minutes: rangeToMinutes(q.range),
    serverId: parseId(q.serverId),
    userId: q.userId?.trim() || undefined,
    iface: q.iface?.trim() || undefined,
+    dedup: parseDedup(q.dedup),
  }
 }

@@ -155,8 +181,26 @@ const trafficFlowRoutes: FastifyPluginAsyncZod = async (app) => {
    return reply.send(buildFlowAnalytics(analyticsQuery(req)))
  })

+  app.get("/traffic/flow/monthly", async (req, reply) => {
+    const q = req.query as { month?: string; serverId?: string }
+    const now = new Date()
+    const month = /^\d{4}-\d{2}$/.test(q.month ?? "")
+      ? (q.month as string)
+      : `${now.getUTCFullYear()}-${String(now.getUTCMonth() + 1).padStart(2, "0")}`
+    return reply.send(getFlowMonthly(month, parseId(q.serverId)))
+  })
+
  app.get("/traffic/flow/live", async (req, reply) => {
+    if (!tryAcquireFlowLiveSlot()) {
+      return reply.status(429).send({ error: "Слишком много live-подписок" })
+    }
    const query = analyticsQuery(req)
+    const liveQuery = {
+      serverId: query.serverId,
+      userId: query.userId,
+      iface: query.iface,
+      dedup: query.dedup,
+    }
    const abort = new AbortController()
    const onClose = () => abort.abort()
    req.raw.on("close", onClose)
@@ -183,12 +227,14 @@ const trafficFlowRoutes: FastifyPluginAsyncZod = async (app) => {

    try {
      while (!abort.signal.aborted) {
-        writeSse(reply.raw, "sample", buildFlowAnalytics(query))
+        const payload = safeBuildLiveFlowSample(liveQuery)
+        writeSse(reply.raw, payload.event, payload.data)
        await sleep(LIVE_TICK_MS, abort.signal)
      }
    } catch {
      /* abort / disconnect */
    } finally {
+      releaseFlowLiveSlot()
      req.raw.off("close", onClose)
      try {
        reply.raw.end()
@@ -11,6 +11,16 @@ import type {
  FirewallFamily, FirewallTable,
 } from "../types/server.js"

+const MAX_ROS_BODY_BYTES = 8 * 1024 * 1024
+
+function appendRosBody(body: string, chunk: string, req?: http.ClientRequest): string {
+  if (body.length + chunk.length > MAX_ROS_BODY_BYTES) {
+    req?.destroy(new Error("RouterOS: ответ больше 8 МиБ"))
+    return body
+  }
+  return body + chunk
+}
+
 // ── connection params ─────────────────────────────────────────────────────────

 export interface MikrotikConnectParams {
@@ -52,7 +62,7 @@ function rosRequest(
    const req = lib.request(options, (res) => {
      let body = ""
      res.setEncoding("utf8")
-      res.on("data", (chunk: string) => { body += chunk })
+      res.on("data", (chunk: string) => { body = appendRosBody(body, chunk, req) })
      res.on("end", () => {
        clearTimeout(timer)
        if (!res.statusCode || res.statusCode < 200 || res.statusCode >= 300) {
@@ -135,7 +145,7 @@ function rosPost(
    req = lib.request(options, (res) => {
      let buf = ""
      res.setEncoding("utf8")
-      res.on("data", (chunk: string) => { buf += chunk })
+      res.on("data", (chunk: string) => { buf = appendRosBody(buf, chunk, req) })
      res.on("end", () => {
        settle(() => {
          if (!res.statusCode || res.statusCode < 200 || res.statusCode >= 300) {
@@ -189,7 +199,7 @@ function rosPut(
    const req = lib.request(options, (res) => {
      let buf = ""
      res.setEncoding("utf8")
-      res.on("data", (chunk: string) => { buf += chunk })
+      res.on("data", (chunk: string) => { buf = appendRosBody(buf, chunk, req) })
      res.on("end", () => {
        clearTimeout(timer)
        if (!res.statusCode || res.statusCode < 200 || res.statusCode >= 300) {
@@ -239,7 +249,7 @@ function rosDelete(
    const req = lib.request(options, (res) => {
      let body = ""
      res.setEncoding("utf8")
-      res.on("data", (chunk: string) => { body += chunk })
+      res.on("data", (chunk: string) => { body = appendRosBody(body, chunk, req) })
      res.on("end", () => {
        clearTimeout(timer)
        if (!res.statusCode || res.statusCode < 200 || res.statusCode >= 300) {
@@ -289,7 +299,7 @@ function rosPatch(
    const req = lib.request(options, (res) => {
      let buf = ""
      res.setEncoding("utf8")
-      res.on("data", (chunk: string) => { buf += chunk })
+      res.on("data", (chunk: string) => { buf = appendRosBody(buf, chunk, req) })
      res.on("end", () => {
        clearTimeout(timer)
        if (!res.statusCode || res.statusCode < 200 || res.statusCode >= 300) {
@@ -4,8 +4,13 @@ import os from "node:os"
 import path from "node:path"
 import Database from "better-sqlite3"
 import { env } from "../config.js"
-import { sqliteDatabase } from "../db/index.js"
+import { reopenSqlite, sqliteDatabase } from "../db/index.js"
 import { refreshScheduler, stopScheduler } from "./scheduler.js"
+import {
+  reattachFlowSqlite,
+  startTrafficFlowListener,
+  stopTrafficFlowListener,
+} from "./traffic-flow-ingest.js"

 const SQLITE_MAGIC = Buffer.from("SQLite format 3\0")
 const MAX_RESTORE_BYTES = 512 * 1024 * 1024
@@ -37,10 +42,12 @@ async function withDatabaseOperation<T>(fn: () => Promise<T> | T): Promise<T> {
    throw new Error("Операция с базой данных уже выполняется")
  }
  operationInFlight = true
+  stopTrafficFlowListener()
  stopScheduler()
  try {
    return await fn()
  } finally {
+    startTrafficFlowListener()
    refreshScheduler()
    operationInFlight = false
  }
@@ -80,6 +87,8 @@ export async function restoreSystemDatabaseBackup(buffer: Buffer): Promise<void>
      await writeFile(tempPath, buffer)
      source = new Database(tempPath, { readonly: true, fileMustExist: true })
      await source.backup(resolveDatabasePath())
+      reopenSqlite()
+      reattachFlowSqlite()
      sqliteDatabase.pragma("wal_checkpoint(TRUNCATE)")
    } finally {
      source?.close()
@@ -4,8 +4,21 @@ import {
  ingestParsedFlowsForServerForTests,
  resetFlowRingsForTests,
 } from "./traffic-flow-ingest.js"
-import { buildFlowAnalytics } from "./traffic-flow-analytics.js"
+import { buildFlowAnalytics, formatLiveSseFromBuilder, getFlowMonthly, listFlowClients, listFlowExporters } from "./traffic-flow-analytics.js"
+import { sqliteDatabase } from "../db/index.js"
+import { disableCatalogFetchForTests, resetFlowCatalogForTests, seedFlowCatalogForTests } from "./traffic-flow-classify.js"
+import {
+  disableRipeEnqueueForTests,
+  disableRipePersistForTests,
+  resetRipeCacheForTests,
+  seedRipeCacheForTests,
+} from "./traffic-flow-ripe.js"

+disableCatalogFetchForTests()
+resetFlowCatalogForTests()
+disableRipePersistForTests()
+resetRipeCacheForTests()
+disableRipeEnqueueForTests()
 resetIfaceCacheForTests()
 resetFlowRingsForTests()
 rememberServerIfaces(7, [
@@ -65,4 +78,189 @@ try {
  resetIfaceCacheForTests()
 }

+resetFlowRingsForTests()
+resetIfaceCacheForTests()
+rememberServerIfaces(7, [
+  { ".id": "*2", name: "ether1" },
+  { ".id": "*A", name: "wg-flow" },
+])
+ingestParsedFlowsForServerForTests(7, [
+  {
+    src: "10.1.1.8",
+    dst: "8.8.8.8",
+    proto: 6,
+    srcPort: 51234,
+    dstPort: 443,
+    bytes: 12_000,
+    packets: 10,
+    inIface: "2",
+    outIface: "10",
+  },
+  {
+    src: "10.1.1.8",
+    dst: "8.8.8.8",
+    proto: 6,
+    srcPort: 51234,
+    dstPort: 443,
+    bytes: 9_000,
+    packets: 9,
+    inIface: "10",
+    outIface: "",
+  },
+])
+try {
+  const summed = buildFlowAnalytics({ minutes: 5, serverId: 7, dedup: false })
+  assert.equal(summed.bytes, 21_000)
+  assert.equal(summed.conversations, 2)
+  const deduped = buildFlowAnalytics({ minutes: 5, serverId: 7, dedup: true })
+  assert.equal(deduped.bytes, 12_000)
+  assert.equal(deduped.conversations, 1)
+  assert.equal(deduped.dedupApplied, true)
+  assert.equal(deduped.interfaces.length, 2)
+} finally {
+  resetFlowRingsForTests()
+  resetIfaceCacheForTests()
+}
+
+resetFlowRingsForTests()
+resetIfaceCacheForTests()
+disableRipeEnqueueForTests()
+seedRipeCacheForTests({
+  prefix: "8.8.8.0/24",
+  asn: 15169,
+  country: "US",
+  lat: 37.4,
+  lng: -122.1,
+  holder: "GOOGLE",
+  ok: true,
+  fetchedAt: Date.now(),
+})
+seedFlowCatalogForTests({
+  cidrs: [{ cidr: "8.8.8.0/24", purpose: "steam-gaming" }],
+})
+rememberServerIfaces(7, [{ ".id": "*2", name: "ether1" }])
+ingestParsedFlowsForServerForTests(7, [
+  {
+    src: "10.1.1.8",
+    dst: "8.8.8.8",
+    proto: 6,
+    srcPort: 51234,
+    dstPort: 443,
+    bytes: 12_000,
+    packets: 10,
+    inIface: "2",
+    outIface: "",
+  },
+])
+try {
+  const geo = buildFlowAnalytics({ minutes: 5, serverId: 7 })
+  assert.equal(geo.categories?.[0]?.label, "Игры")
+  assert.ok(geo.asns?.some((r) => r.label.includes("AS15169")))
+  assert.equal(geo.countries?.[0]?.id, "US")
+  assert.equal(geo.mapEdges?.[0]?.toCountry, "US")
+  assert.ok(geo.mapEdges?.every((e) => e.toCountry !== "?"))
+  assert.equal(geo.conversationsList[0]?.dstCountry, "US")
+  assert.equal(geo.asns?.[0]?.id, "15169")
+} finally {
+  resetFlowRingsForTests()
+  resetIfaceCacheForTests()
+  resetRipeCacheForTests()
+  resetFlowCatalogForTests()
+}
+
+resetFlowRingsForTests()
+resetIfaceCacheForTests()
+disableRipeEnqueueForTests()
+resetRipeCacheForTests()
+resetFlowCatalogForTests()
+seedRipeCacheForTests({
+  prefix: "1.1.1.0/24",
+  asn: 13335,
+  country: "?",
+  lat: null,
+  lng: null,
+  holder: "CLOUDFLARENET, US",
+  ok: true,
+  fetchedAt: Date.now(),
+})
+rememberServerIfaces(7, [{ ".id": "*2", name: "ether1" }])
+ingestParsedFlowsForServerForTests(7, [
+  {
+    src: "10.1.1.8",
+    dst: "1.1.1.1",
+    proto: 6,
+    srcPort: 51234,
+    dstPort: 443,
+    bytes: 5000,
+    packets: 5,
+    inIface: "2",
+    outIface: "",
+  },
+])
+try {
+  const cf = buildFlowAnalytics({ minutes: 5, serverId: 7 })
+  assert.equal(cf.countries?.[0]?.id, "US")
+  assert.ok(cf.mapEdges?.every((e) => e.toCountry !== "?"))
+  assert.equal(cf.services?.[0]?.label, "Cloudflare")
+  assert.equal(cf.categories?.[0]?.label, "CDN")
+  assert.equal(cf.conversationsList[0]?.dstCountry, "US")
+  assert.equal(cf.asns?.[0]?.id, "13335")
+} finally {
+  resetFlowRingsForTests()
+  resetIfaceCacheForTests()
+  resetRipeCacheForTests()
+  resetFlowCatalogForTests()
+}
+
+{
+  ingestParsedFlowsForServerForTests(7, [
+    {
+      src: "10.1.1.8",
+      dst: "8.8.8.8",
+      proto: 6,
+      srcPort: 51234,
+      dstPort: 443,
+      bytes: 12_000,
+      packets: 10,
+      inIface: "2",
+      outIface: "",
+    },
+  ])
+  const degraded = buildFlowAnalytics({ minutes: 5, serverId: 7, skipHeavy: true })
+  assert.equal(degraded.degraded, true)
+  assert.equal(degraded.conversationsList.length, 0)
+  assert.ok((degraded.bytes ?? 0) >= 12_000)
+  const liveErr = formatLiveSseFromBuilder(() => {
+    throw new Error("SQLITE_BUSY")
+  })
+  assert.equal(liveErr.event, "error")
+  assert.equal((liveErr.data as { error: string }).error, "SQLITE_BUSY")
+  const liveOk = formatLiveSseFromBuilder(() => ({ ok: true }))
+  assert.equal(liveOk.event, "sample")
+  const exporters = listFlowExporters(5)
+  const clients = listFlowClients(5)
+  assert.ok(Array.isArray(exporters.exporters))
+  assert.ok(Array.isArray(clients.clients))
+  resetFlowRingsForTests()
+}
+
+{
+  sqliteDatabase.prepare(`DELETE FROM flow_daily_dims WHERE server_id = 7 AND day LIKE '2026-09-%'`).run()
+  sqliteDatabase.exec(`
+    INSERT INTO flow_daily_dims (server_id, day, dim, key, bytes, packets)
+    VALUES
+      (7, '2026-09-01', 'country', 'US', 1000, 10),
+      (7, '2026-09-02', 'country', 'US', 500, 5),
+      (7, '2026-09-01', 'service', 'steam', 800, 8),
+      (7, '2026-09-01', 'asn', '15169', 900, 9),
+      (7, '2026-09-01', 'asn', 'other', 100, 1)
+  `)
+  const monthly = getFlowMonthly("2026-09", 7)
+  assert.equal(monthly.bytes, 1500)
+  assert.equal(monthly.countries[0]?.id, "US")
+  assert.equal(monthly.countries[0]?.bytes, 1500)
+  assert.ok(monthly.asns.some((row) => row.id === "other"))
+  sqliteDatabase.prepare(`DELETE FROM flow_daily_dims WHERE server_id = 7 AND day LIKE '2026-09-%'`).run()
+}
+
 console.log("traffic-flow-analytics.test.ts: ok")
@@ -1,5 +1,5 @@
 import { eq } from "drizzle-orm"
-import { db } from "../db/index.js"
+import { db, sqliteDatabase } from "../db/index.js"
 import { appUsers, servers, userInterfaceBindings } from "../db/schema.js"
 import type {
  FlowAnalyticsDto,
@@ -7,38 +7,57 @@ import type {
  FlowClientsDto,
  FlowEntityCard,
  FlowExportersDto,
+  FlowMapEdge,
+  FlowMonthlyDto,
  FlowTalkerDto,
 } from "@mmapp/contracts/traffic-flow"
 import { protoName } from "./traffic-flow-parse.js"
 import {
  getFlowListenerState,
+  getFlowRuntimeCounters,
+  getFlowWorkerHealth,
  getRingMbps,
-  listStoredFlowRows,
+  listFlowRowsForWindow,
  type PendingFlowRow,
 } from "./traffic-flow-ingest.js"
+import { MAX_PENDING } from "./traffic-flow-engine.js"
 import { resolveIfaceName } from "./traffic-flow-ifaces.js"
 import { getTrafficFlowSettingsRow, listHostPeers } from "./traffic-flow-settings.js"
 import { applicationName, flowRowMatchesFilter } from "./traffic-flow-apps.js"
+import { dedupFlowRowsMaxBytes, flowTupleKey } from "./traffic-flow-dedup.js"
+import { enqueueRipeMisses, lookupRipeCached } from "./traffic-flow-ripe.js"
+import { classifyFlowDst, refreshFlowCatalogInBackground } from "./traffic-flow-classify.js"
+import { isIsoCountry } from "./traffic-flow-brands.js"
+
+export const LIVE_ANALYTICS_MINUTES = 5
+const LIVE_DEGRADED_PENDING = Math.floor(MAX_PENDING * 0.8)

 export interface FlowAnalyticsQuery {
  minutes: number
  serverId?: number
  userId?: string
  iface?: string
+  /** Default true: один 5-tuple = max байт по ifaces. */
+  dedup?: boolean
+  skipHeavy?: boolean
 }

 function bpsToMbps(bps: number): number {
  return bps / 1_000_000
 }

-function topN(map: Map<string, { bytes: number; packets: number }>, windowSec: number, n: number): FlowBreakdownRow[] {
+function topN(
+  map: Map<string, { bytes: number; packets: number; label?: string }>,
+  windowSec: number,
+  n: number,
+): FlowBreakdownRow[] {
  const total = [...map.values()].reduce((a, v) => a + v.bytes, 0) || 1
  return [...map.entries()]
    .sort((a, b) => b[1].bytes - a[1].bytes)
    .slice(0, n)
    .map(([id, v]) => ({
      id,
-      label: id,
+      label: v.label || id,
      bytes: v.bytes,
      packets: v.packets,
      bps: (v.bytes * 8) / windowSec,
@@ -46,10 +65,17 @@ function topN(map: Map<string, { bytes: number; packets: number }>, windowSec: n
    }))
 }

-function bump(map: Map<string, { bytes: number; packets: number }>, id: string, bytes: number, packets: number) {
-  const prev = map.get(id) ?? { bytes: 0, packets: 0 }
+function bump(
+  map: Map<string, { bytes: number; packets: number; label?: string }>,
+  id: string,
+  bytes: number,
+  packets: number,
+  label?: string,
+) {
+  const prev = map.get(id) ?? { bytes: 0, packets: 0, label }
  prev.bytes += bytes
  prev.packets += packets
+  if (label) prev.label = label
  map.set(id, prev)
 }

@@ -89,93 +115,163 @@ function snapshotStatus(serverId: number): FlowEntityCard["status"] {
  return "online"
 }

+function topLabel(map: Map<string, { bytes: number; packets: number; label?: string }>, fallback = "—"): string {
+  let best = fallback
+  let bestBytes = 0
+  for (const [id, v] of map) {
+    if (v.bytes > bestBytes) {
+      bestBytes = v.bytes
+      best = v.label || id
+    }
+  }
+  return best
+}
+
 export function buildFlowAnalytics(q: FlowAnalyticsQuery): FlowAnalyticsDto {
  const settings = getTrafficFlowSettingsRow()
  const top = Math.min(50, Math.max(10, settings.topN))
  const windowSec = Math.max(60, q.minutes * 60)
-  const sinceIso = new Date(Date.now() - q.minutes * 60_000).toISOString()
-  const raw = listStoredFlowRows(sinceIso)
+  const raw = listFlowRowsForWindow(q.minutes)
  const allow = q.userId ? userIfaceAllow(q.userId) : null
  const serverRows = db.select().from(servers).all()
  const nameById = new Map(serverRows.map((s) => [s.id, s.name || s.host]))
+  const countryById = new Map(serverRows.map((s) => [s.id, (s.country || "").toUpperCase() || "UN"]))
+  const ifaceFilter = q.iface && q.iface !== "__all__" ? q.iface : ""
+  const wantDedup = q.dedup !== false && !ifaceFilter

-  const applications = new Map<string, { bytes: number; packets: number }>()
-  const protocols = new Map<string, { bytes: number; packets: number }>()
-  const sources = new Map<string, { bytes: number; packets: number }>()
-  const destinations = new Map<string, { bytes: number; packets: number }>()
+  refreshFlowCatalogInBackground()
+
+  const applications = new Map<string, { bytes: number; packets: number; label?: string }>()
+  const protocols = new Map<string, { bytes: number; packets: number; label?: string }>()
+  const sources = new Map<string, { bytes: number; packets: number; label?: string }>()
+  const destinations = new Map<string, { bytes: number; packets: number; label?: string }>()
  const ifacesMap = new Map<string, { bytes: number; packets: number; index: string }>()
+  const asns = new Map<string, { bytes: number; packets: number; label?: string }>()
+  const countries = new Map<string, { bytes: number; packets: number; label?: string }>()
+  const categories = new Map<string, { bytes: number; packets: number; label?: string }>()
+  const services = new Map<string, { bytes: number; packets: number; label?: string }>()
  const conv = new Map<string, FlowTalkerDto & { rawBytes: number }>()
+  const edgeAcc = new Map<string, FlowMapEdge & { catBytes: Map<string, number> }>()
  const srcs = new Set<string>()
  const dsts = new Set<string>()
-  let totalBytes = 0
-  let totalPackets = 0
  const matched: PendingFlowRow[] = []
+  const skipHeavy = Boolean(q.skipHeavy)

  for (const r of raw) {
    const resolved = resolveIfaceName(r.serverId, r.inIface)
    if (!flowRowMatchesFilter(r, resolved.name, q, allow)) continue
    matched.push(r)
-    totalBytes += r.bytes
-    totalPackets += r.packets
-    srcs.add(r.src)
-    dsts.add(r.dst)
-    const app = applicationName(r.proto, r.dstPort, r.srcPort)
-    bump(applications, app, r.bytes, r.packets)
-    bump(protocols, protoName(r.proto), r.bytes, r.packets)
-    bump(sources, r.src, r.bytes, r.packets)
-    bump(destinations, r.dst, r.bytes, r.packets)
+
    const ifaceKey = resolved.name
    const prevIf = ifacesMap.get(ifaceKey) ?? { bytes: 0, packets: 0, index: resolved.index }
    prevIf.bytes += r.bytes
    prevIf.packets += r.packets
    ifacesMap.set(ifaceKey, prevIf)
+  }

-    const ckey = `${r.serverId}|${r.src}|${r.dst}|${r.proto}|${r.srcPort}|${r.dstPort}|${r.inIface}`
-    const prev = conv.get(ckey)
-    if (prev) {
-      prev.rawBytes += r.bytes
-      prev.bytes += r.bytes
-      prev.packets += r.packets
-    } else {
-      conv.set(ckey, {
-        serverId: String(r.serverId),
-        serverName: nameById.get(r.serverId) ?? String(r.serverId),
-        src: r.src,
-        dst: r.dst,
-        proto: r.proto,
-        protoName: protoName(r.proto),
-        srcPort: r.srcPort,
-        dstPort: r.dstPort,
-        bytes: r.bytes,
-        packets: r.packets,
-        bps: 0,
-        inIface: resolved.name,
-        inIfaceIndex: resolved.index,
-        application: app,
-        rawBytes: r.bytes,
-      })
+  const working = wantDedup ? dedupFlowRowsMaxBytes(matched) : matched
+  const conversationsRaw = new Set(matched.map((r) => `${flowTupleKey(r)}|${r.inIface}`)).size
+
+  let totalBytes = 0
+  let totalPackets = 0
+  for (const r of working) {
+    const resolved = resolveIfaceName(r.serverId, r.inIface)
+    totalBytes += r.bytes
+    totalPackets += r.packets
+    srcs.add(r.src)
+    dsts.add(r.dst)
+    const app = applicationName(r.proto, r.dstPort, r.srcPort)
+    const ripe = lookupRipeCached(r.dst)
+    const classified = classifyFlowDst(r.dst, r.proto, r.dstPort, r.srcPort, ripe)
+    bump(applications, app, r.bytes, r.packets)
+    bump(protocols, protoName(r.proto), r.bytes, r.packets)
+    bump(sources, r.src, r.bytes, r.packets)
+    bump(destinations, r.dst, r.bytes, r.packets)
+    bump(categories, classified.category, r.bytes, r.packets)
+    bump(services, classified.service, r.bytes, r.packets)
+    if (ripe?.ok && ripe.asn) {
+      const asnId = String(ripe.asn)
+      const asnLabel = ripe.holder ? `AS${ripe.asn} ${ripe.holder}` : `AS${ripe.asn}`
+      bump(asns, asnId, r.bytes, r.packets, asnLabel)
+    }
+    const dstCountry = ripe?.ok && isIsoCountry(ripe.country) ? ripe.country : ""
+    if (dstCountry) {
+      bump(countries, dstCountry, r.bytes, r.packets)
+    }
+
+    if (!skipHeavy) {
+      const ckey = wantDedup
+        ? flowTupleKey(r)
+        : `${flowTupleKey(r)}|${r.inIface}`
+      const prev = conv.get(ckey)
+      if (prev) {
+        prev.rawBytes += r.bytes
+        prev.bytes += r.bytes
+        prev.packets += r.packets
+      } else {
+        conv.set(ckey, {
+          serverId: String(r.serverId),
+          serverName: nameById.get(r.serverId) ?? String(r.serverId),
+          src: r.src,
+          dst: r.dst,
+          proto: r.proto,
+          protoName: protoName(r.proto),
+          srcPort: r.srcPort,
+          dstPort: r.dstPort,
+          bytes: r.bytes,
+          packets: r.packets,
+          bps: 0,
+          inIface: resolved.name,
+          inIfaceIndex: resolved.index,
+          application: app,
+          category: classified.category,
+          service: classified.service,
+          dstCountry: dstCountry || undefined,
+          dstAsn: ripe?.asn || undefined,
+          rawBytes: r.bytes,
+        })
+      }
+
+      const toCountry = dstCountry
+      if (toCountry) {
+        const fromCountry = countryById.get(r.serverId) || "UN"
+        const ekey = `${r.serverId}|${toCountry}`
+        let edge = edgeAcc.get(ekey)
+        if (!edge) {
+          edge = {
+            fromId: String(r.serverId),
+            fromLabel: nameById.get(r.serverId) ?? String(r.serverId),
+            fromCountry,
+            toCountry,
+            toAsn: ripe?.asn ?? 0,
+            category: classified.category,
+            bytes: 0,
+            bps: 0,
+            catBytes: new Map(),
+          }
+          edgeAcc.set(ekey, edge)
+        }
+        edge.bytes += r.bytes
+        if (ripe?.asn) edge.toAsn = ripe.asn
+        edge.catBytes.set(classified.category, (edge.catBytes.get(classified.category) ?? 0) + r.bytes)
+      }
    }
  }

+  enqueueRipeMisses(dsts)
+
  const conversationsList = [...conv.values()]
    .map((t) => ({ ...t, bps: (t.rawBytes * 8) / windowSec }))
    .sort((a, b) => b.bytes - a.bytes)
    .slice(0, top)
    .map(({ rawBytes: _raw, ...rest }) => rest)

-  let topProto = "—"
-  let topProtoBytes = 0
-  for (const [label, v] of protocols) {
-    if (v.bytes > topProtoBytes) {
-      topProtoBytes = v.bytes
-      topProto = label
-    }
-  }
+  const topProto = topLabel(protocols)
+  const topCategory = topLabel(categories)

-  const ifaceFilter = q.iface && q.iface !== "__all__" ? q.iface : "__all__"
  const ringServer = q.serverId ?? (matched[0]?.serverId ?? 0)
  const ring = ringServer
-    ? getRingMbps(ringServer, ifaceFilter === "__all__" ? "__all__" : (ifacesMap.get(ifaceFilter)?.index || ifaceFilter))
+    ? getRingMbps(ringServer, ifaceFilter === "" ? "__all__" : (ifacesMap.get(ifaceFilter)?.index || ifaceFilter))
    : { rx: Array(60).fill(0) as number[], tx: Array(60).fill(0) as number[], rxNow: 0, txNow: 0 }

  const fromBuckets = seriesFromRows(matched, q.minutes)
@@ -190,21 +286,46 @@ export function buildFlowAnalytics(q: FlowAnalyticsQuery): FlowAnalyticsDto {
      bps: (v.bytes * 8) / windowSec,
    }))

-  const protoBreakdown = topN(protocols, windowSec, top)
+  const ifaceRawBytes = [...ifacesMap.values()].reduce((a, v) => a + v.bytes, 0) || 1
  const listener = getFlowListenerState()
+  const mapEdges: FlowMapEdge[] = [...edgeAcc.values()]
+    .map((e) => {
+      let cat = e.category
+      let catBest = 0
+      for (const [label, bytes] of e.catBytes) {
+        if (bytes > catBest) {
+          catBest = bytes
+          cat = label
+        }
+      }
+      return {
+        fromId: e.fromId,
+        fromLabel: e.fromLabel,
+        fromCountry: e.fromCountry,
+        toCountry: e.toCountry,
+        toAsn: e.toAsn,
+        category: cat,
+        bytes: e.bytes,
+        bps: (e.bytes * 8) / windowSec,
+      }
+    })
+    .sort((a, b) => b.bytes - a.bytes)
+    .slice(0, top)

  return {
    bpsNow: (ring.rxNow + ring.txNow) * 1_000_000 || (totalBytes * 8) / windowSec,
    bytes: totalBytes,
    packets: totalPackets,
    conversations: conv.size,
+    conversationsRaw,
    uniqueSrc: srcs.size,
    uniqueDst: dsts.size,
    topProto,
+    topCategory,
    rxSeries,
    txSeries,
    applications: topN(applications, windowSec, top),
-    protocols: protoBreakdown,
+    protocols: topN(protocols, windowSec, top),
    sources: topN(sources, windowSec, top),
    destinations: topN(destinations, windowSec, top),
    interfaces: [...ifacesMap.entries()].map(([label, v]) => ({
@@ -213,55 +334,67 @@ export function buildFlowAnalytics(q: FlowAnalyticsQuery): FlowAnalyticsDto {
      bytes: v.bytes,
      packets: v.packets,
      bps: (v.bytes * 8) / windowSec,
-      percent: totalBytes > 0 ? (v.bytes / totalBytes) * 100 : 0,
+      percent: (v.bytes / ifaceRawBytes) * 100,
    })).sort((a, b) => b.bytes - a.bytes),
+    asns: topN(asns, windowSec, top),
+    countries: topN(countries, windowSec, top),
+    categories: topN(categories, windowSec, top),
+    services: topN(services, windowSec, top),
+    mapEdges,
    conversationsList,
    ifaces: ifaceRows,
    live: listener.bound,
+    dedupApplied: wantDedup,
+    degraded: skipHeavy,
  }
 }

-function cardFromServer(
-  s: typeof servers.$inferSelect,
-  minutes: number,
-): FlowEntityCard {
-  const analytics = buildFlowAnalytics({ minutes, serverId: s.id })
-  const ring = getRingMbps(s.id, "__all__")
-  return {
-    id: String(s.id),
-    name: s.name || s.host,
-    subtitle: s.host,
-    site: s.site || "—",
-    country: s.country || "UN",
-    status: snapshotStatus(s.id),
-    rxNow: ring.rxNow || bpsToMbps(analytics.bpsNow),
-    txNow: ring.txNow,
-    sessions: analytics.conversations,
-    rxSeries: ring.rx.some((v) => v > 0) ? ring.rx : analytics.rxSeries,
-    txSeries: ring.tx,
-    bytes: analytics.bytes,
+function summarizeByServer(rows: PendingFlowRow[]) {
+  const bytes = new Map<number, number>()
+  const sessions = new Map<number, number>()
+  for (const r of rows) {
+    bytes.set(r.serverId, (bytes.get(r.serverId) ?? 0) + r.bytes)
+    sessions.set(r.serverId, (sessions.get(r.serverId) ?? 0) + 1)
  }
+  return { bytes, sessions }
 }

 export function listFlowExporters(minutes: number): FlowExportersDto {
-  const settings = getTrafficFlowSettingsRow()
-  const sinceIso = new Date(Date.now() - minutes * 60_000).toISOString()
-  const rows = listStoredFlowRows(sinceIso)
-  const ids = new Set<number>()
-  for (const r of rows) ids.add(r.serverId)
+  const runtime = getFlowRuntimeCounters()
+  const rows = listFlowRowsForWindow(minutes)
+  const { bytes, sessions } = summarizeByServer(rows)
+  const ids = new Set<number>([...bytes.keys()])
  for (const p of listHostPeers()) ids.add(p.serverId)
  const serverRows = db.select().from(servers).all()
+  const emptySeries = Array(60).fill(0) as number[]
  const exporters = serverRows
    .filter((s) => ids.has(s.id))
-    .map((s) => cardFromServer(s, minutes))
+    .map((s) => {
+      const ring = getRingMbps(s.id, "__all__")
+      const total = bytes.get(s.id) ?? 0
+      return {
+        id: String(s.id),
+        name: s.name || s.host,
+        subtitle: s.host,
+        site: s.site || "—",
+        country: s.country || "UN",
+        status: snapshotStatus(s.id),
+        rxNow: ring.rxNow || (total * 8) / Math.max(60, minutes * 60) / 1_000_000,
+        txNow: ring.txNow,
+        sessions: sessions.get(s.id) ?? 0,
+        rxSeries: ring.rx.some((v) => v > 0) ? ring.rx : emptySeries,
+        txSeries: ring.tx,
+        bytes: total,
+      } satisfies FlowEntityCard
+    })
    .sort((a, b) => b.rxNow - a.rxNow)
  const listener = getFlowListenerState()
  return {
    exporters,
-    lastExporterIp: settings.lastExporterIp ?? null,
-    lastError: settings.lastError || null,
-    packetsReceived: settings.packetsReceived,
-    lastDatagramAt: settings.lastDatagramAt ?? null,
+    lastExporterIp: runtime.lastExporterIp,
+    lastError: runtime.lastError,
+    packetsReceived: runtime.packetsReceived,
+    lastDatagramAt: runtime.lastDatagramAt,
    listenerBound: listener.bound,
    listenerAddress: listener.address,
  }
@@ -276,13 +409,31 @@ export function listFlowClients(minutes: number): FlowClientsDto {
    list.push(b)
    byUser.set(b.userId, list)
  }
+  const rows = listFlowRowsForWindow(minutes)
+  const emptySeries = Array(60).fill(0) as number[]
+  const windowSec = Math.max(60, minutes * 60)
  const clients: FlowEntityCard[] = []
  for (const u of users) {
    const userBinds = byUser.get(u.id) ?? []
    if (userBinds.length === 0) continue
-    const analytics = buildFlowAnalytics({ minutes, userId: u.id })
+    const allow = new Map<number, Set<string>>()
+    for (const b of userBinds) {
+      const set = allow.get(b.serverId) ?? new Set<string>()
+      set.add(b.interfaceName)
+      allow.set(b.serverId, set)
+    }
+    let total = 0
+    let sessions = 0
+    for (const r of rows) {
+      const resolved = resolveIfaceName(r.serverId, r.inIface)
+      const names = allow.get(r.serverId)
+      if (!names) continue
+      if (!names.has(resolved.name) && !names.has(r.inIface)) continue
+      total += r.bytes
+      sessions += 1
+    }
    const firstServer = userBinds[0]?.serverId
-    const ring = firstServer ? getRingMbps(firstServer, "__all__") : { rx: Array(60).fill(0) as number[], tx: Array(60).fill(0) as number[], rxNow: 0, txNow: 0 }
+    const ring = firstServer ? getRingMbps(firstServer, "__all__") : { rx: emptySeries, tx: emptySeries, rxNow: 0, txNow: 0 }
    clients.push({
      id: u.id,
      name: u.login,
@@ -290,14 +441,110 @@ export function listFlowClients(minutes: number): FlowClientsDto {
      site: `${userBinds.length} ifaces`,
      country: "UN",
      status: u.active ? "online" : "offline",
-      rxNow: bpsToMbps(analytics.bpsNow) || ring.rxNow,
+      rxNow: (total * 8) / windowSec / 1_000_000 || ring.rxNow,
      txNow: ring.txNow,
-      sessions: analytics.conversations,
-      rxSeries: analytics.rxSeries,
-      txSeries: analytics.txSeries,
-      bytes: analytics.bytes,
+      sessions,
+      rxSeries: ring.rx.some((v) => v > 0) ? ring.rx : emptySeries,
+      txSeries: ring.tx,
+      bytes: total,
    })
  }
  clients.sort((a, b) => b.rxNow - a.rxNow)
  return { clients }
 }
+
+export function formatLiveSseFromBuilder(build: () => unknown): { event: "sample" | "error"; data: unknown } {
+  try {
+    return { event: "sample", data: build() }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err)
+    return { event: "error", data: { error: message } }
+  }
+}
+
+export function isFlowAnalyticsDegraded(): boolean {
+  const health = getFlowWorkerHealth()
+  return health.pendingSize >= LIVE_DEGRADED_PENDING
+}
+
+export function safeBuildLiveFlowSample(q: Omit<FlowAnalyticsQuery, "minutes" | "skipHeavy">): {
+  event: "sample" | "error"
+  data: unknown
+} {
+  return formatLiveSseFromBuilder(() => {
+    const skipHeavy = isFlowAnalyticsDegraded()
+    return buildFlowAnalytics({ ...q, minutes: LIVE_ANALYTICS_MINUTES, skipHeavy })
+  })
+}
+
+function monthBounds(month: string): { start: string; end: string } | null {
+  if (!/^\d{4}-\d{2}$/.test(month)) return null
+  const [yearRaw, monthRaw] = month.split("-")
+  const year = Number(yearRaw)
+  const monthIdx = Number(monthRaw)
+  if (!Number.isFinite(year) || monthIdx < 1 || monthIdx > 12) return null
+  const start = `${month}-01`
+  const endDate = new Date(Date.UTC(year, monthIdx, 1))
+  const end = endDate.toISOString().slice(0, 10)
+  return { start, end }
+}
+
+function toBreakdown(
+  rows: Array<{ key: string; bytes: number; packets: number }>,
+  totalBytes: number,
+  windowSec: number,
+): FlowBreakdownRow[] {
+  const denom = totalBytes || 1
+  return rows
+    .sort((a, b) => b.bytes - a.bytes)
+    .map((r) => ({
+      id: r.key,
+      label: r.key,
+      bytes: r.bytes,
+      packets: r.packets,
+      bps: (r.bytes * 8) / windowSec,
+      percent: (r.bytes / denom) * 100,
+    }))
+}
+
+export function getFlowMonthly(month: string, serverId?: number): FlowMonthlyDto {
+  const bounds = monthBounds(month)
+  if (!bounds) {
+    return { month, bytes: 0, countries: [], services: [], asns: [] }
+  }
+  const params: Array<string | number> = [bounds.start, bounds.end]
+  let where = "day >= ? AND day < ? AND dim IN ('country', 'service', 'asn')"
+  if (serverId != null) {
+    where += " AND server_id = ?"
+    params.push(serverId)
+  }
+  const rows = sqliteDatabase.prepare(`
+    SELECT dim AS dim, key AS key, SUM(bytes) AS bytes, SUM(packets) AS packets
+    FROM flow_daily_dims
+    WHERE ${where}
+    GROUP BY dim, key
+  `).all(...params) as Array<{ dim: string; key: string; bytes: number; packets: number }>
+
+  const countries: Array<{ key: string; bytes: number; packets: number }> = []
+  const services: Array<{ key: string; bytes: number; packets: number }> = []
+  const asns: Array<{ key: string; bytes: number; packets: number }> = []
+  let bytes = 0
+  for (const row of rows) {
+    const rec = { key: row.key, bytes: Number(row.bytes) || 0, packets: Number(row.packets) || 0 }
+    if (row.dim === "country") {
+      countries.push(rec)
+      bytes += rec.bytes
+    } else if (row.dim === "service") services.push(rec)
+    else if (row.dim === "asn") asns.push(rec)
+  }
+  const daysInMonth = Math.max(1, Math.round((Date.parse(`${bounds.end}T00:00:00Z`) - Date.parse(`${bounds.start}T00:00:00Z`)) / 86_400_000))
+  const windowSec = daysInMonth * 86_400
+  const countryTotal = countries.reduce((a, r) => a + r.bytes, 0) || bytes || 1
+  return {
+    month,
+    bytes,
+    countries: toBreakdown(countries, countryTotal, windowSec),
+    services: toBreakdown(services, services.reduce((a, r) => a + r.bytes, 0) || 1, windowSec),
+    asns: toBreakdown(asns, asns.reduce((a, r) => a + r.bytes, 0) || 1, windowSec),
+  }
+}
@@ -0,0 +1,26 @@
+import assert from "node:assert/strict"
+import {
+  brandByAsn,
+  countryFromHolder,
+  lookupBrand,
+  OTHER_SERVICE,
+  resolveRipeCountry,
+} from "./traffic-flow-brands.js"
+
+assert.equal(resolveRipeCountry("?", 13335, "CLOUDFLARENET, US"), "US")
+assert.equal(resolveRipeCountry("EU", 13335, ""), "US")
+assert.equal(resolveRipeCountry("?", 0, "CLOUDFLARENET, US"), "US")
+assert.equal(countryFromHolder("CLOUDFLARENET, US"), "US")
+assert.equal(resolveRipeCountry("NL", 0, ""), "NL")
+assert.equal(resolveRipeCountry("?", 0, ""), "")
+
+assert.equal(brandByAsn(13335)?.service, "Cloudflare")
+assert.equal(brandByAsn(13335)?.category, "CDN")
+assert.equal(brandByAsn(32590)?.service, "Steam")
+assert.equal(brandByAsn(32590)?.category, "Игры")
+assert.equal(brandByAsn(401115)?.service, "ChatGPT")
+assert.equal(lookupBrand("1.1.1.1", 13335)?.service, "Cloudflare")
+assert.equal(lookupBrand("203.0.113.9", 64500), null)
+assert.equal(OTHER_SERVICE, "Прочее")
+
+console.log("traffic-flow-brands.test.ts: ok")
@@ -0,0 +1,105 @@
+import { ipInCidrV4, parseCidrV4 } from "./traffic-flow-ip.js"
+
+export const OTHER_SERVICE = "Прочее"
+
+export interface BrandHit {
+  service: string
+  category: string
+}
+
+const ASN_BRANDS = new Map<number, BrandHit>([
+  [13335, { service: "Cloudflare", category: "CDN" }],
+  [209242, { service: "Cloudflare", category: "CDN" }],
+  [54113, { service: "Fastly", category: "CDN" }],
+  [20940, { service: "Akamai", category: "CDN" }],
+  [16509, { service: "Amazon", category: "CDN" }],
+  [14618, { service: "Amazon", category: "CDN" }],
+  [8075, { service: "Microsoft", category: "CDN" }],
+  [13238, { service: "Yandex", category: "CDN" }],
+  [32590, { service: "Steam", category: "Игры" }],
+  [2906, { service: "Netflix", category: "Видео / стриминг" }],
+  [40027, { service: "Netflix", category: "Видео / стриминг" }],
+  [15169, { service: "Google", category: "Видео / стриминг" }],
+  [36040, { service: "YouTube", category: "Видео / стриминг" }],
+  [46489, { service: "Twitch", category: "Видео / стриминг" }],
+  [401115, { service: "ChatGPT", category: "ИИ" }],
+  [49544, { service: "Discord", category: "Голос" }],
+  [62041, { service: "Telegram", category: "Голос" }],
+  [59930, { service: "Telegram", category: "Голос" }],
+  [211157, { service: "Telegram", category: "Голос" }],
+  [32934, { service: "Meta", category: "CDN" }],
+  [396986, { service: "TikTok", category: "Видео / стриминг" }],
+])
+
+const ASN_HQ_COUNTRY = new Map<number, string>([
+  [13335, "US"],
+  [209242, "US"],
+  [54113, "US"],
+  [20940, "US"],
+  [16509, "US"],
+  [14618, "US"],
+  [8075, "US"],
+  [15169, "US"],
+  [32590, "US"],
+  [2906, "US"],
+  [40027, "US"],
+  [36040, "US"],
+  [46489, "US"],
+  [401115, "US"],
+  [49544, "US"],
+  [32934, "US"],
+  [13238, "RU"],
+  [62041, "NL"],
+  [59930, "NL"],
+  [211157, "NL"],
+])
+
+const CIDR_BRANDS: Array<{ cidr: string; prefixLen: number; hit: BrandHit }> = [
+  { cidr: "104.16.0.0/13", prefixLen: 13, hit: { service: "Cloudflare", category: "CDN" } },
+  { cidr: "104.24.0.0/14", prefixLen: 14, hit: { service: "Cloudflare", category: "CDN" } },
+  { cidr: "172.64.0.0/13", prefixLen: 13, hit: { service: "Cloudflare", category: "CDN" } },
+  { cidr: "162.158.0.0/15", prefixLen: 15, hit: { service: "Cloudflare", category: "CDN" } },
+].sort((a, b) => b.prefixLen - a.prefixLen)
+
+const NON_ISO = new Set(["EU", "AP", "ZZ", "XX", "A1", "A2", "O1"])
+
+export function isIsoCountry(code: string): boolean {
+  const c = String(code ?? "").trim().toUpperCase()
+  return /^[A-Z]{2}$/.test(c) && !NON_ISO.has(c)
+}
+
+export function normalizeIsoCountry(code: string): string {
+  const c = String(code ?? "").trim().toUpperCase()
+  return isIsoCountry(c) ? c : ""
+}
+
+/** `CLOUDFLARENET, US` → `US`. */
+export function countryFromHolder(holder: string): string {
+  const m = String(holder ?? "").trim().match(/,\s*([A-Za-z]{2})\s*$/)
+  return m?.[1] ? normalizeIsoCountry(m[1]) : ""
+}
+
+export function countryForAsn(asn: number): string {
+  if (!asn) return ""
+  return ASN_HQ_COUNTRY.get(asn) ?? ""
+}
+
+export function resolveRipeCountry(country: string, asn: number, holder: string): string {
+  return normalizeIsoCountry(country) || countryFromHolder(holder) || countryForAsn(asn)
+}
+
+export function brandByAsn(asn: number): BrandHit | null {
+  if (!asn) return null
+  return ASN_BRANDS.get(asn) ?? null
+}
+
+export function brandByCidr(ip: string): BrandHit | null {
+  for (const row of CIDR_BRANDS) {
+    if (parseCidrV4(row.cidr) && ipInCidrV4(ip, row.cidr)) return row.hit
+  }
+  return null
+}
+
+export function lookupBrand(ip: string, asn: number): BrandHit | null {
+  return brandByCidr(ip) || brandByAsn(asn)
+}
@@ -0,0 +1,25 @@
+import assert from "node:assert/strict"
+import { classifyFlowDst, disableCatalogFetchForTests, resetFlowCatalogForTests, seedFlowCatalogForTests } from "./traffic-flow-classify.js"
+
+disableCatalogFetchForTests()
+resetFlowCatalogForTests()
+seedFlowCatalogForTests({
+  cidrs: [{ cidr: "192.0.2.0/24", purpose: "steam-gaming" }],
+})
+
+const hit = classifyFlowDst("192.0.2.10", 6, 443, 50000, null)
+assert.equal(hit.category, "Игры")
+assert.equal(hit.service, "steam-gaming")
+
+const miss = classifyFlowDst("203.0.113.9", 17, 53, 53000, null)
+assert.equal(miss.category, "DNS")
+
+const cdn = classifyFlowDst("203.0.113.9", 6, 443, 1, { prefix: "203.0.113.0/24", asn: 13335, country: "US", lat: null, lng: null, holder: "CLOUDFLARENET", ok: true, fetchedAt: Date.now() })
+assert.equal(cdn.category, "CDN")
+assert.equal(cdn.service, "Cloudflare")
+
+const amazonHolder = classifyFlowDst("203.0.113.50", 6, 443, 1, { prefix: "203.0.113.0/24", asn: 64500, country: "RU", lat: null, lng: null, holder: "AMAZON-AES - Amazon.com, Inc.", ok: true, fetchedAt: Date.now() })
+assert.equal(amazonHolder.service, "Прочее")
+assert.notEqual(amazonHolder.service, "AMAZON-AES - Amazon.com, Inc.")
+
+console.log("traffic-flow-classify.test.ts: ok")
@@ -0,0 +1,142 @@
+import { lookupBrand, OTHER_SERVICE } from "./traffic-flow-brands.js"
+import { db } from "../db/index.js"
+import { evobgpSettings } from "../db/schema.js"
+import { ipInCidrV4, parseCidrV4 } from "./traffic-flow-ip.js"
+import type { FlowIpMeta } from "./traffic-flow-ripe.js"
+import { applicationName } from "./traffic-flow-apps.js"
+
+export interface FlowClassification {
+  service: string
+  category: string
+}
+
+interface CatalogCidr {
+  cidr: string
+  purpose: string
+  prefixLen: number
+}
+
+const CATALOG_TTL_MS = 10 * 60_000
+let cidrs: CatalogCidr[] = []
+let asnPurpose = new Map<number, string>()
+let fetchedAt = 0
+let catalogFetchEnabled = true
+let inflight: Promise<void> | null = null
+
+export function disableCatalogFetchForTests(): void {
+  catalogFetchEnabled = false
+}
+
+export function resetFlowCatalogForTests(): void {
+  cidrs = []
+  asnPurpose = new Map()
+  fetchedAt = 0
+  inflight = null
+}
+
+export function seedFlowCatalogForTests(input: {
+  cidrs?: Array<{ cidr: string; purpose: string }>
+  asns?: Array<{ asn: number; purpose: string }>
+}): void {
+  cidrs = (input.cidrs ?? [])
+    .map((c) => ({ cidr: c.cidr, purpose: c.purpose, prefixLen: parseCidrV4(c.cidr)?.prefixLen ?? 0 }))
+    .sort((a, b) => b.prefixLen - a.prefixLen)
+  asnPurpose = new Map((input.asns ?? []).map((a) => [a.asn, a.purpose]))
+  fetchedAt = Date.now()
+}
+
+export function categoryFromPurpose(purpose: string, proto: number, dstPort: number, srcPort: number): string {
+  const p = purpose.toLowerCase()
+  if (/gaming|steam|epic|riot/.test(p)) return "Игры"
+  if (/streaming|youtube|netflix|twitch|video/.test(p)) return "Видео / стриминг"
+  if (/cdn|cloudflare|akamai|fastly/.test(p)) return "CDN"
+  if (/voip|discord|zoom/.test(p)) return "Голос"
+  if (/openai|chatgpt|\bai\b/.test(p)) return "ИИ"
+  const app = applicationName(proto, dstPort, srcPort)
+  if (app === "DNS" || app === "SSH" || app === "BGP") return app
+  return OTHER_SERVICE
+}
+
+function matchCidr(ip: string): CatalogCidr | null {
+  for (const row of cidrs) {
+    if (ipInCidrV4(ip, row.cidr)) return row
+  }
+  return null
+}
+
+export function classifyFlowDst(
+  dst: string,
+  proto: number,
+  dstPort: number,
+  srcPort: number,
+  ripe: FlowIpMeta | null,
+): FlowClassification {
+  const hit = matchCidr(dst)
+  const brand = lookupBrand(dst, ripe?.asn ?? 0)
+  const asnName = ripe?.asn ? asnPurpose.get(ripe.asn) : undefined
+  const service = (hit?.purpose || brand?.service || asnName || OTHER_SERVICE).trim() || OTHER_SERVICE
+  const category = hit
+    ? categoryFromPurpose(hit.purpose, proto, dstPort, srcPort)
+    : (brand?.category || categoryFromPurpose(asnName || "", proto, dstPort, srcPort))
+  return { service, category }
+}
+
+async function fetchCatalog(): Promise<void> {
+  if (!catalogFetchEnabled) return
+  if (Date.now() - fetchedAt < CATALOG_TTL_MS) return
+  if (inflight) return inflight
+  inflight = (async () => {
+    try {
+      const row = db.select().from(evobgpSettings).limit(1).all()[0]
+      if (!row?.enabled) return
+      const root = String(row.baseUrl ?? "").replace(/\/+$/, "")
+      const token = String(row.apiKey ?? "").replace(/^Bearer\s+/i, "").trim()
+      if (!root || !token) return
+      const ac = new AbortController()
+      const t = setTimeout(() => ac.abort(), 20_000)
+      try {
+        const res = await fetch(`${root}/v1/router-lists/catalog`, {
+          headers: { Authorization: `Bearer ${token}`, Accept: "application/json" },
+          signal: ac.signal,
+        })
+        if (!res.ok) return
+        const catalog = await res.json() as {
+          modules?: { items?: Array<{ id: string; name: string }> }
+          ip_ranges?: { items?: Array<{ module_id: string; entry: { prefix: string } }> }
+          asns?: { items?: Array<{ module_id: string; entry: { asn: number } }> }
+        }
+        const mods = new Map((catalog.modules?.items ?? []).map((m) => [m.id, m.name]))
+        const next: CatalogCidr[] = []
+        for (const item of catalog.ip_ranges?.items ?? []) {
+          const prefix = String(item.entry?.prefix ?? "").trim()
+          const purpose = mods.get(item.module_id) ?? ""
+          const parsed = parseCidrV4(prefix)
+          if (!prefix || !parsed) continue
+          next.push({ cidr: prefix, purpose, prefixLen: parsed.prefixLen })
+        }
+        next.sort((a, b) => b.prefixLen - a.prefixLen)
+        const nextAsn = new Map<number, string>()
+        for (const item of catalog.asns?.items ?? []) {
+          const purpose = mods.get(item.module_id)
+          const asn = Number(item.entry?.asn)
+          if (purpose && Number.isFinite(asn) && asn > 0) nextAsn.set(asn, purpose)
+        }
+        cidrs = next
+        asnPurpose = nextAsn
+        fetchedAt = Date.now()
+      } finally {
+        clearTimeout(t)
+      }
+    } catch {
+      /* catalog optional */
+    } finally {
+      inflight = null
+    }
+  })()
+  return inflight
+}
+
+/** Background refresh — analytics never awaits the HTTP. */
+export function refreshFlowCatalogInBackground(): void {
+  void fetchCatalog()
+}
@@ -0,0 +1,41 @@
+import type { OverlayPeerRef } from "./traffic-flow-map-exporter.js"
+
+export interface ExporterMapPayload {
+  overlayPrefix: string
+  byTunnelIp: Array<[string, number]>
+  peers: OverlayPeerRef[]
+  hostIps: Array<[string, number]>
+}
+
+export interface CollectorStartPayload {
+  dbPath: string
+  listenHost: string
+  listenPort: number
+  topN: number
+  retentionHours: number
+  exporterMap: ExporterMapPayload
+}
+
+export interface CollectorHeartbeat {
+  bound: boolean
+  address: string | null
+  packetsReceived: number
+  lastExporterIp: string | null
+  lastError: string
+  lastDatagramAt: string | null
+  pendingSize: number
+  dropped: number
+  rowsStored: number
+  workerAlive: boolean
+  rings: Array<{ key: string; inBps: number[]; outBps: number[] }>
+}
+
+export type MainToWorker =
+  | { type: "start"; payload: CollectorStartPayload }
+  | { type: "stop" }
+  | { type: "updateExporterMap"; payload: ExporterMapPayload }
+  | { type: "updateSettings"; payload: { topN: number; retentionHours: number } }
+
+export type WorkerToMain =
+  | { type: "heartbeat"; payload: CollectorHeartbeat }
+  | { type: "error"; payload: { message: string } }
@@ -0,0 +1,141 @@
+import { createSocket, type Socket } from "node:dgram"
+import { parentPort } from "node:worker_threads"
+import { sqliteDatabase } from "../db/index.js"
+import type {
+  CollectorStartPayload,
+  ExporterMapPayload,
+  MainToWorker,
+  WorkerToMain,
+} from "./traffic-flow-collector-ipc.js"
+import {
+  TICK_MS,
+  attachEngineSqlite,
+  configureEngine,
+  flushPending,
+  getEngineStats,
+  ingestDatagram,
+  setEngineError,
+  setExporterResolveCtx,
+  snapshotRings,
+} from "./traffic-flow-engine.js"
+
+let socket: Socket | null = null
+let flushTimer: ReturnType<typeof setInterval> | null = null
+let bound = false
+let address: string | null = null
+let attached = false
+
+function send(msg: WorkerToMain): void {
+  parentPort?.postMessage(msg)
+}
+
+function heartbeat(): void {
+  const stats = getEngineStats()
+  send({
+    type: "heartbeat",
+    payload: {
+      bound,
+      address,
+      packetsReceived: stats.packetsReceived,
+      lastExporterIp: stats.lastExporterIp,
+      lastError: stats.lastError,
+      lastDatagramAt: stats.lastDatagramAt,
+      pendingSize: stats.pendingSize,
+      dropped: stats.dropped,
+      rowsStored: stats.rowsStored,
+      workerAlive: true,
+      rings: snapshotRings(),
+    },
+  })
+}
+
+function applyExporterMap(payload: ExporterMapPayload): void {
+  setExporterResolveCtx({
+    overlayPrefix: payload.overlayPrefix,
+    byTunnelIp: new Map(payload.byTunnelIp),
+    peers: payload.peers,
+    hostIps: new Map(payload.hostIps),
+  })
+}
+
+function ensureSqlite(): void {
+  if (attached) return
+  attachEngineSqlite(sqliteDatabase)
+  attached = true
+}
+
+function stopListener(): void {
+  if (flushTimer) {
+    clearInterval(flushTimer)
+    flushTimer = null
+  }
+  try {
+    flushPending()
+  } catch (e) {
+    setEngineError(e instanceof Error ? e.message : String(e))
+  }
+  if (socket) {
+    try { socket.close() } catch { /* ignore */ }
+    socket = null
+  }
+  bound = false
+  address = null
+}
+
+function startListener(payload: CollectorStartPayload): void {
+  stopListener()
+  ensureSqlite()
+  configureEngine({ topN: payload.topN, retentionHours: payload.retentionHours })
+  applyExporterMap(payload.exporterMap)
+
+  const sock = createSocket("udp4")
+  sock.on("error", (err) => {
+    setEngineError(err.message)
+    bound = false
+    address = null
+    send({ type: "error", payload: { message: err.message } })
+    heartbeat()
+  })
+  sock.on("message", (msg, rinfo) => {
+    try {
+      ingestDatagram(msg, rinfo.address)
+    } catch (e) {
+      setEngineError(e instanceof Error ? e.message : String(e))
+    }
+  })
+  try {
+    sock.setRecvBufferSize(8 * 1024 * 1024)
+  } catch {
+    /* platform may ignore */
+  }
+  sock.bind(payload.listenPort, payload.listenHost, () => {
+    bound = true
+    address = `${payload.listenHost}:${payload.listenPort}`
+    setEngineError("")
+    heartbeat()
+  })
+  socket = sock
+  flushTimer = setInterval(() => {
+    try {
+      flushPending()
+    } catch (e) {
+      setEngineError(e instanceof Error ? e.message : String(e))
+    }
+    heartbeat()
+  }, TICK_MS)
+}
+
+parentPort?.on("message", (msg: MainToWorker) => {
+  try {
+    if (msg.type === "start") startListener(msg.payload)
+    else if (msg.type === "stop") {
+      stopListener()
+      heartbeat()
+    } else if (msg.type === "updateExporterMap") applyExporterMap(msg.payload)
+    else if (msg.type === "updateSettings") configureEngine(msg.payload)
+  } catch (e) {
+    const message = e instanceof Error ? e.message : String(e)
+    setEngineError(message)
+    send({ type: "error", payload: { message } })
+  }
+})
@@ -0,0 +1,25 @@
+import assert from "node:assert/strict"
+import { dedupFlowRowsMaxBytes, flowTupleKey } from "./traffic-flow-dedup.js"
+
+const a = {
+  serverId: 7,
+  src: "10.1.1.8",
+  dst: "8.8.8.8",
+  proto: 6,
+  srcPort: 1,
+  dstPort: 443,
+  inIface: "2",
+  bytes: 12_000,
+  packets: 10,
+}
+const b = { ...a, inIface: "10", bytes: 8_000, packets: 8 }
+const out = dedupFlowRowsMaxBytes([a, b])
+assert.equal(out.length, 1)
+assert.equal(out[0]?.bytes, 12_000)
+assert.equal(out[0]?.inIface, "2")
+assert.equal(flowTupleKey(a), flowTupleKey(b))
+
+const sameIface = dedupFlowRowsMaxBytes([a, { ...a, bytes: 3_000, packets: 2 }])
+assert.equal(sameIface[0]?.bytes, 15_000)
+
+console.log("traffic-flow-dedup.test.ts: ok")
@@ -0,0 +1,44 @@
+export interface FlowTupleRow {
+  serverId: number
+  src: string
+  dst: string
+  proto: number
+  srcPort: number
+  dstPort: number
+  inIface: string
+  bytes: number
+  packets: number
+}
+
+export function flowTupleKey(r: Pick<FlowTupleRow, "serverId" | "src" | "dst" | "proto" | "srcPort" | "dstPort">): string {
+  return `${r.serverId}|${r.src}|${r.dst}|${r.proto}|${r.srcPort}|${r.dstPort}`
+}
+
+function ifaceKey(r: FlowTupleRow): string {
+  return `${flowTupleKey(r)}|${r.inIface}`
+}
+
+/**
+ * Один 5-tuple на двух ifIndex — это один поток: сначала сумма по бакетам/iface,
+ * затем max байт между интерфейсами (не sum).
+ */
+export function dedupFlowRowsMaxBytes<T extends FlowTupleRow>(rows: T[]): T[] {
+  const byIface = new Map<string, T>()
+  for (const row of rows) {
+    const key = ifaceKey(row)
+    const prev = byIface.get(key)
+    if (!prev) {
+      byIface.set(key, { ...row })
+      continue
+    }
+    prev.bytes += row.bytes
+    prev.packets += row.packets
+  }
+  const byTuple = new Map<string, T>()
+  for (const row of byIface.values()) {
+    const key = flowTupleKey(row)
+    const prev = byTuple.get(key)
+    if (!prev || row.bytes > prev.bytes) byTuple.set(key, row)
+  }
+  return [...byTuple.values()]
+}
@@ -0,0 +1,706 @@
+import type Database from "better-sqlite3"
+import { parseFlowPacket, protoName, type ParsedFlow } from "./traffic-flow-parse.js"
+import { pickServerIdForExporter, type OverlayPeerRef } from "./traffic-flow-map-exporter.js"
+import { applicationName } from "./traffic-flow-apps.js"
+import { classifyFlowDst } from "./traffic-flow-classify.js"
+import { enqueueRipeMisses, lookupRipeCached } from "./traffic-flow-ripe.js"
+import { isIsoCountry } from "./traffic-flow-brands.js"
+import { maybeRefreshIfaces } from "./traffic-flow-ifaces.js"
+
+type SqliteHandle = InstanceType<typeof Database>
+
+export const TICK_MS = 2_000
+export const RING_LEN = 60
+export const MAX_PENDING = 50_000
+export const DAILY_ASN_TOP = 500
+export const DAILY_RETENTION_DAYS = 396
+export const MINUTE_RETENTION_HOURS = 48
+
+let pendingCap = MAX_PENDING
+
+export interface PendingFlowRow {
+  serverId: number
+  bucketAt: string
+  src: string
+  dst: string
+  proto: number
+  srcPort: number
+  dstPort: number
+  bytes: number
+  packets: number
+  inIface: string
+  outIface: string
+}
+
+export interface EngineStats {
+  packetsReceived: number
+  lastExporterIp: string | null
+  lastError: string
+  lastDatagramAt: string | null
+  dropped: number
+  rowsStored: number
+  pendingSize: number
+}
+
+interface PendingEntry {
+  serverId: number
+  bucketAt: string
+  flow: ParsedFlow
+  bytes: number
+  packets: number
+}
+
+interface MinuteRollup {
+  bytes: number
+  packets: number
+  srcs: Set<string>
+  dsts: Set<string>
+  conversations: number
+}
+
+interface DimAcc {
+  bytes: number
+  packets: number
+}
+
+export interface ExporterResolveCtx {
+  overlayPrefix: string
+  byTunnelIp: Map<string, number>
+  peers: OverlayPeerRef[]
+  hostIps: Map<string, number>
+}
+
+let sqliteRef: SqliteHandle | null = null
+let topN = 200
+let retentionHours = 24
+
+const pending = new Map<string, PendingEntry>()
+const recent = new Map<string, PendingFlowRow>()
+const tickAccum = new Map<string, { inBytes: number; outBytes: number }>()
+const rings = new Map<string, { inBps: number[]; outBps: number[] }>()
+const minuteRollup = new Map<string, MinuteRollup>()
+const minuteDims = new Map<string, DimAcc>()
+
+let packetsReceived = 0
+let lastExporterIp: string | null = null
+let lastError = ""
+let lastDatagramAt: string | null = null
+let dropped = 0
+let rowsStored = 0
+let lastFlushUsedTransaction = false
+let lastPruneAt = 0
+let exporterCtx: ExporterResolveCtx | null = null
+
+const PRUNE_MS = 5 * 60_000
+const LIVE_WINDOW_MS = 15 * 60_000
+
+function nowIso(): string {
+  return new Date().toISOString()
+}
+
+export function minuteBucketIso(at = Date.now()): string {
+  const d = new Date(at)
+  d.setSeconds(0, 0)
+  return d.toISOString()
+}
+
+function dayKey(bucketAt: string): string {
+  return bucketAt.slice(0, 10)
+}
+
+function ringKey(serverId: number, iface: string): string {
+  return `${serverId}\0${iface || "__all__"}`
+}
+
+function pendingKey(serverId: number, bucketAt: string, flow: ParsedFlow): string {
+  return `${serverId}\0${bucketAt}\0${flow.src}\0${flow.dst}\0${flow.proto}\0${flow.srcPort}\0${flow.dstPort}\0${flow.inIface}`
+}
+
+function rowKey(row: PendingFlowRow): string {
+  return `${row.serverId}|${row.bucketAt}|${row.src}|${row.dst}|${row.proto}|${row.srcPort}|${row.dstPort}|${row.inIface}`
+}
+
+function rollupKey(serverId: number, bucketAt: string): string {
+  return `${serverId}\0${bucketAt}`
+}
+
+function dimKey(serverId: number, bucketAt: string, dim: string, key: string): string {
+  return `${serverId}\0${bucketAt}\0${dim}\0${key}`
+}
+
+function bumpTick(key: string, inBytes: number, outBytes: number): void {
+  const prev = tickAccum.get(key) ?? { inBytes: 0, outBytes: 0 }
+  prev.inBytes += inBytes
+  prev.outBytes += outBytes
+  tickAccum.set(key, prev)
+}
+
+function addToTick(serverId: number, inIface: string, outIface: string, bytes: number): void {
+  bumpTick(ringKey(serverId, "__all__"), bytes, 0)
+  if (inIface) bumpTick(ringKey(serverId, inIface), bytes, 0)
+  if (outIface && outIface !== inIface) bumpTick(ringKey(serverId, outIface), 0, bytes)
+}
+
+function emptyRing(): { inBps: number[]; outBps: number[] } {
+  return { inBps: Array(RING_LEN).fill(0), outBps: Array(RING_LEN).fill(0) }
+}
+
+function bumpDim(serverId: number, bucketAt: string, dim: string, key: string, bytes: number, packets: number): void {
+  if (!key) return
+  const k = dimKey(serverId, bucketAt, dim, key)
+  const prev = minuteDims.get(k)
+  if (prev) {
+    prev.bytes += bytes
+    prev.packets += packets
+    return
+  }
+  minuteDims.set(k, { bytes, packets })
+}
+
+function bumpRollup(serverId: number, bucketAt: string, flow: ParsedFlow, bytes: number, packets: number): void {
+  const k = rollupKey(serverId, bucketAt)
+  let acc = minuteRollup.get(k)
+  if (!acc) {
+    acc = { bytes: 0, packets: 0, srcs: new Set(), dsts: new Set(), conversations: 0 }
+    minuteRollup.set(k, acc)
+  }
+  acc.bytes += bytes
+  acc.packets += packets
+  if (flow.src) acc.srcs.add(flow.src)
+  if (flow.dst) acc.dsts.add(flow.dst)
+  acc.conversations += 1
+}
+
+export function attachEngineSqlite(handle: SqliteHandle): void {
+  sqliteRef = handle
+}
+
+export function setPendingCapForTests(n: number | null): void {
+  pendingCap = n == null ? MAX_PENDING : Math.max(1, n)
+}
+
+export function configureEngine(opts: { topN?: number; retentionHours?: number }): void {
+  if (opts.topN != null) topN = Math.max(20, opts.topN)
+  if (opts.retentionHours != null) retentionHours = Math.max(1, opts.retentionHours)
+}
+
+export function setExporterResolveCtx(ctx: ExporterResolveCtx | null): void {
+  exporterCtx = ctx
+}
+
+export function resolveServerId(exporterIp: string): number | null {
+  if (!exporterCtx) return null
+  return pickServerIdForExporter({
+    exporterIp,
+    overlayPrefix: exporterCtx.overlayPrefix,
+    byTunnelIp: exporterCtx.byTunnelIp,
+    peers: exporterCtx.peers,
+    hostIps: exporterCtx.hostIps,
+  })
+}
+
+export function bumpPacketMeta(exporterIp: string): void {
+  packetsReceived += 1
+  lastExporterIp = exporterIp
+  lastDatagramAt = nowIso()
+}
+
+export function setEngineError(message: string): void {
+  lastError = message
+}
+
+export function getEngineStats(): EngineStats {
+  return {
+    packetsReceived,
+    lastExporterIp,
+    lastError,
+    lastDatagramAt,
+    dropped,
+    rowsStored,
+    pendingSize: pending.size,
+  }
+}
+
+export function queueParsedFlows(serverId: number, flows: ParsedFlow[]): void {
+  const bucketAt = minuteBucketIso()
+  const ripeMisses: string[] = []
+  for (const flow of flows) {
+    addToTick(serverId, flow.inIface, flow.outIface, flow.bytes)
+    bumpRollup(serverId, bucketAt, flow, flow.bytes, flow.packets)
+    const ripe = lookupRipeCached(flow.dst)
+    if (flow.dst && !ripe) ripeMisses.push(flow.dst)
+    const classified = classifyFlowDst(flow.dst, flow.proto, flow.dstPort, flow.srcPort, ripe)
+    const app = applicationName(flow.proto, flow.dstPort, flow.srcPort)
+    const country = ripe?.ok && isIsoCountry(ripe.country)
+      ? ripe.country
+      : (ripe?.ok ? "" : "unknown")
+    const asnKey = ripe?.ok && ripe.asn ? String(ripe.asn) : "unknown"
+    bumpDim(serverId, bucketAt, "proto", protoName(flow.proto), flow.bytes, flow.packets)
+    bumpDim(serverId, bucketAt, "app", app, flow.bytes, flow.packets)
+    bumpDim(serverId, bucketAt, "iface", flow.inIface || "__unknown__", flow.bytes, flow.packets)
+    bumpDim(serverId, bucketAt, "category", classified.category, flow.bytes, flow.packets)
+    bumpDim(serverId, bucketAt, "service", classified.service, flow.bytes, flow.packets)
+    if (country) bumpDim(serverId, bucketAt, "country", country, flow.bytes, flow.packets)
+    bumpDim(serverId, bucketAt, "asn", asnKey, flow.bytes, flow.packets)
+
+    const key = pendingKey(serverId, bucketAt, flow)
+    const prev = pending.get(key)
+    if (prev) {
+      prev.bytes += flow.bytes
+      prev.packets += flow.packets
+      continue
+    }
+    if (pending.size >= pendingCap) {
+      dropped += 1
+      continue
+    }
+    pending.set(key, {
+      serverId,
+      bucketAt,
+      flow: { ...flow },
+      bytes: flow.bytes,
+      packets: flow.packets,
+    })
+  }
+  if (ripeMisses.length) enqueueRipeMisses(ripeMisses)
+}
+
+export function ingestDatagram(msg: Buffer, exporterIp: string): boolean {
+  bumpPacketMeta(exporterIp)
+  const flows = parseFlowPacket(msg, exporterIp)
+  if (!flows.length) return true
+  const serverId = resolveServerId(exporterIp)
+  if (serverId == null) {
+    setEngineError(
+      `IPFIX от ${exporterIp}: нет jump-host с адресом wg-flow. Docker SNAT (172.x) при нескольких JH не различим.`,
+    )
+    return false
+  }
+  setEngineError("")
+  maybeRefreshIfaces(serverId)
+  queueParsedFlows(serverId, flows)
+  return true
+}
+
+function toPendingRow(row: PendingEntry): PendingFlowRow {
+  return {
+    serverId: row.serverId,
+    bucketAt: row.bucketAt,
+    src: row.flow.src || "0.0.0.0",
+    dst: row.flow.dst || "0.0.0.0",
+    proto: row.flow.proto,
+    srcPort: row.flow.srcPort,
+    dstPort: row.flow.dstPort,
+    bytes: row.bytes,
+    packets: row.packets,
+    inIface: row.flow.inIface,
+    outIface: row.flow.outIface,
+  }
+}
+
+function mergeInto(map: Map<string, PendingFlowRow>, row: PendingFlowRow): void {
+  const key = rowKey(row)
+  const prev = map.get(key)
+  if (prev) {
+    prev.bytes += row.bytes
+    prev.packets += row.packets
+    return
+  }
+  map.set(key, { ...row })
+}
+
+function pruneRecent(sinceMs = Date.now() - LIVE_WINDOW_MS): void {
+  const cutoff = new Date(sinceMs).toISOString()
+  for (const [key, row] of recent) {
+    if (row.bucketAt < cutoff) recent.delete(key)
+  }
+  while (recent.size > MAX_PENDING) {
+    const first = recent.keys().next().value
+    if (first == null) break
+    recent.delete(first)
+  }
+}
+
+export function peekPendingFlows(): PendingFlowRow[] {
+  return [...pending.values()].map(toPendingRow)
+}
+
+export function listLiveFlowRows(sinceIso: string): PendingFlowRow[] {
+  const merged = new Map<string, PendingFlowRow>()
+  for (const row of recent.values()) {
+    if (row.bucketAt < sinceIso) continue
+    mergeInto(merged, row)
+  }
+  for (const row of peekPendingFlows()) {
+    if (row.bucketAt < sinceIso) continue
+    mergeInto(merged, row)
+  }
+  return [...merged.values()]
+}
+
+export function rollFlowRings(): void {
+  const keys = new Set([...tickAccum.keys(), ...rings.keys()])
+  const sec = TICK_MS / 1000
+  for (const key of keys) {
+    const acc = tickAccum.get(key) ?? { inBytes: 0, outBytes: 0 }
+    tickAccum.delete(key)
+    const inBps = (acc.inBytes * 8) / sec
+    const outBps = (acc.outBytes * 8) / sec
+    let ring = rings.get(key)
+    if (!ring) {
+      ring = emptyRing()
+      rings.set(key, ring)
+    }
+    ring.inBps.push(inBps)
+    ring.inBps.shift()
+    ring.outBps.push(outBps)
+    ring.outBps.shift()
+    const silent = ring.inBps.every((v) => v === 0) && ring.outBps.every((v) => v === 0)
+    if (silent && !tickAccum.has(key)) rings.delete(key)
+  }
+}
+
+export function getRingMbps(serverId: number, iface = "__all__"): {
+  rx: number[]
+  tx: number[]
+  rxNow: number
+  txNow: number
+} {
+  const ring = rings.get(ringKey(serverId, iface))
+  const scale = 1_000_000
+  if (!ring) {
+    return { rx: Array(RING_LEN).fill(0), tx: Array(RING_LEN).fill(0), rxNow: 0, txNow: 0 }
+  }
+  return {
+    rx: ring.inBps.map((b) => b / scale),
+    tx: ring.outBps.map((b) => b / scale),
+    rxNow: (ring.inBps[RING_LEN - 1] ?? 0) / scale,
+    txNow: (ring.outBps[RING_LEN - 1] ?? 0) / scale,
+  }
+}
+
+export function snapshotRings(): Array<{ key: string; inBps: number[]; outBps: number[] }> {
+  return [...rings.entries()].map(([key, ring]) => ({
+    key,
+    inBps: [...ring.inBps],
+    outBps: [...ring.outBps],
+  }))
+}
+
+export function applyRingSnapshot(rows: Array<{ key: string; inBps: number[]; outBps: number[] }>): void {
+  rings.clear()
+  for (const row of rows) {
+    rings.set(row.key, { inBps: row.inBps, outBps: row.outBps })
+  }
+}
+
+function persistListenerStats(handle: SqliteHandle): void {
+  handle.prepare(`
+    UPDATE traffic_flow_settings
+    SET packets_received = @packetsReceived,
+        last_datagram_at = @lastDatagramAt,
+        last_exporter_ip = @lastExporterIp,
+        last_error = @lastError,
+        updated_at = @updatedAt
+    WHERE id = 1
+  `).run({
+    packetsReceived,
+    lastDatagramAt,
+    lastExporterIp,
+    lastError,
+    updatedAt: nowIso(),
+  })
+}
+
+function upsertMinuteAndDaily(handle: SqliteHandle): void {
+  const upsertMinute = handle.prepare(`
+    INSERT INTO flow_minute_stats (
+      server_id, bucket_at, bytes, packets, unique_src, unique_dst, conversations
+    ) VALUES (
+      @serverId, @bucketAt, @bytes, @packets, @uniqueSrc, @uniqueDst, @conversations
+    )
+    ON CONFLICT(server_id, bucket_at) DO UPDATE SET
+      bytes = bytes + excluded.bytes,
+      packets = packets + excluded.packets,
+      unique_src = MAX(unique_src, excluded.unique_src),
+      unique_dst = MAX(unique_dst, excluded.unique_dst),
+      conversations = conversations + excluded.conversations
+  `)
+  const upsertDim = handle.prepare(`
+    INSERT INTO flow_minute_dims (server_id, bucket_at, dim, key, bytes, packets)
+    VALUES (@serverId, @bucketAt, @dim, @key, @bytes, @packets)
+    ON CONFLICT(server_id, bucket_at, dim, key) DO UPDATE SET
+      bytes = bytes + excluded.bytes,
+      packets = packets + excluded.packets
+  `)
+  const upsertDaily = handle.prepare(`
+    INSERT INTO flow_daily_dims (server_id, day, dim, key, bytes, packets)
+    VALUES (@serverId, @day, @dim, @key, @bytes, @packets)
+    ON CONFLICT(server_id, day, dim, key) DO UPDATE SET
+      bytes = bytes + excluded.bytes,
+      packets = packets + excluded.packets
+  `)
+
+  const tx = handle.transaction(() => {
+    for (const [k, acc] of minuteRollup) {
+      const [serverIdRaw, bucketAt] = k.split("\0")
+      upsertMinute.run({
+        serverId: Number(serverIdRaw),
+        bucketAt,
+        bytes: acc.bytes,
+        packets: acc.packets,
+        uniqueSrc: acc.srcs.size,
+        uniqueDst: acc.dsts.size,
+        conversations: acc.conversations,
+      })
+    }
+    for (const [k, acc] of minuteDims) {
+      const [serverIdRaw, bucketAt, dim, key] = k.split("\0")
+      upsertDim.run({
+        serverId: Number(serverIdRaw),
+        bucketAt,
+        dim,
+        key,
+        bytes: acc.bytes,
+        packets: acc.packets,
+      })
+      if (dim === "country" || dim === "service" || dim === "asn") {
+        upsertDaily.run({
+          serverId: Number(serverIdRaw),
+          day: dayKey(bucketAt ?? ""),
+          dim,
+          key,
+          bytes: acc.bytes,
+          packets: acc.packets,
+        })
+      }
+    }
+  })
+  tx()
+  minuteRollup.clear()
+  minuteDims.clear()
+}
+
+function capDailyAsn(handle: SqliteHandle): void {
+  const today = nowIso().slice(0, 10)
+  const rows = handle.prepare(`
+    SELECT server_id AS serverId, key, bytes, packets
+    FROM flow_daily_dims
+    WHERE day = ? AND dim = 'asn'
+    ORDER BY server_id, bytes DESC
+  `).all(today) as Array<{ serverId: number; key: string; bytes: number; packets: number }>
+  const byServer = new Map<number, typeof rows>()
+  for (const row of rows) {
+    const list = byServer.get(row.serverId) ?? []
+    list.push(row)
+    byServer.set(row.serverId, list)
+  }
+  const del = handle.prepare(`
+    DELETE FROM flow_daily_dims WHERE server_id = ? AND day = ? AND dim = 'asn' AND key = ?
+  `)
+  const upsertOther = handle.prepare(`
+    INSERT INTO flow_daily_dims (server_id, day, dim, key, bytes, packets)
+    VALUES (?, ?, 'asn', 'other', ?, ?)
+    ON CONFLICT(server_id, day, dim, key) DO UPDATE SET
+      bytes = bytes + excluded.bytes,
+      packets = packets + excluded.packets
+  `)
+  for (const [serverId, list] of byServer) {
+    if (list.length <= DAILY_ASN_TOP) continue
+    let otherBytes = 0
+    let otherPackets = 0
+    for (const row of list.slice(DAILY_ASN_TOP)) {
+      if (row.key === "other") continue
+      otherBytes += row.bytes
+      otherPackets += row.packets
+      del.run(serverId, today, row.key)
+    }
+    if (otherBytes > 0) upsertOther.run(serverId, today, otherBytes, otherPackets)
+  }
+}
+
+function pruneStored(handle: SqliteHandle): void {
+  const now = Date.now()
+  if (now - lastPruneAt < PRUNE_MS) return
+  lastPruneAt = now
+  const flowCutoff = new Date(now - retentionHours * 3600_000).toISOString()
+  const minuteCutoff = new Date(now - MINUTE_RETENTION_HOURS * 3600_000).toISOString()
+  const dailyCutoff = new Date(now - DAILY_RETENTION_DAYS * 86400_000).toISOString().slice(0, 10)
+  handle.prepare(`DELETE FROM flow_buckets WHERE bucket_at < ?`).run(flowCutoff)
+  handle.prepare(`DELETE FROM flow_minute_stats WHERE bucket_at < ?`).run(minuteCutoff)
+  handle.prepare(`DELETE FROM flow_minute_dims WHERE bucket_at < ?`).run(minuteCutoff)
+  handle.prepare(`DELETE FROM flow_daily_dims WHERE day < ?`).run(dailyCutoff)
+
+  const keep = Math.max(20, topN)
+  try {
+    handle.prepare(`
+      DELETE FROM flow_buckets WHERE id IN (
+        SELECT id FROM (
+          SELECT id, ROW_NUMBER() OVER (
+            PARTITION BY server_id, bucket_at ORDER BY bytes DESC
+          ) AS rn
+          FROM flow_buckets
+        ) ranked WHERE rn > ?
+      )
+    `).run(keep)
+  } catch {
+    const buckets = handle.prepare(`
+      SELECT DISTINCT server_id AS serverId, bucket_at AS bucketAt FROM flow_buckets
+    `).all() as Array<{ serverId: number; bucketAt: string }>
+    for (const b of buckets) {
+      const rows = handle.prepare(`
+        SELECT id, bytes FROM flow_buckets
+        WHERE server_id = ? AND bucket_at = ?
+        ORDER BY bytes DESC
+      `).all(b.serverId, b.bucketAt) as Array<{ id: number; bytes: number }>
+      for (const extra of rows.slice(keep)) {
+        handle.prepare(`DELETE FROM flow_buckets WHERE id = ?`).run(extra.id)
+      }
+    }
+  }
+}
+
+function topNPending(rows: PendingFlowRow[]): PendingFlowRow[] {
+  const keep = Math.max(20, topN)
+  const groups = new Map<string, PendingFlowRow[]>()
+  for (const row of rows) {
+    const k = `${row.serverId}\0${row.bucketAt}`
+    const list = groups.get(k) ?? []
+    list.push(row)
+    groups.set(k, list)
+  }
+  const out: PendingFlowRow[] = []
+  for (const list of groups.values()) {
+    list.sort((a, b) => b.bytes - a.bytes)
+    out.push(...list.slice(0, keep))
+  }
+  return out
+}
+
+export function flushPending(): void {
+  pruneRecent()
+  rollFlowRings()
+  const handle = sqliteRef
+  if (!handle) {
+    lastFlushUsedTransaction = false
+    return
+  }
+  persistListenerStats(handle)
+  if (pending.size === 0 && minuteRollup.size === 0 && minuteDims.size === 0) {
+    pruneStored(handle)
+    lastFlushUsedTransaction = false
+    return
+  }
+  const rows = topNPending([...pending.values()].map(toPendingRow))
+  pending.clear()
+  for (const row of rows) mergeInto(recent, row)
+
+  const upsertFlow = handle.prepare(`
+    INSERT INTO flow_buckets (
+      server_id, bucket_at, src, dst, proto, src_port, dst_port, bytes, packets, in_iface
+    ) VALUES (
+      @serverId, @bucketAt, @src, @dst, @proto, @srcPort, @dstPort, @bytes, @packets, @inIface
+    )
+    ON CONFLICT(server_id, bucket_at, src, dst, proto, src_port, dst_port, in_iface)
+    DO UPDATE SET
+      bytes = bytes + excluded.bytes,
+      packets = packets + excluded.packets
+  `)
+  lastFlushUsedTransaction = false
+  try {
+    const tx = handle.transaction((batch: PendingFlowRow[]) => {
+      for (const r of batch) {
+        upsertFlow.run({
+          serverId: r.serverId,
+          bucketAt: r.bucketAt,
+          src: r.src,
+          dst: r.dst,
+          proto: r.proto,
+          srcPort: r.srcPort,
+          dstPort: r.dstPort,
+          bytes: r.bytes,
+          packets: r.packets,
+          inIface: r.inIface,
+        })
+      }
+    })
+    tx(rows)
+    lastFlushUsedTransaction = true
+    rowsStored += rows.length
+  } catch {
+    for (const r of rows) {
+      try {
+        upsertFlow.run({
+          serverId: r.serverId,
+          bucketAt: r.bucketAt,
+          src: r.src,
+          dst: r.dst,
+          proto: r.proto,
+          srcPort: r.srcPort,
+          dstPort: r.dstPort,
+          bytes: r.bytes,
+          packets: r.packets,
+          inIface: r.inIface,
+        })
+        rowsStored += 1
+      } catch {
+        /* ignore single-row failures */
+      }
+    }
+  }
+  try {
+    upsertMinuteAndDaily(handle)
+    capDailyAsn(handle)
+  } catch {
+    /* rollup best-effort */
+  }
+  pruneStored(handle)
+  try {
+    handle.pragma("wal_checkpoint(TRUNCATE)")
+  } catch {
+    /* ignore */
+  }
+}
+
+export function lastFlushUsedTransactionForTests(): boolean {
+  return lastFlushUsedTransaction
+}
+
+export function flushPendingForTests(): void {
+  flushPending()
+}
+
+export function onEngineTick(): void {
+  flushPending()
+}
+
+export function ingestParsedFlowsForServerForTests(serverId: number, flows: ParsedFlow[]): void {
+  queueParsedFlows(serverId, flows)
+  rollFlowRings()
+}
+
+export function resetEngineForTests(): void {
+  pending.clear()
+  recent.clear()
+  tickAccum.clear()
+  rings.clear()
+  minuteRollup.clear()
+  minuteDims.clear()
+  packetsReceived = 0
+  lastExporterIp = null
+  lastError = ""
+  lastDatagramAt = null
+  dropped = 0
+  rowsStored = 0
+  lastFlushUsedTransaction = false
+  lastPruneAt = 0
+  pendingCap = MAX_PENDING
+}
+
+export function pendingSizeForTests(): number {
+  return pending.size
+}
+
+export function droppedForTests(): number {
+  return dropped
+}
@@ -0,0 +1,23 @@
+import assert from "node:assert/strict"
+import { SQLITE_BUSY_TIMEOUT_MS, sqliteDatabase } from "../db/index.js"
+import {
+  MAX_FLOW_LIVE_SUBSCRIBERS,
+  resetFlowLiveSlotsForTests,
+  tryAcquireFlowLiveSlot,
+  releaseFlowLiveSlot,
+} from "../routes/traffic-flow.js"
+
+const busy = sqliteDatabase.pragma("busy_timeout") as Array<{ busy_timeout: number }>
+const busyValue = Array.isArray(busy) ? Number(Object.values(busy[0] ?? {})[0]) : Number(busy)
+assert.equal(busyValue, SQLITE_BUSY_TIMEOUT_MS)
+
+resetFlowLiveSlotsForTests()
+for (let i = 0; i < MAX_FLOW_LIVE_SUBSCRIBERS; i++) {
+  assert.equal(tryAcquireFlowLiveSlot(), true)
+}
+assert.equal(tryAcquireFlowLiveSlot(), false)
+releaseFlowLiveSlot()
+assert.equal(tryAcquireFlowLiveSlot(), true)
+resetFlowLiveSlotsForTests()
+
+console.log("traffic-flow-hardening.test.ts: ok")
@@ -4,6 +4,8 @@ import {
  resetIfaceCacheForTests,
  resolveIfaceName,
  rosIdToIfIndex,
+  shouldRefreshIfaces,
+  markIfaceRefreshAttempt,
 } from "./traffic-flow-ifindex.js"
 import { applicationName, flowRowMatchesFilter } from "./traffic-flow-apps.js"

@@ -27,6 +29,22 @@ assert.equal(resolveIfaceName(7, "0").name, "—")
 assert.equal(resolveIfaceName(7, "ether1").name, "ether1")
 assert.equal(resolveIfaceName(7, "99").name, "#99")

+resetIfaceCacheForTests()
+rememberServerIfaces(8, [
+  { ifindex: "10", ".id": "*12", name: "gre1" },
+])
+assert.equal(rosIdToIfIndex("*12"), 18)
+assert.equal(resolveIfaceName(8, "10").name, "gre1")
+assert.equal(resolveIfaceName(8, "18").name, "gre1")
+
+resetIfaceCacheForTests()
+assert.equal(shouldRefreshIfaces(9), true)
+rememberServerIfaces(9, [{ ".id": "*2", name: "ether1" }])
+assert.equal(shouldRefreshIfaces(9), false)
+resetIfaceCacheForTests()
+markIfaceRefreshAttempt(9)
+assert.equal(shouldRefreshIfaces(9), false)
+
 assert.equal(applicationName(6, 443), "HTTPS")
 assert.equal(applicationName(17, 53), "DNS")
 assert.equal(applicationName(6, 22), "SSH")
@@ -3,24 +3,29 @@ import { db } from "../db/index.js"
 import { servers } from "../db/schema.js"
 import { MikrotikClient } from "./mikrotik.js"
 import {
-  ifaceCacheFresh,
  rememberServerIfaces,
+  shouldRefreshIfaces,
+  markIfaceRefreshAttempt,
  type RosIfaceIndexRow,
 } from "./traffic-flow-ifindex.js"

 export {
+  ifaceCacheFresh,
  ifaceCacheHas,
  rememberServerIfaces,
  resetIfaceCacheForTests,
  resolveIfaceName,
  rosIdToIfIndex,
+  shouldRefreshIfaces,
+  markIfaceRefreshAttempt,
 } from "./traffic-flow-ifindex.js"

 const inflight = new Set<number>()
+let refreshIfacesImpl: (serverId: number, force?: boolean) => Promise<void> = refreshServerIfacesInner

-export async function refreshServerIfaces(serverId: number, force = false): Promise<void> {
+async function refreshServerIfacesInner(serverId: number, force = false): Promise<void> {
  if (inflight.has(serverId)) return
-  if (!force && ifaceCacheFresh(serverId)) return
+  if (!force && !shouldRefreshIfaces(serverId)) return
  inflight.add(serverId)
  try {
    const row = db.select().from(servers).where(eq(servers.id, serverId)).limit(1).all()[0]
@@ -31,6 +36,21 @@ export async function refreshServerIfaces(serverId: number, force = false): Prom
  } catch {
    /* keep previous cache */
  } finally {
+    markIfaceRefreshAttempt(serverId)
    inflight.delete(serverId)
  }
 }
+
+export async function refreshServerIfaces(serverId: number, force = false): Promise<void> {
+  return refreshIfacesImpl(serverId, force)
+}
+
+export function maybeRefreshIfaces(serverId: number): boolean {
+  if (!shouldRefreshIfaces(serverId)) return false
+  void refreshIfacesImpl(serverId)
+  return true
+}
+
+export function setRefreshIfacesForTests(fn: typeof refreshServerIfacesInner | null): void {
+  refreshIfacesImpl = fn ?? refreshServerIfacesInner
+}
@@ -6,6 +6,7 @@ export interface RosIfaceIndexRow {

 const cache = new Map<number, Map<number, string>>()
 const fetchedAt = new Map<number, number>()
+const lastAttempt = new Map<number, number>()

 export const IFACE_CACHE_TTL_MS = 60_000

@@ -25,10 +26,9 @@ export function rememberServerIfaces(serverId: number, rows: RosIfaceIndexRow[])
    const name = String(row.name ?? "").trim()
    if (!name) continue
    const fromProp = Number.parseInt(String(row.ifindex ?? ""), 10)
-    const idx = Number.isFinite(fromProp) && fromProp > 0
-      ? fromProp
-      : rosIdToIfIndex(row[".id"])
-    if (idx != null && idx > 0) map.set(idx, name)
+    const fromId = rosIdToIfIndex(row[".id"])
+    if (Number.isFinite(fromProp) && fromProp > 0) map.set(fromProp, name)
+    if (fromId != null && fromId > 0) map.set(fromId, name)
  }
  cache.set(serverId, map)
  fetchedAt.set(serverId, Date.now())
@@ -53,7 +53,19 @@ export function ifaceCacheFresh(serverId: number, ttlMs = IFACE_CACHE_TTL_MS): b
  return Boolean(prev && Date.now() - prev < ttlMs && cache.has(serverId))
 }

+/** Не ходить в REST, пока кэш жив или с момента последней попытки не прошёл TTL. */
+export function shouldRefreshIfaces(serverId: number, ttlMs = IFACE_CACHE_TTL_MS): boolean {
+  if (ifaceCacheFresh(serverId, ttlMs)) return false
+  const attempted = lastAttempt.get(serverId) ?? 0
+  return !(attempted && Date.now() - attempted < ttlMs)
+}
+
+export function markIfaceRefreshAttempt(serverId: number, at = Date.now()): void {
+  lastAttempt.set(serverId, at)
+}
+
 export function resetIfaceCacheForTests(): void {
  cache.clear()
  fetchedAt.clear()
+  lastAttempt.clear()
 }
@@ -0,0 +1,120 @@
+import assert from "node:assert/strict"
+import {
+  markIfaceRefreshAttempt,
+  rememberServerIfaces,
+  resetIfaceCacheForTests,
+  shouldRefreshIfaces,
+} from "./traffic-flow-ifindex.js"
+import {
+  applyHeartbeatForTests,
+  flushPendingForTests,
+  getFlowListenerState,
+  getFlowRuntimeCounters,
+  getFlowWorkerHealth,
+  ingestParsedFlowsForServerForTests,
+  lastFlushUsedTransactionForTests,
+  maybeRefreshIfaces,
+  peekPendingFlows,
+  resetFlowRingsForTests,
+  setPendingCapForTests,
+  setRefreshIfacesForTests,
+  setWantListenForTests,
+  simulateWorkerExitForTests,
+} from "./traffic-flow-ingest.js"
+import { configureEngine, droppedForTests, pendingSizeForTests } from "./traffic-flow-engine.js"
+import { sqliteDatabase } from "../db/index.js"
+
+resetIfaceCacheForTests()
+resetFlowRingsForTests()
+
+let refreshCalls = 0
+setRefreshIfacesForTests(async () => {
+  refreshCalls += 1
+})
+
+rememberServerIfaces(1, [{ ".id": "*A", name: "wg-flow" }])
+assert.equal(shouldRefreshIfaces(1), false)
+assert.equal(maybeRefreshIfaces(1), false)
+assert.equal(refreshCalls, 0)
+
+resetIfaceCacheForTests()
+assert.equal(shouldRefreshIfaces(2), true)
+assert.equal(maybeRefreshIfaces(2), true)
+assert.equal(refreshCalls, 1)
+
+markIfaceRefreshAttempt(2)
+assert.equal(shouldRefreshIfaces(2), false)
+assert.equal(maybeRefreshIfaces(2), false)
+assert.equal(refreshCalls, 1)
+
+assert.equal(lastFlushUsedTransactionForTests(), false)
+
+resetFlowRingsForTests()
+setPendingCapForTests(3)
+const many = Array.from({ length: 6 }, (_, i) => ({
+  src: `10.1.1.${i + 1}`,
+  dst: "8.8.8.8",
+  proto: 6,
+  srcPort: 50000 + i,
+  dstPort: 443,
+  bytes: 1000,
+  packets: 1,
+  inIface: "2",
+  outIface: "",
+}))
+ingestParsedFlowsForServerForTests(9, many)
+assert.equal(pendingSizeForTests(), 3)
+assert.equal(droppedForTests(), 3)
+assert.equal(peekPendingFlows().length, 3)
+setPendingCapForTests(null)
+
+resetFlowRingsForTests()
+configureEngine({ topN: 20 })
+const talkers = Array.from({ length: 25 }, (_, i) => ({
+  src: `10.2.1.${i + 1}`,
+  dst: "1.1.1.1",
+  proto: 6,
+  srcPort: 40000 + i,
+  dstPort: 443,
+  bytes: 1000 + i,
+  packets: 1,
+  inIface: "2",
+  outIface: "",
+}))
+ingestParsedFlowsForServerForTests(9, talkers)
+flushPendingForTests()
+const stored = sqliteDatabase.prepare(`
+  SELECT COUNT(*) AS n FROM flow_buckets WHERE server_id = 9
+`).get() as { n: number }
+assert.ok(stored.n <= 20, `expected topN cap, got ${stored.n}`)
+sqliteDatabase.prepare(`DELETE FROM flow_buckets WHERE server_id = 9`).run()
+sqliteDatabase.prepare(`DELETE FROM flow_minute_stats WHERE server_id = 9`).run()
+sqliteDatabase.prepare(`DELETE FROM flow_minute_dims WHERE server_id = 9`).run()
+sqliteDatabase.prepare(`DELETE FROM flow_daily_dims WHERE server_id = 9`).run()
+
+applyHeartbeatForTests({
+  bound: true,
+  address: "127.0.0.1:4739",
+  packetsReceived: 42,
+  lastExporterIp: "10.255.254.3",
+  lastError: "",
+  lastDatagramAt: new Date().toISOString(),
+  pendingSize: 1,
+  dropped: 0,
+  rowsStored: 1,
+  workerAlive: true,
+  rings: [],
+})
+assert.equal(getFlowListenerState().bound, true)
+assert.equal(getFlowRuntimeCounters().packetsReceived, 42)
+assert.equal(getFlowWorkerHealth().alive, false)
+setWantListenForTests(true)
+assert.equal(simulateWorkerExitForTests(), 1)
+assert.equal(getFlowListenerState().bound, false)
+setWantListenForTests(false)
+
+resetFlowRingsForTests()
+resetIfaceCacheForTests()
+setRefreshIfacesForTests(null)
+
+console.log("traffic-flow-ingest.test.ts: ok")
@@ -1,315 +1,295 @@
-import { createSocket, type Socket } from "node:dgram"
-import { desc, eq, gte, sql } from "drizzle-orm"
-import { db } from "../db/index.js"
+import { Worker } from "node:worker_threads"
+import { gte, sql } from "drizzle-orm"
+import { db, sqliteDatabase } from "../db/index.js"
+import { env } from "../config.js"
 import { flowBuckets, servers } from "../db/schema.js"
 import type { FlowStatsDto, FlowTalkerDto } from "@mmapp/contracts/traffic-flow"
-import { parseFlowPacket, protoName, type ParsedFlow } from "./traffic-flow-parse.js"
-import { pickServerIdForExporter } from "./traffic-flow-map-exporter.js"
+import { protoName, type ParsedFlow } from "./traffic-flow-parse.js"
+import type { CollectorHeartbeat, ExporterMapPayload, MainToWorker, WorkerToMain } from "./traffic-flow-collector-ipc.js"
+import {
+  attachEngineSqlite,
+  applyRingSnapshot,
+  configureEngine,
+  flushPending,
+  getEngineStats,
+  getRingMbps as engineGetRingMbps,
+  ingestParsedFlowsForServerForTests as engineIngestForServer,
+  lastFlushUsedTransactionForTests as engineLastFlushTx,
+  listLiveFlowRows as engineListLive,
+  peekPendingFlows,
+  queueParsedFlows,
+  resetEngineForTests,
+  resolveServerId,
+  rollFlowRings,
+  setExporterResolveCtx,
+  type PendingFlowRow,
+} from "./traffic-flow-engine.js"
 import {
  getTrafficFlowSettingsRow,
  listHostPeers,
-  recordFlowListenerError,
-  recordFlowPacket,
 } from "./traffic-flow-settings.js"
-import { ifaceCacheHas, refreshServerIfaces, resolveIfaceName } from "./traffic-flow-ifaces.js"
 import { applicationName } from "./traffic-flow-apps.js"
+import { resolveIfaceName } from "./traffic-flow-ifaces.js"
+
+export type { PendingFlowRow }

 export interface FlowListenerState {
  bound: boolean
  address: string | null
 }

-export interface PendingFlowRow {
-  serverId: number
-  bucketAt: string
-  src: string
-  dst: string
-  proto: number
-  srcPort: number
-  dstPort: number
-  bytes: number
-  packets: number
-  inIface: string
-  outIface: string
+export interface FlowWorkerHealth {
+  alive: boolean
+  bound: boolean
+  pendingSize: number
+  dropped: number
+  packetsReceived: number
 }

-const TICK_MS = 2_000
-const RING_LEN = 60
-
-let socket: Socket | null = null
+let worker: Worker | null = null
+let restartTimer: ReturnType<typeof setTimeout> | null = null
+let restartAttempts = 0
+let lastHeartbeat: CollectorHeartbeat | null = null
 let state: FlowListenerState = { bound: false, address: null }
-const pending = new Map<string, {
-  serverId: number
-  bucketAt: string
-  flow: ParsedFlow
-  bytes: number
-  packets: number
-}>()
-let flushTimer: ReturnType<typeof setInterval> | null = null
+let wantListen = false

-const tickAccum = new Map<string, { inBytes: number; outBytes: number }>()
-const rings = new Map<string, { inBps: number[]; outBps: number[] }>()
+attachEngineSqlite(sqliteDatabase)

-export function getFlowListenerState(): FlowListenerState {
-  return state
+function workerFileUrl(): URL {
+  const ts = import.meta.url.includes(".ts")
+  return new URL(
+    ts ? "./traffic-flow-collector-worker.ts" : "./traffic-flow-collector-worker.js",
+    import.meta.url,
+  )
 }

-function minuteBucketIso(at = Date.now()): string {
-  const d = new Date(at)
-  d.setSeconds(0, 0)
-  return d.toISOString()
-}
-
-function ringKey(serverId: number, iface: string): string {
-  return `${serverId}\0${iface || "__all__"}`
-}
-
-function bumpTick(key: string, inBytes: number, outBytes: number): void {
-  const prev = tickAccum.get(key) ?? { inBytes: 0, outBytes: 0 }
-  prev.inBytes += inBytes
-  prev.outBytes += outBytes
-  tickAccum.set(key, prev)
-}
-
-function addToTick(serverId: number, inIface: string, outIface: string, bytes: number): void {
-  bumpTick(ringKey(serverId, "__all__"), bytes, 0)
-  if (inIface) bumpTick(ringKey(serverId, inIface), bytes, 0)
-  if (outIface && outIface !== inIface) bumpTick(ringKey(serverId, outIface), 0, bytes)
-}
-
-function emptyRing(): { inBps: number[]; outBps: number[] } {
-  return { inBps: Array(RING_LEN).fill(0), outBps: Array(RING_LEN).fill(0) }
-}
-
-export function rollFlowRings(): void {
-  const keys = new Set([...tickAccum.keys(), ...rings.keys()])
-  const sec = TICK_MS / 1000
-  for (const key of keys) {
-    const acc = tickAccum.get(key) ?? { inBytes: 0, outBytes: 0 }
-    tickAccum.delete(key)
-    const inBps = (acc.inBytes * 8) / sec
-    const outBps = (acc.outBytes * 8) / sec
-    let ring = rings.get(key)
-    if (!ring) {
-      ring = emptyRing()
-      rings.set(key, ring)
-    }
-    ring.inBps.push(inBps)
-    ring.inBps.shift()
-    ring.outBps.push(outBps)
-    ring.outBps.shift()
-  }
-}
-
-export function getRingMbps(serverId: number, iface = "__all__"): {
-  rx: number[]
-  tx: number[]
-  rxNow: number
-  txNow: number
-} {
-  const ring = rings.get(ringKey(serverId, iface))
-  const scale = 1_000_000
-  if (!ring) {
-    return { rx: Array(RING_LEN).fill(0), tx: Array(RING_LEN).fill(0), rxNow: 0, txNow: 0 }
-  }
-  return {
-    rx: ring.inBps.map((b) => b / scale),
-    tx: ring.outBps.map((b) => b / scale),
-    rxNow: (ring.inBps[RING_LEN - 1] ?? 0) / scale,
-    txNow: (ring.outBps[RING_LEN - 1] ?? 0) / scale,
-  }
-}
-
-function resolveServerId(exporterIp: string): number | null {
+export function buildExporterMapPayload(): ExporterMapPayload {
  const settings = getTrafficFlowSettingsRow()
  const rows = db.select({
    id: servers.id,
    host: servers.host,
    mgmtTunnelIp: servers.mgmtTunnelIp,
  }).from(servers).all()
-  const byTunnelIp = new Map<string, number>()
-  const hostIps = new Map<string, number>()
+  const byTunnelIp: Array<[string, number]> = []
+  const hostIps: Array<[string, number]> = []
  for (const row of rows) {
-    if (row.mgmtTunnelIp) byTunnelIp.set(row.mgmtTunnelIp, row.id)
-    if (/^\d{1,3}(?:\.\d{1,3}){3}$/.test(row.host)) hostIps.set(row.host, row.id)
+    if (row.mgmtTunnelIp) byTunnelIp.push([row.mgmtTunnelIp, row.id])
+    if (/^\d{1,3}(?:\.\d{1,3}){3}$/.test(row.host)) hostIps.push([row.host, row.id])
  }
-  return pickServerIdForExporter({
-    exporterIp,
+  return {
    overlayPrefix: settings.prefix,
    byTunnelIp,
    peers: listHostPeers(),
    hostIps,
+  }
+}
+
+function applyExporterCtxFromDb(): void {
+  const payload = buildExporterMapPayload()
+  setExporterResolveCtx({
+    overlayPrefix: payload.overlayPrefix,
+    byTunnelIp: new Map(payload.byTunnelIp),
+    peers: payload.peers,
+    hostIps: new Map(payload.hostIps),
  })
 }

-function queueFlows(exporterIp: string, flows: ParsedFlow[]): boolean {
-  const serverId = resolveServerId(exporterIp)
-  if (serverId == null) return false
-  if (!ifaceCacheHas(serverId)) void refreshServerIfaces(serverId)
-  const bucketAt = minuteBucketIso()
-  for (const flow of flows) {
-    addToTick(serverId, flow.inIface, flow.outIface, flow.bytes)
-    const key = `${serverId}\0${bucketAt}\0${flow.src}\0${flow.dst}\0${flow.proto}\0${flow.srcPort}\0${flow.dstPort}\0${flow.inIface}`
-    const prev = pending.get(key)
-    if (prev) {
-      prev.bytes += flow.bytes
-      prev.packets += flow.packets
-    } else {
-      pending.set(key, {
-        serverId,
-        bucketAt,
-        flow: { ...flow },
-        bytes: flow.bytes,
-        packets: flow.packets,
-      })
-    }
+function postToWorker(msg: MainToWorker): void {
+  worker?.postMessage(msg)
+}
+
+function handleWorkerMessage(msg: WorkerToMain): void {
+  if (msg.type === "heartbeat") {
+    lastHeartbeat = msg.payload
+    state = { bound: msg.payload.bound, address: msg.payload.address }
+    applyRingSnapshot(msg.payload.rings)
+    restartAttempts = 0
+    return
+  }
+  if (msg.type === "error") {
+    lastHeartbeat = lastHeartbeat
+      ? { ...lastHeartbeat, lastError: msg.payload.message, workerAlive: true }
+      : null
  }
-  return true
 }

-export function peekPendingFlows(): PendingFlowRow[] {
-  return [...pending.values()].map((row) => ({
-    serverId: row.serverId,
-    bucketAt: row.bucketAt,
-    src: row.flow.src || "0.0.0.0",
-    dst: row.flow.dst || "0.0.0.0",
-    proto: row.flow.proto,
-    srcPort: row.flow.srcPort,
-    dstPort: row.flow.dstPort,
-    bytes: row.bytes,
-    packets: row.packets,
-    inIface: row.flow.inIface,
-    outIface: row.flow.outIface,
-  }))
-}
-
-function flushPending() {
-  if (pending.size === 0) return
+function spawnWorker(): void {
+  stopWorkerProcess()
  const settings = getTrafficFlowSettingsRow()
-  const topN = Math.max(20, settings.topN)
-  const cutoff = new Date(Date.now() - settings.retentionHours * 3600_000).toISOString()
-  const rows = [...pending.values()]
-  pending.clear()
+  configureEngine({ topN: settings.topN, retentionHours: settings.retentionHours })
+  applyExporterCtxFromDb()
+  const w = new Worker(workerFileUrl(), { execArgv: process.execArgv })
+  w.on("message", (msg: WorkerToMain) => handleWorkerMessage(msg))
+  w.on("error", (err) => {
+    state = { bound: false, address: null }
+    lastHeartbeat = lastHeartbeat
+      ? { ...lastHeartbeat, workerAlive: false, lastError: err.message, bound: false }
+      : {
+          bound: false,
+          address: null,
+          packetsReceived: 0,
+          lastExporterIp: null,
+          lastError: err.message,
+          lastDatagramAt: null,
+          pendingSize: 0,
+          dropped: 0,
+          rowsStored: 0,
+          workerAlive: false,
+          rings: [],
+        }
+  })
+  w.on("exit", (code) => {
+    worker = null
+    state = { bound: false, address: null }
+    if (!wantListen) return
+    const delay = Math.min(30_000, 1000 * 2 ** restartAttempts)
+    restartAttempts += 1
+    restartTimer = setTimeout(() => {
+      if (wantListen) spawnWorker()
+    }, delay)
+    void code
+  })
+  worker = w
+  const host = process.env.FLOW_LISTEN_HOST?.trim() || settings.collectorIp || "127.0.0.1"
+  postToWorker({
+    type: "start",
+    payload: {
+      dbPath: env.DATABASE_PATH,
+      listenHost: host,
+      listenPort: settings.flowListenPort,
+      topN: settings.topN,
+      retentionHours: settings.retentionHours,
+      exporterMap: buildExporterMapPayload(),
+    },
+  })
+}

-  for (const row of rows) {
+function stopWorkerProcess(): void {
+  if (restartTimer) {
+    clearTimeout(restartTimer)
+    restartTimer = null
+  }
+  if (worker) {
    try {
-      db.insert(flowBuckets).values({
-        serverId: row.serverId,
-        bucketAt: row.bucketAt,
-        src: row.flow.src || "0.0.0.0",
-        dst: row.flow.dst || "0.0.0.0",
-        proto: row.flow.proto,
-        srcPort: row.flow.srcPort,
-        dstPort: row.flow.dstPort,
-        bytes: row.bytes,
-        packets: row.packets,
-        inIface: row.flow.inIface,
-      }).onConflictDoUpdate({
-        target: [
-          flowBuckets.serverId,
-          flowBuckets.bucketAt,
-          flowBuckets.src,
-          flowBuckets.dst,
-          flowBuckets.proto,
-          flowBuckets.srcPort,
-          flowBuckets.dstPort,
-          flowBuckets.inIface,
-        ],
-        set: {
-          bytes: sql`${flowBuckets.bytes} + excluded.bytes`,
-          packets: sql`${flowBuckets.packets} + excluded.packets`,
-        },
-      }).run()
+      postToWorker({ type: "stop" })
+      void worker.terminate()
    } catch {
-      // ignore single-row failures
-    }
-  }
-
-  db.delete(flowBuckets).where(sql`${flowBuckets.bucketAt} < ${cutoff}`).run()
-
-  const latest = db.select({ bucketAt: flowBuckets.bucketAt }).from(flowBuckets)
-    .orderBy(desc(flowBuckets.bucketAt)).limit(1).all()[0]?.bucketAt
-  if (!latest) return
-  const latestRows = db.select().from(flowBuckets).where(eq(flowBuckets.bucketAt, latest)).all()
-  const byServer = new Map<number, typeof latestRows>()
-  for (const r of latestRows) {
-    const list = byServer.get(r.serverId) ?? []
-    list.push(r)
-    byServer.set(r.serverId, list)
-  }
-  for (const list of byServer.values()) {
-    if (list.length <= topN) continue
-    list.sort((a, b) => b.bytes - a.bytes)
-    for (const d of list.slice(topN)) {
-      db.delete(flowBuckets).where(eq(flowBuckets.id, d.id)).run()
+      /* ignore */
    }
+    worker = null
  }
 }

-function onTick() {
-  rollFlowRings()
-  flushPending()
+export function reattachFlowSqlite(): void {
+  attachEngineSqlite(sqliteDatabase)
 }

-function onMessage(msg: Buffer, rinfo: { address: string }) {
-  try {
-    const flows = parseFlowPacket(msg, rinfo.address)
-    recordFlowPacket(rinfo.address)
-    if (!flows.length) return
-    if (!queueFlows(rinfo.address, flows)) {
-      recordFlowListenerError(
-        `IPFIX от ${rinfo.address}: нет jump-host с адресом wg-flow. Docker SNAT (172.x) при нескольких JH не различим.`,
-      )
-      return
-    }
-    recordFlowListenerError("")
-  } catch (e) {
-    recordFlowListenerError(e instanceof Error ? e.message : String(e))
-  }
+export function applyHeartbeatForTests(payload: CollectorHeartbeat): void {
+  handleWorkerMessage({ type: "heartbeat", payload })
 }

-export function stopTrafficFlowListener() {
-  if (flushTimer) {
-    clearInterval(flushTimer)
-    flushTimer = null
-  }
-  flushPending()
-  if (socket) {
-    try { socket.close() } catch { /* ignore */ }
-    socket = null
-  }
+export function simulateWorkerExitForTests(): number {
+  worker = null
  state = { bound: false, address: null }
+  lastHeartbeat = lastHeartbeat ? { ...lastHeartbeat, workerAlive: false, bound: false } : null
+  if (!wantListen) return restartAttempts
+  restartAttempts += 1
+  return restartAttempts
+}
+
+export function setWantListenForTests(value: boolean): void {
+  wantListen = value
+}
+
+export function getFlowListenerState(): FlowListenerState {
+  return state
+}
+
+export function getFlowWorkerHealth(): FlowWorkerHealth {
+  const hb = lastHeartbeat
+  const mem = getEngineStats()
+  return {
+    alive: Boolean(worker) && (hb?.workerAlive ?? false),
+    bound: state.bound,
+    pendingSize: hb?.pendingSize ?? mem.pendingSize,
+    dropped: hb?.dropped ?? mem.dropped,
+    packetsReceived: hb?.packetsReceived ?? mem.packetsReceived,
+  }
+}
+
+export function getFlowRuntimeCounters() {
+  const settings = getTrafficFlowSettingsRow()
+  const hb = lastHeartbeat
+  return {
+    packetsReceived: hb?.packetsReceived ?? settings.packetsReceived,
+    lastExporterIp: hb?.lastExporterIp ?? settings.lastExporterIp ?? null,
+    lastError: (hb?.lastError ?? settings.lastError) || null,
+    lastDatagramAt: hb?.lastDatagramAt ?? settings.lastDatagramAt ?? null,
+    dropped: hb?.dropped ?? 0,
+  }
 }

 export function startTrafficFlowListener() {
  stopTrafficFlowListener()
  const settings = getTrafficFlowSettingsRow()
  if (!settings.enabled) {
+    wantListen = false
    state = { bound: false, address: null }
    return
  }
-  const host = process.env.FLOW_LISTEN_HOST?.trim() || settings.collectorIp || "127.0.0.1"
-  const port = settings.flowListenPort
-  const sock = createSocket("udp4")
-  sock.on("error", (err) => {
-    recordFlowListenerError(err.message)
-    state = { bound: false, address: null }
-  })
-  sock.on("message", onMessage)
-  sock.bind(port, host, () => {
-    state = { bound: true, address: `${host}:${port}` }
-    recordFlowListenerError("")
-  })
-  socket = sock
-  flushTimer = setInterval(onTick, TICK_MS)
+  wantListen = true
+  spawnWorker()
+}
+
+export function stopTrafficFlowListener() {
+  wantListen = false
+  stopWorkerProcess()
+  try {
+    flushPending()
+  } catch {
+    /* ignore */
+  }
+  state = { bound: false, address: null }
+}
+
+export function refreshFlowExporterMap(): void {
+  applyExporterCtxFromDb()
+  postToWorker({ type: "updateExporterMap", payload: buildExporterMapPayload() })
+}
+
+export function getRingMbps(serverId: number, iface = "__all__") {
+  return engineGetRingMbps(serverId, iface)
+}
+
+function mergeInto(map: Map<string, PendingFlowRow>, row: PendingFlowRow): void {
+  const key = `${row.serverId}|${row.bucketAt}|${row.src}|${row.dst}|${row.proto}|${row.srcPort}|${row.dstPort}|${row.inIface}`
+  const prev = map.get(key)
+  if (prev) {
+    prev.bytes += row.bytes
+    prev.packets += row.packets
+    return
+  }
+  map.set(key, { ...row })
+}
+
+export function listLiveFlowRows(sinceIso: string): PendingFlowRow[] {
+  if (worker && lastHeartbeat?.workerAlive) {
+    return listStoredFlowRows(sinceIso)
+  }
+  return engineListLive(sinceIso)
 }

 export function listStoredFlowRows(sinceIso: string): PendingFlowRow[] {
-  const stored = db.select().from(flowBuckets).where(gte(flowBuckets.bucketAt, sinceIso)).all()
+  const settings = getTrafficFlowSettingsRow()
+  const cap = Math.max(20, settings.topN) * 60
+  const stored = db.select().from(flowBuckets)
+    .where(gte(flowBuckets.bucketAt, sinceIso))
+    .orderBy(sql`${flowBuckets.bytes} DESC`)
+    .limit(cap)
+    .all()
  const merged = new Map<string, PendingFlowRow>()
  for (const r of stored) {
-    const key = `${r.serverId}|${r.bucketAt}|${r.src}|${r.dst}|${r.proto}|${r.srcPort}|${r.dstPort}|${r.inIface}`
-    merged.set(key, {
+    mergeInto(merged, {
      serverId: r.serverId,
      bucketAt: r.bucketAt,
      src: r.src,
@@ -323,24 +303,25 @@ export function listStoredFlowRows(sinceIso: string): PendingFlowRow[] {
      outIface: "",
    })
  }
-  for (const p of peekPendingFlows()) {
-    if (p.bucketAt < sinceIso) continue
-    const key = `${p.serverId}|${p.bucketAt}|${p.src}|${p.dst}|${p.proto}|${p.srcPort}|${p.dstPort}|${p.inIface}`
-    const prev = merged.get(key)
-    if (prev) {
-      prev.bytes += p.bytes
-      prev.packets += p.packets
-    } else {
-      merged.set(key, { ...p })
+  if (!worker) {
+    for (const p of peekPendingFlows()) {
+      if (p.bucketAt < sinceIso) continue
+      mergeInto(merged, p)
    }
  }
  return [...merged.values()]
 }

+export function listFlowRowsForWindow(minutes: number): PendingFlowRow[] {
+  const sinceIso = new Date(Date.now() - minutes * 60_000).toISOString()
+  if (minutes <= 15 && !worker) return listLiveFlowRows(sinceIso)
+  return listStoredFlowRows(sinceIso)
+}
+
 export function listFlowTalkers(minutes = 5): FlowStatsDto {
  const settings = getTrafficFlowSettingsRow()
-  const rangeStart = new Date(Date.now() - minutes * 60_000).toISOString()
-  const rows = listStoredFlowRows(rangeStart)
+  const runtime = getFlowRuntimeCounters()
+  const rows = listFlowRowsForWindow(minutes)
  const serverRows = db.select().from(servers).all()
  const nameById = new Map(serverRows.map((s) => [s.id, s.name || s.host]))
  const agg = new Map<string, FlowTalkerDto & { rawBytes: number }>()
@@ -404,46 +385,44 @@ export function listFlowTalkers(minutes = 5): FlowStatsDto {
    uniqueDst: dsts.size,
    topProto,
    talkers,
-    lastExporterIp: settings.lastExporterIp ?? null,
-    lastError: settings.lastError || null,
-    packetsReceived: settings.packetsReceived,
-    lastDatagramAt: settings.lastDatagramAt ?? null,
+    lastExporterIp: runtime.lastExporterIp,
+    lastError: runtime.lastError,
+    packetsReceived: runtime.packetsReceived,
+    lastDatagramAt: runtime.lastDatagramAt,
    listenerBound: state.bound,
    listenerAddress: state.address,
  }
 }

 export function ingestParsedFlowsForTests(exporterIp: string, flows: ParsedFlow[]) {
-  queueFlows(exporterIp, flows)
+  applyExporterCtxFromDb()
+  const serverId = resolveServerId(exporterIp)
+  if (serverId == null) return
+  queueParsedFlows(serverId, flows)
  rollFlowRings()
  flushPending()
 }

-/** Кладёт потоки в pending без flush в SQLite — для юнит-тестов аналитики. */
 export function ingestParsedFlowsForServerForTests(serverId: number, flows: ParsedFlow[]) {
-  const bucketAt = minuteBucketIso()
-  for (const flow of flows) {
-    addToTick(serverId, flow.inIface, flow.outIface, flow.bytes)
-    const key = `${serverId}\0${bucketAt}\0${flow.src}\0${flow.dst}\0${flow.proto}\0${flow.srcPort}\0${flow.dstPort}\0${flow.inIface}`
-    const prev = pending.get(key)
-    if (prev) {
-      prev.bytes += flow.bytes
-      prev.packets += flow.packets
-    } else {
-      pending.set(key, {
-        serverId,
-        bucketAt,
-        flow: { ...flow },
-        bytes: flow.bytes,
-        packets: flow.packets,
-      })
-    }
-  }
-  rollFlowRings()
+  engineIngestForServer(serverId, flows)
 }

 export function resetFlowRingsForTests() {
-  tickAccum.clear()
-  rings.clear()
-  pending.clear()
+  resetEngineForTests()
+  attachEngineSqlite(sqliteDatabase)
+  lastHeartbeat = null
+  wantListen = false
+  restartAttempts = 0
 }
+
+export function lastFlushUsedTransactionForTests(): boolean {
+  return engineLastFlushTx()
+}
+
+export function flushPendingForTests(): void {
+  flushPending()
+}
+
+export { peekPendingFlows }
+export { setPendingCapForTests } from "./traffic-flow-engine.js"
+export { maybeRefreshIfaces, setRefreshIfacesForTests } from "./traffic-flow-ifaces.js"
@@ -0,0 +1,54 @@
+/** IPv4 helpers for RIPEstat prefix cache and EvoBGP CIDR match. */
+
+export function ipv4ToInt(ip: string): number | null {
+  const parts = String(ip ?? "").trim().split(".")
+  if (parts.length !== 4) return null
+  let n = 0
+  for (const p of parts) {
+    if (!/^\d+$/.test(p)) return null
+    const o = Number(p)
+    if (o < 0 || o > 255) return null
+    n = ((n << 8) >>> 0) + o
+  }
+  return n >>> 0
+}
+
+export function parseCidrV4(cidr: string): { net: number; mask: number; prefixLen: number } | null {
+  const raw = String(cidr ?? "").trim()
+  const [ip, lenRaw] = raw.split("/")
+  const addr = ipv4ToInt(ip ?? "")
+  const prefixLen = Number.parseInt(lenRaw ?? "", 10)
+  if (addr == null || !Number.isFinite(prefixLen) || prefixLen < 0 || prefixLen > 32) return null
+  const mask = prefixLen === 0 ? 0 : (0xffffffff << (32 - prefixLen)) >>> 0
+  return { net: (addr & mask) >>> 0, mask, prefixLen }
+}
+
+export function ipInCidrV4(ip: string, cidr: string): boolean {
+  const addr = ipv4ToInt(ip)
+  const parsed = parseCidrV4(cidr)
+  if (addr == null || !parsed) return false
+  return ((addr & parsed.mask) >>> 0) === parsed.net
+}
+
+export function isNonPublicIp(ip: string): boolean {
+  const trimmed = String(ip ?? "").trim()
+  if (!trimmed) return true
+  if (trimmed.includes(":")) {
+    const lower = trimmed.toLowerCase()
+    return lower === "::1" || lower.startsWith("fe80:") || lower.startsWith("fc") || lower.startsWith("fd") || lower === "::"
+  }
+  const n = ipv4ToInt(trimmed)
+  if (n == null) return true
+  const inRange = (cidr: string) => ipInCidrV4(trimmed, cidr)
+  return (
+    inRange("0.0.0.0/8")
+    || inRange("10.0.0.0/8")
+    || inRange("127.0.0.0/8")
+    || inRange("169.254.0.0/16")
+    || inRange("172.16.0.0/12")
+    || inRange("192.168.0.0/16")
+    || inRange("100.64.0.0/10")
+    || inRange("224.0.0.0/4")
+    || inRange("255.255.255.255/32")
+  )
+}
@@ -19,7 +19,7 @@ import {
  getTrafficFlowSettingsRow,
  upsertHostPeer,
 } from "./traffic-flow-settings.js"
-import { startTrafficFlowListener } from "./traffic-flow-ingest.js"
+import { refreshFlowExporterMap, startTrafficFlowListener } from "./traffic-flow-ingest.js"
 import { listTrafficFlowHostFiles } from "./traffic-flow-host-files.js"

 const IFACE_NAME = "wg-flow"
@@ -268,6 +268,7 @@ export async function applyFlowOverlay(

    enableTrafficFlowIngest()
    startTrafficFlowListener()
+    refreshFlowExporterMap()
    steps.push("Коллектор IPFIX на MM включён")

    return {
@@ -1,5 +1,5 @@
 import assert from "node:assert/strict"
-import { parseFlowPacket, protoName, resetFlowTemplatesForTests } from "./traffic-flow-parse.js"
+import { parseFlowPacket, protoName, resetFlowTemplatesForTests, templateExporterCountForTests } from "./traffic-flow-parse.js"
 import { allocateOverlayAddress, FLOW_TARGET_SRC_AUTO, usablePublicHost } from "./traffic-flow-overlay.js"

 function netflowV5One(): Buffer {
@@ -96,8 +96,27 @@ resetFlowTemplatesForTests()
  parseFlowPacket(tpl, "10.255.254.3")
  const named = parseFlowPacket(data, "10.255.254.3")
  assert.equal(named.length, 1)
-  assert.equal(named[0]?.inIface, "13")
+  assert.equal(named[0]?.inIface, "ether1")
  assert.equal(named[0]?.src, "10.1.1.8")
 }

+resetFlowTemplatesForTests()
+{
+  const tpl = Buffer.alloc(16 + 16 + 20)
+  tpl.writeUInt16BE(10, 0)
+  tpl.writeUInt16BE(tpl.length, 2)
+  tpl.writeUInt16BE(2, 16)
+  tpl.writeUInt16BE(16, 18)
+  tpl.writeUInt16BE(256, 20)
+  tpl.writeUInt16BE(2, 22)
+  tpl.writeUInt16BE(8, 24)
+  tpl.writeUInt16BE(4, 26)
+  tpl.writeUInt16BE(12, 28)
+  tpl.writeUInt16BE(4, 30)
+  for (let i = 0; i < 260; i++) {
+    parseFlowPacket(tpl, `203.0.${Math.floor(i / 250)}.${i % 250}`)
+  }
+  assert.ok(templateExporterCountForTests() <= 256)
+}
+
 console.log("traffic-flow-parse.test.ts: ok")
@@ -19,8 +19,26 @@ interface Template {
  fields: FieldSpec[]
 }

+const MAX_TEMPLATE_EXPORTERS = 256
 const templatesByExporter = new Map<string, Map<number, Template>>()

+function templatesForExporter(exporter: string): Map<number, Template> {
+  const existing = templatesByExporter.get(exporter)
+  if (existing) {
+    templatesByExporter.delete(exporter)
+    templatesByExporter.set(exporter, existing)
+    return existing
+  }
+  const created = new Map<number, Template>()
+  templatesByExporter.set(exporter, created)
+  while (templatesByExporter.size > MAX_TEMPLATE_EXPORTERS) {
+    const oldest = templatesByExporter.keys().next().value
+    if (oldest == null || oldest === exporter) break
+    templatesByExporter.delete(oldest)
+  }
+  return created
+}
+
 function ipv4(buf: Buffer, offset: number): string {
  return `${buf[offset]}.${buf[offset + 1]}.${buf[offset + 2]}.${buf[offset + 3]}`
 }
@@ -105,7 +123,7 @@ function parseNetflowV5(buf: Buffer): ParsedFlow[] {

 function parseIpfixTemplates(exporter: string, buf: Buffer, setStart: number, setEnd: number, setId: number) {
  let off = setStart + 4
-  const map = templatesByExporter.get(exporter) ?? new Map<number, Template>()
+  const map = templatesForExporter(exporter)
  while (off + 4 <= setEnd) {
    const templateId = buf.readUInt16BE(off)
    const fieldCount = buf.readUInt16BE(off + 2)
@@ -206,7 +224,7 @@ function recordFromFields(
    }
    off = field.next
  }
-  if (!inIface && ifaceName) inIface = ifaceName
+  if (ifaceName) inIface = ifaceName
  return { flow: { src, dst, proto, srcPort, dstPort, bytes, packets, inIface, outIface }, next: off }
 }

@@ -255,7 +273,7 @@ function parseNetflowV9(buf: Buffer, exporter: string): ParsedFlow[] {
  const count = buf.readUInt16BE(2)
  let off = 20
  const out: ParsedFlow[] = []
-  const map = templatesByExporter.get(exporter) ?? new Map<number, Template>()
+  const map = templatesForExporter(exporter)
  for (let s = 0; s < count && off + 4 <= buf.length; s++) {
    const setId = buf.readUInt16BE(off)
    const setLen = buf.readUInt16BE(off + 2)
@@ -308,3 +326,7 @@ export function protoName(proto: number): string {
 export function resetFlowTemplatesForTests() {
  templatesByExporter.clear()
 }
+
+export function templateExporterCountForTests(): number {
+  return templatesByExporter.size
+}
@@ -0,0 +1,103 @@
+import assert from "node:assert/strict"
+import {
+  disableRipeEnqueueForTests,
+  disableRipePersistForTests,
+  enqueueRipeMisses,
+  flushRipeQueueForTests,
+  lookupRipeCached,
+  resetRipeCacheForTests,
+  ripeFetchCountForTests,
+  seedRipeCacheForTests,
+  setRipeFetchForTests,
+} from "./traffic-flow-ripe.js"
+
+disableRipePersistForTests()
+resetRipeCacheForTests()
+disableRipeEnqueueForTests()
+
+assert.equal(lookupRipeCached("10.1.1.8")?.ok, false)
+assert.equal(lookupRipeCached("192.168.0.1")?.ok, false)
+assert.equal(lookupRipeCached("100.64.1.2")?.ok, false)
+assert.equal(ripeFetchCountForTests(), 0)
+
+seedRipeCacheForTests({
+  prefix: "1.2.3.0/24",
+  asn: 64500,
+  country: "NL",
+  lat: 52.3,
+  lng: 4.9,
+  holder: "TEST",
+  ok: true,
+  fetchedAt: Date.now(),
+})
+assert.equal(lookupRipeCached("1.2.3.10")?.country, "NL")
+assert.equal(lookupRipeCached("1.2.3.10")?.asn, 64500)
+assert.equal(ripeFetchCountForTests(), 0)
+
+resetRipeCacheForTests()
+disableRipePersistForTests()
+setRipeFetchForTests(async (input) => {
+  const url = String(input)
+  const body = url.includes("network-info")
+    ? { data: { prefix: "8.8.8.0/24", asns: ["15169"] } }
+    : url.includes("maxmind-geo-lite")
+      ? { data: { located_resources: [{ locations: [{ country: "US", latitude: 37.4, longitude: -122.1 }] }] } }
+      : { data: { holder: "GOOGLE" } }
+  return new Response(JSON.stringify(body), { status: 200, headers: { "Content-Type": "application/json" } })
+})
+enqueueRipeMisses(["8.8.8.8"])
+await flushRipeQueueForTests()
+assert.equal(lookupRipeCached("8.8.8.8")?.country, "US")
+assert.equal(lookupRipeCached("8.8.8.10")?.prefix, "8.8.8.0/24")
+const afterFirst = ripeFetchCountForTests()
+assert.ok(afterFirst >= 2)
+enqueueRipeMisses(["8.8.8.10"])
+await flushRipeQueueForTests()
+assert.equal(ripeFetchCountForTests(), afterFirst)
+
+resetRipeCacheForTests()
+disableRipePersistForTests()
+setRipeFetchForTests(async () => {
+  throw new Error("timeout")
+})
+enqueueRipeMisses(["203.0.113.50"])
+await flushRipeQueueForTests()
+const neg = lookupRipeCached("203.0.113.50")
+assert.equal(neg?.ok, false)
+const afterNeg = ripeFetchCountForTests()
+enqueueRipeMisses(["203.0.113.50"])
+await flushRipeQueueForTests()
+assert.equal(ripeFetchCountForTests(), afterNeg)
+
+resetRipeCacheForTests()
+disableRipePersistForTests()
+seedRipeCacheForTests({
+  prefix: "1.1.1.0/24",
+  asn: 13335,
+  country: "?",
+  lat: null,
+  lng: null,
+  holder: "CLOUDFLARENET, US",
+  ok: true,
+  fetchedAt: Date.now(),
+})
+assert.equal(lookupRipeCached("1.1.1.1")?.country, "US")
+assert.ok(lookupRipeCached("1.1.1.1")?.country !== "?")
+
+resetRipeCacheForTests()
+disableRipePersistForTests()
+setRipeFetchForTests(async (input) => {
+  const url = String(input)
+  const body = url.includes("network-info")
+    ? { data: { prefix: "1.0.0.0/24", asns: ["13335"] } }
+    : url.includes("maxmind-geo-lite")
+      ? { data: { located_resources: [{ locations: [{ country: "?" }] }] } }
+      : { data: { holder: "CLOUDFLARENET, US" } }
+  return new Response(JSON.stringify(body), { status: 200, headers: { "Content-Type": "application/json" } })
+})
+enqueueRipeMisses(["1.0.0.1"])
+await flushRipeQueueForTests()
+assert.equal(lookupRipeCached("1.0.0.1")?.country, "US")
+assert.equal(lookupRipeCached("1.0.0.1")?.asn, 13335)
+
+console.log("traffic-flow-ripe.test.ts: ok")
@@ -0,0 +1,379 @@
+import { sqliteDatabase } from "../db/index.js"
+import { ipInCidrV4, ipv4ToInt, isNonPublicIp, parseCidrV4 } from "./traffic-flow-ip.js"
+import { resolveRipeCountry } from "./traffic-flow-brands.js"
+
+export interface FlowIpMeta {
+  prefix: string
+  asn: number
+  country: string
+  lat: number | null
+  lng: number | null
+  holder: string
+  ok: boolean
+  fetchedAt: number
+}
+
+const HIT_TTL_MS = 24 * 60 * 60_000
+const NEG_TTL_MS = 6 * 60 * 60_000
+const MAX_NEW_PREFIX_PER_MIN = 30
+const MAX_QUEUE = 90
+const CONCURRENCY = 3
+const RIPE_BASE = "https://stat.ripe.net/data"
+const UA = "MikrotikManager-flow/1.0"
+
+const mem = new Map<string, FlowIpMeta>()
+const asnHolder = new Map<number, { holder: string; fetchedAt: number }>()
+const inflight = new Map<string, Promise<FlowIpMeta | null>>()
+const queue: string[] = []
+const queued = new Set<string>()
+const recentFetches: number[] = []
+
+let persistEnabled = true
+let enqueueEnabled = true
+let loaded = false
+let workerRunning = false
+let fetchImpl: typeof fetch = globalThis.fetch.bind(globalThis)
+let fetchCount = 0
+
+export function disableRipePersistForTests(): void {
+  persistEnabled = false
+}
+
+export function disableRipeEnqueueForTests(): void {
+  enqueueEnabled = false
+}
+
+export function resetRipeCacheForTests(): void {
+  mem.clear()
+  asnHolder.clear()
+  inflight.clear()
+  queue.length = 0
+  queued.clear()
+  recentFetches.length = 0
+  loaded = persistEnabled ? false : true
+  workerRunning = false
+  fetchCount = 0
+  enqueueEnabled = true
+  fetchImpl = globalThis.fetch.bind(globalThis)
+}
+
+export function seedRipeCacheForTests(entry: FlowIpMeta): void {
+  mem.set(entry.prefix, { ...entry })
+  loaded = true
+}
+
+export function setRipeFetchForTests(fn: typeof fetch): void {
+  fetchImpl = fn
+  fetchCount = 0
+}
+
+export function ripeFetchCountForTests(): number {
+  return fetchCount
+}
+
+export async function flushRipeQueueForTests(timeoutMs = 4000): Promise<void> {
+  const start = Date.now()
+  while (Date.now() - start < timeoutMs) {
+    if (!queue.length && !inflight.size && !workerRunning) return
+    await new Promise((r) => setTimeout(r, 20))
+  }
+}
+
+function ttlMs(ok: boolean): number {
+  return ok ? HIT_TTL_MS : NEG_TTL_MS
+}
+
+function isFresh(entry: FlowIpMeta): boolean {
+  return Date.now() - entry.fetchedAt < ttlMs(entry.ok)
+}
+
+function loadSqlite(): void {
+  if (loaded || !persistEnabled) {
+    loaded = true
+    return
+  }
+  loaded = true
+  try {
+    const rows = sqliteDatabase.prepare(`
+      SELECT prefix, asn, country, lat, lng, holder, ok, fetched_at
+      FROM flow_ip_meta
+    `).all() as Array<{
+      prefix: string
+      asn: number | null
+      country: string
+      lat: number | null
+      lng: number | null
+      holder: string
+      ok: number
+      fetched_at: string
+    }>
+    for (const r of rows) {
+      const fetchedAt = Date.parse(r.fetched_at)
+      const asn = Number(r.asn ?? 0) || 0
+      const holder = r.holder || ""
+      mem.set(r.prefix, {
+        prefix: r.prefix,
+        asn,
+        country: resolveRipeCountry(r.country || "", asn, holder) || "—",
+        lat: r.lat == null ? null : Number(r.lat),
+        lng: r.lng == null ? null : Number(r.lng),
+        holder,
+        ok: r.ok !== 0,
+        fetchedAt: Number.isFinite(fetchedAt) ? fetchedAt : 0,
+      })
+    }
+    const asns = sqliteDatabase.prepare(`SELECT asn, holder, fetched_at FROM flow_asn_meta`).all() as Array<{
+      asn: number
+      holder: string
+      fetched_at: string
+    }>
+    for (const a of asns) {
+      const fetchedAt = Date.parse(a.fetched_at)
+      asnHolder.set(a.asn, { holder: a.holder || "", fetchedAt: Number.isFinite(fetchedAt) ? fetchedAt : 0 })
+    }
+  } catch {
+    /* table may not exist in isolated tests */
+  }
+}
+
+function persist(entry: FlowIpMeta): void {
+  if (!persistEnabled) return
+  try {
+    sqliteDatabase.prepare(`
+      INSERT INTO flow_ip_meta (prefix, asn, country, lat, lng, holder, ok, fetched_at)
+      VALUES (@prefix, @asn, @country, @lat, @lng, @holder, @ok, @fetchedAt)
+      ON CONFLICT(prefix) DO UPDATE SET
+        asn=excluded.asn, country=excluded.country, lat=excluded.lat, lng=excluded.lng,
+        holder=excluded.holder, ok=excluded.ok, fetched_at=excluded.fetched_at
+    `).run({
+      prefix: entry.prefix,
+      asn: entry.asn,
+      country: entry.country,
+      lat: entry.lat,
+      lng: entry.lng,
+      holder: entry.holder,
+      ok: entry.ok ? 1 : 0,
+      fetchedAt: new Date(entry.fetchedAt).toISOString(),
+    })
+  } catch {
+    /* ignore persist errors */
+  }
+}
+
+function persistAsn(asn: number, holder: string): void {
+  if (!persistEnabled || !asn) return
+  try {
+    sqliteDatabase.prepare(`
+      INSERT INTO flow_asn_meta (asn, holder, fetched_at)
+      VALUES (@asn, @holder, @fetchedAt)
+      ON CONFLICT(asn) DO UPDATE SET holder=excluded.holder, fetched_at=excluded.fetched_at
+    `).run({
+      asn,
+      holder,
+      fetchedAt: new Date().toISOString(),
+    })
+  } catch {
+    /* ignore */
+  }
+}
+
+function negative(prefix: string): FlowIpMeta {
+  return {
+    prefix,
+    asn: 0,
+    country: "—",
+    lat: null,
+    lng: null,
+    holder: "",
+    ok: false,
+    fetchedAt: Date.now(),
+  }
+}
+
+export function lookupRipeCached(ip: string): FlowIpMeta | null {
+  loadSqlite()
+  const trimmed = String(ip ?? "").trim()
+  if (!trimmed) return null
+  if (isNonPublicIp(trimmed)) {
+    return negative(`${trimmed.includes(":") ? trimmed : trimmed}/32`)
+  }
+  let best: FlowIpMeta | null = null
+  let bestLen = -1
+  for (const entry of mem.values()) {
+    if (!isFresh(entry)) continue
+    const parsed = parseCidrV4(entry.prefix)
+    if (!parsed) continue
+    if (!ipInCidrV4(trimmed, entry.prefix)) continue
+    if (parsed.prefixLen > bestLen) {
+      best = entry
+      bestLen = parsed.prefixLen
+    }
+  }
+  return best
+    ? { ...best, country: resolveRipeCountry(best.country, best.asn, best.holder) || "—" }
+    : null
+}
+
+async function ripeJson(path: string, resource: string): Promise<unknown> {
+  fetchCount += 1
+  const url = `${RIPE_BASE}/${path}/data.json?resource=${encodeURIComponent(resource)}`
+  const ac = new AbortController()
+  const t = setTimeout(() => ac.abort(), 12_000)
+  try {
+    const res = await fetchImpl(url, {
+      headers: { Accept: "application/json", "User-Agent": UA },
+      signal: ac.signal,
+    })
+    if (!res.ok) throw new Error(`HTTP ${res.status}`)
+    return await res.json()
+  } finally {
+    clearTimeout(t)
+  }
+}
+
+function pickPrefix(data: unknown): string {
+  const d = data as { data?: { prefix?: string } }
+  return String(d?.data?.prefix ?? "").trim()
+}
+
+function pickAsns(data: unknown): number {
+  const d = data as { data?: { asns?: unknown } }
+  const raw = d?.data?.asns
+  const first = Array.isArray(raw) ? raw[0] : raw
+  const n = Number.parseInt(String(first ?? "").replace(/^AS/i, ""), 10)
+  return Number.isFinite(n) ? n : 0
+}
+
+function pickGeo(data: unknown): { country: string; lat: number | null; lng: number | null } {
+  const d = data as {
+    data?: {
+      located_resources?: Array<{
+        locations?: Array<{ country?: string; latitude?: number; longitude?: number }>
+      }>
+    }
+  }
+  const loc = d?.data?.located_resources?.[0]?.locations?.[0]
+  const country = resolveRipeCountry(String(loc?.country ?? ""), 0, "")
+  const lat = loc?.latitude == null ? null : Number(loc.latitude)
+  const lng = loc?.longitude == null ? null : Number(loc.longitude)
+  return {
+    country: country || "—",
+    lat: Number.isFinite(lat) ? lat : null,
+    lng: Number.isFinite(lng) ? lng : null,
+  }
+}
+
+function pickHolder(data: unknown): string {
+  const d = data as { data?: { holder?: string } }
+  return String(d?.data?.holder ?? "").trim()
+}
+
+function allowNewPrefix(): boolean {
+  const now = Date.now()
+  while (recentFetches.length && now - recentFetches[0]! > 60_000) recentFetches.shift()
+  return recentFetches.length < MAX_NEW_PREFIX_PER_MIN
+}
+
+async function resolveIp(ip: string): Promise<FlowIpMeta | null> {
+  const cached = lookupRipeCached(ip)
+  if (cached) return cached
+  const pending = inflight.get(ip)
+  if (pending) return pending
+
+  const job = (async () => {
+    if (!allowNewPrefix()) return null
+    recentFetches.push(Date.now())
+    try {
+      const net = await ripeJson("network-info", ip)
+      const prefix = pickPrefix(net) || `${ip}/32`
+      const existing = mem.get(prefix)
+      if (existing && isFresh(existing)) return existing
+      const asn = pickAsns(net)
+      let geo = { country: "—", lat: null as number | null, lng: null as number | null }
+      try {
+        geo = pickGeo(await ripeJson("maxmind-geo-lite", prefix))
+      } catch {
+        /* best-effort */
+      }
+      let holder = asnHolder.get(asn)?.holder ?? ""
+      if (asn && (!holder || Date.now() - (asnHolder.get(asn)?.fetchedAt ?? 0) > HIT_TTL_MS)) {
+        try {
+          holder = pickHolder(await ripeJson("as-overview", `AS${asn}`))
+          asnHolder.set(asn, { holder, fetchedAt: Date.now() })
+          persistAsn(asn, holder)
+        } catch {
+          /* best-effort */
+        }
+      }
+      const country = resolveRipeCountry(geo.country, asn, holder)
+      const entry: FlowIpMeta = {
+        prefix,
+        asn,
+        country: country || "—",
+        lat: geo.lat,
+        lng: geo.lng,
+        holder,
+        ok: Boolean(asn || country),
+        fetchedAt: Date.now(),
+      }
+      mem.set(prefix, entry)
+      persist(entry)
+      return entry
+    } catch {
+      const prefix = `${ip}/32`
+      const entry = negative(prefix)
+      mem.set(prefix, entry)
+      persist(entry)
+      return entry
+    } finally {
+      inflight.delete(ip)
+    }
+  })()
+
+  inflight.set(ip, job)
+  return job
+}
+
+async function runWorker(): Promise<void> {
+  if (workerRunning) return
+  workerRunning = true
+  try {
+    while (queue.length) {
+      const batch: string[] = []
+      while (batch.length < CONCURRENCY && queue.length) {
+        const ip = queue.shift()
+        if (!ip) break
+        queued.delete(ip)
+        if (lookupRipeCached(ip)) continue
+        if (ipv4ToInt(ip) == null && !ip.includes(":")) continue
+        batch.push(ip)
+      }
+      if (!batch.length) {
+        if (!allowNewPrefix()) {
+          await new Promise((r) => setTimeout(r, 1000))
+        }
+        continue
+      }
+      await Promise.all(batch.map((ip) => resolveIp(ip)))
+    }
+  } finally {
+    workerRunning = false
+    if (queue.length) void runWorker()
+  }
+}
+
+/** HTTP / SSE never await this — cache miss is filled on a later tick. */
+export function enqueueRipeMisses(ips: Iterable<string>): void {
+  if (!enqueueEnabled) return
+  loadSqlite()
+  for (const raw of ips) {
+    if (queue.length >= MAX_QUEUE) break
+    const ip = String(raw ?? "").trim()
+    if (!ip || isNonPublicIp(ip)) continue
+    if (lookupRipeCached(ip)) continue
+    if (queued.has(ip) || inflight.has(ip)) continue
+    queued.add(ip)
+    queue.push(ip)
+  }
+  if (queue.length) void runWorker()
+}
@@ -64,7 +64,14 @@ function TrafficFlowsDataGrid({
        accessorFn: (r) => r.application ?? r.protoName,
        header: () => <span className="text-xs font-medium text-muted-foreground">App</span>,
        cell: ({ row }) => (
-          <span className="text-xs">{row.original.application ?? row.original.protoName}</span>
+          <span className="flex min-w-0 flex-col gap-0.5 text-xs">
+            <span>{row.original.application ?? row.original.protoName}</span>
+            {row.original.category || row.original.service ? (
+              <span className="text-[10px] text-muted-foreground truncate">
+                {[row.original.category, row.original.service].filter(Boolean).join(" · ")}
+              </span>
+            ) : null}
+          </span>
        ),
        meta: { headerClassName: DATA_GRID_CELL_PAD, cellClassName: DATA_GRID_CELL_PAD },
      },
@@ -46,6 +46,7 @@ function nearestCdnSize(px: number): number {
 export function Flag({ code, size = 20, className }: FlagProps) {
  if (!code) return null
  const lower  = code.toLowerCase()
+  if (!/^[a-z]{2}$/.test(lower)) return null
  const name   = countryName(code.toUpperCase())
  const cdnSrc = nearestCdnSize(size)
  const cdnSrc2x = nearestCdnSize(size * 2)
@@ -2,12 +2,14 @@

 import { useMemo, useState } from "react"
 import { type ColumnDef, getCoreRowModel, useReactTable } from "@tanstack/react-table"
-import type { FlowAnalyticsDto, FlowBreakdownRow, FlowEntityCard } from "@mmapp/contracts/traffic-flow"
-import { ArrowDownIcon, ArrowUpIcon, GitBranchIcon } from "lucide-react"
+import type { FlowAnalyticsDto, FlowBreakdownRow, FlowEntityCard, FlowTalkerDto } from "@mmapp/contracts/traffic-flow"
+import { ArrowDownIcon, ArrowUpIcon, GitBranchIcon, GlobeIcon, LayersIcon, UsersIcon } from "lucide-react"
 import { Badge } from "@/components/reui/badge"
 import { KpiStatGrid } from "@/components/reui-kit/kpi-stat-grid"
 import { TrafficRxTxChart } from "@/components/reui-kit/traffic-rx-tx-chart"
 import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs"
+import { Switch } from "@/components/ui/switch"
+import { Label } from "@/components/ui/label"
 import { DataGridShell } from "@/components/data-grids/shared/data-grid-shell"
 import {
  DATA_GRID_CELL_PAD,
@@ -15,7 +17,7 @@ import {
  DATA_GRID_CELL_PAD_LAST,
 } from "@/components/data-grids/shared/data-grid-layout"
 import { TrafficFlowsDataGrid } from "@/components/data-grids/traffic-flows-data-grid"
-import { Sparkline } from "@/components/sparkline"
+import { FlowTrafficMap } from "@/components/traffic/flow-traffic-map"
 import { StatusDot } from "@/components/status-dot"
 import { Flag } from "@/components/flag"
 import { fmtRate } from "@/lib/fmt-rate"
@@ -28,13 +30,14 @@ function formatBytes(n: number): string {
  return `${n} Б`
 }

-const RANGE_KEYS = ["5m", "15m", "1h", "4h", "24h"] as const
+const RANGE_KEYS = ["5m", "15m", "1h", "4h", "24h", "30d"] as const
 const RANGE_LABELS: Record<string, string> = {
  "5m": "5м",
  "15m": "15м",
  "1h": "1ч",
  "4h": "4ч",
  "24h": "24ч",
+  "30d": "месяц",
 }

 function MiniAreaChart({ rx, tx, height = 44 }: { rx: number[]; tx: number[]; height?: number }) {
@@ -106,7 +109,37 @@ export function FlowEntityCardView({
  )
 }

-function FlowBreakdownGrid({ rows, empty }: { rows: FlowBreakdownRow[]; empty?: string }) {
+type SessionFilter = {
+  kind: "application" | "category" | "service" | "asn" | "country" | "protocol" | "source" | "destination" | "iface"
+  value: string
+  label: string
+}
+
+function talkerMatchesFilter(row: FlowTalkerDto, filter: SessionFilter): boolean {
+  switch (filter.kind) {
+    case "application": return row.application === filter.value
+    case "category": return row.category === filter.value
+    case "service": return row.service === filter.value
+    case "asn": return String(row.dstAsn ?? "") === filter.value
+    case "country": return row.dstCountry === filter.value
+    case "protocol": return row.protoName === filter.value
+    case "source": return row.src === filter.value
+    case "destination": return row.dst === filter.value
+    case "iface": return row.inIface === filter.value
+  }
+}
+
+function FlowBreakdownGrid({
+  rows,
+  empty,
+  country,
+  onPick,
+}: {
+  rows: FlowBreakdownRow[]
+  empty?: string
+  country?: boolean
+  onPick?: (row: FlowBreakdownRow) => void
+}) {
  const columns = useMemo<ColumnDef<FlowBreakdownRow>[]>(
    () => [
      {
@@ -115,7 +148,10 @@ function FlowBreakdownGrid({ rows, empty }: { rows: FlowBreakdownRow[]; empty?:
        header: () => <span className="text-xs font-medium text-muted-foreground">Имя</span>,
        cell: ({ row }) => (
          <div className="flex min-w-0 flex-col gap-1">
-            <span className="text-sm font-medium truncate">{row.original.label}</span>
+            <span className="flex items-center gap-1.5 text-sm font-medium truncate">
+              {country ? <Flag code={row.original.id} /> : null}
+              {row.original.label}
+            </span>
            <div className="h-1 rounded-full bg-muted overflow-hidden">
              <div
                className="h-full bg-primary"
@@ -154,7 +190,7 @@ function FlowBreakdownGrid({ rows, empty }: { rows: FlowBreakdownRow[]; empty?:
        meta: { headerClassName: DATA_GRID_CELL_PAD_LAST, cellClassName: DATA_GRID_CELL_PAD_LAST },
      },
    ],
-    [],
+    [country],
  )

  const table = useReactTable({
@@ -165,7 +201,12 @@ function FlowBreakdownGrid({ rows, empty }: { rows: FlowBreakdownRow[]; empty?:
  })

  return (
-    <DataGridShell table={table} recordCount={rows.length} emptyMessage={empty ?? "Нет данных за период"} />
+    <DataGridShell
+      table={table}
+      recordCount={rows.length}
+      emptyMessage={empty ?? "Нет данных за период"}
+      onRowClick={onPick}
+    />
  )
 }

@@ -176,6 +217,8 @@ export function FlowAnalyticsDetail({
  onRange,
  selectedIface,
  onIface,
+  dedup,
+  onDedup,
  liveHint,
  emptyHint,
 }: {
@@ -185,12 +228,23 @@ export function FlowAnalyticsDetail({
  onRange: (r: string) => void
  selectedIface: string
  onIface: (name: string) => void
+  dedup: boolean
+  onDedup: (value: boolean) => void
  liveHint?: string
  emptyHint?: string
 }) {
  const [slice, setSlice] = useState("applications")
+  const [sessionFilter, setSessionFilter] = useState<SessionFilter | null>(null)
  const rxNow = analytics ? analytics.bpsNow / 1_000_000 : (card?.rxNow ?? 0)
  const bytes = analytics?.bytes ?? card?.bytes ?? 0
+  const sessionRows = (analytics?.conversationsList ?? []).filter((row) =>
+    sessionFilter ? talkerMatchesFilter(row, sessionFilter) : true,
+  )
+
+  function pickBreakdown(kind: SessionFilter["kind"], row: FlowBreakdownRow) {
+    setSessionFilter({ kind, value: row.id, label: row.label })
+    setSlice("sessions")
+  }

  if (!card) {
    return (
@@ -211,22 +265,34 @@ export function FlowAnalyticsDetail({
            {card.site}
          </span>
        </div>
-        <div className="flex gap-1 shrink-0">
-          {RANGE_KEYS.map((r) => (
-            <button
-              key={r}
-              type="button"
-              onClick={() => onRange(r)}
-              className={cn(
-                "h-7 px-2 text-xs rounded border transition-colors",
-                range === r
-                  ? "border-primary bg-primary/10 text-primary font-medium"
-                  : "border-border text-muted-foreground hover:text-foreground",
-              )}
-            >
-              {RANGE_LABELS[r]}
-            </button>
-          ))}
+        <div className="flex items-center gap-3 shrink-0">
+          <div className="flex items-center gap-2">
+            <Switch
+              id="flow-dedup"
+              checked={dedup}
+              onCheckedChange={onDedup}
+            />
+            <Label htmlFor="flow-dedup" className="text-xs text-muted-foreground whitespace-nowrap">
+              Без дублей
+            </Label>
+          </div>
+          <div className="flex gap-1">
+            {RANGE_KEYS.map((r) => (
+              <button
+                key={r}
+                type="button"
+                onClick={() => onRange(r)}
+                className={cn(
+                  "h-7 px-2 text-xs rounded border transition-colors",
+                  range === r
+                    ? "border-primary bg-primary/10 text-primary font-medium"
+                    : "border-border text-muted-foreground hover:text-foreground",
+                )}
+              >
+                {RANGE_LABELS[r]}
+              </button>
+            ))}
+          </div>
        </div>
      </div>

@@ -265,6 +331,7 @@ export function FlowAnalyticsDetail({
              )
            })}
          </div>
+          <p className="text-[10px] text-muted-foreground mt-1.5">по iface, без дедупа</p>
        </div>
      ) : null}

@@ -295,11 +362,28 @@ export function FlowAnalyticsDetail({
            },
            {
              id: "flows",
-              label: "Разговоры",
+              label: "Сессии",
              value: String(analytics?.conversations ?? card.sessions),
+              hint: analytics?.conversationsRaw != null && analytics.conversationsRaw !== analytics.conversations
+                ? `до дедупа ${analytics.conversationsRaw}`
+                : undefined,
              icon: <GitBranchIcon className="size-4" />,
              iconClassName: "text-warning",
            },
+            {
+              id: "uniq",
+              label: "Уник. src / dst",
+              value: `${analytics?.uniqueSrc ?? 0} / ${analytics?.uniqueDst ?? 0}`,
+              icon: <UsersIcon className="size-4" />,
+              iconClassName: "text-muted-foreground",
+            },
+            {
+              id: "category",
+              label: "Топ категория",
+              value: analytics?.topCategory ?? "—",
+              icon: <LayersIcon className="size-4" />,
+              iconClassName: "text-primary",
+            },
          ]}
        />
      </div>
@@ -312,58 +396,78 @@ export function FlowAnalyticsDetail({
        <Tabs value={slice} onValueChange={(v) => setSlice(String(v))} className="gap-3">
          <TabsList variant="line" className="flex flex-wrap h-auto">
            <TabsTrigger value="applications">Приложения</TabsTrigger>
+            <TabsTrigger value="categories">Категории</TabsTrigger>
+            <TabsTrigger value="services">Сервисы</TabsTrigger>
+            <TabsTrigger value="asns">ASN</TabsTrigger>
+            <TabsTrigger value="countries">Страны</TabsTrigger>
+            <TabsTrigger value="map">Карта</TabsTrigger>
            <TabsTrigger value="protocols">Протоколы</TabsTrigger>
            <TabsTrigger value="sources">Источники</TabsTrigger>
            <TabsTrigger value="destinations">Назначения</TabsTrigger>
-            <TabsTrigger value="conversations">Разговоры</TabsTrigger>
+            <TabsTrigger value="sessions">Сессии</TabsTrigger>
            <TabsTrigger value="interfaces">Интерфейсы</TabsTrigger>
          </TabsList>
          <TabsContent value="applications">
-            <FlowBreakdownGrid rows={analytics?.applications ?? []} />
+            <FlowBreakdownGrid rows={analytics?.applications ?? []} onPick={(row) => pickBreakdown("application", row)} />
+          </TabsContent>
+          <TabsContent value="categories">
+            <FlowBreakdownGrid rows={analytics?.categories ?? []} onPick={(row) => pickBreakdown("category", row)} />
+          </TabsContent>
+          <TabsContent value="services">
+            <FlowBreakdownGrid rows={analytics?.services ?? []} onPick={(row) => pickBreakdown("service", row)} />
+          </TabsContent>
+          <TabsContent value="asns">
+            <FlowBreakdownGrid rows={analytics?.asns ?? []} onPick={(row) => pickBreakdown("asn", row)} />
+          </TabsContent>
+          <TabsContent value="countries">
+            <FlowBreakdownGrid rows={analytics?.countries ?? []} country onPick={(row) => pickBreakdown("country", row)} />
+          </TabsContent>
+          <TabsContent value="map">
+            <FlowTrafficMap
+              edges={analytics?.mapEdges ?? []}
+              onSelectCountry={(iso) => {
+                setSessionFilter({ kind: "country", value: iso, label: iso })
+                setSlice("sessions")
+              }}
+            />
          </TabsContent>
          <TabsContent value="protocols">
-            <FlowBreakdownGrid rows={analytics?.protocols ?? []} />
+            <FlowBreakdownGrid rows={analytics?.protocols ?? []} onPick={(row) => pickBreakdown("protocol", row)} />
          </TabsContent>
          <TabsContent value="sources">
-            <FlowBreakdownGrid rows={analytics?.sources ?? []} />
+            <FlowBreakdownGrid rows={analytics?.sources ?? []} onPick={(row) => pickBreakdown("source", row)} />
          </TabsContent>
          <TabsContent value="destinations">
-            <FlowBreakdownGrid rows={analytics?.destinations ?? []} />
+            <FlowBreakdownGrid rows={analytics?.destinations ?? []} onPick={(row) => pickBreakdown("destination", row)} />
          </TabsContent>
-          <TabsContent value="conversations">
+          <TabsContent value="sessions">
+            {sessionFilter ? (
+              <div className="flex items-center gap-2 mb-2">
+                <GlobeIcon className="size-3.5 text-muted-foreground" />
+                <Badge variant="secondary" size="sm">Фильтр: {sessionFilter.label}</Badge>
+                <button
+                  type="button"
+                  className="text-xs text-primary"
+                  onClick={() => setSessionFilter(null)}
+                >
+                  сбросить
+                </button>
+              </div>
+            ) : null}
            <TrafficFlowsDataGrid
-              rows={analytics?.conversationsList ?? []}
-              emptyHint={emptyHint}
+              rows={sessionRows}
+              emptyHint={emptyHint ?? "Нет сессий по выбранному фильтру"}
            />
          </TabsContent>
          <TabsContent value="interfaces">
-            <FlowBreakdownGrid rows={analytics?.interfaces ?? []} />
+            <FlowBreakdownGrid
+              rows={analytics?.interfaces ?? []}
+              empty="Нет данных по интерфейсам"
+              onPick={(row) => pickBreakdown("iface", row)}
+            />
          </TabsContent>
        </Tabs>
      </div>
-
-      <div className="mt-4 pt-4 border-t grid grid-cols-2 gap-4">
-        <div>
-          <p className="text-xs text-muted-foreground mb-1">Объём за период</p>
-          <p className="text-lg font-semibold tabular-nums">{formatBytes(bytes)}</p>
-          <Sparkline
-            data={analytics?.rxSeries ?? card.rxSeries}
-            width={180}
-            height={28}
-            color="var(--chart-rx)"
-            filled
-          />
-        </div>
-        <div>
-          <p className="text-xs text-muted-foreground mb-1">Уник. адреса</p>
-          <p className="text-lg font-semibold tabular-nums">
-            {analytics?.uniqueSrc ?? 0}
-            <span className="text-sm font-normal text-muted-foreground"> src · </span>
-            {analytics?.uniqueDst ?? 0}
-            <span className="text-sm font-normal text-muted-foreground"> dst</span>
-          </p>
-        </div>
-      </div>
    </>
  )
 }
@@ -0,0 +1,191 @@
+"use client"
+
+import { useMemo, useState } from "react"
+import { type ColumnDef, getCoreRowModel, useReactTable } from "@tanstack/react-table"
+import type { FlowMapEdge } from "@mmapp/contracts/traffic-flow"
+import { Frame, FramePanel } from "@/components/reui/frame"
+import { DataGridShell } from "@/components/data-grids/shared/data-grid-shell"
+import {
+  DATA_GRID_CELL_PAD,
+  DATA_GRID_CELL_PAD_FIRST,
+  DATA_GRID_CELL_PAD_LAST,
+} from "@/components/data-grids/shared/data-grid-layout"
+import { Flag } from "@/components/flag"
+import { fmtRate } from "@/lib/fmt-rate"
+
+const W = 640
+const H = 280
+const STROKES = [
+  "var(--chart-1)",
+  "var(--chart-2)",
+  "var(--chart-3)",
+  "var(--color-success)",
+  "var(--chart-5)",
+]
+
+function formatBytes(n: number): string {
+  if (n >= 1_000_000_000) return `${(n / 1_000_000_000).toFixed(2)} ГБ`
+  if (n >= 1_000_000) return `${(n / 1_000_000).toFixed(1)} МБ`
+  if (n >= 1000) return `${(n / 1000).toFixed(1)} КБ`
+  return `${n} Б`
+}
+
+function FlowTrafficMap({
+  edges,
+  onSelectCountry,
+}: {
+  edges: FlowMapEdge[]
+  onSelectCountry?: (country: string) => void
+}) {
+  const [hover, setHover] = useState<string | null>(null)
+
+  const layout = useMemo(() => {
+    const sources = [...new Map(edges.map((e) => [e.fromId, e])).values()]
+    const dests = [...new Map(edges.map((e) => [e.toCountry, e])).values()]
+    const srcY = (i: number) => sources.length <= 1 ? H / 2 : 36 + (i * (H - 72)) / Math.max(1, sources.length - 1)
+    const dstY = (i: number) => dests.length <= 1 ? H / 2 : 36 + (i * (H - 72)) / Math.max(1, dests.length - 1)
+    const srcPos = new Map(sources.map((s, i) => [s.fromId, { x: 88, y: srcY(i), label: s.fromLabel, country: s.fromCountry }]))
+    const dstPos = new Map(dests.map((d, i) => [d.toCountry, { x: 552, y: dstY(i), country: d.toCountry }]))
+    const maxBytes = Math.max(...edges.map((e) => e.bytes), 1)
+    return { srcPos, dstPos, maxBytes }
+  }, [edges])
+
+  const columns = useMemo<ColumnDef<FlowMapEdge>[]>(
+    () => [
+      {
+        id: "from",
+        accessorKey: "fromLabel",
+        header: () => <span className="text-xs font-medium text-muted-foreground">Источник</span>,
+        cell: ({ row }) => (
+          <span className="flex items-center gap-1.5 text-sm">
+            {row.original.fromCountry && row.original.fromCountry !== "UN"
+              ? <Flag code={row.original.fromCountry} />
+              : null}
+            {row.original.fromLabel}
+          </span>
+        ),
+        meta: { headerClassName: DATA_GRID_CELL_PAD_FIRST, cellClassName: DATA_GRID_CELL_PAD_FIRST },
+      },
+      {
+        id: "to",
+        accessorKey: "toCountry",
+        header: () => <span className="text-xs font-medium text-muted-foreground">Назначение</span>,
+        cell: ({ row }) => (
+          <span className="flex items-center gap-1.5 text-sm">
+            {/^[a-z]{2}$/i.test(row.original.toCountry)
+              ? <Flag code={row.original.toCountry} />
+              : null}
+            {row.original.toCountry}
+            {row.original.toAsn ? <span className="font-mono text-[10px] text-muted-foreground">AS{row.original.toAsn}</span> : null}
+          </span>
+        ),
+        meta: { headerClassName: DATA_GRID_CELL_PAD, cellClassName: DATA_GRID_CELL_PAD },
+      },
+      {
+        id: "cat",
+        accessorKey: "category",
+        header: () => <span className="text-xs font-medium text-muted-foreground">Категория</span>,
+        cell: ({ row }) => <span className="text-xs">{row.original.category}</span>,
+        meta: { headerClassName: DATA_GRID_CELL_PAD, cellClassName: DATA_GRID_CELL_PAD },
+      },
+      {
+        id: "rate",
+        accessorFn: (r) => r.bps,
+        header: () => <span className="text-xs font-medium text-muted-foreground">Скорость</span>,
+        cell: ({ row }) => <span className="text-xs tabular-nums">{fmtRate(row.original.bps / 1_000_000)}</span>,
+        meta: { headerClassName: DATA_GRID_CELL_PAD, cellClassName: DATA_GRID_CELL_PAD },
+      },
+      {
+        id: "bytes",
+        accessorKey: "bytes",
+        header: () => <span className="text-xs font-medium text-muted-foreground">Байты</span>,
+        cell: ({ row }) => <span className="text-xs tabular-nums">{formatBytes(row.original.bytes)}</span>,
+        meta: { headerClassName: DATA_GRID_CELL_PAD_LAST, cellClassName: DATA_GRID_CELL_PAD_LAST },
+      },
+    ],
+    [],
+  )
+
+  const table = useReactTable({
+    data: edges,
+    columns,
+    getCoreRowModel: getCoreRowModel(),
+    getRowId: (row, i) => `${row.fromId}-${row.toCountry}-${i}`,
+  })
+
+  if (!edges.length) {
+    return (
+      <p className="text-sm text-muted-foreground py-8 text-center">
+        Страны подтянутся из кэша RIPEstat
+      </p>
+    )
+  }
+
+  return (
+    <div className="flex flex-col gap-3">
+      <Frame>
+        <FramePanel className="p-3">
+          <svg viewBox={`0 0 ${W} ${H}`} className="w-full h-[220px]" role="img" aria-label="Карта потоков откуда куда">
+            {edges.map((e, i) => {
+              const from = layout.srcPos.get(e.fromId)
+              const to = layout.dstPos.get(e.toCountry)
+              if (!from || !to) return null
+              const id = `${e.fromId}-${e.toCountry}`
+              const midX = (from.x + to.x) / 2
+              const d = `M ${from.x} ${from.y} C ${midX} ${from.y}, ${midX} ${to.y}, ${to.x} ${to.y}`
+              const sw = 1.25 + 7 * (e.bytes / layout.maxBytes)
+              const active = hover === id
+              return (
+                <path
+                  key={id}
+                  d={d}
+                  fill="none"
+                  stroke={STROKES[i % STROKES.length]}
+                  strokeWidth={active ? sw + 1.5 : sw}
+                  strokeOpacity={active ? 1 : 0.72}
+                  className="cursor-pointer"
+                  onMouseEnter={() => setHover(id)}
+                  onMouseLeave={() => setHover(null)}
+                  onClick={() => onSelectCountry?.(e.toCountry)}
+                >
+                  <title>
+                    {`${e.fromLabel} → ${e.toCountry} · ${e.category} · ${formatBytes(e.bytes)}`}
+                  </title>
+                </path>
+              )
+            })}
+            {[...layout.srcPos.values()].map((n) => (
+              <g key={`s-${n.label}`}>
+                <circle cx={n.x} cy={n.y} r="7" className="fill-primary" />
+                <text x={n.x - 14} y={n.y + 4} textAnchor="end" className="fill-foreground text-[11px]">
+                  {n.label}
+                </text>
+              </g>
+            ))}
+            {[...layout.dstPos.values()].map((n) => (
+              <g key={`d-${n.country}`}>
+                <circle cx={n.x} cy={n.y} r="7" className="fill-chart-2" />
+                <text x={n.x + 14} y={n.y + 4} className="fill-foreground text-[11px]">
+                  {n.country}
+                </text>
+              </g>
+            ))}
+          </svg>
+          {hover ? (
+            <p className="text-[11px] text-muted-foreground mt-1">
+              Нажмите дугу, чтобы отфильтровать сессии по стране назначения
+            </p>
+          ) : null}
+        </FramePanel>
+      </Frame>
+      <DataGridShell
+        table={table}
+        recordCount={edges.length}
+        emptyMessage="Нет рёбер с известной страной"
+        onRowClick={(row) => onSelectCountry?.(row.toCountry)}
+      />
+    </div>
+  )
+}
+
+export { FlowTrafficMap }
@@ -22,6 +22,7 @@ export function useFlowLive(opts: {
  serverId?: string
  userId?: string
  iface?: string
+  dedup?: boolean
 }): { sample: FlowAnalyticsDto | null; error: string | null } {
  const [sample, setSample] = useState<FlowAnalyticsDto | null>(null)
  const [error, setError] = useState<string | null>(null)
@@ -41,6 +42,7 @@ export function useFlowLive(opts: {
      serverId: opts.serverId,
      userId: opts.userId,
      iface: opts.iface,
+      dedup: opts.dedup,
    })}`
    const url = resolveApiUrl(opts.backendUrl, path)

@@ -69,8 +71,9 @@ export function useFlowLive(opts: {
            if (!raw.trim() || raw.trim().startsWith(":")) continue
            const ev = parseSseBlock(raw)
            if (ev.event === "sample" && ev.data) {
-              setSample(JSON.parse(ev.data) as FlowAnalyticsDto)
-              setError(null)
+              const parsed = JSON.parse(ev.data) as FlowAnalyticsDto
+              setSample(parsed)
+              setError(parsed.degraded ? "Коллектор перегружен: упрощённая аналитика" : null)
            } else if (ev.event === "error" && ev.data) {
              const parsed = JSON.parse(ev.data) as { error?: string }
              setError(parsed.error ?? "live error")
@@ -84,7 +87,7 @@ export function useFlowLive(opts: {
    })()

    return () => ac.abort()
-  }, [opts.enabled, opts.backendUrl, opts.range, opts.serverId, opts.userId, opts.iface])
+  }, [opts.enabled, opts.backendUrl, opts.range, opts.serverId, opts.userId, opts.iface, opts.dedup])

  return { sample, error }
 }
@@ -81,6 +81,10 @@ export const flowTalkerDtoSchema = z.object({
  inIface: z.string(),
  inIfaceIndex: z.string().optional(),
  application: z.string().optional(),
+  category: z.string().optional(),
+  service: z.string().optional(),
+  dstCountry: z.string().optional(),
+  dstAsn: z.number().int().optional(),
 })

 export const flowStatsDtoSchema = z.object({
@@ -133,14 +137,27 @@ export const flowEntityCardSchema = z.object({
  bytes: z.number().nonnegative(),
 })

+export const flowMapEdgeSchema = z.object({
+  fromId: z.string(),
+  fromLabel: z.string(),
+  fromCountry: z.string(),
+  toCountry: z.string(),
+  toAsn: z.number().int().nonnegative(),
+  category: z.string(),
+  bytes: z.number().nonnegative(),
+  bps: z.number().nonnegative(),
+})
+
 export const flowAnalyticsDtoSchema = z.object({
  bpsNow: z.number().nonnegative(),
  bytes: z.number().nonnegative(),
  packets: z.number().nonnegative(),
  conversations: z.number().int().nonnegative(),
+  conversationsRaw: z.number().int().nonnegative().optional(),
  uniqueSrc: z.number().int().nonnegative(),
  uniqueDst: z.number().int().nonnegative(),
  topProto: z.string(),
+  topCategory: z.string().optional(),
  rxSeries: z.array(z.number()),
  txSeries: z.array(z.number()),
  applications: z.array(flowBreakdownRowSchema),
@@ -148,9 +165,16 @@ export const flowAnalyticsDtoSchema = z.object({
  sources: z.array(flowBreakdownRowSchema),
  destinations: z.array(flowBreakdownRowSchema),
  interfaces: z.array(flowBreakdownRowSchema),
+  asns: z.array(flowBreakdownRowSchema).optional(),
+  countries: z.array(flowBreakdownRowSchema).optional(),
+  categories: z.array(flowBreakdownRowSchema).optional(),
+  services: z.array(flowBreakdownRowSchema).optional(),
+  mapEdges: z.array(flowMapEdgeSchema).optional(),
  conversationsList: z.array(flowTalkerDtoSchema),
  ifaces: z.array(flowIfaceChipSchema),
  live: z.boolean(),
+  dedupApplied: z.boolean().optional(),
+  degraded: z.boolean().optional(),
 })

 export const flowExportersDtoSchema = z.object({
@@ -167,11 +191,21 @@ export const flowClientsDtoSchema = z.object({
  clients: z.array(flowEntityCardSchema),
 })

+export const flowMonthlyDtoSchema = z.object({
+  month: z.string(),
+  bytes: z.number().nonnegative(),
+  countries: z.array(flowBreakdownRowSchema),
+  services: z.array(flowBreakdownRowSchema),
+  asns: z.array(flowBreakdownRowSchema),
+})
+
 export type FlowTalkerDto = z.infer<typeof flowTalkerDtoSchema>
 export type FlowStatsDto = z.infer<typeof flowStatsDtoSchema>
 export type FlowBreakdownRow = z.infer<typeof flowBreakdownRowSchema>
 export type FlowIfaceChip = z.infer<typeof flowIfaceChipSchema>
 export type FlowEntityCard = z.infer<typeof flowEntityCardSchema>
+export type FlowMapEdge = z.infer<typeof flowMapEdgeSchema>
 export type FlowAnalyticsDto = z.infer<typeof flowAnalyticsDtoSchema>
 export type FlowExportersDto = z.infer<typeof flowExportersDtoSchema>
 export type FlowClientsDto = z.infer<typeof flowClientsDtoSchema>
+export type FlowMonthlyDto = z.infer<typeof flowMonthlyDtoSchema>
@@ -2,6 +2,7 @@ import type {
  FlowAnalyticsDto,
  FlowClientsDto,
  FlowExportersDto,
+  FlowMonthlyDto,
  FlowStatsDto,
  TrafficFlowHostFile,
  TrafficFlowOverlayResult,
@@ -59,12 +60,15 @@ function flowQuery(params: {
  serverId?: string
  userId?: string
  iface?: string
+  dedup?: boolean
 }): string {
  const q = new URLSearchParams()
  if (params.range) q.set("range", params.range)
  if (params.serverId) q.set("serverId", params.serverId)
  if (params.userId) q.set("userId", params.userId)
  if (params.iface && params.iface !== "__all__") q.set("iface", params.iface)
+  if (params.dedup === false) q.set("dedup", "0")
+  else if (params.dedup === true) q.set("dedup", "1")
  const s = q.toString()
  return s ? `?${s}` : ""
 }
@@ -79,9 +83,19 @@ export async function getFlowClients(baseUrl: string, range = "5m"): Promise<Flo

 export async function getFlowAnalytics(
  baseUrl: string,
-  params: { range?: string; serverId?: string; userId?: string; iface?: string },
+  params: { range?: string; serverId?: string; userId?: string; iface?: string; dedup?: boolean },
 ): Promise<FlowAnalyticsDto> {
  return requestJson<FlowAnalyticsDto>(baseUrl, `/api/traffic/flow/analytics${flowQuery(params)}`)
 }

+export async function getFlowMonthly(
+  baseUrl: string,
+  params: { month: string; serverId?: string },
+): Promise<FlowMonthlyDto> {
+  const q = new URLSearchParams()
+  q.set("month", params.month)
+  if (params.serverId) q.set("serverId", params.serverId)
+  return requestJson<FlowMonthlyDto>(baseUrl, `/api/traffic/flow/monthly?${q.toString()}`)
+}
+
 export { flowQuery }
Author	SHA1	Message	Date
DenozordecandCursor	cb799da13a	fix(netflow): изолировать коллектор IPFIX и срезать раздувание базы Docker images / prepare-release (push) Successful in 8s Details Docker images / backend-image (push) Successful in 2m23s Details Docker images / frontend-image (push) Successful in 3m16s Details Docker images / notify-webhook (push) Skipped Details Docker images / updater-image (push) Successful in 57s Details Docker images / publish-release (push) Successful in 12s Details Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-07 09:50:24 +07:00
DenozordecandCursor	e0ddb17539	feat(traffic): классифицировать потоки по брендам и разгрузить ingest Docker images / prepare-release (push) Successful in 12s Details Docker images / backend-image (push) Successful in 1m48s Details Docker images / frontend-image (push) Successful in 2m53s Details Docker images / notify-webhook (push) Skipped Details Docker images / updater-image (push) Successful in 41s Details Docker images / publish-release (push) Successful in 8s Details Починить ISO-страну Cloudflare, не держать holder как сервис, клик по срезу открывает Сессии. Не вызывать REST /interface с UDP, flush SQLite пачкой — uptime не должен ловить timeout 10s. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-07 03:01:14 +07:00
DenozordecandCursor	2820683cba	feat(traffic): добавить карту и срезы IPFIX по странам и сессиям Docker images / prepare-release (push) Successful in 11s Details Docker images / backend-image (push) Successful in 2m6s Details Docker images / frontend-image (push) Successful in 3m23s Details Docker images / notify-webhook (push) Skipped Details Docker images / updater-image (push) Successful in 49s Details Docker images / publish-release (push) Successful in 14s Details Имена ifIndex пишутся по обоим ключам REST, дедуп 5-tuple по max байт, RIPEstat только из prefix-кэша, карта откуда-куда в Frame. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-07 02:13:21 +07:00