feat(traffic): enhance flow analytics and brand classification

- Introduced `pickInternetPeer` function to improve IP classification by selecting the appropriate public IP from source and destination.
- Updated `buildFlowAnalytics` and related functions to utilize the new peer selection logic, enhancing accuracy in flow analytics.
- Added tests for new classifications and ensured existing tests cover new scenarios for Google and Cloudflare.
- Refactored traffic flow brand mappings to include additional CIDR ranges for Google and Cloudflare.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/(main)/network-map/page.tsx

@@ -17,11 +17,14 @@ import {
   buildServerResourceMap,
   buildWanJhEdges,
   computeNetworkMapLayout,
+  NETWORK_MAP_H,
   NETWORK_MAP_LAYOUT_REVISION,
   NETWORK_MAP_PIPELINE_Y,
+  NETWORK_MAP_W,
   findServerByGreRemote,
   greSourceWanIndexOnMap,
   greTunnelProbe,
+  placeServiceNodes,
   type GreMapEdge,
   type WanJhEdge,
 } from "@/lib/network-map-layout"
@@ -41,6 +44,16 @@ import {
   wanJhEdgeMapKey,
   type GreSpeedProbeSnapshot,
 } from "@/lib/map-gre-speed-probe"
+import {
+  formatNetflowDir,
+  formatNetflowRate,
+  hopHasRate,
+  matchNetflowForGreEdge,
+  matchNetflowForWan,
+  type MatchedNetflowHop,
+} from "@/lib/map-netflow-hops"
+import type { FlowMapHop, FlowMapHopsDto, FlowMapService, FlowMapServiceEdge } from "@mmapp/contracts/traffic-flow"
+import { ServiceBrandIcon } from "@/components/network-map/service-brand-icon"
 import { Button } from "@/components/ui/button"
 import { StatusBadge } from "@/components/status-badge"
 import { StatusDot } from "@/components/status-dot"
@@ -226,8 +239,8 @@ function Sparkline({ history }: { history: number[] }) {
 
 // ─── Canvas dimensions ────────────────────────────────────────────────────────
 
-const W = 1060
-const H = 580
+const W = NETWORK_MAP_W
+const H = NETWORK_MAP_H
 const ZOOM_MIN = 0.2
 const ZOOM_MAX = 6
 
@@ -262,6 +275,24 @@ const TYPE_LABELS: Record<ServerType, string> = {
   "home-router": "Home Router",
 }
 
+const MOCK_MAP_SERVICES: FlowMapService[] = [
+  { id: "svc:google", label: "Google", category: "Веб", bytes: 22_000_000, bps: 8_800_000, share: 0.22 },
+  { id: "svc:cloudflare", label: "Cloudflare", category: "CDN", bytes: 14_000_000, bps: 5_600_000, share: 0.14 },
+  { id: "svc:aws", label: "AWS", category: "CDN", bytes: 9_000_000, bps: 3_600_000, share: 0.09 },
+]
+
+const MOCK_MAP_SERVICE_EDGES: FlowMapServiceEdge[] = [
+  { fromId: "srv2", toId: "svc:google", bytes: 14_000_000, bps: 5_600_000, bpsFwd: 4_200_000, bpsRev: 1_400_000 },
+  { fromId: "srv3", toId: "svc:google", bytes: 8_000_000, bps: 3_200_000, bpsFwd: 2_400_000, bpsRev: 800_000 },
+  { fromId: "srv2", toId: "svc:cloudflare", bytes: 9_000_000, bps: 3_600_000, bpsFwd: 2_800_000, bpsRev: 800_000 },
+  { fromId: "srv3", toId: "svc:cloudflare", bytes: 5_000_000, bps: 2_000_000, bpsFwd: 1_500_000, bpsRev: 500_000 },
+  { fromId: "srv3", toId: "svc:aws", bytes: 9_000_000, bps: 3_600_000, bpsFwd: 2_700_000, bpsRev: 900_000 },
+]
+
+function serviceSharePct(share: number): string {
+  return `${Math.round(share * 100)}%`
+}
+
 // ─── Helpers ──────────────────────────────────────────────────────────────────
 
 function pingColor(ms: number | null) {
@@ -420,6 +451,53 @@ function GreEdgeMetricBadge({
   )
 }
 
+/** Живой поток NetFlow (не ёмкость канала / не BT). */
+function NetflowRateBadge({
+  mx,
+  my,
+  hop,
+  onOpen,
+}: {
+  mx: number
+  my: number
+  hop: MatchedNetflowHop
+  onOpen?: (e: React.MouseEvent<SVGElement>) => void
+}) {
+  const showDir = hop.bpsFwd > 0 && hop.bpsRev > 0
+  const bw = showDir ? 86 : 72
+  const bh = showDir ? 32 : 20
+  return (
+    <g
+      transform={`translate(${mx},${my})`}
+      style={{ cursor: onOpen ? "pointer" : "default" }}
+      onPointerDown={(e) => { e.stopPropagation() }}
+      onClick={(e) => { e.stopPropagation(); onOpen?.(e) }}
+    >
+      <title>
+        Поток NetFlow между узлами (как в «Трафик»: 5 мин, без overlay/mesh). Скорость канала — отдельно.
+      </title>
+      <rect
+        x={-bw / 2}
+        y={-bh / 2}
+        width={bw}
+        height={bh}
+        rx="6"
+        fill="rgba(6,13,26,0.94)"
+        stroke="#34d399"
+        strokeWidth="1.15"
+      />
+      <text textAnchor="middle" y={showDir ? "-4" : "4"} fontFamily="ui-monospace,monospace">
+        <tspan fill="#6ee7b7" fontSize="8" fontWeight="700">{formatNetflowRate(hop)}</tspan>
+      </text>
+      {showDir && (
+        <text textAnchor="middle" y="10" fontFamily="ui-monospace,monospace">
+          <tspan fill="#34d399" fontSize="6.5" fontWeight="600">{formatNetflowDir(hop)}</tspan>
+        </text>
+      )}
+    </g>
+  )
+}
+
 function SvgTooltip({ n }: { n: Server & { x: number; y: number } }) {
   const ss = STATUS_STYLE[n.status]
   const ts = TYPE_STYLE[n.type]
@@ -552,6 +630,74 @@ function ServerNode({ n, isSel, isVis, isDragged, hideCatalogLatency, onClick, o
   )
 }
 
+function ServiceNode({
+  label,
+  share,
+  x,
+  y,
+  isSel,
+  isVis,
+  onClick,
+}: {
+  label: string
+  share: number
+  x: number
+  y: number
+  isSel: boolean
+  isVis: boolean
+  onClick: () => void
+}) {
+  const bw = 86
+  const bh = 58
+  return (
+    <g
+      transform={`translate(${x},${y})`}
+      style={{ cursor: "pointer", transition: "opacity 0.25s" }}
+      opacity={isVis ? 1 : 0.08}
+      onClick={(e) => { e.stopPropagation(); onClick() }}
+    >
+      <title>{`${label} · ${serviceSharePct(share)} трафика окна`}</title>
+      {isSel && (
+        <rect
+          x={-bw / 2 - 6}
+          y={-bh / 2 - 6}
+          width={bw + 12}
+          height={bh + 12}
+          rx="12"
+          fill="none"
+          stroke="rgba(56,189,248,0.55)"
+          strokeWidth="1.5"
+          strokeDasharray="4 3"
+        />
+      )}
+      <rect
+        x={-bw / 2}
+        y={-bh / 2}
+        width={bw}
+        height={bh}
+        rx="10"
+        fill="#08202c"
+        stroke="#22d3ee"
+        strokeWidth={isSel ? 2.2 : 1.4}
+      />
+      <foreignObject x={-14} y={-24} width={28} height={28} style={{ overflow: "visible", pointerEvents: "none" }}>
+        <div
+          style={{ display: "flex", alignItems: "center", justifyContent: "center", width: 28, height: 28 }}
+          {...({ xmlns: "http://www.w3.org/1999/xhtml" } as Record<string, string>)}
+        >
+          <ServiceBrandIcon label={label} size={22} />
+        </div>
+      </foreignObject>
+      <text textAnchor="middle" y="14" fontSize="8.5" fontWeight="700" fill="#e0f2fe" fontFamily="ui-monospace,monospace">
+        {label}
+      </text>
+      <text textAnchor="middle" y="25" fontSize="7.5" fill="#67e8f9" fontFamily="ui-monospace,monospace">
+        {serviceSharePct(share)}
+      </text>
+    </g>
+  )
+}
+
 function WanSatNode({ x, y, wan, color, active, isSel, isDragged, onSelect, onMouseDown }: {
   x: number; y: number
   wan: { name: string; isp: string; maxDl: number; maxUl: number }
@@ -667,13 +813,14 @@ function ContextMenu({ menu, onClose }: { menu: CtxMenu; onClose: () => void })
 
 const MM_W = 172, MM_H = 94
 
-function Minimap({ pan, zoom, nodes, greEdges, satPos, wanJhEdges, homeRouters, onClose, onPan }: {
+function Minimap({ pan, zoom, nodes, greEdges, satPos, wanJhEdges, homeRouters, servicePos, onClose, onPan }: {
   pan: { x: number; y: number }; zoom: number
   nodes: (Server & { x: number; y: number })[]
   greEdges: GreMapEdge[]
   satPos: Record<string, { x: number; y: number }[]>
   wanJhEdges: WanJhEdge[]
   homeRouters: Server[]
+  servicePos: Record<string, { x: number; y: number }>
   onClose: () => void
   onPan: (x: number, y: number) => void
 }) {
@@ -726,6 +873,10 @@ function Minimap({ pan, zoom, nodes, greEdges, satPos, wanJhEdges, homeRouters,
               fill={WAN_COLORS[i] + "33"} stroke={WAN_COLORS[i]} strokeWidth="3" opacity="0.7" />
           ))
         )}
+        {Object.entries(servicePos).map(([id, p]) => (
+          <rect key={id} x={p.x - 14} y={p.y - 10} width="28" height="20" rx="4"
+            fill="#08202c" stroke="#22d3ee" strokeWidth="3" opacity="0.85" />
+        ))}
         {/* viewport rect */}
         <rect x={pan.x} y={pan.y} width={W / zoom} height={H / zoom}
           fill="rgba(255,255,255,0.04)" stroke="rgba(255,255,255,0.6)" strokeWidth="6" rx="6" />
@@ -784,6 +935,10 @@ export default function NetworkMapPage() {
   const [mapServers, setMapServers] = useState<Server[]>([])
   const [mapGreTunnels, setMapGreTunnels] = useState<GreTunnel[]>([])
   const [speedProbes, setSpeedProbes] = useState<GreSpeedProbeSnapshot[]>([])
+  const [mapHops, setMapHops] = useState<FlowMapHop[]>([])
+  const [mapServices, setMapServices] = useState<FlowMapService[]>([])
+  const [mapServiceEdges, setMapServiceEdges] = useState<FlowMapServiceEdge[]>([])
+  const [mapSharePct, setMapSharePct] = useState(5)
   /** FQDN из GRE outer → IPv4 (ответ POST /api/network/resolve-hosts), для матчинга с WAN. */
   const [greResolvedIpv4ByHost, setGreResolvedIpv4ByHost] = useState<Record<string, string>>({})
   const [dataError, setDataError] = useState<string | null>(null)
@@ -875,6 +1030,10 @@ export default function NetworkMapPage() {
         setMapGreTunnels(mockGreTunnels)
         setSpeedProbes([])
         setGreResolvedIpv4ByHost({})
+        setMapHops([])
+        setMapServices(MOCK_MAP_SERVICES)
+        setMapServiceEdges(MOCK_MAP_SERVICE_EDGES)
+        setMapSharePct(5)
         setDataError(null)
       })
       return
@@ -902,6 +1061,7 @@ export default function NetworkMapPage() {
 
   // ── Interaction ─────────────────────────────────────────────────────────────
   const [selected,   setSelected]   = useState<Server | null>(null)
+  const [selectedService, setSelectedService] = useState<FlowMapService | null>(null)
   const [selWanIdx,  setSelWanIdx]  = useState<number | null>(null)
   const [hoveredId,  setHoveredId]  = useState<string | null>(null)
 
@@ -935,11 +1095,59 @@ export default function NetworkMapPage() {
   const [filter,         setFilter]         = useState<FilterKey>("all")
   const [search,         setSearch]         = useState("")
   const [showPingBadges, setShowPingBadges] = useState(true)
+  const [showNetflow,     setShowNetflow]     = useState(true)
+  const [showServices,    setShowServices]    = useState(true)
   const [showAnimDots,   setShowAnimDots]   = useState(true)
   const [showMinimap,    setShowMinimap]    = useState(true)
   const [showHints,      setShowHints]      = useState(false)
   const [showLayers,     setShowLayers]     = useState(false)
 
+  useEffect(() => {
+    if (!useLiveData) {
+      queueMicrotask(() => {
+        setMapHops([])
+        setMapServices(MOCK_MAP_SERVICES)
+        setMapServiceEdges(MOCK_MAP_SERVICE_EDGES)
+        setMapSharePct(5)
+      })
+      return
+    }
+    if (!showNetflow && !showServices) {
+      queueMicrotask(() => {
+        setMapHops([])
+        setMapServices([])
+        setMapServiceEdges([])
+      })
+      return
+    }
+    let cancelled = false
+    let ac: AbortController | null = null
+    const tick = () => {
+      ac?.abort()
+      ac = new AbortController()
+      apiFetch<FlowMapHopsDto>("/api/traffic/flow/map-hops?range=5m", { signal: ac.signal })
+        .then((res) => {
+          if (cancelled) return
+          setMapHops(res.hops ?? [])
+          setMapServices(res.services ?? [])
+          setMapServiceEdges(res.serviceEdges ?? [])
+          if (res.mapServiceMinSharePct != null) setMapSharePct(res.mapServiceMinSharePct)
+        })
+        .catch((err: unknown) => {
+          if (cancelled) return
+          const name = err instanceof Error ? err.name : ""
+          if (name === "AbortError") return
+        })
+    }
+    tick()
+    const id = window.setInterval(tick, 4000)
+    return () => {
+      cancelled = true
+      ac?.abort()
+      window.clearInterval(id)
+    }
+  }, [useLiveData, showNetflow, showServices, apiFetch])
+
   const effectiveSatPos = useMemo(() => {
     const out: Record<string, { x: number; y: number }[]> = {}
     mapServers
@@ -1100,6 +1308,37 @@ export default function NetworkMapPage() {
     return out
   }, [greEdges])
 
+  const netflowByGreKey = useMemo(() => {
+    const m = new Map<string, MatchedNetflowHop>()
+    if (!showNetflow) return m
+    for (const e of greEdges) {
+      const hop = matchNetflowForGreEdge(e, mapHops)
+      if (hopHasRate(hop)) m.set(greEdgeKey(e), hop)
+    }
+    return m
+  }, [greEdges, mapHops, showNetflow])
+
+  const netflowByWanKey = useMemo(() => {
+    const m = new Map<string, MatchedNetflowHop>()
+    if (!showNetflow) return m
+    for (const home of homeRouters) {
+      for (const [wIdx, wan] of (home.wanUplinks ?? []).entries()) {
+        const hop = matchNetflowForWan(home.id, wan.iface, mapHops)
+        if (!hopHasRate(hop)) continue
+        m.set(`${home.id}\t${wIdx}`, hop)
+        for (const e of wanJhEdges) {
+          if (e.homeId === home.id && e.wanIdx === wIdx) m.set(wanJhEdgeMapKey(e), hop)
+        }
+      }
+    }
+    return m
+  }, [homeRouters, wanJhEdges, mapHops, showNetflow])
+
+  const visibleMapServices = showServices ? mapServices : []
+  const visibleServiceEdges = showServices ? mapServiceEdges.filter((e) =>
+    visibleMapServices.some((s) => s.id === e.toId),
+  ) : []
+
   const nodes = mapServers
     .map((s) => ({ ...s, ...nodePosById[s.id]! }))
     // Визуальный приоритет: HR поверх JH, JH поверх EN.
@@ -1112,6 +1351,14 @@ export default function NetworkMapPage() {
     })
   const nodeById = Object.fromEntries(nodes.map((n) => [n.id, n]))
 
+  const servicePosById = placeServiceNodes(
+    visibleMapServices.map((s) => s.id),
+    mapServers
+      .filter((s) => s.type === "exit-node")
+      .map((s) => nodePosById[s.id])
+      .filter((p): p is { x: number; y: number } => Boolean(p)),
+  )
+
   // ── Refs ─────────────────────────────────────────────────────────────────────
   const svgRef  = useRef<SVGSVGElement>(null)
 
@@ -1186,7 +1433,7 @@ export default function NetworkMapPage() {
   useEffect(() => {
     function onKey(e: KeyboardEvent) {
       if (e.target instanceof HTMLInputElement || e.target instanceof HTMLTextAreaElement) return
-      if (e.key === "Escape") { setSelected(null); setSelWanIdx(null); setSelectedGreEdge(null) }
+      if (e.key === "Escape") { setSelected(null); setSelWanIdx(null); setSelectedGreEdge(null); setSelectedService(null) }
       if (e.key === "=" || e.key === "+") applyZoomCenter(1.25)
       if (e.key === "-")                  applyZoomCenter(1 / 1.25)
       if (e.key === "0" || e.key.toLowerCase() === "f") fitView()
@@ -1274,7 +1521,7 @@ export default function NetworkMapPage() {
     const moved = dragRef.current?.moved ?? false
     dragRef.current = null
     setIsDragging(false)
-    if (!moved) { setSelected(null); setSelWanIdx(null); setSelectedGreEdge(null) }
+    if (!moved) { setSelected(null); setSelWanIdx(null); setSelectedGreEdge(null); setSelectedService(null) }
   }
 
   // ── Node drag start ──────────────────────────────────────────────────────
@@ -1306,12 +1553,20 @@ export default function NetworkMapPage() {
   // ── Side panel ────────────────────────────────────────────────────────────
   function selectServer(s: Server) {
     setSelectedGreEdge(null)
+    setSelectedService(null)
     setSelected(prev => prev?.id === s.id ? null : s)
     setSelWanIdx(null)
     setHoveredId(null)
   }
+  function selectService(svc: FlowMapService) {
+    setSelectedGreEdge(null)
+    setSelected(null)
+    setSelWanIdx(null)
+    setSelectedService((prev: FlowMapService | null) => prev?.id === svc.id ? null : svc)
+  }
   function selectWan(s: Server, wanIdx: number) {
     setSelectedGreEdge(null)
+    setSelectedService(null)
     setSelected(s)
     setSelWanIdx(prev => prev === wanIdx && selected?.id === s.id ? null : wanIdx)
   }
@@ -1321,6 +1576,7 @@ export default function NetworkMapPage() {
     const home = mapServers.find((s) => s.id === edge.homeId)
     if (!home) return
     setSelectedGreEdge(null)
+    setSelectedService(null)
     setSelected(home)
     setSelWanIdx(edge.wanIdx)
     setHoveredId(null)
@@ -1461,6 +1717,8 @@ export default function NetworkMapPage() {
               onMouseLeave={() => setShowLayers(false)}>
               {([
                 { key: "showPingBadges", label: "Ping-значки",      val: showPingBadges, set: setShowPingBadges, hint: "P" },
+                { key: "showNetflow",    label: "NetFlow",          val: showNetflow,    set: setShowNetflow,    hint: "" },
+                { key: "showServices",   label: "Сервисы",          val: showServices,   set: setShowServices,   hint: "" },
                 { key: "showAnimDots",   label: "Анимация трафика", val: showAnimDots,   set: setShowAnimDots,   hint: "" },
                 { key: "showMinimap",    label: "Минимап",          val: showMinimap,    set: setShowMinimap,    hint: "M" },
                 { key: "showHints", label: "Горячие клавиши", val: showHints, set: setShowHints, hint: "" },
@@ -1485,6 +1743,11 @@ export default function NetworkMapPage() {
                   </span>
                 </button>
               ))}
+              <p className="px-3 pt-1.5 pb-1 text-[10px] text-muted-foreground leading-snug">
+                {mapSharePct > 0
+                  ? `Порог доли сервиса ≥ ${mapSharePct}% · Настройки → NetFlow`
+                  : "Порог доли выключен (все бренды, макс. 20) · Настройки → NetFlow"}
+              </p>
               {(Object.keys(nodePositions).length > 0 || Object.keys(satPositions).length > 0) && (
                 <div className="border-t border-border/50 mt-1 pt-1">
                   <button
@@ -1588,17 +1851,27 @@ export default function NetworkMapPage() {
                 tBadge,
                 normalPx,
               )
+              const flowHop = netflowByGreKey.get(edgeId)
+              const flowPos = edgeBadgePosition(
+                e.from.x,
+                e.from.y,
+                e.to.x,
+                e.to.y,
+                tBadge,
+                -normalPx - (normalPx === 0 ? 22 : 0),
+              )
               function openGreDetail(ev: React.MouseEvent<SVGElement>) {
                 ev.stopPropagation()
                 setSelectedGreEdge(e)
                 setSelected(null)
+                setSelectedService(null)
                 setSelWanIdx(null)
               }
               return (
                 <g key={edgeId} opacity={dimmed ? 0.05 : 1} style={{ transition: "opacity 0.3s" }}>
                   <line
                     x1={e.from.x} y1={e.from.y} x2={e.to.x} y2={e.to.y}
-                    stroke={ts.stroke} strokeWidth="1.5"
+                    stroke={ts.stroke} strokeWidth={hopHasRate(flowHop) ? 2.6 : 1.5}
                     strokeDasharray={e.tunnel.ipsec ? "7 4" : "none"}
                     opacity={ts.opacity}
                   />
@@ -1632,6 +1905,14 @@ export default function NetworkMapPage() {
                       outerSummary={greOuterSummaryLine(e.tunnel, fromN, toN, greResolvedMap)}
                     />
                   )}
+                  {showNetflow && hopHasRate(flowHop) && (
+                    <NetflowRateBadge
+                      mx={flowPos.mx}
+                      my={flowPos.my}
+                      hop={flowHop}
+                      onOpen={openGreDetail}
+                    />
+                  )}
                 </g>
               )
             })}
@@ -1663,14 +1944,16 @@ export default function NetworkMapPage() {
               const color = WAN_COLORS[edge.wanIdx] ?? "#888"
               const vis   = filter === "all" || filter === "home-router" || filter === "jump-host" || filter === "online"
               const { mx, my } = edgeBadgePosition(satPos.x, satPos.y, jh.x, jh.y, 0.62, -17)
+              const flowPos = edgeBadgePosition(satPos.x, satPos.y, jh.x, jh.y, 0.38, 18)
               const isHL  = selected?.id === edge.homeId && (selWanIdx === null || selWanIdx === edge.wanIdx)
+              const wanFlow = netflowByWanKey.get(wanJhEdgeMapKey(edge))
               return (
                 <g key={edgeKey} opacity={vis ? (isHL ? 1 : 0.45) : 0.05}
                   style={{ transition: "opacity 0.3s" }}>
                   <line
                     x1={satPos.x} y1={satPos.y} x2={jh.x} y2={jh.y}
                     stroke={color}
-                    strokeWidth={edge.active ? 2 : 1.2}
+                    strokeWidth={edge.active ? (hopHasRate(wanFlow) ? 2.8 : 2) : 1.2}
                     strokeDasharray={edge.active ? "none" : "5 4"}
                     opacity={edge.active ? 0.7 : 0.4}
                     filter={isHL ? `url(#glow-wan-${edge.wanIdx})` : undefined}
@@ -1710,6 +1993,58 @@ export default function NetworkMapPage() {
                     }
                     return <PingBadge mx={mx} my={my} ping={edge.pingMs} color={pingColor(edge.pingMs)} />
                   })()}
+                  {showNetflow && hopHasRate(wanFlow) && (
+                    <NetflowRateBadge
+                      mx={flowPos.mx}
+                      my={flowPos.my}
+                      hop={wanFlow}
+                      onOpen={(ev) => openWanJhSpeedDetail(ev, edge)}
+                    />
+                  )}
+                </g>
+              )
+            })}
+
+            {/* ── EN/JH → destination services ── */}
+            {visibleServiceEdges.map((edge) => {
+              const from = nodeById[edge.fromId] ?? nodePosById[edge.fromId]
+              const to = servicePosById[edge.toId]
+              if (!from || !to) return null
+              const hop: MatchedNetflowHop = {
+                bytes: edge.bytes,
+                bps: edge.bps,
+                bpsFwd: edge.bpsFwd,
+                bpsRev: edge.bpsRev,
+              }
+              const { mx, my } = edgeBadgePosition(from.x, from.y, to.x, to.y, 0.55, 16)
+              const hl = selectedService?.id === edge.toId || selected?.id === edge.fromId
+              return (
+                <g key={`${edge.fromId}|${edge.toId}`} opacity={hl ? 1 : 0.72} style={{ transition: "opacity 0.3s" }}>
+                  <line
+                    x1={from.x} y1={from.y} x2={to.x} y2={to.y}
+                    stroke="#22d3ee"
+                    strokeWidth={hopHasRate(hop) ? 2.2 : 1.3}
+                    strokeDasharray="5 5"
+                    opacity="0.7"
+                  />
+                  {showAnimDots && hopHasRate(hop) && (
+                    <circle r="3" fill="#67e8f9" opacity="0.85" pointerEvents="none">
+                      <animateMotion dur="2.6s" repeatCount="indefinite"
+                        path={`M ${from.x} ${from.y} L ${to.x} ${to.y}`} />
+                    </circle>
+                  )}
+                  {hopHasRate(hop) && (
+                    <NetflowRateBadge
+                      mx={mx}
+                      my={my}
+                      hop={hop}
+                      onOpen={(ev) => {
+                        ev.stopPropagation()
+                        const svc = visibleMapServices.find((s) => s.id === edge.toId)
+                        if (svc) selectService(svc)
+                      }}
+                    />
+                  )}
                 </g>
               )
             })}
@@ -1760,6 +2095,26 @@ export default function NetworkMapPage() {
               }).filter(Boolean)
             })}
 
+            {visibleMapServices.map((svc) => {
+              const pos = servicePosById[svc.id]
+              if (!pos) return null
+              return (
+                <ServiceNode
+                  key={svc.id}
+                  label={svc.label}
+                  share={svc.share}
+                  x={pos.x}
+                  y={pos.y}
+                  isSel={selectedService?.id === svc.id}
+                  isVis
+                  onClick={() => {
+                    if (suppressClickRef.current) { suppressClickRef.current = false; return }
+                    selectService(svc)
+                  }}
+                />
+              )
+            })}
+
             {/* ── Hover tooltip ── */}
             {hoveredNode && !isDragging && (
               <SvgTooltip n={hoveredNode} />
@@ -1767,7 +2122,7 @@ export default function NetworkMapPage() {
 
             {/* ── Legend (viewport-fixed) ── */}
             <g transform={`translate(${pan.x + 14}, ${pan.y + 14})`}>
-              <rect width="140" height="224" rx="8"
+              <rect width="140" height="250" rx="8"
                 fill="rgba(6,13,26,0.88)" stroke="rgba(255,255,255,0.07)" strokeWidth="1" />
               <text x="10" y="22" fontSize="8" fontWeight="700" fill="#64748b"
                 fontFamily="system-ui" letterSpacing="0.08em">ЛЕГЕНДА</text>
@@ -1796,12 +2151,17 @@ export default function NetworkMapPage() {
                 </g>
               ))}
 
-              <line x1="10" y1="166" x2="130" y2="166" stroke="rgba(255,255,255,0.07)" strokeWidth="1" />
+              <g transform="translate(10, 164)">
+                <rect width="14" height="14" rx="4" fill="#08202c" stroke="#22d3ee" strokeWidth="1.2" />
+                <text x="22" y="11" fontSize="8.5" fill="#cbd5e1" fontFamily="system-ui">Сервис</text>
+              </g>
 
-              <text x="10" y="180" fontSize="7.5" fontWeight="700" fill="#475569"
+              <line x1="10" y1="186" x2="130" y2="186" stroke="rgba(255,255,255,0.07)" strokeWidth="1" />
+
+              <text x="10" y="200" fontSize="7.5" fontWeight="700" fill="#475569"
                 fontFamily="system-ui" letterSpacing="0.05em">WAN АПЛИНКИ</text>
               {WAN_COLORS.slice(0, 2).map((c, i) => (
-                <g key={i} transform={`translate(10, ${190 + i * 14})`}>
+                <g key={i} transform={`translate(10, ${210 + i * 14})`}>
                   <circle cx="5" cy="4" r="4" fill={c} opacity="0.9" />
                   <text x="16" y="8" fontSize="8" fill="#94a3b8" fontFamily="ui-monospace,monospace">
                     WAN{i + 1}
@@ -1857,6 +2217,7 @@ export default function NetworkMapPage() {
               satPos={effectiveSatPos}
               wanJhEdges={visibleWanJhEdges}
               homeRouters={homeRouters}
+              servicePos={servicePosById}
               onClose={() => setShowMinimap(false)}
               onPan={(x, y) => setPan({ x, y })}
             />
@@ -1885,7 +2246,7 @@ export default function NetworkMapPage() {
         </div>
 
         {/* ── Side panel (узел или выбранное GRE-ребро) ── */}
-        {(selectedGreEdge || selected) && (
+        {(selectedGreEdge || selected || selectedService) && (
           <div className="border-l flex flex-col overflow-hidden shrink-0 bg-background" style={{ width: 300 }}>
             {selectedGreEdge ? (
               <>
@@ -1976,7 +2337,7 @@ export default function NetworkMapPage() {
                             </div>
                             <div className="flex items-center justify-between py-2 border-b border-border/50">
                               <span className="text-xs text-muted-foreground">
-                                {bwMon ? "TX / RX (BT)" : "Скорость (модель)"}
+                                {bwMon ? "TX / RX (BT)" : "Скорость канала (модель)"}
                               </span>
                               <span className="text-xs font-mono font-semibold text-sky-400">
                                 {merged.dlMbps != null && merged.ulMbps != null
@@ -1984,10 +2345,23 @@ export default function NetworkMapPage() {
                                   : "—"}
                               </span>
                             </div>
+                            <div className="flex items-center justify-between py-2 border-b border-border/50">
+                              <span className="text-xs text-muted-foreground">Поток (NetFlow)</span>
+                              <span className="text-xs font-mono font-semibold text-emerald-400">
+                                {(() => {
+                                  const hop = netflowByGreKey.get(selectedEdgeId)
+                                  if (!hopHasRate(hop)) return "—"
+                                  return hop.bpsFwd > 0 && hop.bpsRev > 0
+                                    ? formatNetflowDir(hop)
+                                    : formatNetflowRate(hop)
+                                })()}
+                              </span>
+                            </div>
                             <p className="text-[10px] text-muted-foreground pt-2 leading-snug">
                               {merged.hasSpeedMonitor
-                                ? "Ping и/или TX/RX — с последнего прогона speed-пробы; проба сопоставляется с этим GRE по WAN и интерфейсам."
-                                : "«Модель RTT» и «скорость» — демо до появления подходящей speed-пробы в «Мониторинг → скорость»."}
+                                ? "Ping и/или TX/RX — с последнего прогона speed-пробы; проба сопоставляется с этим GRE по WAN и интерфейсам. "
+                                : "«Модель RTT» и «скорость канала» — демо до появления подходящей speed-пробы в «Мониторинг → скорость». "}
+                              Поток — живой NetFlow за 5 мин (как в «Трафик»: без overlay/mesh), не ёмкость канала.
                             </p>
                           </div>
                         </div>
@@ -2078,6 +2452,62 @@ export default function NetworkMapPage() {
                   })()}
                 </div>
               </>
+            ) : selectedService ? (
+              <>
+                <div className="flex items-start gap-2 px-4 py-3 border-b">
+                  <div className="mt-0.5">
+                    <ServiceBrandIcon label={selectedService.label} size={22} />
+                  </div>
+                  <div className="flex-1 min-w-0">
+                    <p className="font-mono font-semibold text-sm truncate">{selectedService.label}</p>
+                    <p className="text-xs text-muted-foreground mt-0.5">
+                      Конечный сервис · {selectedService.category}
+                    </p>
+                  </div>
+                  <button
+                    type="button"
+                    onClick={() => setSelectedService(null)}
+                    className="text-muted-foreground hover:text-foreground transition-colors"
+                  >
+                    <XIcon className="size-4" />
+                  </button>
+                </div>
+                <div className="flex-1 overflow-y-auto px-4 py-4 flex flex-col gap-4">
+                  <div className="flex flex-col gap-0">
+                    <div className="flex items-center justify-between py-2 border-b border-border/50">
+                      <span className="text-xs text-muted-foreground">Доля окна</span>
+                      <span className="text-xs font-mono font-medium text-cyan-400">{serviceSharePct(selectedService.share)}</span>
+                    </div>
+                    <div className="flex items-center justify-between py-2 border-b border-border/50">
+                      <span className="text-xs text-muted-foreground">Скорость</span>
+                      <span className="text-xs font-mono font-medium">
+                        {formatNetflowRate({
+                          bytes: selectedService.bytes,
+                          bps: selectedService.bps,
+                          bpsFwd: selectedService.bps,
+                          bpsRev: 0,
+                        })}
+                      </span>
+                    </div>
+                  </div>
+                  <div>
+                    <p className="text-xs font-semibold text-muted-foreground uppercase tracking-wider mb-2">С узлов</p>
+                    <div className="flex flex-col gap-1.5">
+                      {visibleServiceEdges.filter((e) => e.toId === selectedService.id).map((e) => {
+                        const src = mapServers.find((s) => s.id === e.fromId)
+                        return (
+                          <div key={`${e.fromId}|${e.toId}`} className="flex items-center justify-between text-xs">
+                            <span className="font-mono truncate">{src?.name ?? e.fromId}</span>
+                            <span className="font-mono text-emerald-400 tabular-nums">
+                              {formatNetflowRate({ bytes: e.bytes, bps: e.bps, bpsFwd: e.bpsFwd, bpsRev: e.bpsRev })}
+                            </span>
+                          </div>
+                        )
+                      })}
+                    </div>
+                  </div>
+                </div>
+              </>
             ) : selected ? (
               <>
             <div className="flex items-start gap-2 px-4 py-3 border-b">
@@ -2168,12 +2598,26 @@ export default function NetworkMapPage() {
                           </div>
                           <div className="flex flex-col gap-1">
                             {[["ISP", wan.isp], ["Iface", wan.iface], ["IP", wan.ip],
-                              ["BW", `↓${wan.maxDl} ↑${wan.maxUl} Мбит`]].map(([k, v]) => (
+                              ["Канал", `↓${wan.maxDl} ↑${wan.maxUl} Мбит`]].map(([k, v]) => (
                               <div key={k} className="flex items-center justify-between">
                                 <span className="text-[10px] text-muted-foreground">{k}</span>
                                 <span className="text-[10px] font-mono">{v}</span>
                               </div>
                             ))}
+                            {(() => {
+                              const hop = netflowByWanKey.get(`${selected.id}\t${wIdx}`)
+                              if (!hopHasRate(hop)) return null
+                              return (
+                                <div className="flex items-center justify-between">
+                                  <span className="text-[10px] text-muted-foreground">Поток</span>
+                                  <span className="text-[10px] font-mono text-emerald-400">
+                                    {hop.bpsFwd > 0 && hop.bpsRev > 0
+                                      ? formatNetflowDir(hop)
+                                      : formatNetflowRate(hop)}
+                                  </span>
+                                </div>
+                              )
+                            })()}
                           </div>
                           {myEdges.length > 0 && (
                             <div className="mt-2 pt-2 border-t border-border/40">
@@ -2230,9 +2674,11 @@ export default function NetworkMapPage() {
                         fromServer && toServer ? speedProbeByTunnelId.get(tunnelPanelKey) : undefined
                       const merged = mergeGreMetricsWithSpeedProbe(spGre, baseProbe)
                       const pc     = pingColor(merged.pingMs)
+                      const greFlow = netflowByGreKey.get(tunnelPanelKey)
                       const showMetrics =
                         merged.pingMs != null ||
-                        (merged.dlMbps != null && merged.ulMbps != null)
+                        (merged.dlMbps != null && merged.ulMbps != null) ||
+                        hopHasRate(greFlow)
                       return (
                         <div key={tunnelPanelKey} className="rounded-md border border-border/60 px-3 py-2 bg-muted/20">
                           <div className="flex items-center justify-between mb-1">
@@ -2272,6 +2718,11 @@ export default function NetworkMapPage() {
                                     ↓{merged.dlMbps} ↑{merged.ulMbps}
                                   </span>
                                 )}
+                                {hopHasRate(greFlow) && (
+                                  <span className="text-[9px] ml-1.5 text-emerald-400">
+                                    {formatNetflowRate(greFlow)}
+                                  </span>
+                                )}
                               </span>
                             </div>
                           )}

app/(main)/settings/page.tsx

@@ -32,6 +32,8 @@ import {
 import { cn } from "@/lib/utils"
 import { requestJson } from "@/shared/api/http-client"
 import { downloadSystemDatabaseBackup, restoreSystemDatabaseBackup } from "@/shared/api/system-database"
+import { purgeTrafficFlowData } from "@/shared/api/traffic-flow"
+import { formatFlowPurgeResult, NetflowPurgeConfirm } from "@/components/traffic/netflow-purge-dialog"
 import { toast } from "sonner"
 
 interface ApiKey { id: string; name: string; prefix: string; created: string; last: string; scopes: string[] }
@@ -148,6 +150,8 @@ export default function SettingsPage() {
   const [dbRestoreBusy, setDbRestoreBusy] = useState(false)
   const [dbRestoreFile, setDbRestoreFile] = useState<File | null>(null)
   const [dbRestoreDialogOpen, setDbRestoreDialogOpen] = useState(false)
+  const [dbPurgeOpen, setDbPurgeOpen] = useState(false)
+  const [dbPurgeBusy, setDbPurgeBusy] = useState(false)
 
   // notifications
   const [notifEmail,   setNotifEmail]   = useState(true)
@@ -266,6 +270,20 @@ export default function SettingsPage() {
     }
   }, [backendUrl, dbRestoreFile, systemDbAvailable])
 
+  const handleNetflowPurgeConfirm = useCallback(async () => {
+    if (!systemDbAvailable) return
+    setDbPurgeBusy(true)
+    try {
+      const result = await purgeTrafficFlowData(backendUrl)
+      toast.success(formatFlowPurgeResult(result))
+      setDbPurgeOpen(false)
+    } catch (e) {
+      toast.error(e instanceof Error ? e.message : "Не удалось сбросить NetFlow")
+    } finally {
+      setDbPurgeBusy(false)
+    }
+  }, [backendUrl, systemDbAvailable])
+
   const renderContent = () => {
     const ra = DEFAULT_ROUTE_AI_OPTIMIZER_SETTINGS
 
@@ -417,7 +435,7 @@ export default function SettingsPage() {
 
       <OpsPanel
         title="База данных приложения"
-        description="Резервная копия SQLite бекенда: серверы, мониторинг, оповещения, EvoBGP. На время операции планировщик сбора данных приостанавливается."
+        description="Резервная копия SQLite бекенда и сброс таблиц NetFlow. На время операции планировщик и коллектор IPFIX приостанавливаются. Preview: https://reui.io/preview/base/settings-16"
         contentClassName="divide-y px-5"
       >
           {!systemDbAvailable && (
@@ -434,7 +452,7 @@ export default function SettingsPage() {
               variant="outline"
               size="sm"
               className="h-8"
-              disabled={!systemDbAvailable || dbBackupBusy || dbRestoreBusy}
+              disabled={!systemDbAvailable || dbBackupBusy || dbRestoreBusy || dbPurgeBusy}
               onClick={() => { void handleSystemDatabaseBackup() }}
             >
               {dbBackupBusy ? <LoaderCircleIcon className="size-4 animate-spin" /> : <DownloadIcon className="size-4" />}
@@ -450,7 +468,7 @@ export default function SettingsPage() {
                 variant="outline"
                 size="sm"
                 className="h-8"
-                disabled={!systemDbAvailable || dbBackupBusy || dbRestoreBusy}
+                disabled={!systemDbAvailable || dbBackupBusy || dbRestoreBusy || dbPurgeBusy}
                 onClick={() => setDbRestoreDialogOpen(true)}
               >
                 <UploadIcon className="size-4" />
@@ -461,6 +479,21 @@ export default function SettingsPage() {
               )}
             </div>
           </SettingRow>
+          <SettingRow
+            label="Сбросить данные NetFlow"
+            description="Удалит сессии и агрегаты из SQLite, затем VACUUM. Ключи WG и пиры не трогает"
+          >
+            <Button
+              variant="destructive"
+              size="sm"
+              className="h-8"
+              disabled={!systemDbAvailable || dbBackupBusy || dbRestoreBusy || dbPurgeBusy}
+              onClick={() => setDbPurgeOpen(true)}
+            >
+              {dbPurgeBusy ? <LoaderCircleIcon className="size-4 animate-spin" /> : <TrashIcon className="size-4" />}
+              {dbPurgeBusy ? "Сброс…" : "Сбросить"}
+            </Button>
+          </SettingRow>
       </OpsPanel>
 
       <OpsPanel
@@ -893,6 +926,13 @@ export default function SettingsPage() {
         />
       )}
 
+      <NetflowPurgeConfirm
+        open={dbPurgeOpen}
+        busy={dbPurgeBusy}
+        onConfirm={() => { void handleNetflowPurgeConfirm() }}
+        onCancel={() => { if (!dbPurgeBusy) setDbPurgeOpen(false) }}
+      />
+
       <FileImportDialog
         open={dbRestoreDialogOpen}
         onOpenChange={setDbRestoreDialogOpen}

app/(main)/traffic/page.tsx

@@ -103,9 +103,14 @@ function monthlyToAnalytics(m: FlowMonthlyDto): FlowAnalyticsDto {
     services: m.services,
     mapEdges: [],
     conversationsList: [],
+    paths: [],
     ifaces: [],
     live: false,
     degraded: false,
+    bytesPayload: m.bytes,
+    bytesOverlay: 0,
+    bytesMesh: 0,
+    bytesWire: 0,
   }
 }
 
@@ -806,6 +811,8 @@ export default function TrafficPage() {
   const [flowAnalytics, setFlowAnalytics] = useState<FlowAnalyticsDto | null>(null)
   const [flowIface, setFlowIface] = useState("__all__")
   const [flowDedup, setFlowDedup] = useState(true)
+  const [flowExcludeMesh, setFlowExcludeMesh] = useState(true)
+  const [flowExcludeOverlay, setFlowExcludeOverlay] = useState(true)
   const [overlayOpen, setOverlayOpen] = useState(false)
   const [catalogServers, setCatalogServers] = useState<ServerRead[]>([])
   const effectiveMode: GroupMode = groupMode
@@ -824,6 +831,8 @@ export default function TrafficPage() {
     userId: flowScope === "users" ? selectedId : undefined,
     iface: flowIface,
     dedup: flowDedup,
+    excludeMesh: flowExcludeMesh,
+    excludeOverlay: flowExcludeOverlay,
   })
 
   const toLiveServer = (s: LiveTrafficServer): ServerTraffic => {
@@ -961,8 +970,10 @@ export default function TrafficPage() {
       userId: flowScope === "users" ? selectedId : undefined,
       iface: flowIface,
       dedup: flowDedup,
+      excludeMesh: flowExcludeMesh,
+      excludeOverlay: flowExcludeOverlay,
     }).then(setFlowAnalytics).catch(() => setFlowAnalytics(null))
-  }, [isLive, effectiveMode, selectedId, range, flowScope, flowIface, flowDedup, backendUrl])
+  }, [isLive, effectiveMode, selectedId, range, flowScope, flowIface, flowDedup, flowExcludeMesh, flowExcludeOverlay, backendUrl])
 
   useEffect(() => {
     setFlowIface("__all__")
@@ -1328,6 +1339,10 @@ export default function TrafficPage() {
                       onIface={setFlowIface}
                       dedup={flowDedup}
                       onDedup={setFlowDedup}
+                      excludeMesh={flowExcludeMesh}
+                      onExcludeMesh={setFlowExcludeMesh}
+                      excludeOverlay={flowExcludeOverlay}
+                      onExcludeOverlay={setFlowExcludeOverlay}
                       liveHint={displayedFlow?.live ? "live" : undefined}
                       emptyHint={flowEmptyHint(flowStats, collectorAlive)}
                     />

backend/package.json

@@ -14,7 +14,7 @@
     "test:auth": "tsx src/lib/permissions.test.ts && tsx src/plugins/auth.smoke.test.ts",
     "test:wireguard": "npx tsx src/services/wireguard-config.test.ts",
     "test:traffic-rate": "tsx src/services/traffic-rate.test.ts",
-    "test:traffic-flow": "tsx src/services/traffic-flow-parse.test.ts && tsx src/services/traffic-flow-map-exporter.test.ts && tsx src/services/traffic-flow-ifaces.test.ts && tsx src/services/traffic-flow-dedup.test.ts && tsx src/services/traffic-flow-classify.test.ts && tsx src/services/traffic-flow-ripe.test.ts && tsx src/services/traffic-flow-brands.test.ts && tsx src/services/traffic-flow-ingest.test.ts && tsx src/services/traffic-flow-analytics.test.ts && tsx src/services/traffic-flow-hardening.test.ts",
+    "test:traffic-flow": "tsx src/services/traffic-flow-parse.test.ts && tsx src/services/traffic-flow-map-exporter.test.ts && tsx src/services/traffic-flow-ifaces.test.ts && tsx src/services/traffic-flow-dedup.test.ts && tsx src/services/traffic-flow-planes.test.ts && tsx src/services/traffic-flow-ip.test.ts && tsx src/services/traffic-flow-classify.test.ts && tsx src/services/traffic-flow-ripe.test.ts && tsx src/services/traffic-flow-brands.test.ts && tsx src/services/traffic-flow-ingest.test.ts && tsx src/services/traffic-flow-analytics.test.ts && tsx src/services/traffic-flow-map-hops.test.ts && tsx src/services/traffic-flow-hardening.test.ts && tsx src/services/traffic-flow-purge.test.ts",
     "test:users": "tsx src/modules/users/iface-type.test.ts && tsx src/modules/users/bindings.test.ts"
   },
   "dependencies": {

backend/src/db/index.ts

@@ -146,6 +146,7 @@ CREATE TABLE IF NOT EXISTS traffic_flow_settings (
   hub_server_id INTEGER,
   retention_hours INTEGER NOT NULL DEFAULT 24,
   top_n INTEGER NOT NULL DEFAULT 200,
+  map_service_min_share_pct REAL NOT NULL DEFAULT 5,
   last_datagram_at TEXT,
   last_exporter_ip TEXT,
   last_error TEXT,
@@ -167,6 +168,10 @@ CREATE TABLE IF NOT EXISTS flow_buckets (
   bytes INTEGER NOT NULL DEFAULT 0,
   packets INTEGER NOT NULL DEFAULT 0,
   in_iface TEXT NOT NULL DEFAULT '',
+  out_iface TEXT NOT NULL DEFAULT '',
+  next_hop TEXT NOT NULL DEFAULT '',
+  flow_start_ms INTEGER NOT NULL DEFAULT 0,
+  flow_end_ms INTEGER NOT NULL DEFAULT 0,
   FOREIGN KEY (server_id) REFERENCES servers(id) ON DELETE CASCADE
 );
 CREATE UNIQUE INDEX IF NOT EXISTS idx_flow_buckets_unique
@@ -830,6 +835,13 @@ SELECT 1, 0, '10.255.254.1', 4739, 51821, '10.255.254.0/24'
 WHERE NOT EXISTS (SELECT 1 FROM traffic_flow_settings WHERE id = 1);
 `)
 
+{
+  const flowSettingsCols = sqlite.prepare(`PRAGMA table_info('traffic_flow_settings')`).all() as Array<{ name?: string }>
+  if (!flowSettingsCols.some((c) => c.name === "map_service_min_share_pct")) {
+    sqlite.exec(`ALTER TABLE traffic_flow_settings ADD COLUMN map_service_min_share_pct REAL NOT NULL DEFAULT 5`)
+  }
+}
+
 sqlite.exec(`
 INSERT INTO uptime_settings (id, enabled, interval_sec, retention_days)
 SELECT 1, 1, 15, 14
@@ -889,6 +901,15 @@ WHERE NOT EXISTS (SELECT 1 FROM acme_settings WHERE id = 1);
   }
 }
 
+{
+  const flowCols = sqlite.prepare(`PRAGMA table_info('flow_buckets')`).all() as Array<{ name?: string }>
+  const names = new Set(flowCols.map((c) => c.name))
+  if (!names.has("out_iface")) sqlite.exec(`ALTER TABLE flow_buckets ADD COLUMN out_iface TEXT NOT NULL DEFAULT ''`)
+  if (!names.has("next_hop")) sqlite.exec(`ALTER TABLE flow_buckets ADD COLUMN next_hop TEXT NOT NULL DEFAULT ''`)
+  if (!names.has("flow_start_ms")) sqlite.exec(`ALTER TABLE flow_buckets ADD COLUMN flow_start_ms INTEGER NOT NULL DEFAULT 0`)
+  if (!names.has("flow_end_ms")) sqlite.exec(`ALTER TABLE flow_buckets ADD COLUMN flow_end_ms INTEGER NOT NULL DEFAULT 0`)
+}
+
 const certIssueJobCols = sqlite.prepare(`PRAGMA table_info('certificate_issue_jobs')`).all() as Array<{ name?: string }>
 if (!certIssueJobCols.some((c) => c.name === "source")) {
   sqlite.exec(`ALTER TABLE certificate_issue_jobs ADD COLUMN source TEXT NOT NULL DEFAULT 'manual'`)
@@ -952,6 +973,19 @@ export let db = drizzle(sqlite, { schema })
 /** Прямой доступ к better-sqlite3 для сложных read-only запросов (напр. /api/alerts). */
 export let sqliteDatabase: SqliteHandle = sqlite
 
+let sqliteExclusiveOp = false
+
+export function beginSqliteExclusiveOp(): void {
+  if (sqliteExclusiveOp) {
+    throw new Error("Операция с базой данных уже выполняется")
+  }
+  sqliteExclusiveOp = true
+}
+
+export function endSqliteExclusiveOp(): void {
+  sqliteExclusiveOp = false
+}
+
 export function reopenSqlite(): void {
   try {
     sqlite.close()

backend/src/db/schema.ts

@@ -173,6 +173,7 @@ export const trafficFlowSettings = sqliteTable("traffic_flow_settings", {
   hubServerId:     integer("hub_server_id"),
   retentionHours:  integer("retention_hours").notNull().default(24),
   topN:            integer("top_n").notNull().default(200),
+  mapServiceMinSharePct: real("map_service_min_share_pct").notNull().default(5),
   lastDatagramAt:  text("last_datagram_at"),
   lastExporterIp:  text("last_exporter_ip"),
   lastError:       text("last_error"),
@@ -230,6 +231,10 @@ export const flowBuckets = sqliteTable("flow_buckets", {
   bytes:     integer("bytes").notNull().default(0),
   packets:   integer("packets").notNull().default(0),
   inIface:   text("in_iface").notNull().default(""),
+  outIface:  text("out_iface").notNull().default(""),
+  nextHop:   text("next_hop").notNull().default(""),
+  flowStartMs: integer("flow_start_ms").notNull().default(0),
+  flowEndMs:   integer("flow_end_ms").notNull().default(0),
 }, (t) => [
   uniqueIndex("idx_flow_buckets_unique").on(
     t.serverId, t.bucketAt, t.src, t.dst, t.proto, t.srcPort, t.dstPort, t.inIface,

backend/src/lib/permissions.test.ts

@@ -21,6 +21,10 @@ assert.equal(
   permissionForRequest("GET", "/api/traffic/servers/1/live"),
   "mm:traffic:read",
 )
+assert.equal(
+  permissionForRequest("POST", "/api/traffic/flow/purge"),
+  "mm:traffic:write",
+)
 assert.equal(
   permissionForRequest("GET", "/api/unknown-thing"),
   "mm:dashboard:read",

backend/src/routes/traffic-flow.ts

@@ -13,6 +13,7 @@ import {
 } from "../services/traffic-flow-settings.js"
 import {
   getFlowListenerState,
+  purgeTrafficFlowStore,
   startTrafficFlowListener,
   listFlowTalkers,
 } from "../services/traffic-flow-ingest.js"
@@ -23,8 +24,10 @@ import {
   listFlowExporters,
   safeBuildLiveFlowSample,
 } from "../services/traffic-flow-analytics.js"
+import { buildFlowMapHops } from "../services/traffic-flow-map-hops.js"
 import { applyFlowOverlay } from "../services/traffic-flow-overlay.js"
 import { listTrafficFlowHostFiles } from "../services/traffic-flow-host-files.js"
+import { appendEvent } from "../modules/events/service/events-service.js"
 
 const LIVE_TICK_MS = 2000
 export const MAX_FLOW_LIVE_SUBSCRIBERS = 4
@@ -69,13 +72,23 @@ function parseDedup(raw: unknown): boolean {
 }
 
 function analyticsQuery(req: FastifyRequest) {
-  const q = req.query as { range?: string; serverId?: string; userId?: string; iface?: string; dedup?: string }
+  const q = req.query as {
+    range?: string
+    serverId?: string
+    userId?: string
+    iface?: string
+    dedup?: string
+    excludeMesh?: string
+    excludeOverlay?: string
+  }
   return {
     minutes: rangeToMinutes(q.range),
     serverId: parseId(q.serverId),
     userId: q.userId?.trim() || undefined,
     iface: q.iface?.trim() || undefined,
     dedup: parseDedup(q.dedup),
+    excludeMesh: parseDedup(q.excludeMesh),
+    excludeOverlay: parseDedup(q.excludeOverlay),
   }
 }
 
@@ -161,6 +174,35 @@ const trafficFlowRoutes: FastifyPluginAsyncZod = async (app) => {
     return reply.send({ files: listTrafficFlowHostFiles() })
   })
 
+  app.post("/traffic/flow/purge", async (_req, reply) => {
+    try {
+      const result = await purgeTrafficFlowStore()
+      appendEvent({
+        level: "warning",
+        eventType: "traffic.flow.purge",
+        sourceModule: "traffic",
+        title: "Сброшены данные NetFlow",
+        message: `Удалены сессии ${result.deleted.buckets}, minute ${result.deleted.minuteStats}, daily ${result.deleted.dailyDims}`,
+        entityType: "traffic_flow",
+        entityId: "purge",
+        payload: {
+          buckets: result.deleted.buckets,
+          minuteStats: result.deleted.minuteStats,
+          minuteDims: result.deleted.minuteDims,
+          dailyDims: result.deleted.dailyDims,
+          fileBytesBefore: result.fileBytesBefore,
+          fileBytesAfter: result.fileBytesAfter,
+          vacuumed: result.vacuumed,
+        },
+      })
+      return reply.send(result)
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err)
+      const status = message.includes("уже выполняется") ? 409 : 500
+      return reply.status(status).send({ error: message })
+    }
+  })
+
   app.post("/traffic/flow/overlay", applyOverlayHandler)
   app.post("/traffic/flow-overlay", applyOverlayHandler)
 
@@ -181,6 +223,10 @@ const trafficFlowRoutes: FastifyPluginAsyncZod = async (app) => {
     return reply.send(buildFlowAnalytics(analyticsQuery(req)))
   })
 
+  app.get("/traffic/flow/map-hops", async (req, reply) => {
+    return reply.send(buildFlowMapHops(analyticsQuery(req)))
+  })
+
   app.get("/traffic/flow/monthly", async (req, reply) => {
     const q = req.query as { month?: string; serverId?: string }
     const now = new Date()
@@ -200,6 +246,8 @@ const trafficFlowRoutes: FastifyPluginAsyncZod = async (app) => {
       userId: query.userId,
       iface: query.iface,
       dedup: query.dedup,
+      excludeMesh: query.excludeMesh,
+      excludeOverlay: query.excludeOverlay,
     }
     const abort = new AbortController()
     const onClose = () => abort.abort()

backend/src/services/system-database-backup.ts

@@ -4,7 +4,7 @@ import os from "node:os"
 import path from "node:path"
 import Database from "better-sqlite3"
 import { env } from "../config.js"
-import { reopenSqlite, sqliteDatabase } from "../db/index.js"
+import { beginSqliteExclusiveOp, endSqliteExclusiveOp, reopenSqlite, sqliteDatabase } from "../db/index.js"
 import { refreshScheduler, stopScheduler } from "./scheduler.js"
 import {
   reattachFlowSqlite,
@@ -17,8 +17,6 @@ const MAX_RESTORE_BYTES = 512 * 1024 * 1024
 
 type SqliteHandle = InstanceType<typeof Database>
 
-let operationInFlight = false
-
 function fmtTimestamp(date = new Date()): string {
   const pad = (n: number) => String(n).padStart(2, "0")
   return `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}_${pad(date.getHours())}-${pad(date.getMinutes())}-${pad(date.getSeconds())}`
@@ -38,10 +36,7 @@ function assertSqliteFile(buffer: Buffer): void {
 }
 
 async function withDatabaseOperation<T>(fn: () => Promise<T> | T): Promise<T> {
-  if (operationInFlight) {
-    throw new Error("Операция с базой данных уже выполняется")
-  }
-  operationInFlight = true
+  beginSqliteExclusiveOp()
   stopTrafficFlowListener()
   stopScheduler()
   try {
@@ -49,7 +44,7 @@ async function withDatabaseOperation<T>(fn: () => Promise<T> | T): Promise<T> {
   } finally {
     startTrafficFlowListener()
     refreshScheduler()
-    operationInFlight = false
+    endSqliteExclusiveOp()
   }
 }
 

backend/src/services/traffic-flow-analytics.test.ts

@@ -6,6 +6,7 @@ import {
 } from "./traffic-flow-ingest.js"
 import { buildFlowAnalytics, formatLiveSseFromBuilder, getFlowMonthly, listFlowClients, listFlowExporters } from "./traffic-flow-analytics.js"
 import { sqliteDatabase } from "../db/index.js"
+import { seedFlowTopologyForTests, type FlowTopology } from "./traffic-flow-topology.js"
 import { disableCatalogFetchForTests, resetFlowCatalogForTests, seedFlowCatalogForTests } from "./traffic-flow-classify.js"
 import {
   disableRipeEnqueueForTests,
@@ -21,8 +22,18 @@ resetRipeCacheForTests()
 disableRipeEnqueueForTests()
 resetIfaceCacheForTests()
 resetFlowRingsForTests()
+seedFlowTopologyForTests({
+  clientIfaces: new Map(),
+  clientByIface: new Map(),
+  enNodes: [],
+  enHosts: new Set(),
+  jhHosts: new Set(),
+  wanIfaces: new Map(),
+  plane: { clientIfaceNames: new Set(), enHosts: new Set(), jhHosts: new Set() },
+})
 rememberServerIfaces(7, [
   { ".id": "*2", name: "ether1" },
+  { ".id": "*B", name: "ether2" },
   { ".id": "*A", name: "wg-flow" },
 ])
 
@@ -36,7 +47,7 @@ ingestParsedFlowsForServerForTests(7, [
     bytes: 12_000,
     packets: 10,
     inIface: "2",
-    outIface: "10",
+    outIface: "11",
   },
   {
     src: "10.1.1.8",
@@ -82,6 +93,7 @@ resetFlowRingsForTests()
 resetIfaceCacheForTests()
 rememberServerIfaces(7, [
   { ".id": "*2", name: "ether1" },
+  { ".id": "*B", name: "ether2" },
   { ".id": "*A", name: "wg-flow" },
 ])
 ingestParsedFlowsForServerForTests(7, [
@@ -94,7 +106,7 @@ ingestParsedFlowsForServerForTests(7, [
     bytes: 12_000,
     packets: 10,
     inIface: "2",
-    outIface: "10",
+    outIface: "11",
   },
   {
     src: "10.1.1.8",
@@ -104,7 +116,7 @@ ingestParsedFlowsForServerForTests(7, [
     dstPort: 443,
     bytes: 9_000,
     packets: 9,
-    inIface: "10",
+    inIface: "11",
     outIface: "",
   },
 ])
@@ -263,4 +275,192 @@ try {
   sqliteDatabase.prepare(`DELETE FROM flow_daily_dims WHERE server_id = 7 AND day LIKE '2026-09-%'`).run()
 }
 
+{
+  resetFlowRingsForTests()
+  resetIfaceCacheForTests()
+  resetRipeCacheForTests()
+  resetFlowCatalogForTests()
+  disableRipeEnqueueForTests()
+  rememberServerIfaces(7, [
+    { ".id": "*2", name: "gre-client" },
+    { ".id": "*3", name: "NSK-SERVHOST-RTK" },
+    { ".id": "*4", name: "gre-en-nsk" },
+  ])
+  const topo: FlowTopology = {
+    clientIfaces: new Map([[7, new Set(["gre-client"])]]),
+    clientByIface: new Map([["7|gre-client", {
+      userId: "u1",
+      login: "alice",
+      name: "Alice",
+      serverId: 7,
+      interfaceName: "gre-client",
+    }]]),
+    enNodes: [{ id: 9, name: "NSK-SERVHOST-RTK", hosts: ["198.51.100.1"] }],
+    enHosts: new Set(["198.51.100.1"]),
+    jhHosts: new Set(["203.0.113.10"]),
+    wanIfaces: new Map(),
+    plane: {
+      clientIfaceNames: new Set(["gre-client"]),
+      enHosts: new Set(["198.51.100.1"]),
+      jhHosts: new Set(["203.0.113.10"]),
+    },
+  }
+  seedFlowTopologyForTests(topo)
+  seedRipeCacheForTests({
+    prefix: "173.194.0.0/16",
+    asn: 15169,
+    country: "US",
+    lat: null,
+    lng: null,
+    holder: "GOOGLE",
+    ok: true,
+    fetchedAt: Date.now(),
+  })
+  ingestParsedFlowsForServerForTests(7, [
+    {
+      src: "10.100.1.17",
+      dst: "173.194.160.163",
+      proto: 6,
+      srcPort: 51234,
+      dstPort: 443,
+      bytes: 12_000,
+      packets: 10,
+      inIface: "2",
+      outIface: "3",
+      nextHop: "198.51.100.1",
+    },
+    {
+      src: "203.0.113.10",
+      dst: "198.51.100.1",
+      proto: 47,
+      srcPort: 0,
+      dstPort: 0,
+      bytes: 5_000_000,
+      packets: 4000,
+      inIface: "4",
+      outIface: "4",
+    },
+    {
+      src: "10.100.1.17",
+      dst: "10.100.1.18",
+      proto: 6,
+      srcPort: 50000,
+      dstPort: 443,
+      bytes: 8000,
+      packets: 8,
+      inIface: "2",
+      outIface: "2",
+    },
+  ])
+  try {
+    const def = buildFlowAnalytics({ minutes: 5, serverId: 7 })
+    assert.equal(def.bytes, 12_000)
+    assert.equal(def.bytesPayload, 12_000)
+    assert.equal(def.bytesOverlay, 5_000_000)
+    assert.equal(def.bytesMesh, 8000)
+    assert.equal(def.excludeOverlayApplied, true)
+    assert.equal(def.excludeMeshApplied, true)
+    assert.ok(!def.conversationsList.some((r) => r.proto === 47))
+    assert.equal(def.conversationsList[0]?.service, "Google")
+    assert.equal(def.conversationsList[0]?.category, "Веб")
+    assert.equal(def.conversationsList[0]?.clientName, "Alice")
+    assert.equal(def.conversationsList[0]?.enName, "NSK-SERVHOST-RTK")
+    assert.equal(def.conversationsList[0]?.plane, "payload")
+    const path = def.paths?.[0]
+    assert.ok(path)
+    assert.equal(path.clientName, "Alice")
+    assert.equal(path.enName, "NSK-SERVHOST-RTK")
+    assert.equal(path.dst, "173.194.160.163")
+    const withAll = buildFlowAnalytics({ minutes: 5, serverId: 7, excludeOverlay: false, excludeMesh: false })
+    assert.equal(withAll.bytes, 12_000 + 5_000_000 + 8000)
+    assert.ok(withAll.conversationsList.some((r) => r.plane === "overlay"))
+    assert.ok(withAll.conversationsList.some((r) => r.plane === "client_mesh"))
+  } finally {
+    seedFlowTopologyForTests(null)
+    resetFlowRingsForTests()
+    resetIfaceCacheForTests()
+    resetRipeCacheForTests()
+    resetFlowCatalogForTests()
+  }
+}
+
+{
+  resetFlowRingsForTests()
+  resetIfaceCacheForTests()
+  resetRipeCacheForTests()
+  disableRipeEnqueueForTests()
+  rememberServerIfaces(7, [{ ".id": "*2", name: "ether1" }])
+  ingestParsedFlowsForServerForTests(7, [
+    {
+      src: "173.194.151.65",
+      dst: "10.200.100.53",
+      proto: 6,
+      srcPort: 443,
+      dstPort: 57182,
+      bytes: 12_000,
+      packets: 10,
+      inIface: "2",
+      outIface: "2",
+    },
+    {
+      src: "104.18.35.51",
+      dst: "10.200.100.53",
+      proto: 6,
+      srcPort: 443,
+      dstPort: 53880,
+      bytes: 3_000,
+      packets: 4,
+      inIface: "2",
+      outIface: "2",
+    },
+  ])
+  try {
+    const rev = buildFlowAnalytics({ minutes: 5, serverId: 7 })
+    const google = rev.conversationsList.find((r) => r.src === "173.194.151.65")
+    const cf = rev.conversationsList.find((r) => r.src === "104.18.35.51")
+    assert.equal(google?.service, "Google")
+    assert.equal(google?.category, "Веб")
+    assert.equal(cf?.service, "Cloudflare")
+    assert.equal(cf?.category, "CDN")
+  } finally {
+    resetFlowRingsForTests()
+    resetIfaceCacheForTests()
+    resetRipeCacheForTests()
+  }
+}
+
+{
+  resetFlowRingsForTests()
+  resetIfaceCacheForTests()
+  const sidRow = sqliteDatabase.prepare(`SELECT id FROM servers LIMIT 1`).get() as { id?: number } | undefined
+  if (sidRow?.id) {
+    const sid = sidRow.id
+    rememberServerIfaces(sid, [{ ".id": "*4", name: "gre-en-nsk" }])
+    ingestParsedFlowsForServerForTests(sid, [{
+      src: "10.100.1.17",
+      dst: "8.8.8.8",
+      proto: 6,
+      srcPort: 1,
+      dstPort: 443,
+      bytes: 100,
+      packets: 1,
+      inIface: "4",
+      outIface: "4",
+    }])
+    sqliteDatabase.prepare(`
+      INSERT INTO traffic_samples (server_id, interface_name, sampled_at, rx_bytes, tx_bytes, rx_bps, tx_bps)
+      VALUES (?, 'gre-en-nsk', datetime('now'), 9000000, 1000000, 40000000, 2000000)
+    `).run(sid)
+    try {
+      const wire = buildFlowAnalytics({ minutes: 5, serverId: sid })
+      assert.ok((wire.bpsWire ?? 0) >= 40_000_000)
+      assert.notEqual(wire.bpsWire, (wire.bytes * 8) / 300)
+    } finally {
+      sqliteDatabase.prepare(`DELETE FROM traffic_samples WHERE server_id = ? AND interface_name = 'gre-en-nsk'`).run(sid)
+    }
+  }
+  resetFlowRingsForTests()
+  resetIfaceCacheForTests()
+}
+
 console.log("traffic-flow-analytics.test.ts: ok")

backend/src/services/traffic-flow-analytics.ts

@@ -9,6 +9,7 @@ import type {
   FlowExportersDto,
   FlowMapEdge,
   FlowMonthlyDto,
+  FlowPathRow,
   FlowTalkerDto,
 } from "@mmapp/contracts/traffic-flow"
 import { protoName } from "./traffic-flow-parse.js"
@@ -20,7 +21,7 @@ import {
   listFlowRowsForWindow,
   type PendingFlowRow,
 } from "./traffic-flow-ingest.js"
-import { MAX_PENDING } from "./traffic-flow-engine.js"
+import { MAX_PENDING, RING_OVERLAY } from "./traffic-flow-engine.js"
 import { resolveIfaceName } from "./traffic-flow-ifaces.js"
 import { getTrafficFlowSettingsRow, listHostPeers } from "./traffic-flow-settings.js"
 import { applicationName, flowRowMatchesFilter } from "./traffic-flow-apps.js"
@@ -28,6 +29,15 @@ import { dedupFlowRowsMaxBytes, flowTupleKey } from "./traffic-flow-dedup.js"
 import { enqueueRipeMisses, lookupRipeCached } from "./traffic-flow-ripe.js"
 import { classifyFlowDst, refreshFlowCatalogInBackground } from "./traffic-flow-classify.js"
 import { isIsoCountry } from "./traffic-flow-brands.js"
+import { classifyFlowPlane, flowBps, shouldKeepPlane } from "./traffic-flow-planes.js"
+import { pickInternetPeer } from "./traffic-flow-ip.js"
+import {
+  enGreIfaceNames,
+  latestWireBps,
+  loadFlowTopology,
+  resolveClient,
+  resolveEn,
+} from "./traffic-flow-topology.js"
 
 export const LIVE_ANALYTICS_MINUTES = 5
 const LIVE_DEGRADED_PENDING = Math.floor(MAX_PENDING * 0.8)
@@ -39,6 +49,10 @@ export interface FlowAnalyticsQuery {
   iface?: string
   /** Default true: один 5-tuple = max байт по ifaces. */
   dedup?: boolean
+  /** Default true: скрыть GRE/WG между клиентами JH. */
+  excludeMesh?: boolean
+  /** Default true: скрыть overlay GRE/ESP JH↔EN из payload KPI. */
+  excludeOverlay?: boolean
   skipHeavy?: boolean
 }
 
@@ -138,6 +152,9 @@ export function buildFlowAnalytics(q: FlowAnalyticsQuery): FlowAnalyticsDto {
   const countryById = new Map(serverRows.map((s) => [s.id, (s.country || "").toUpperCase() || "UN"]))
   const ifaceFilter = q.iface && q.iface !== "__all__" ? q.iface : ""
   const wantDedup = q.dedup !== false && !ifaceFilter
+  const excludeMesh = q.excludeMesh !== false
+  const excludeOverlay = q.excludeOverlay !== false
+  const topo = loadFlowTopology()
 
   refreshFlowCatalogInBackground()
 
@@ -150,16 +167,38 @@ export function buildFlowAnalytics(q: FlowAnalyticsQuery): FlowAnalyticsDto {
   const countries = new Map<string, { bytes: number; packets: number; label?: string }>()
   const categories = new Map<string, { bytes: number; packets: number; label?: string }>()
   const services = new Map<string, { bytes: number; packets: number; label?: string }>()
-  const conv = new Map<string, FlowTalkerDto & { rawBytes: number }>()
+  const conv = new Map<string, FlowTalkerDto & { rawBytes: number; flowStartMs: number; flowEndMs: number }>()
   const edgeAcc = new Map<string, FlowMapEdge & { catBytes: Map<string, number> }>()
+  const pathAcc = new Map<string, FlowPathRow>()
   const srcs = new Set<string>()
   const dsts = new Set<string>()
+  const peers = new Set<string>()
   const matched: PendingFlowRow[] = []
   const skipHeavy = Boolean(q.skipHeavy)
+  let bytesPayload = 0
+  let bytesOverlay = 0
+  let bytesMesh = 0
+  const ifacesForWire = new Set<string>()
 
   for (const r of raw) {
     const resolved = resolveIfaceName(r.serverId, r.inIface)
+    const outResolved = resolveIfaceName(r.serverId, r.outIface)
     if (!flowRowMatchesFilter(r, resolved.name, q, allow)) continue
+    ifacesForWire.add(resolved.name)
+    if (outResolved.name && outResolved.name !== "—") ifacesForWire.add(outResolved.name)
+    const plane = classifyFlowPlane({
+      src: r.src,
+      dst: r.dst,
+      proto: r.proto,
+      srcPort: r.srcPort,
+      dstPort: r.dstPort,
+      inIface: resolved.name,
+      outIface: outResolved.name,
+    }, topo.plane)
+    if (plane === "payload") bytesPayload += r.bytes
+    else if (plane === "overlay") bytesOverlay += r.bytes
+    else if (plane === "client_mesh") bytesMesh += r.bytes
+    if (!shouldKeepPlane(plane, { excludeMesh, excludeOverlay })) continue
     matched.push(r)
 
     const ifaceKey = resolved.name
@@ -180,9 +219,11 @@ export function buildFlowAnalytics(q: FlowAnalyticsQuery): FlowAnalyticsDto {
     totalPackets += r.packets
     srcs.add(r.src)
     dsts.add(r.dst)
+    const peer = pickInternetPeer(r.src, r.dst, r.srcPort, r.dstPort)
+    peers.add(peer)
     const app = applicationName(r.proto, r.dstPort, r.srcPort)
-    const ripe = lookupRipeCached(r.dst)
-    const classified = classifyFlowDst(r.dst, r.proto, r.dstPort, r.srcPort, ripe)
+    const ripe = lookupRipeCached(peer)
+    const classified = classifyFlowDst(peer, r.proto, r.dstPort, r.srcPort, ripe)
     bump(applications, app, r.bytes, r.packets)
     bump(protocols, protoName(r.proto), r.bytes, r.packets)
     bump(sources, r.src, r.bytes, r.packets)
@@ -200,6 +241,18 @@ export function buildFlowAnalytics(q: FlowAnalyticsQuery): FlowAnalyticsDto {
     }
 
     if (!skipHeavy) {
+      const outResolved = resolveIfaceName(r.serverId, r.outIface)
+      const plane = classifyFlowPlane({
+        src: r.src,
+        dst: r.dst,
+        proto: r.proto,
+        srcPort: r.srcPort,
+        dstPort: r.dstPort,
+        inIface: resolved.name,
+        outIface: outResolved.name,
+      }, topo.plane)
+      const client = resolveClient(topo, r.serverId, resolved.name)
+      const en = resolveEn(topo, r.nextHop, outResolved.name)
       const ckey = wantDedup
         ? flowTupleKey(r)
         : `${flowTupleKey(r)}|${r.inIface}`
@@ -208,6 +261,8 @@ export function buildFlowAnalytics(q: FlowAnalyticsQuery): FlowAnalyticsDto {
         prev.rawBytes += r.bytes
         prev.bytes += r.bytes
         prev.packets += r.packets
+        if (r.flowStartMs && (!prev.flowStartMs || r.flowStartMs < prev.flowStartMs)) prev.flowStartMs = r.flowStartMs
+        if (r.flowEndMs > prev.flowEndMs) prev.flowEndMs = r.flowEndMs
       } else {
         conv.set(ckey, {
           serverId: String(r.serverId),
@@ -223,12 +278,48 @@ export function buildFlowAnalytics(q: FlowAnalyticsQuery): FlowAnalyticsDto {
           bps: 0,
           inIface: resolved.name,
           inIfaceIndex: resolved.index,
+          outIface: outResolved.name !== "—" ? outResolved.name : undefined,
+          nextHop: r.nextHop || undefined,
           application: app,
           category: classified.category,
           service: classified.service,
           dstCountry: dstCountry || undefined,
           dstAsn: ripe?.asn || undefined,
+          clientId: client?.userId,
+          clientName: client?.name,
+          enId: en ? String(en.id) : undefined,
+          enName: en?.name,
+          plane,
           rawBytes: r.bytes,
+          flowStartMs: r.flowStartMs ?? 0,
+          flowEndMs: r.flowEndMs ?? 0,
+        })
+      }
+
+      const pathKey = `${client?.userId || "unknown"}|${r.serverId}|${en?.id || ""}|${r.dst}|${resolved.name}`
+      const pathPrev = pathAcc.get(pathKey)
+      if (pathPrev) {
+        pathPrev.bytes += r.bytes
+        pathPrev.packets += r.packets
+      } else {
+        pathAcc.set(pathKey, {
+          id: pathKey,
+          clientId: client?.userId || "unknown",
+          clientName: client?.name || "Неизвестный клиент",
+          ifaces: client ? [...(topo.clientIfaces.get(r.serverId) ?? [resolved.name])].join(", ") : resolved.name,
+          serverId: String(r.serverId),
+          serverName: nameById.get(r.serverId) ?? String(r.serverId),
+          inIface: resolved.name,
+          outIface: outResolved.name !== "—" ? outResolved.name : "",
+          enId: en ? String(en.id) : "",
+          enName: en?.name || "",
+          dst: r.dst,
+          service: classified.service,
+          category: classified.category,
+          plane,
+          bytes: r.bytes,
+          packets: r.packets,
+          bps: 0,
         })
       }
 
@@ -258,13 +349,20 @@ export function buildFlowAnalytics(q: FlowAnalyticsQuery): FlowAnalyticsDto {
     }
   }
 
-  enqueueRipeMisses(dsts)
+  enqueueRipeMisses(peers)
 
   const conversationsList = [...conv.values()]
-    .map((t) => ({ ...t, bps: (t.rawBytes * 8) / windowSec }))
+    .map((t) => {
+      const { rawBytes, flowStartMs, flowEndMs, ...rest } = t
+      return { ...rest, bps: flowBps(rawBytes, flowStartMs, flowEndMs, windowSec) }
+    })
+    .sort((a, b) => b.bytes - a.bytes)
+    .slice(0, top)
+
+  const paths: FlowPathRow[] = [...pathAcc.values()]
+    .map((p) => ({ ...p, bps: (p.bytes * 8) / windowSec }))
     .sort((a, b) => b.bytes - a.bytes)
     .slice(0, top)
-    .map(({ rawBytes: _raw, ...rest }) => rest)
 
   const topProto = topLabel(protocols)
   const topCategory = topLabel(categories)
@@ -312,6 +410,12 @@ export function buildFlowAnalytics(q: FlowAnalyticsQuery): FlowAnalyticsDto {
     .sort((a, b) => b.bytes - a.bytes)
     .slice(0, top)
 
+  const overlayRing = ringServer
+    ? getRingMbps(ringServer, RING_OVERLAY)
+    : { rxNow: 0, txNow: 0 }
+  const greNames = ringServer ? enGreIfaceNames(topo, ringServer, [...ifacesForWire]) : []
+  const wire = ringServer ? latestWireBps(ringServer, greNames) : { bps: 0, bytes: 0 }
+
   return {
     bpsNow: (ring.rxNow + ring.txNow) * 1_000_000 || (totalBytes * 8) / windowSec,
     bytes: totalBytes,
@@ -342,10 +446,19 @@ export function buildFlowAnalytics(q: FlowAnalyticsQuery): FlowAnalyticsDto {
     services: topN(services, windowSec, top),
     mapEdges,
     conversationsList,
+    paths,
     ifaces: ifaceRows,
     live: listener.bound,
     dedupApplied: wantDedup,
     degraded: skipHeavy,
+    bytesPayload,
+    bytesOverlay,
+    bytesMesh,
+    bytesWire: wire.bytes,
+    bpsOverlay: (overlayRing.rxNow + overlayRing.txNow) * 1_000_000 || (bytesOverlay * 8) / windowSec,
+    bpsWire: wire.bps,
+    excludeMeshApplied: excludeMesh,
+    excludeOverlayApplied: excludeOverlay,
   }
 }
 

backend/src/services/traffic-flow-apps.ts

@@ -32,7 +32,12 @@ const WELL_KNOWN: Record<string, string> = {
   "17:500": "IKE",
   "17:4500": "NAT-T",
   "17:1194": "OpenVPN",
+  "17:443": "QUIC",
+  "17:853": "DNS",
+  "6:853": "DNS",
   "17:51820": "WireGuard",
+  "17:13232": "WireGuard",
+  "17:51821": "WireGuard",
   "17:4789": "VXLAN",
   "17:4739": "IPFIX",
   "17:2055": "NetFlow",
@@ -51,6 +56,7 @@ export function applicationName(proto: number, dstPort: number, srcPort = 0): st
   if (proto === 47) return "GRE"
   if (proto === 50) return "ESP"
   if (proto === 89) return "OSPF"
+  if (proto === 17 && (dstPort === 443 || srcPort === 443)) return "QUIC"
   const dstKey = `${proto}:${dstPort}`
   const srcKey = `${proto}:${srcPort}`
   return WELL_KNOWN[dstKey] ?? WELL_KNOWN[srcKey] ?? `${protoName(proto)}/${dstPort || srcPort || "—"}`

backend/src/services/traffic-flow-brands.test.ts

@@ -4,6 +4,8 @@ import {
   countryFromHolder,
   lookupBrand,
   OTHER_SERVICE,
+  isNamedInternetService,
+  mapServiceNodeId,
   resolveRipeCountry,
 } from "./traffic-flow-brands.js"
 
@@ -16,11 +18,25 @@ assert.equal(resolveRipeCountry("?", 0, ""), "")
 
 assert.equal(brandByAsn(13335)?.service, "Cloudflare")
 assert.equal(brandByAsn(13335)?.category, "CDN")
+assert.equal(brandByAsn(15169)?.service, "Google")
+assert.equal(brandByAsn(15169)?.category, "Веб")
+assert.equal(lookupBrand("208.65.153.1", 0)?.service, "YouTube")
 assert.equal(brandByAsn(32590)?.service, "Steam")
 assert.equal(brandByAsn(32590)?.category, "Игры")
+assert.equal(brandByAsn(16509)?.service, "AWS")
+assert.equal(brandByAsn(57976)?.service, "Blizzard")
 assert.equal(brandByAsn(401115)?.service, "ChatGPT")
 assert.equal(lookupBrand("1.1.1.1", 13335)?.service, "Cloudflare")
+assert.equal(lookupBrand("104.18.35.51", 0)?.service, "Cloudflare")
+assert.equal(lookupBrand("173.194.151.65", 0)?.service, "Google")
+assert.equal(lookupBrand("8.8.8.8", 0)?.service, "Google")
 assert.equal(lookupBrand("203.0.113.9", 64500), null)
 assert.equal(OTHER_SERVICE, "Прочее")
+assert.equal(isNamedInternetService("Google", "Веб"), true)
+assert.equal(isNamedInternetService("Прочее", "Прочее"), false)
+assert.equal(isNamedInternetService("GRE", "Туннель"), false)
+assert.equal(isNamedInternetService("DNS", "DNS"), false)
+assert.equal(mapServiceNodeId("AWS"), "svc:aws")
+assert.equal(mapServiceNodeId("Cloudflare"), "svc:cloudflare")
 
 console.log("traffic-flow-brands.test.ts: ok")

backend/src/services/traffic-flow-brands.ts

@@ -12,14 +12,15 @@ const ASN_BRANDS = new Map<number, BrandHit>([
   [209242, { service: "Cloudflare", category: "CDN" }],
   [54113, { service: "Fastly", category: "CDN" }],
   [20940, { service: "Akamai", category: "CDN" }],
-  [16509, { service: "Amazon", category: "CDN" }],
-  [14618, { service: "Amazon", category: "CDN" }],
+  [16509, { service: "AWS", category: "CDN" }],
+  [14618, { service: "AWS", category: "CDN" }],
   [8075, { service: "Microsoft", category: "CDN" }],
   [13238, { service: "Yandex", category: "CDN" }],
   [32590, { service: "Steam", category: "Игры" }],
+  [57976, { service: "Blizzard", category: "Игры" }],
   [2906, { service: "Netflix", category: "Видео / стриминг" }],
   [40027, { service: "Netflix", category: "Видео / стриминг" }],
-  [15169, { service: "Google", category: "Видео / стриминг" }],
+  [15169, { service: "Google", category: "Веб" }],
   [36040, { service: "YouTube", category: "Видео / стриминг" }],
   [46489, { service: "Twitch", category: "Видео / стриминг" }],
   [401115, { service: "ChatGPT", category: "ИИ" }],
@@ -41,6 +42,7 @@ const ASN_HQ_COUNTRY = new Map<number, string>([
   [8075, "US"],
   [15169, "US"],
   [32590, "US"],
+  [57976, "US"],
   [2906, "US"],
   [40027, "US"],
   [36040, "US"],
@@ -54,11 +56,23 @@ const ASN_HQ_COUNTRY = new Map<number, string>([
   [211157, "NL"],
 ])
 
+const GOOGLE: BrandHit = { service: "Google", category: "Веб" }
+const CLOUDFLARE: BrandHit = { service: "Cloudflare", category: "CDN" }
+const YOUTUBE: BrandHit = { service: "YouTube", category: "Видео / стриминг" }
+
 const CIDR_BRANDS: Array<{ cidr: string; prefixLen: number; hit: BrandHit }> = [
-  { cidr: "104.16.0.0/13", prefixLen: 13, hit: { service: "Cloudflare", category: "CDN" } },
-  { cidr: "104.24.0.0/14", prefixLen: 14, hit: { service: "Cloudflare", category: "CDN" } },
-  { cidr: "172.64.0.0/13", prefixLen: 13, hit: { service: "Cloudflare", category: "CDN" } },
-  { cidr: "162.158.0.0/15", prefixLen: 15, hit: { service: "Cloudflare", category: "CDN" } },
+  { cidr: "104.16.0.0/13", prefixLen: 13, hit: CLOUDFLARE },
+  { cidr: "104.24.0.0/14", prefixLen: 14, hit: CLOUDFLARE },
+  { cidr: "172.64.0.0/13", prefixLen: 13, hit: CLOUDFLARE },
+  { cidr: "162.158.0.0/15", prefixLen: 15, hit: CLOUDFLARE },
+  { cidr: "8.8.8.0/24", prefixLen: 24, hit: GOOGLE },
+  { cidr: "8.8.4.0/24", prefixLen: 24, hit: GOOGLE },
+  { cidr: "173.194.0.0/16", prefixLen: 16, hit: GOOGLE },
+  { cidr: "172.217.0.0/16", prefixLen: 16, hit: GOOGLE },
+  { cidr: "74.125.0.0/16", prefixLen: 16, hit: GOOGLE },
+  { cidr: "142.250.0.0/15", prefixLen: 15, hit: GOOGLE },
+  { cidr: "208.65.152.0/22", prefixLen: 22, hit: YOUTUBE },
+  { cidr: "208.117.224.0/19", prefixLen: 19, hit: YOUTUBE },
 ].sort((a, b) => b.prefixLen - a.prefixLen)
 
 const NON_ISO = new Set(["EU", "AP", "ZZ", "XX", "A1", "A2", "O1"])
@@ -103,3 +117,32 @@ export function brandByCidr(ip: string): BrandHit | null {
 export function lookupBrand(ip: string, asn: number): BrandHit | null {
   return brandByCidr(ip) || brandByAsn(asn)
 }
+
+const SKIP_MAP_SERVICES = new Set([
+  OTHER_SERVICE,
+  "GRE",
+  "ESP",
+  "WireGuard",
+  "DNS",
+  "SSH",
+  "BGP",
+])
+
+const SKIP_MAP_CATEGORIES = new Set(["Туннель", "DNS", "SSH", "BGP"])
+
+/** Именованный интернет-сервис для карты (не туннель и не «Прочее»). */
+export function isNamedInternetService(service: string, category: string): boolean {
+  const s = service.trim()
+  const c = category.trim()
+  if (!s || SKIP_MAP_SERVICES.has(s) || SKIP_MAP_CATEGORIES.has(c)) return false
+  return true
+}
+
+export function mapServiceNodeId(label: string): string {
+  const slug = label
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+  return `svc:${slug || "unknown"}`
+}

backend/src/services/traffic-flow-classify.test.ts

@@ -1,4 +1,5 @@
 import assert from "node:assert/strict"
+import { applicationName } from "./traffic-flow-apps.js"
 import { classifyFlowDst, disableCatalogFetchForTests, resetFlowCatalogForTests, seedFlowCatalogForTests } from "./traffic-flow-classify.js"
 
 disableCatalogFetchForTests()
@@ -22,4 +23,42 @@ const amazonHolder = classifyFlowDst("203.0.113.50", 6, 443, 1, { prefix: "203.0
 assert.equal(amazonHolder.service, "Прочее")
 assert.notEqual(amazonHolder.service, "AMAZON-AES - Amazon.com, Inc.")
 
+const google = classifyFlowDst("173.194.160.163", 6, 443, 1, {
+  prefix: "173.194.0.0/16",
+  asn: 15169,
+  country: "US",
+  lat: null,
+  lng: null,
+  holder: "GOOGLE",
+  ok: true,
+  fetchedAt: Date.now(),
+})
+assert.equal(google.service, "Google")
+assert.equal(google.category, "Веб")
+
+const googleCidr = classifyFlowDst("173.194.151.65", 6, 57182, 443, null)
+assert.equal(googleCidr.service, "Google")
+assert.equal(googleCidr.category, "Веб")
+
+const youtube = classifyFlowDst("173.194.160.163", 6, 443, 1, {
+  prefix: "173.194.0.0/16",
+  asn: 15169,
+  country: "US",
+  lat: null,
+  lng: null,
+  holder: "YouTube LLC",
+  ok: true,
+  fetchedAt: Date.now(),
+})
+assert.equal(youtube.service, "YouTube")
+assert.equal(youtube.category, "Видео / стриминг")
+
+const gre = classifyFlowDst("198.51.100.1", 47, 0, 0, null)
+assert.equal(gre.service, "GRE")
+assert.equal(gre.category, "Туннель")
+const esp = classifyFlowDst("198.51.100.1", 50, 0, 0, null)
+assert.equal(esp.category, "Туннель")
+assert.equal(applicationName(17, 443, 50000), "QUIC")
+assert.equal(applicationName(17, 853, 50000), "DNS")
+
 console.log("traffic-flow-classify.test.ts: ok")

backend/src/services/traffic-flow-classify.ts

@@ -52,8 +52,10 @@ export function categoryFromPurpose(purpose: string, proto: number, dstPort: num
   if (/cdn|cloudflare|akamai|fastly/.test(p)) return "CDN"
   if (/voip|discord|zoom/.test(p)) return "Голос"
   if (/openai|chatgpt|\bai\b/.test(p)) return "ИИ"
+  if (/веб|web|google/.test(p)) return "Веб"
   const app = applicationName(proto, dstPort, srcPort)
   if (app === "DNS" || app === "SSH" || app === "BGP") return app
+  if (app === "GRE" || app === "ESP" || app === "WireGuard") return "Туннель"
   return OTHER_SERVICE
 }
 
@@ -71,8 +73,16 @@ export function classifyFlowDst(
   srcPort: number,
   ripe: FlowIpMeta | null,
 ): FlowClassification {
+  if (proto === 47) return { service: "GRE", category: "Туннель" }
+  if (proto === 50) return { service: "ESP", category: "Туннель" }
+  const app = applicationName(proto, dstPort, srcPort)
+  if (app === "WireGuard") return { service: "WireGuard", category: "Туннель" }
   const hit = matchCidr(dst)
-  const brand = lookupBrand(dst, ripe?.asn ?? 0)
+  const holder = ripe?.holder ?? ""
+  const youtubeHolder = /youtube/i.test(holder)
+  const brand = youtubeHolder
+    ? { service: "YouTube", category: "Видео / стриминг" }
+    : lookupBrand(dst, ripe?.asn ?? 0)
   const asnName = ripe?.asn ? asnPurpose.get(ripe.asn) : undefined
   const service = (hit?.purpose || brand?.service || asnName || OTHER_SERVICE).trim() || OTHER_SERVICE
   const category = hit

backend/src/services/traffic-flow-engine.ts

@@ -1,11 +1,13 @@
 import type Database from "better-sqlite3"
-import { parseFlowPacket, protoName, type ParsedFlow } from "./traffic-flow-parse.js"
+import { normalizeParsedFlow, parseFlowPacket, protoName, type ParsedFlow, type ParsedFlowInput } from "./traffic-flow-parse.js"
+import { classifyFlowPlaneLite } from "./traffic-flow-planes.js"
 import { pickServerIdForExporter, type OverlayPeerRef } from "./traffic-flow-map-exporter.js"
 import { applicationName } from "./traffic-flow-apps.js"
 import { classifyFlowDst } from "./traffic-flow-classify.js"
 import { enqueueRipeMisses, lookupRipeCached } from "./traffic-flow-ripe.js"
 import { isIsoCountry } from "./traffic-flow-brands.js"
 import { maybeRefreshIfaces } from "./traffic-flow-ifaces.js"
+import { pickInternetPeer } from "./traffic-flow-ip.js"
 
 type SqliteHandle = InstanceType<typeof Database>
 
@@ -30,6 +32,9 @@ export interface PendingFlowRow {
   packets: number
   inIface: string
   outIface: string
+  nextHop: string
+  flowStartMs: number
+  flowEndMs: number
 }
 
 export interface EngineStats {
@@ -108,8 +113,12 @@ function dayKey(bucketAt: string): string {
   return bucketAt.slice(0, 10)
 }
 
+export const RING_PAYLOAD = "__all__"
+export const RING_OVERLAY = "__overlay__"
+export const RING_MESH = "__mesh__"
+
 function ringKey(serverId: number, iface: string): string {
-  return `${serverId}\0${iface || "__all__"}`
+  return `${serverId}\0${iface || RING_PAYLOAD}`
 }
 
 function pendingKey(serverId: number, bucketAt: string, flow: ParsedFlow): string {
@@ -135,10 +144,13 @@ function bumpTick(key: string, inBytes: number, outBytes: number): void {
   tickAccum.set(key, prev)
 }
 
-function addToTick(serverId: number, inIface: string, outIface: string, bytes: number): void {
-  bumpTick(ringKey(serverId, "__all__"), bytes, 0)
-  if (inIface) bumpTick(ringKey(serverId, inIface), bytes, 0)
-  if (outIface && outIface !== inIface) bumpTick(ringKey(serverId, outIface), 0, bytes)
+function addToTick(serverId: number, flow: ParsedFlow, bytes: number): void {
+  const plane = classifyFlowPlaneLite(flow)
+  if (plane === "mgmt") return
+  const bucket = plane === "overlay" ? RING_OVERLAY : plane === "client_mesh" ? RING_MESH : RING_PAYLOAD
+  bumpTick(ringKey(serverId, bucket), bytes, 0)
+  if (flow.inIface) bumpTick(ringKey(serverId, flow.inIface), bytes, 0)
+  if (flow.outIface && flow.outIface !== flow.inIface) bumpTick(ringKey(serverId, flow.outIface), 0, bytes)
 }
 
 function emptyRing(): { inBps: number[]; outBps: number[] } {
@@ -221,15 +233,17 @@ export function getEngineStats(): EngineStats {
   }
 }
 
-export function queueParsedFlows(serverId: number, flows: ParsedFlow[]): void {
+export function queueParsedFlows(serverId: number, flows: ParsedFlowInput[]): void {
   const bucketAt = minuteBucketIso()
   const ripeMisses: string[] = []
-  for (const flow of flows) {
-    addToTick(serverId, flow.inIface, flow.outIface, flow.bytes)
+  for (const raw of flows) {
+    const flow = normalizeParsedFlow(raw)
+    addToTick(serverId, flow, flow.bytes)
     bumpRollup(serverId, bucketAt, flow, flow.bytes, flow.packets)
-    const ripe = lookupRipeCached(flow.dst)
-    if (flow.dst && !ripe) ripeMisses.push(flow.dst)
-    const classified = classifyFlowDst(flow.dst, flow.proto, flow.dstPort, flow.srcPort, ripe)
+    const peer = pickInternetPeer(flow.src, flow.dst, flow.srcPort, flow.dstPort)
+    const ripe = lookupRipeCached(peer)
+    if (peer && !ripe) ripeMisses.push(peer)
+    const classified = classifyFlowDst(peer, flow.proto, flow.dstPort, flow.srcPort, ripe)
     const app = applicationName(flow.proto, flow.dstPort, flow.srcPort)
     const country = ripe?.ok && isIsoCountry(ripe.country)
       ? ripe.country
@@ -248,6 +262,12 @@ export function queueParsedFlows(serverId: number, flows: ParsedFlow[]): void {
     if (prev) {
       prev.bytes += flow.bytes
       prev.packets += flow.packets
+      if (flow.outIface && !prev.flow.outIface) prev.flow.outIface = flow.outIface
+      if (flow.nextHop && !prev.flow.nextHop) prev.flow.nextHop = flow.nextHop
+      if (flow.flowStartMs && (!prev.flow.flowStartMs || flow.flowStartMs < prev.flow.flowStartMs)) {
+        prev.flow.flowStartMs = flow.flowStartMs
+      }
+      if (flow.flowEndMs > (prev.flow.flowEndMs ?? 0)) prev.flow.flowEndMs = flow.flowEndMs
       continue
     }
     if (pending.size >= pendingCap) {
@@ -283,18 +303,22 @@ export function ingestDatagram(msg: Buffer, exporterIp: string): boolean {
 }
 
 function toPendingRow(row: PendingEntry): PendingFlowRow {
+  const flow = normalizeParsedFlow(row.flow)
   return {
     serverId: row.serverId,
     bucketAt: row.bucketAt,
-    src: row.flow.src || "0.0.0.0",
-    dst: row.flow.dst || "0.0.0.0",
-    proto: row.flow.proto,
-    srcPort: row.flow.srcPort,
-    dstPort: row.flow.dstPort,
+    src: flow.src || "0.0.0.0",
+    dst: flow.dst || "0.0.0.0",
+    proto: flow.proto,
+    srcPort: flow.srcPort,
+    dstPort: flow.dstPort,
     bytes: row.bytes,
     packets: row.packets,
-    inIface: row.flow.inIface,
-    outIface: row.flow.outIface,
+    inIface: flow.inIface,
+    outIface: flow.outIface,
+    nextHop: flow.nextHop,
+    flowStartMs: flow.flowStartMs,
+    flowEndMs: flow.flowEndMs,
   }
 }
 
@@ -304,6 +328,10 @@ function mergeInto(map: Map<string, PendingFlowRow>, row: PendingFlowRow): void
   if (prev) {
     prev.bytes += row.bytes
     prev.packets += row.packets
+    if (row.outIface && !prev.outIface) prev.outIface = row.outIface
+    if (row.nextHop && !prev.nextHop) prev.nextHop = row.nextHop
+    if (row.flowStartMs && (!prev.flowStartMs || row.flowStartMs < prev.flowStartMs)) prev.flowStartMs = row.flowStartMs
+    if (row.flowEndMs > (prev.flowEndMs ?? 0)) prev.flowEndMs = row.flowEndMs
     return
   }
   map.set(key, { ...row })
@@ -360,7 +388,7 @@ export function rollFlowRings(): void {
   }
 }
 
-export function getRingMbps(serverId: number, iface = "__all__"): {
+export function getRingMbps(serverId: number, iface = RING_PAYLOAD): {
   rx: number[]
   tx: number[]
   rxNow: number
@@ -597,14 +625,20 @@ export function flushPending(): void {
 
   const upsertFlow = handle.prepare(`
     INSERT INTO flow_buckets (
-      server_id, bucket_at, src, dst, proto, src_port, dst_port, bytes, packets, in_iface
+      server_id, bucket_at, src, dst, proto, src_port, dst_port, bytes, packets, in_iface, out_iface, next_hop, flow_start_ms, flow_end_ms
     ) VALUES (
-      @serverId, @bucketAt, @src, @dst, @proto, @srcPort, @dstPort, @bytes, @packets, @inIface
+      @serverId, @bucketAt, @src, @dst, @proto, @srcPort, @dstPort, @bytes, @packets, @inIface, @outIface, @nextHop, @flowStartMs, @flowEndMs
     )
     ON CONFLICT(server_id, bucket_at, src, dst, proto, src_port, dst_port, in_iface)
     DO UPDATE SET
       bytes = bytes + excluded.bytes,
-      packets = packets + excluded.packets
+      packets = packets + excluded.packets,
+      out_iface = CASE WHEN excluded.out_iface != '' THEN excluded.out_iface ELSE out_iface END,
+      next_hop = CASE WHEN excluded.next_hop != '' THEN excluded.next_hop ELSE next_hop END,
+      flow_start_ms = CASE
+        WHEN excluded.flow_start_ms > 0 AND (flow_start_ms = 0 OR excluded.flow_start_ms < flow_start_ms)
+        THEN excluded.flow_start_ms ELSE flow_start_ms END,
+      flow_end_ms = MAX(flow_end_ms, excluded.flow_end_ms)
   `)
   lastFlushUsedTransaction = false
   try {
@@ -621,6 +655,10 @@ export function flushPending(): void {
           bytes: r.bytes,
           packets: r.packets,
           inIface: r.inIface,
+          outIface: r.outIface,
+          nextHop: r.nextHop,
+          flowStartMs: r.flowStartMs,
+          flowEndMs: r.flowEndMs,
         })
       }
     })
@@ -641,6 +679,10 @@ export function flushPending(): void {
           bytes: r.bytes,
           packets: r.packets,
           inIface: r.inIface,
+          outIface: r.outIface,
+          nextHop: r.nextHop,
+          flowStartMs: r.flowStartMs,
+          flowEndMs: r.flowEndMs,
         })
         rowsStored += 1
       } catch {
@@ -674,7 +716,7 @@ export function onEngineTick(): void {
   flushPending()
 }
 
-export function ingestParsedFlowsForServerForTests(serverId: number, flows: ParsedFlow[]): void {
+export function ingestParsedFlowsForServerForTests(serverId: number, flows: ParsedFlowInput[]): void {
   queueParsedFlows(serverId, flows)
   rollFlowRings()
 }

backend/src/services/traffic-flow-ingest.ts

@@ -1,10 +1,12 @@
 import { Worker } from "node:worker_threads"
+import { existsSync, statSync } from "node:fs"
+import path from "node:path"
 import { gte, sql } from "drizzle-orm"
-import { db, sqliteDatabase } from "../db/index.js"
+import { beginSqliteExclusiveOp, db, endSqliteExclusiveOp, sqliteDatabase } from "../db/index.js"
 import { env } from "../config.js"
 import { flowBuckets, servers } from "../db/schema.js"
-import type { FlowStatsDto, FlowTalkerDto } from "@mmapp/contracts/traffic-flow"
-import { protoName, type ParsedFlow } from "./traffic-flow-parse.js"
+import type { FlowPurgeDto, FlowStatsDto, FlowTalkerDto } from "@mmapp/contracts/traffic-flow"
+import { protoName, type ParsedFlowInput } from "./traffic-flow-parse.js"
 import type { CollectorHeartbeat, ExporterMapPayload, MainToWorker, WorkerToMain } from "./traffic-flow-collector-ipc.js"
 import {
   attachEngineSqlite,
@@ -27,6 +29,7 @@ import {
 import {
   getTrafficFlowSettingsRow,
   listHostPeers,
+  resetFlowIngestCounters,
 } from "./traffic-flow-settings.js"
 import { applicationName } from "./traffic-flow-apps.js"
 import { resolveIfaceName } from "./traffic-flow-ifaces.js"
@@ -267,6 +270,10 @@ function mergeInto(map: Map<string, PendingFlowRow>, row: PendingFlowRow): void
   if (prev) {
     prev.bytes += row.bytes
     prev.packets += row.packets
+    if (row.outIface && !prev.outIface) prev.outIface = row.outIface
+    if (row.nextHop && !prev.nextHop) prev.nextHop = row.nextHop
+    if (row.flowStartMs && (!prev.flowStartMs || row.flowStartMs < prev.flowStartMs)) prev.flowStartMs = row.flowStartMs
+    if (row.flowEndMs > (prev.flowEndMs ?? 0)) prev.flowEndMs = row.flowEndMs
     return
   }
   map.set(key, { ...row })
@@ -300,7 +307,10 @@ export function listStoredFlowRows(sinceIso: string): PendingFlowRow[] {
       bytes: r.bytes,
       packets: r.packets,
       inIface: r.inIface,
-      outIface: "",
+      outIface: r.outIface ?? "",
+      nextHop: r.nextHop ?? "",
+      flowStartMs: r.flowStartMs ?? 0,
+      flowEndMs: r.flowEndMs ?? 0,
     })
   }
   if (!worker) {
@@ -394,7 +404,7 @@ export function listFlowTalkers(minutes = 5): FlowStatsDto {
   }
 }
 
-export function ingestParsedFlowsForTests(exporterIp: string, flows: ParsedFlow[]) {
+export function ingestParsedFlowsForTests(exporterIp: string, flows: ParsedFlowInput[]) {
   applyExporterCtxFromDb()
   const serverId = resolveServerId(exporterIp)
   if (serverId == null) return
@@ -403,7 +413,7 @@ export function ingestParsedFlowsForTests(exporterIp: string, flows: ParsedFlow[
   flushPending()
 }
 
-export function ingestParsedFlowsForServerForTests(serverId: number, flows: ParsedFlow[]) {
+export function ingestParsedFlowsForServerForTests(serverId: number, flows: ParsedFlowInput[]) {
   engineIngestForServer(serverId, flows)
 }
 
@@ -423,6 +433,86 @@ export function flushPendingForTests(): void {
   flushPending()
 }
 
+function tableCount(name: string): number {
+  const row = sqliteDatabase.prepare(`SELECT COUNT(*) AS n FROM ${name}`).get() as { n: number }
+  return Number(row?.n) || 0
+}
+
+function dbFileBytes(): number {
+  const resolved = path.resolve(process.cwd(), env.DATABASE_PATH)
+  if (!existsSync(resolved)) return 0
+  return statSync(resolved).size
+}
+
+async function stopWorkerProcessAsync(): Promise<void> {
+  if (restartTimer) {
+    clearTimeout(restartTimer)
+    restartTimer = null
+  }
+  if (!worker) return
+  const current = worker
+  worker = null
+  try {
+    current.postMessage({ type: "stop" })
+    await current.terminate()
+  } catch {
+    /* ignore */
+  }
+}
+
+/** Удаляет сессии, minute/daily rollup и сжимает SQLite. Ключи WG и пиры JH не трогает. */
+export async function purgeTrafficFlowStore(): Promise<FlowPurgeDto> {
+  beginSqliteExclusiveOp()
+  try {
+    wantListen = false
+    await stopWorkerProcessAsync()
+    resetEngineForTests()
+    attachEngineSqlite(sqliteDatabase)
+    lastHeartbeat = null
+    state = { bound: false, address: null }
+    const fileBytesBefore = dbFileBytes()
+    const deleted = {
+      buckets: tableCount("flow_buckets"),
+      minuteStats: tableCount("flow_minute_stats"),
+      minuteDims: tableCount("flow_minute_dims"),
+      dailyDims: tableCount("flow_daily_dims"),
+    }
+    sqliteDatabase.exec(`
+      DELETE FROM flow_buckets;
+      DELETE FROM flow_minute_stats;
+      DELETE FROM flow_minute_dims;
+      DELETE FROM flow_daily_dims;
+    `)
+    resetFlowIngestCounters()
+    try {
+      sqliteDatabase.pragma("wal_checkpoint(TRUNCATE)")
+    } catch {
+      /* ignore */
+    }
+    let vacuumed = false
+    try {
+      sqliteDatabase.exec("VACUUM")
+      vacuumed = true
+    } catch {
+      vacuumed = false
+    }
+    return {
+      ok: true,
+      deleted,
+      fileBytesBefore,
+      fileBytesAfter: dbFileBytes(),
+      vacuumed,
+    }
+  } finally {
+    try {
+      startTrafficFlowListener()
+    } catch {
+      /* ingest мог остаться выключенным */
+    }
+    endSqliteExclusiveOp()
+  }
+}
+
 export { peekPendingFlows }
 export { setPendingCapForTests } from "./traffic-flow-engine.js"
 export { maybeRefreshIfaces, setRefreshIfacesForTests } from "./traffic-flow-ifaces.js"

backend/src/services/traffic-flow-ip.test.ts

@@ -0,0 +1,25 @@
+import assert from "node:assert/strict"
+import { isNonPublicIp, pickInternetPeer } from "./traffic-flow-ip.js"
+
+assert.equal(isNonPublicIp("10.200.100.53"), true)
+assert.equal(isNonPublicIp("173.194.151.65"), false)
+
+assert.equal(
+  pickInternetPeer("173.194.151.65", "10.200.100.53", 443, 57182),
+  "173.194.151.65",
+  "reverse IPFIX: Google:443 → RFC1918",
+)
+assert.equal(
+  pickInternetPeer("10.200.100.53", "104.18.35.51", 53880, 443),
+  "104.18.35.51",
+  "client → Cloudflare:443",
+)
+assert.equal(pickInternetPeer("10.100.1.17", "8.8.8.8", 51234, 443), "8.8.8.8")
+assert.equal(
+  pickInternetPeer("1.1.1.1", "8.8.8.8", 443, 51234),
+  "1.1.1.1",
+  "оба публичные — сторона с well-known портом",
+)
+assert.equal(pickInternetPeer("10.1.1.1", "10.2.2.2", 443, 80), "10.2.2.2")
+
+console.log("traffic-flow-ip.test.ts: ok")

backend/src/services/traffic-flow-ip.ts

@@ -52,3 +52,23 @@ export function isNonPublicIp(ip: string): boolean {
     || inRange("255.255.255.255/32")
   )
 }
+
+const PEER_WELL_KNOWN_PORTS = new Set([80, 443, 53, 853])
+
+/**
+ * Интернет-сторона потока: у IPFIX сервис часто в src (Google:443 → RFC1918:ephemeral).
+ * Классифицировать этот IP, не слепой dst.
+ */
+export function pickInternetPeer(src: string, dst: string, srcPort: number, dstPort: number): string {
+  const srcPub = !isNonPublicIp(src)
+  const dstPub = !isNonPublicIp(dst)
+  if (srcPub && !dstPub) return src
+  if (dstPub && !srcPub) return dst
+  if (srcPub && dstPub) {
+    const srcWk = PEER_WELL_KNOWN_PORTS.has(srcPort)
+    const dstWk = PEER_WELL_KNOWN_PORTS.has(dstPort)
+    if (srcWk && !dstWk) return src
+    if (dstWk && !srcWk) return dst
+  }
+  return dst
+}

backend/src/services/traffic-flow-map-hops.test.ts

@@ -0,0 +1,330 @@
+import assert from "node:assert/strict"
+import { rememberServerIfaces, resetIfaceCacheForTests } from "./traffic-flow-ifindex.js"
+import {
+  ingestParsedFlowsForServerForTests,
+  resetFlowRingsForTests,
+} from "./traffic-flow-ingest.js"
+import { buildFlowMapHops, resetFlowMapHopsCacheForTests } from "./traffic-flow-map-hops.js"
+import { seedFlowTopologyForTests, type FlowTopology } from "./traffic-flow-topology.js"
+import { disableCatalogFetchForTests, resetFlowCatalogForTests } from "./traffic-flow-classify.js"
+import {
+  disableRipeEnqueueForTests,
+  disableRipePersistForTests,
+  resetRipeCacheForTests,
+  seedRipeCacheForTests,
+} from "./traffic-flow-ripe.js"
+
+disableCatalogFetchForTests()
+resetFlowCatalogForTests()
+disableRipePersistForTests()
+resetRipeCacheForTests()
+disableRipeEnqueueForTests()
+
+const topo: FlowTopology = {
+  clientIfaces: new Map([[7, new Set(["gre-client"])]]),
+  clientByIface: new Map([["7|gre-client", {
+    userId: "u1",
+    login: "alice",
+    name: "Alice",
+    serverId: 7,
+    interfaceName: "gre-client",
+  }]]),
+  enNodes: [{ id: 9, name: "NSK-EN", hosts: ["198.51.100.1"] }],
+  enHosts: new Set(["198.51.100.1"]),
+  jhHosts: new Set(["203.0.113.10"]),
+  wanIfaces: new Map([[3, new Set(["ether1-rt"])]]),
+  plane: {
+    clientIfaceNames: new Set(["gre-client"]),
+    enHosts: new Set(["198.51.100.1"]),
+    jhHosts: new Set(["203.0.113.10"]),
+  },
+}
+
+resetFlowRingsForTests()
+resetIfaceCacheForTests()
+seedFlowTopologyForTests(topo)
+rememberServerIfaces(7, [
+  { ".id": "*2", name: "gre-client" },
+  { ".id": "*3", name: "gre-jh-en" },
+  { ".id": "*A", name: "wg-flow" },
+])
+rememberServerIfaces(3, [
+  { ".id": "*1", name: "ether1-rt" },
+])
+
+ingestParsedFlowsForServerForTests(7, [
+  {
+    src: "10.100.1.17",
+    dst: "8.8.8.8",
+    proto: 6,
+    srcPort: 51234,
+    dstPort: 443,
+    bytes: 12_000,
+    packets: 10,
+    inIface: "2",
+    outIface: "3",
+    nextHop: "198.51.100.1",
+  },
+  {
+    src: "203.0.113.10",
+    dst: "198.51.100.1",
+    proto: 47,
+    srcPort: 0,
+    dstPort: 0,
+    bytes: 5_000_000,
+    packets: 4000,
+    inIface: "3",
+    outIface: "3",
+  },
+  {
+    src: "10.100.1.17",
+    dst: "10.100.1.18",
+    proto: 6,
+    srcPort: 50000,
+    dstPort: 443,
+    bytes: 8000,
+    packets: 8,
+    inIface: "2",
+    outIface: "2",
+  },
+  {
+    src: "10.255.254.1",
+    dst: "10.255.254.2",
+    proto: 17,
+    srcPort: 4739,
+    dstPort: 2055,
+    bytes: 400,
+    packets: 2,
+    inIface: "10",
+    outIface: "",
+  },
+])
+ingestParsedFlowsForServerForTests(3, [
+  {
+    src: "192.168.1.10",
+    dst: "8.8.4.4",
+    proto: 6,
+    srcPort: 40000,
+    dstPort: 443,
+    bytes: 3000,
+    packets: 4,
+    inIface: "1",
+    outIface: "1",
+  },
+])
+
+try {
+  resetFlowMapHopsCacheForTests()
+  const def = buildFlowMapHops({ minutes: 5 })
+  assert.equal(def.excludeOverlayApplied, true)
+  assert.equal(def.excludeMeshApplied, true)
+  assert.equal(def.dedupApplied, true)
+  assert.equal(def.windowSec, 300)
+
+  const payloadGre = def.hops.find((h) => h.kind === "gre" && h.fromId === "7" && h.toId === "9")
+  assert.ok(payloadGre, "payload JH→EN hop")
+  assert.equal(payloadGre.bytes, 12_000)
+  assert.equal(payloadGre.bps, (12_000 * 8) / 300)
+  assert.equal(payloadGre.bpsFwd, (12_000 * 8) / 300)
+  assert.equal(payloadGre.iface, "gre-jh-en")
+
+  const greIface = def.hops.find((h) => h.kind === "iface" && h.iface === "gre-jh-en" && h.fromId === "7")
+  assert.ok(greIface)
+  assert.equal(greIface.bytes, 12_000)
+  assert.equal(greIface.bpsFwd, (12_000 * 8) / 300)
+
+  assert.ok(!def.hops.some((h) => h.bytes >= 5_000_000), "overlay GRE proto 47 excluded")
+  assert.ok(!def.hops.some((h) => h.iface === "wg-flow"), "mgmt wg-flow excluded")
+  const clientIngress = def.hops.find((h) => h.iface === "gre-client" && h.fromId === "7" && h.kind === "iface")
+  assert.ok(clientIngress, "payload ingress on client iface")
+  assert.equal(clientIngress.bytes, 12_000)
+
+  const wan = def.hops.find((h) => h.kind === "wan" && h.fromId === "3" && h.iface === "ether1-rt")
+  assert.ok(wan, "WAN hop from home-router")
+  assert.equal(wan.bytes, 3000)
+
+  resetFlowMapHopsCacheForTests()
+  const withAll = buildFlowMapHops({ minutes: 5, excludeOverlay: false, excludeMesh: false })
+  const overlayIface = withAll.hops.find((h) => h.iface === "gre-jh-en" && h.fromId === "7")
+  assert.ok(overlayIface && overlayIface.bytes >= 5_000_000)
+  const meshIface = withAll.hops.find((h) => h.iface === "gre-client" && h.fromId === "7" && h.kind === "iface")
+  assert.ok(meshIface && meshIface.bytes >= 20_000)
+} finally {
+  seedFlowTopologyForTests(null)
+  resetFlowRingsForTests()
+  resetIfaceCacheForTests()
+  resetRipeCacheForTests()
+  resetFlowCatalogForTests()
+}
+
+console.log("traffic-flow-map-hops.test.ts: hops ok")
+
+function googleRipe() {
+  seedRipeCacheForTests({
+    prefix: "8.8.8.0/24",
+    asn: 15169,
+    country: "US",
+    lat: 37.4,
+    lng: -122.1,
+    holder: "GOOGLE",
+    ok: true,
+    fetchedAt: Date.now(),
+  })
+}
+
+function payloadFlow(dst: string, bytes: number) {
+  return {
+    src: "10.100.1.17",
+    dst,
+    proto: 6,
+    srcPort: 51234,
+    dstPort: 443,
+    bytes,
+    packets: Math.max(1, Math.round(bytes / 1200)),
+    inIface: "2",
+    outIface: "3",
+    nextHop: "198.51.100.1",
+  }
+}
+
+resetFlowRingsForTests()
+resetIfaceCacheForTests()
+resetRipeCacheForTests()
+disableRipeEnqueueForTests()
+seedFlowTopologyForTests(topo)
+rememberServerIfaces(7, [
+  { ".id": "*2", name: "gre-client" },
+  { ".id": "*3", name: "gre-jh-en" },
+])
+googleRipe()
+ingestParsedFlowsForServerForTests(7, [
+  payloadFlow("8.8.8.8", 600),
+  payloadFlow("203.0.113.50", 9400),
+])
+try {
+  resetFlowMapHopsCacheForTests()
+  const six = buildFlowMapHops({ minutes: 5, minSharePct: 5 })
+  assert.equal(six.totalBytes, 10_000)
+  const google = six.services?.find((s) => s.id === "svc:google")
+  assert.ok(google, "Google ≥ 5%")
+  assert.ok(google.share >= 0.05)
+  assert.ok(six.serviceEdges?.some((e) => e.toId === "svc:google" && e.fromId === "9"))
+} finally {
+  resetFlowRingsForTests()
+  resetIfaceCacheForTests()
+  resetRipeCacheForTests()
+}
+
+resetFlowRingsForTests()
+resetIfaceCacheForTests()
+resetRipeCacheForTests()
+disableRipeEnqueueForTests()
+seedFlowTopologyForTests(topo)
+rememberServerIfaces(7, [
+  { ".id": "*2", name: "gre-client" },
+  { ".id": "*3", name: "gre-jh-en" },
+])
+googleRipe()
+ingestParsedFlowsForServerForTests(7, [
+  payloadFlow("8.8.8.8", 400),
+  payloadFlow("203.0.113.50", 9600),
+])
+try {
+  resetFlowMapHopsCacheForTests()
+  const four = buildFlowMapHops({ minutes: 5, minSharePct: 5 })
+  assert.equal(four.totalBytes, 10_000)
+  assert.ok(!(four.services ?? []).some((s) => s.id === "svc:google"), "Google < 5% hidden")
+  resetFlowMapHopsCacheForTests()
+  const off = buildFlowMapHops({ minutes: 5, minSharePct: 0 })
+  assert.ok(off.services?.some((s) => s.id === "svc:google"), "порог 0 показывает Google 4%")
+} finally {
+  resetFlowRingsForTests()
+  resetIfaceCacheForTests()
+  resetRipeCacheForTests()
+}
+
+resetFlowRingsForTests()
+resetIfaceCacheForTests()
+resetRipeCacheForTests()
+disableRipeEnqueueForTests()
+seedFlowTopologyForTests(topo)
+rememberServerIfaces(7, [
+  { ".id": "*2", name: "gre-client" },
+  { ".id": "*3", name: "gre-jh-en" },
+])
+ingestParsedFlowsForServerForTests(7, [
+  {
+    src: "203.0.113.10",
+    dst: "198.51.100.1",
+    proto: 47,
+    srcPort: 0,
+    dstPort: 0,
+    bytes: 9_000,
+    packets: 90,
+    inIface: "3",
+    outIface: "3",
+  },
+  payloadFlow("203.0.113.50", 1000),
+])
+try {
+  resetFlowMapHopsCacheForTests()
+  const greOnly = buildFlowMapHops({ minutes: 5, excludeOverlay: false, minSharePct: 0 })
+  assert.ok(!(greOnly.services ?? []).some((s) => s.label === "GRE"), "GRE is not a destination service")
+} finally {
+  seedFlowTopologyForTests(null)
+  resetFlowRingsForTests()
+  resetIfaceCacheForTests()
+  resetRipeCacheForTests()
+  resetFlowCatalogForTests()
+}
+
+resetFlowRingsForTests()
+resetIfaceCacheForTests()
+resetRipeCacheForTests()
+disableRipeEnqueueForTests()
+seedFlowTopologyForTests(topo)
+rememberServerIfaces(7, [
+  { ".id": "*2", name: "gre-client" },
+  { ".id": "*3", name: "gre-jh-en" },
+])
+ingestParsedFlowsForServerForTests(7, [
+  {
+    src: "173.194.151.65",
+    dst: "10.200.100.53",
+    proto: 6,
+    srcPort: 443,
+    dstPort: 57182,
+    bytes: 9_000,
+    packets: 90,
+    inIface: "2",
+    outIface: "3",
+    nextHop: "198.51.100.1",
+  },
+  {
+    src: "104.18.35.51",
+    dst: "10.200.100.53",
+    proto: 6,
+    srcPort: 443,
+    dstPort: 53880,
+    bytes: 1_000,
+    packets: 10,
+    inIface: "2",
+    outIface: "3",
+    nextHop: "198.51.100.1",
+  },
+])
+try {
+  resetFlowMapHopsCacheForTests()
+  const rev = buildFlowMapHops({ minutes: 5, minSharePct: 0 })
+  assert.ok(rev.services?.some((s) => s.id === "svc:google"), "реверс Google:443 → 10.x")
+  assert.ok(rev.services?.some((s) => s.id === "svc:cloudflare"), "реверс Cloudflare:443 → 10.x")
+  assert.ok(rev.serviceEdges?.some((e) => e.toId === "svc:google" && e.fromId === "9"))
+} finally {
+  seedFlowTopologyForTests(null)
+  resetFlowRingsForTests()
+  resetIfaceCacheForTests()
+  resetRipeCacheForTests()
+  resetFlowCatalogForTests()
+}
+
+console.log("traffic-flow-map-hops.test.ts: ok")

backend/src/services/traffic-flow-map-hops.ts

@@ -0,0 +1,384 @@
+import { eq } from "drizzle-orm"
+import type { FlowMapHop, FlowMapHopsDto, FlowMapService, FlowMapServiceEdge } from "@mmapp/contracts/traffic-flow"
+import { db } from "../db/index.js"
+import { servers, userInterfaceBindings } from "../db/schema.js"
+import { applicationName, flowRowMatchesFilter } from "./traffic-flow-apps.js"
+import {
+  isNamedInternetService,
+  lookupBrand,
+  mapServiceNodeId,
+} from "./traffic-flow-brands.js"
+import { dedupFlowRowsMaxBytes } from "./traffic-flow-dedup.js"
+import { getFlowListenerState, listFlowRowsForWindow } from "./traffic-flow-ingest.js"
+import { resolveIfaceName } from "./traffic-flow-ifaces.js"
+import { classifyFlowPlane, shouldKeepPlane } from "./traffic-flow-planes.js"
+import { pickInternetPeer } from "./traffic-flow-ip.js"
+import { lookupRipeCached, type FlowIpMeta } from "./traffic-flow-ripe.js"
+import { getTrafficFlowSettingsRow } from "./traffic-flow-settings.js"
+import { loadFlowTopology, resolveEn } from "./traffic-flow-topology.js"
+
+export const DEFAULT_MAP_SERVICE_MIN_SHARE_PCT = 5
+export const MAP_SERVICE_NODE_CAP = 20
+const HOPS_CACHE_TTL_MS = 2000
+
+export interface FlowMapHopsQuery {
+  minutes: number
+  serverId?: number
+  userId?: string
+  iface?: string
+  dedup?: boolean
+  excludeMesh?: boolean
+  excludeOverlay?: boolean
+  /** Переопределение порога (тесты). Иначе из настроек NetFlow. */
+  minSharePct?: number
+}
+
+interface HopAcc {
+  fromId: string
+  fromLabel: string
+  toId: string
+  toLabel: string
+  kind: FlowMapHop["kind"]
+  iface?: string
+  bytes: number
+  bytesFwd: number
+  bytesRev: number
+}
+
+interface DstAcc {
+  bytes: number
+  proto: number
+  dstPort: number
+  srcPort: number
+  fromBytes: Map<string, number>
+}
+
+let hopsCache: { key: string; at: number; dto: FlowMapHopsDto } | null = null
+
+export function resetFlowMapHopsCacheForTests(): void {
+  hopsCache = null
+}
+
+export function clampMapServiceMinSharePct(n: unknown): number {
+  const v = typeof n === "number" ? n : Number(n)
+  if (!Number.isFinite(v)) return DEFAULT_MAP_SERVICE_MIN_SHARE_PCT
+  return Math.min(100, Math.max(0, v))
+}
+
+function hopsQueryKey(q: FlowMapHopsQuery, minSharePct: number): string {
+  return JSON.stringify({
+    minutes: q.minutes,
+    serverId: q.serverId ?? null,
+    userId: q.userId ?? null,
+    iface: q.iface ?? null,
+    dedup: q.dedup !== false,
+    excludeMesh: q.excludeMesh !== false,
+    excludeOverlay: q.excludeOverlay !== false,
+    minSharePct,
+  })
+}
+
+function userIfaceAllow(userId: string): Map<number, Set<string>> | null {
+  if (!userId) return null
+  const binds = db.select().from(userInterfaceBindings).where(eq(userInterfaceBindings.userId, userId)).all()
+  const allow = new Map<number, Set<string>>()
+  for (const b of binds) {
+    const set = allow.get(b.serverId) ?? new Set<string>()
+    set.add(b.interfaceName)
+    allow.set(b.serverId, set)
+  }
+  return allow
+}
+
+function ifaceUsable(name: string): boolean {
+  return Boolean(name) && name !== "—"
+}
+
+function bump(acc: Map<string, HopAcc>, key: string, seed: Omit<HopAcc, "bytes" | "bytesFwd" | "bytesRev">, bytes: number, dir: "fwd" | "rev" | "both"): void {
+  const prev = acc.get(key)
+  const addFwd = dir === "fwd" || dir === "both" ? bytes : 0
+  const addRev = dir === "rev" || dir === "both" ? bytes : 0
+  if (prev) {
+    prev.bytes += bytes
+    prev.bytesFwd += addFwd
+    prev.bytesRev += addRev
+    if (seed.iface && !prev.iface) prev.iface = seed.iface
+    return
+  }
+  acc.set(key, {
+    ...seed,
+    bytes,
+    bytesFwd: addFwd,
+    bytesRev: addRev,
+  })
+}
+
+function toHop(a: HopAcc, windowSec: number): FlowMapHop {
+  return {
+    fromId: a.fromId,
+    fromLabel: a.fromLabel,
+    toId: a.toId,
+    toLabel: a.toLabel,
+    kind: a.kind,
+    ...(a.iface ? { iface: a.iface } : {}),
+    bytes: a.bytes,
+    bps: (a.bytes * 8) / windowSec,
+    bpsFwd: (a.bytesFwd * 8) / windowSec,
+    bpsRev: (a.bytesRev * 8) / windowSec,
+  }
+}
+
+/** Имя бренда без каталога EvoBGP — только ASN/CIDR кэш + proto. */
+function classifyMapDstLite(
+  dst: string,
+  proto: number,
+  dstPort: number,
+  srcPort: number,
+  ripe: FlowIpMeta | null,
+): { service: string; category: string } | null {
+  if (proto === 47 || proto === 50) return null
+  const app = applicationName(proto, dstPort, srcPort)
+  if (app === "WireGuard" || app === "DNS" || app === "SSH" || app === "BGP") return null
+  if (/youtube/i.test(ripe?.holder ?? "")) {
+    return { service: "YouTube", category: "Видео / стриминг" }
+  }
+  const brand = lookupBrand(dst, ripe?.asn ?? 0)
+  if (!brand || !isNamedInternetService(brand.service, brand.category)) return null
+  return brand
+}
+
+function resolveMinSharePct(q: FlowMapHopsQuery): number {
+  if (q.minSharePct != null) return clampMapServiceMinSharePct(q.minSharePct)
+  try {
+    const row = getTrafficFlowSettingsRow() as { mapServiceMinSharePct?: number }
+    return clampMapServiceMinSharePct(row.mapServiceMinSharePct ?? DEFAULT_MAP_SERVICE_MIN_SHARE_PCT)
+  } catch {
+    return DEFAULT_MAP_SERVICE_MIN_SHARE_PCT
+  }
+}
+
+function buildFlowMapHopsUncached(q: FlowMapHopsQuery, minSharePct: number): FlowMapHopsDto {
+  const windowSec = Math.max(60, q.minutes * 60)
+  const raw = listFlowRowsForWindow(q.minutes)
+  const allow = q.userId ? userIfaceAllow(q.userId) : null
+  const serverRows = db.select().from(servers).all()
+  const nameById = new Map(serverRows.map((s) => [s.id, s.name || s.host]))
+  const ifaceFilter = q.iface && q.iface !== "__all__" ? q.iface : ""
+  const wantDedup = q.dedup !== false && !ifaceFilter
+  const excludeMesh = q.excludeMesh !== false
+  const excludeOverlay = q.excludeOverlay !== false
+  const topo = loadFlowTopology()
+
+  const matched = []
+  for (const r of raw) {
+    const resolved = resolveIfaceName(r.serverId, r.inIface)
+    const outResolved = resolveIfaceName(r.serverId, r.outIface)
+    if (!flowRowMatchesFilter(r, resolved.name, q, allow)) continue
+    const plane = classifyFlowPlane({
+      src: r.src,
+      dst: r.dst,
+      proto: r.proto,
+      srcPort: r.srcPort,
+      dstPort: r.dstPort,
+      inIface: resolved.name,
+      outIface: outResolved.name,
+    }, topo.plane)
+    if (!shouldKeepPlane(plane, { excludeMesh, excludeOverlay })) continue
+    matched.push(r)
+  }
+
+  const working = wantDedup ? dedupFlowRowsMaxBytes(matched) : matched
+  const hops = new Map<string, HopAcc>()
+  const dstAcc = new Map<string, DstAcc>()
+  let totalBytes = 0
+
+  for (const r of working) {
+    const inRes = resolveIfaceName(r.serverId, r.inIface)
+    const outRes = resolveIfaceName(r.serverId, r.outIface)
+    const inName = inRes.name
+    const outName = outRes.name
+    const fromId = String(r.serverId)
+    const fromLabel = nameById.get(r.serverId) ?? fromId
+    const wanSet = topo.wanIfaces.get(r.serverId)
+
+    const inOk = ifaceUsable(inName)
+    const outOk = ifaceUsable(outName)
+    const sameIface = inOk && outOk && inName.toLowerCase() === outName.toLowerCase()
+    if (sameIface) {
+      bump(hops, `iface|${fromId}|${inName.toLowerCase()}`, {
+        fromId,
+        fromLabel,
+        toId: "",
+        toLabel: "",
+        kind: "iface",
+        iface: inName,
+      }, r.bytes, "fwd")
+    } else {
+      if (inOk) {
+        bump(hops, `iface|${fromId}|${inName.toLowerCase()}`, {
+          fromId,
+          fromLabel,
+          toId: "",
+          toLabel: "",
+          kind: "iface",
+          iface: inName,
+        }, r.bytes, "rev")
+      }
+      if (outOk) {
+        bump(hops, `iface|${fromId}|${outName.toLowerCase()}`, {
+          fromId,
+          fromLabel,
+          toId: "",
+          toLabel: "",
+          kind: "iface",
+          iface: outName,
+        }, r.bytes, "fwd")
+      }
+    }
+
+    const enOut = ifaceUsable(outName) ? resolveEn(topo, r.nextHop, outName) : null
+    const enIn = ifaceUsable(inName) ? resolveEn(topo, "", inName) : null
+    const en = (enOut && enOut.id !== r.serverId ? enOut : null)
+      ?? (enIn && enIn.id !== r.serverId ? enIn : null)
+    if (en) {
+      const toId = String(en.id)
+      const dir: "fwd" | "rev" = enOut && enOut.id === en.id ? "fwd" : "rev"
+      const greIface = dir === "fwd" && ifaceUsable(outName) ? outName : (ifaceUsable(inName) ? inName : undefined)
+      bump(hops, `gre|${fromId}|${toId}`, {
+        fromId,
+        fromLabel,
+        toId,
+        toLabel: en.name,
+        kind: "gre",
+        iface: greIface,
+      }, r.bytes, dir)
+    }
+
+    if (wanSet?.size) {
+      if (ifaceUsable(inName) && wanSet.has(inName)) {
+        bump(hops, `wan|${fromId}|${inName.toLowerCase()}`, {
+          fromId,
+          fromLabel,
+          toId: "",
+          toLabel: "",
+          kind: "wan",
+          iface: inName,
+        }, r.bytes, "rev")
+      }
+      if (ifaceUsable(outName) && wanSet.has(outName) && outName.toLowerCase() !== inName.toLowerCase()) {
+        bump(hops, `wan|${fromId}|${outName.toLowerCase()}`, {
+          fromId,
+          fromLabel,
+          toId: "",
+          toLabel: "",
+          kind: "wan",
+          iface: outName,
+        }, r.bytes, "fwd")
+      }
+    }
+
+    totalBytes += r.bytes
+    const svcFromId = String((enOut ?? enIn)?.id ?? r.serverId)
+    const peer = pickInternetPeer(r.src, r.dst, r.srcPort, r.dstPort)
+    const prevDst = dstAcc.get(peer)
+    if (prevDst) {
+      prevDst.bytes += r.bytes
+      prevDst.fromBytes.set(svcFromId, (prevDst.fromBytes.get(svcFromId) ?? 0) + r.bytes)
+    } else {
+      dstAcc.set(peer, {
+        bytes: r.bytes,
+        proto: r.proto,
+        dstPort: r.dstPort,
+        srcPort: r.srcPort,
+        fromBytes: new Map([[svcFromId, r.bytes]]),
+      })
+    }
+  }
+
+  const svcTotals = new Map<string, { label: string; category: string; bytes: number }>()
+  const svcEdges = new Map<string, { fromId: string; toId: string; bytes: number; bytesFwd: number; bytesRev: number }>()
+
+  for (const [dst, acc] of dstAcc) {
+    const ripe = lookupRipeCached(dst)
+    const classified = classifyMapDstLite(dst, acc.proto, acc.dstPort, acc.srcPort, ripe)
+    if (!classified) continue
+    const toId = mapServiceNodeId(classified.service)
+    const prevSvc = svcTotals.get(toId)
+    if (prevSvc) prevSvc.bytes += acc.bytes
+    else svcTotals.set(toId, { label: classified.service, category: classified.category, bytes: acc.bytes })
+    for (const [fromId, bytes] of acc.fromBytes) {
+      const edgeKey = `${fromId}|${toId}`
+      const prevEdge = svcEdges.get(edgeKey)
+      if (prevEdge) {
+        prevEdge.bytes += bytes
+        prevEdge.bytesFwd += bytes
+      } else {
+        svcEdges.set(edgeKey, {
+          fromId,
+          toId,
+          bytes,
+          bytesFwd: bytes,
+          bytesRev: 0,
+        })
+      }
+    }
+  }
+
+  const minShare = minSharePct / 100
+  let services: FlowMapService[] = [...svcTotals.entries()]
+    .map(([id, s]) => ({
+      id,
+      label: s.label,
+      category: s.category,
+      bytes: s.bytes,
+      bps: (s.bytes * 8) / windowSec,
+      share: totalBytes > 0 ? s.bytes / totalBytes : 0,
+    }))
+    .sort((a, b) => b.bytes - a.bytes)
+  if (minSharePct > 0) {
+    services = services.filter((s) => s.share >= minShare)
+  }
+  services = services.slice(0, MAP_SERVICE_NODE_CAP)
+  const keepSvc = new Set(services.map((s) => s.id))
+  const serviceEdges: FlowMapServiceEdge[] = [...svcEdges.values()]
+    .filter((e) => keepSvc.has(e.toId))
+    .map((e) => ({
+      fromId: e.fromId,
+      toId: e.toId,
+      bytes: e.bytes,
+      bps: (e.bytes * 8) / windowSec,
+      bpsFwd: (e.bytesFwd * 8) / windowSec,
+      bpsRev: (e.bytesRev * 8) / windowSec,
+    }))
+    .sort((a, b) => b.bytes - a.bytes)
+
+  const listener = getFlowListenerState()
+  return {
+    hops: [...hops.values()]
+      .map((a) => toHop(a, windowSec))
+      .sort((a, b) => a.bytes === b.bytes ? 0 : b.bytes - a.bytes),
+    live: listener.bound,
+    rangeMinutes: q.minutes,
+    windowSec,
+    totalBytes,
+    services,
+    serviceEdges,
+    mapServiceMinSharePct: minSharePct,
+    dedupApplied: wantDedup,
+    excludeMeshApplied: excludeMesh,
+    excludeOverlayApplied: excludeOverlay,
+  }
+}
+
+/** Hop-rates для карты сети: те же фильтры, что у общего NetFlow (dedup / mesh / overlay). */
+export function buildFlowMapHops(q: FlowMapHopsQuery): FlowMapHopsDto {
+  const minSharePct = resolveMinSharePct(q)
+  const key = hopsQueryKey(q, minSharePct)
+  const now = Date.now()
+  if (hopsCache && hopsCache.key === key && now - hopsCache.at < HOPS_CACHE_TTL_MS) {
+    return hopsCache.dto
+  }
+  const dto = buildFlowMapHopsUncached(q, minSharePct)
+  hopsCache = { key, at: now, dto }
+  return dto
+}

backend/src/services/traffic-flow-overlay.ts

@@ -97,6 +97,32 @@ async function ensureWgInputAccept(client: MikrotikClient, listenPort: number):
 /** Официальный авто-source UDP IPFIX, не фильтр 0.0.0.0/0. */
 export const FLOW_TARGET_SRC_AUTO = "0.0.0.0"
 
+async function ensureIpfixFields(client: MikrotikClient): Promise<void> {
+  const body = toRosBody({
+    bytes: "yes",
+    packets: "yes",
+    "src-address": "yes",
+    "dst-address": "yes",
+    protocol: "yes",
+    "src-port": "yes",
+    "dst-port": "yes",
+    "in-interface": "yes",
+    "out-interface": "yes",
+    gateway: "yes",
+    "first-forwarded": "yes",
+    "last-forwarded": "yes",
+    "nat-src-address": "yes",
+    "nat-dst-address": "yes",
+  })
+  const rows = asRosArray<Record<string, unknown>>(await client.get("/ip/traffic-flow/ipfix"))
+  const id = rows[0] ? rosRowId(rows[0]) : ""
+  if (id) {
+    await patchRosPath(client, `/ip/traffic-flow/ipfix/${encodeRosId(id)}`, body)
+    return
+  }
+  await client.post("/ip/traffic-flow/ipfix/set", body)
+}
+
 async function ensureTrafficFlow(
   client: MikrotikClient,
   collectorIp: string,
@@ -116,6 +142,12 @@ async function ensureTrafficFlow(
     await client.post("/ip/traffic-flow/set", body)
   }
 
+  try {
+    await ensureIpfixFields(client)
+  } catch {
+    /* поля IPFIX опциональны на старых ROS */
+  }
+
   const targets = asRosArray<Record<string, unknown>>(await client.get("/ip/traffic-flow/target"))
   const existing = targets.find((t) => String(t["dst-address"] ?? "") === collectorIp)
   const targetBody = toRosBody({

backend/src/services/traffic-flow-parse.test.ts

@@ -96,10 +96,92 @@ resetFlowTemplatesForTests()
   parseFlowPacket(tpl, "10.255.254.3")
   const named = parseFlowPacket(data, "10.255.254.3")
   assert.equal(named.length, 1)
-  assert.equal(named[0]?.inIface, "ether1")
+  assert.equal(named[0]?.inIface, "13")
   assert.equal(named[0]?.src, "10.1.1.8")
 }
 
+resetFlowTemplatesForTests()
+{
+  const tpl = Buffer.alloc(16 + 20)
+  tpl.writeUInt16BE(10, 0)
+  tpl.writeUInt16BE(tpl.length, 2)
+  tpl.writeUInt16BE(2, 16)
+  tpl.writeUInt16BE(20, 18)
+  tpl.writeUInt16BE(256, 20)
+  tpl.writeUInt16BE(3, 22)
+  tpl.writeUInt16BE(8, 24)
+  tpl.writeUInt16BE(4, 26)
+  tpl.writeUInt16BE(12, 28)
+  tpl.writeUInt16BE(4, 30)
+  tpl.writeUInt16BE(82, 32)
+  tpl.writeUInt16BE(6, 34)
+  const data = Buffer.alloc(16 + 18)
+  data.writeUInt16BE(10, 0)
+  data.writeUInt16BE(data.length, 2)
+  data.writeUInt16BE(256, 16)
+  data.writeUInt16BE(18, 18)
+  data[20] = 10; data[21] = 1; data[22] = 1; data[23] = 8
+  data[24] = 8; data[25] = 8; data[26] = 8; data[27] = 8
+  data.write("ether1", 28)
+  parseFlowPacket(tpl, "10.255.254.4")
+  const namedOnly = parseFlowPacket(data, "10.255.254.4")
+  assert.equal(namedOnly[0]?.inIface, "ether1")
+}
+
+resetFlowTemplatesForTests()
+{
+  const fieldSpecs: Array<[number, number]> = [
+    [8, 4],
+    [12, 4],
+    [10, 4],
+    [14, 4],
+    [15, 4],
+    [152, 8],
+    [153, 8],
+    [1, 4],
+  ]
+  const tplSetLen = 4 + 4 + fieldSpecs.length * 4
+  const tpl = Buffer.alloc(16 + tplSetLen)
+  tpl.writeUInt16BE(10, 0)
+  tpl.writeUInt16BE(tpl.length, 2)
+  tpl.writeUInt16BE(2, 16)
+  tpl.writeUInt16BE(tplSetLen, 18)
+  tpl.writeUInt16BE(256, 20)
+  tpl.writeUInt16BE(fieldSpecs.length, 22)
+  let off = 24
+  for (const [type, len] of fieldSpecs) {
+    tpl.writeUInt16BE(type, off)
+    tpl.writeUInt16BE(len, off + 2)
+    off += 4
+  }
+  const recLen = fieldSpecs.reduce((n, [, len]) => n + len, 0)
+  const data = Buffer.alloc(16 + 4 + recLen)
+  data.writeUInt16BE(10, 0)
+  data.writeUInt16BE(data.length, 2)
+  data.writeUInt16BE(256, 16)
+  data.writeUInt16BE(4 + recLen, 18)
+  let d = 20
+  data[d] = 10; data[d + 1] = 100; data[d + 2] = 1; data[d + 3] = 17; d += 4
+  data[d] = 173; data[d + 1] = 194; data[d + 2] = 160; data[d + 3] = 163; d += 4
+  data.writeUInt32BE(13, d); d += 4
+  data.writeUInt32BE(42, d); d += 4
+  data[d] = 198; data[d + 1] = 51; data[d + 2] = 100; data[d + 3] = 1; d += 4
+  data.writeBigUInt64BE(1_700_000_000_000n, d); d += 8
+  data.writeBigUInt64BE(1_700_000_060_000n, d); d += 8
+  data.writeUInt32BE(1500, d)
+  parseFlowPacket(tpl, "10.255.254.5")
+  const extra = parseFlowPacket(data, "10.255.254.5")
+  assert.equal(extra.length, 1)
+  assert.equal(extra[0]?.src, "10.100.1.17")
+  assert.equal(extra[0]?.dst, "173.194.160.163")
+  assert.equal(extra[0]?.inIface, "13")
+  assert.equal(extra[0]?.outIface, "42")
+  assert.equal(extra[0]?.nextHop, "198.51.100.1")
+  assert.equal(extra[0]?.flowStartMs, 1_700_000_000_000)
+  assert.equal(extra[0]?.flowEndMs, 1_700_000_060_000)
+  assert.equal(extra[0]?.bytes, 1500)
+}
+
 resetFlowTemplatesForTests()
 {
   const tpl = Buffer.alloc(16 + 16 + 20)

backend/src/services/traffic-flow-parse.ts

@@ -8,6 +8,49 @@ export interface ParsedFlow {
   packets: number
   inIface: string
   outIface: string
+  nextHop: string
+  flowStartMs: number
+  flowEndMs: number
+  natSrc: string
+  natDst: string
+}
+
+export type ParsedFlowInput = Partial<ParsedFlow> & Pick<ParsedFlow, "src" | "dst" | "proto" | "bytes">
+
+export function emptyParsedFlow(): ParsedFlow {
+  return {
+    src: "",
+    dst: "",
+    proto: 0,
+    srcPort: 0,
+    dstPort: 0,
+    bytes: 0,
+    packets: 0,
+    inIface: "",
+    outIface: "",
+    nextHop: "",
+    flowStartMs: 0,
+    flowEndMs: 0,
+    natSrc: "",
+    natDst: "",
+  }
+}
+
+export function normalizeParsedFlow(flow: ParsedFlowInput): ParsedFlow {
+  return {
+    ...emptyParsedFlow(),
+    ...flow,
+    nextHop: flow.nextHop ?? "",
+    flowStartMs: flow.flowStartMs ?? 0,
+    flowEndMs: flow.flowEndMs ?? 0,
+    natSrc: flow.natSrc ?? "",
+    natDst: flow.natDst ?? "",
+    inIface: flow.inIface ?? "",
+    outIface: flow.outIface ?? "",
+    srcPort: flow.srcPort ?? 0,
+    dstPort: flow.dstPort ?? 0,
+    packets: flow.packets ?? 0,
+  }
 }
 
 interface FieldSpec {
@@ -105,7 +148,7 @@ function parseNetflowV5(buf: Buffer): ParsedFlow[] {
   const out: ParsedFlow[] = []
   let off = 24
   for (let i = 0; i < count && off + 48 <= buf.length; i++) {
-    out.push({
+    out.push(normalizeParsedFlow({
       src: ipv4(buf, off),
       dst: ipv4(buf, off + 4),
       packets: buf.readUInt32BE(off + 16),
@@ -115,7 +158,7 @@ function parseNetflowV5(buf: Buffer): ParsedFlow[] {
       proto: buf.readUInt8(off + 38),
       inIface: String(buf.readUInt16BE(off + 12)),
       outIface: String(buf.readUInt16BE(off + 14)),
-    })
+    }))
     off += 48
   }
   return out
@@ -166,6 +209,11 @@ function recordFromFields(
   let inIface = ""
   let outIface = ""
   let ifaceName = ""
+  let nextHop = ""
+  let flowStartMs = 0
+  let flowEndMs = 0
+  let natSrc = ""
+  let natDst = ""
   for (const f of fields) {
     const field = consumeField(buf, off, f.length, limit)
     if (!field) return null
@@ -183,11 +231,26 @@ function recordFromFields(
       case 28:
         if (data.length === 16 && !dst) dst = ipv6(data, 0)
         break
+      case 15:
+        if (data.length === 4 && !nextHop) nextHop = ipv4(data, 0)
+        break
+      case 18:
+        if (data.length === 4 && !nextHop) nextHop = ipv4(data, 0)
+        break
+      case 62:
+        if (data.length === 16 && !nextHop) nextHop = ipv6(data, 0)
+        break
       case 225:
-        if (data.length === 4 && !src) src = ipv4(data, 0)
+        if (data.length === 4) {
+          natSrc = ipv4(data, 0)
+          if (!src) src = natSrc
+        }
         break
       case 226:
-        if (data.length === 4 && !dst) dst = ipv4(data, 0)
+        if (data.length === 4) {
+          natDst = ipv4(data, 0)
+          if (!dst) dst = natDst
+        }
         break
       case 4:
         proto = readUint(data, 0, data.length)
@@ -216,6 +279,24 @@ function recordFromFields(
       case 14:
         outIface = String(readUint(data, 0, data.length))
         break
+      case 21:
+        if (!flowEndMs) flowEndMs = readUint(data, 0, data.length)
+        break
+      case 22:
+        if (!flowStartMs) flowStartMs = readUint(data, 0, data.length)
+        break
+      case 150:
+        if (!flowStartMs) flowStartMs = readUint(data, 0, data.length) * 1000
+        break
+      case 151:
+        if (!flowEndMs) flowEndMs = readUint(data, 0, data.length) * 1000
+        break
+      case 152:
+        flowStartMs = readUint(data, 0, data.length)
+        break
+      case 153:
+        flowEndMs = readUint(data, 0, data.length)
+        break
       case 82:
         ifaceName = data.toString("utf8").replace(/\0/g, "").trim()
         break
@@ -224,8 +305,13 @@ function recordFromFields(
     }
     off = field.next
   }
-  if (ifaceName) inIface = ifaceName
-  return { flow: { src, dst, proto, srcPort, dstPort, bytes, packets, inIface, outIface }, next: off }
+  if (ifaceName && !inIface) inIface = ifaceName
+  return {
+    flow: normalizeParsedFlow({
+      src, dst, proto, srcPort, dstPort, bytes, packets, inIface, outIface, nextHop, flowStartMs, flowEndMs, natSrc, natDst,
+    }),
+    next: off,
+  }
 }
 
 function parseDataRecords(

backend/src/services/traffic-flow-planes.test.ts

@@ -0,0 +1,82 @@
+import assert from "node:assert/strict"
+import {
+  classifyFlowPlane,
+  classifyFlowPlaneLite,
+  flowBps,
+  shouldKeepPlane,
+} from "./traffic-flow-planes.js"
+
+const youtubeInner = {
+  src: "10.100.1.17",
+  dst: "173.194.160.163",
+  proto: 6,
+  srcPort: 51234,
+  dstPort: 443,
+  inIface: "gre-client",
+  outIface: "NSK-SERVHOST-RTK",
+}
+assert.equal(classifyFlowPlaneLite(youtubeInner), "payload")
+assert.equal(classifyFlowPlane(youtubeInner), "payload")
+
+const greOverlay = {
+  src: "203.0.113.10",
+  dst: "198.51.100.1",
+  proto: 47,
+  srcPort: 0,
+  dstPort: 0,
+  inIface: "ether1",
+  outIface: "NSK-SERVHOST-RTK",
+}
+assert.equal(classifyFlowPlaneLite(greOverlay), "overlay")
+
+const espOverlay = { ...greOverlay, proto: 50 }
+assert.equal(classifyFlowPlaneLite(espOverlay), "overlay")
+
+const mesh = {
+  src: "10.100.1.17",
+  dst: "10.100.1.18",
+  proto: 6,
+  srcPort: 50000,
+  dstPort: 443,
+  inIface: "gre-a",
+  outIface: "gre-b",
+}
+assert.equal(classifyFlowPlaneLite(mesh), "client_mesh")
+
+const mgmt = {
+  src: "10.255.254.2",
+  dst: "10.255.254.1",
+  proto: 17,
+  srcPort: 4739,
+  dstPort: 4739,
+  inIface: "wg-flow",
+  outIface: "",
+}
+assert.equal(classifyFlowPlaneLite(mgmt), "mgmt")
+assert.equal(classifyFlowPlaneLite({ ...youtubeInner, outIface: "wg-flow" }), "payload")
+assert.equal(shouldKeepPlane("mgmt", {}), false)
+assert.equal(shouldKeepPlane("overlay", {}), false)
+assert.equal(shouldKeepPlane("client_mesh", {}), false)
+assert.equal(shouldKeepPlane("payload", {}), true)
+assert.equal(shouldKeepPlane("overlay", { excludeOverlay: false }), true)
+assert.equal(shouldKeepPlane("client_mesh", { excludeMesh: false }), true)
+
+assert.equal(flowBps(1500, 1_000, 2_000, 300), (1500 * 8) / 1)
+assert.equal(flowBps(1500, 0, 0, 300), (1500 * 8) / 300)
+
+const publicJhEn = {
+  src: "203.0.113.10",
+  dst: "198.51.100.1",
+  proto: 6,
+  srcPort: 1000,
+  dstPort: 443,
+  inIface: "ether1",
+  outIface: "gre-en",
+}
+assert.equal(classifyFlowPlane(publicJhEn, {
+  clientIfaceNames: new Set(["gre-client"]),
+  enHosts: new Set(["198.51.100.1"]),
+  jhHosts: new Set(["203.0.113.10"]),
+}), "overlay")
+
+console.log("traffic-flow-planes.test.ts: ok")

backend/src/services/traffic-flow-planes.ts

@@ -0,0 +1,107 @@
+export type FlowPlane = "payload" | "client_mesh" | "overlay" | "mgmt"
+
+export const PLANE_LABEL: Record<FlowPlane, string> = {
+  payload: "Интернет",
+  client_mesh: "Клиенты",
+  overlay: "JH↔EN",
+  mgmt: "mgmt",
+}
+
+const WG_PORTS = new Set([51820, 13232, 51821])
+const FLOW_PORTS = new Set([4739, 2055])
+
+export function isRfc1918(ip: string): boolean {
+  const parts = String(ip ?? "").split(".").map((n) => Number.parseInt(n, 10))
+  if (parts.length !== 4 || parts.some((n) => !Number.isFinite(n))) return false
+  const [a, b] = parts
+  if (a === 10) return true
+  if (a === 192 && b === 168) return true
+  if (a === 172 && b != null && b >= 16 && b <= 31) return true
+  if (a === 100 && b != null && b >= 64 && b <= 127) return true
+  return false
+}
+
+export function isPublicV4(ip: string): boolean {
+  const parts = String(ip ?? "").split(".").map((n) => Number.parseInt(n, 10))
+  if (parts.length !== 4 || parts.some((n) => !Number.isFinite(n))) return false
+  const a = parts[0] ?? 0
+  if (a === 0 || a === 127 || a >= 224) return false
+  return !isRfc1918(ip)
+}
+
+export function isTunnelProto(proto: number, srcPort: number, dstPort: number): boolean {
+  if (proto === 47 || proto === 50) return true
+  if (proto === 17 && (WG_PORTS.has(srcPort) || WG_PORTS.has(dstPort))) return true
+  return false
+}
+
+function ifaceLooksMgmt(name: string): boolean {
+  const n = name.trim().toLowerCase()
+  return n === "wg-flow" || n.endsWith("/wg-flow") || n.includes("wg-flow")
+}
+
+export interface PlaneFlowInput {
+  src: string
+  dst: string
+  proto: number
+  srcPort: number
+  dstPort: number
+  inIface: string
+  outIface?: string
+}
+
+/** Быстрая классификация без топологии — для live ring на ingest. */
+export function classifyFlowPlaneLite(flow: PlaneFlowInput): FlowPlane {
+  if (ifaceLooksMgmt(flow.inIface)) return "mgmt"
+  if (flow.proto === 17 && (FLOW_PORTS.has(flow.srcPort) || FLOW_PORTS.has(flow.dstPort))) return "mgmt"
+  if (isTunnelProto(flow.proto, flow.srcPort, flow.dstPort)) return "overlay"
+  if (isRfc1918(flow.src) && isRfc1918(flow.dst)) return "client_mesh"
+  return "payload"
+}
+
+export interface PlaneTopology {
+  clientIfaceNames: Set<string>
+  enHosts: Set<string>
+  jhHosts: Set<string>
+}
+
+function hostHit(ip: string, hosts: Set<string>): boolean {
+  return Boolean(ip) && hosts.has(ip)
+}
+
+export function classifyFlowPlane(
+  flow: PlaneFlowInput,
+  topo?: PlaneTopology | null,
+): FlowPlane {
+  const lite = classifyFlowPlaneLite(flow)
+  if (!topo) return lite
+  if (lite === "mgmt") return "mgmt"
+  if (lite === "overlay") return "overlay"
+  const srcEn = hostHit(flow.src, topo.enHosts) || hostHit(flow.src, topo.jhHosts)
+  const dstEn = hostHit(flow.dst, topo.enHosts) || hostHit(flow.dst, topo.jhHosts)
+  if (srcEn && dstEn && isPublicV4(flow.src) && isPublicV4(flow.dst)) return "overlay"
+  if (lite === "client_mesh") {
+    const inClient = topo.clientIfaceNames.has(flow.inIface)
+    const outClient = Boolean(flow.outIface && topo.clientIfaceNames.has(flow.outIface))
+    if (inClient || outClient || (isRfc1918(flow.src) && isRfc1918(flow.dst))) return "client_mesh"
+  }
+  return "payload"
+}
+
+export function shouldKeepPlane(
+  plane: FlowPlane,
+  opts: { excludeMesh?: boolean; excludeOverlay?: boolean },
+): boolean {
+  if (plane === "mgmt") return false
+  if (opts.excludeMesh !== false && plane === "client_mesh") return false
+  if (opts.excludeOverlay !== false && plane === "overlay") return false
+  return true
+}
+
+export function flowBps(bytes: number, startMs: number, endMs: number, windowSec: number): number {
+  if (startMs > 0 && endMs > startMs) {
+    const sec = Math.max(1, (endMs - startMs) / 1000)
+    return (bytes * 8) / sec
+  }
+  return (bytes * 8) / Math.max(1, windowSec)
+}

backend/src/services/traffic-flow-purge.test.ts

@@ -0,0 +1,77 @@
+import assert from "node:assert/strict"
+import { mkdtempSync, rmSync } from "node:fs"
+import os from "node:os"
+import path from "node:path"
+
+const dir = mkdtempSync(path.join(os.tmpdir(), "mm-flow-purge-"))
+process.env.DATABASE_PATH = path.join(dir, "test.db")
+
+const { sqliteDatabase } = await import("../db/index.js")
+const {
+  getFlowRuntimeCounters,
+  purgeTrafficFlowStore,
+  stopTrafficFlowListener,
+} = await import("./traffic-flow-ingest.js")
+
+function count(name: string): number {
+  const row = sqliteDatabase.prepare(`SELECT COUNT(*) AS n FROM ${name}`).get() as { n: number }
+  return Number(row?.n) || 0
+}
+
+try {
+  sqliteDatabase.prepare(`
+    INSERT INTO servers (name, host) VALUES ('purge-test', '127.0.0.1')
+  `).run()
+  const serverId = Number(
+    (sqliteDatabase.prepare(`SELECT id FROM servers WHERE name = 'purge-test'`).get() as { id: number }).id,
+  )
+  sqliteDatabase.prepare(`
+    INSERT INTO flow_buckets (server_id, bucket_at, src, dst, proto, src_port, dst_port, bytes, packets, in_iface)
+    VALUES (?, '2026-01-01T00:00:00.000Z', '10.0.0.1', '8.8.8.8', 6, 50000, 443, 100, 1, 'wg-flow')
+  `).run(serverId)
+  sqliteDatabase.prepare(`
+    INSERT INTO flow_minute_stats (server_id, bucket_at, bytes, packets, unique_src, unique_dst, conversations)
+    VALUES (?, '2026-01-01T00:00:00.000Z', 100, 1, 1, 1, 1)
+  `).run(serverId)
+  sqliteDatabase.prepare(`
+    INSERT INTO flow_minute_dims (server_id, bucket_at, dim, key, bytes, packets)
+    VALUES (?, '2026-01-01T00:00:00.000Z', 'country', 'RU', 100, 1)
+  `).run(serverId)
+  sqliteDatabase.prepare(`
+    INSERT INTO flow_daily_dims (server_id, day, dim, key, bytes, packets)
+    VALUES (?, '2026-01-01', 'country', 'RU', 100, 1)
+  `).run(serverId)
+  sqliteDatabase.prepare(`
+    INSERT INTO flow_ip_meta (prefix, asn, country, holder, ok, fetched_at)
+    VALUES ('8.8.8.0/24', 15169, 'US', 'Google', 1, '2026-01-01T00:00:00.000Z')
+  `).run()
+  sqliteDatabase.prepare(`
+    UPDATE traffic_flow_settings SET packets_received = 42, last_exporter_ip = '10.255.254.3' WHERE id = 1
+  `).run()
+
+  const result = await purgeTrafficFlowStore()
+  stopTrafficFlowListener()
+
+  assert.equal(result.ok, true)
+  assert.equal(result.deleted.buckets, 1)
+  assert.equal(result.deleted.minuteStats, 1)
+  assert.equal(result.deleted.minuteDims, 1)
+  assert.equal(result.deleted.dailyDims, 1)
+  assert.equal(count("flow_buckets"), 0)
+  assert.equal(count("flow_minute_stats"), 0)
+  assert.equal(count("flow_minute_dims"), 0)
+  assert.equal(count("flow_daily_dims"), 0)
+  assert.equal(count("flow_ip_meta"), 1)
+  assert.equal(count("servers"), 1)
+  assert.equal(getFlowRuntimeCounters().packetsReceived, 0)
+  assert.equal(getFlowRuntimeCounters().lastExporterIp, null)
+} finally {
+  try {
+    sqliteDatabase.close()
+  } catch {
+    /* ignore */
+  }
+  rmSync(dir, { recursive: true, force: true })
+}
+
+console.log("traffic-flow-purge.test.ts: ok")

backend/src/services/traffic-flow-ripe.test.ts

@@ -7,6 +7,7 @@ import {
   lookupRipeCached,
   resetRipeCacheForTests,
   ripeFetchCountForTests,
+  ripeLastCandidateCountForTests,
   seedRipeCacheForTests,
   setRipeFetchForTests,
 } from "./traffic-flow-ripe.js"
@@ -100,4 +101,36 @@ await flushRipeQueueForTests()
 assert.equal(lookupRipeCached("1.0.0.1")?.country, "US")
 assert.equal(lookupRipeCached("1.0.0.1")?.asn, 13335)
 
+resetRipeCacheForTests()
+disableRipePersistForTests()
+for (let i = 0; i < 3000; i++) {
+  const o2 = Math.floor(i / 256)
+  const o3 = i % 256
+  seedRipeCacheForTests({
+    prefix: `203.${o2}.${o3}.0/24`,
+    asn: 64500,
+    country: "NL",
+    lat: null,
+    lng: null,
+    holder: "NOISE",
+    ok: true,
+    fetchedAt: Date.now(),
+  })
+}
+seedRipeCacheForTests({
+  prefix: "8.8.8.0/24",
+  asn: 15169,
+  country: "US",
+  lat: null,
+  lng: null,
+  holder: "GOOGLE",
+  ok: true,
+  fetchedAt: Date.now(),
+})
+assert.equal(lookupRipeCached("8.8.8.8")?.asn, 15169)
+assert.ok(
+  ripeLastCandidateCountForTests() < 8,
+  `index should not scan all prefixes, got ${ripeLastCandidateCountForTests()}`,
+)
+
 console.log("traffic-flow-ripe.test.ts: ok")

backend/src/services/traffic-flow-ripe.ts

@@ -1,5 +1,5 @@
 import { sqliteDatabase } from "../db/index.js"
-import { ipInCidrV4, ipv4ToInt, isNonPublicIp, parseCidrV4 } from "./traffic-flow-ip.js"
+import { ipv4ToInt, isNonPublicIp, parseCidrV4 } from "./traffic-flow-ip.js"
 import { resolveRipeCountry } from "./traffic-flow-brands.js"
 
 export interface FlowIpMeta {
@@ -28,6 +28,18 @@ const queue: string[] = []
 const queued = new Set<string>()
 const recentFetches: number[] = []
 
+interface RipeIndexed {
+  entry: FlowIpMeta
+  net: number
+  mask: number
+  prefixLen: number
+}
+
+/** /24 → кандидаты с prefixLen ≥ 24. Более широкие префиксы — в `wideIndex`. */
+const v24Index = new Map<number, RipeIndexed[]>()
+const wideIndex: RipeIndexed[] = []
+let lastCandidateCount = 0
+
 let persistEnabled = true
 let enqueueEnabled = true
 let loaded = false
@@ -50,6 +62,9 @@ export function resetRipeCacheForTests(): void {
   queue.length = 0
   queued.clear()
   recentFetches.length = 0
+  v24Index.clear()
+  wideIndex.length = 0
+  lastCandidateCount = 0
   loaded = persistEnabled ? false : true
   workerRunning = false
   fetchCount = 0
@@ -58,10 +73,15 @@ export function resetRipeCacheForTests(): void {
 }
 
 export function seedRipeCacheForTests(entry: FlowIpMeta): void {
-  mem.set(entry.prefix, { ...entry })
+  remember(entry)
   loaded = true
 }
 
+/** Сколько CIDR смотрели в последнем lookup (для теста индекса /24). */
+export function ripeLastCandidateCountForTests(): number {
+  return lastCandidateCount
+}
+
 export function setRipeFetchForTests(fn: typeof fetch): void {
   fetchImpl = fn
   fetchCount = 0
@@ -87,6 +107,48 @@ function isFresh(entry: FlowIpMeta): boolean {
   return Date.now() - entry.fetchedAt < ttlMs(entry.ok)
 }
 
+function unindexPrefix(prefix: string): void {
+  const parsed = parseCidrV4(prefix)
+  if (!parsed) return
+  if (parsed.prefixLen >= 24) {
+    const key = parsed.net >>> 8
+    const list = v24Index.get(key)
+    if (!list) return
+    const next = list.filter((row) => row.entry.prefix !== prefix)
+    if (next.length) v24Index.set(key, next)
+    else v24Index.delete(key)
+    return
+  }
+  const idx = wideIndex.findIndex((row) => row.entry.prefix === prefix)
+  if (idx >= 0) wideIndex.splice(idx, 1)
+}
+
+function indexEntry(entry: FlowIpMeta): void {
+  const parsed = parseCidrV4(entry.prefix)
+  if (!parsed) return
+  const row: RipeIndexed = {
+    entry,
+    net: parsed.net,
+    mask: parsed.mask,
+    prefixLen: parsed.prefixLen,
+  }
+  if (parsed.prefixLen >= 24) {
+    const key = parsed.net >>> 8
+    const list = v24Index.get(key)
+    if (list) list.push(row)
+    else v24Index.set(key, [row])
+    return
+  }
+  wideIndex.push(row)
+}
+
+function remember(entry: FlowIpMeta): void {
+  const prev = mem.get(entry.prefix)
+  if (prev) unindexPrefix(prev.prefix)
+  mem.set(entry.prefix, entry)
+  indexEntry(entry)
+}
+
 function loadSqlite(): void {
   if (loaded || !persistEnabled) {
     loaded = true
@@ -111,7 +173,7 @@ function loadSqlite(): void {
       const fetchedAt = Date.parse(r.fetched_at)
       const asn = Number(r.asn ?? 0) || 0
       const holder = r.holder || ""
-      mem.set(r.prefix, {
+      remember({
         prefix: r.prefix,
         asn,
         country: resolveRipeCountry(r.country || "", asn, holder) || "—",
@@ -193,20 +255,24 @@ function negative(prefix: string): FlowIpMeta {
 export function lookupRipeCached(ip: string): FlowIpMeta | null {
   loadSqlite()
   const trimmed = String(ip ?? "").trim()
+  lastCandidateCount = 0
   if (!trimmed) return null
   if (isNonPublicIp(trimmed)) {
     return negative(`${trimmed.includes(":") ? trimmed : trimmed}/32`)
   }
+  const addr = ipv4ToInt(trimmed)
+  if (addr == null) return null
+  const bucket = v24Index.get(addr >>> 8)
+  const candidates = bucket ? bucket.concat(wideIndex) : wideIndex
+  lastCandidateCount = candidates.length
   let best: FlowIpMeta | null = null
   let bestLen = -1
-  for (const entry of mem.values()) {
-    if (!isFresh(entry)) continue
-    const parsed = parseCidrV4(entry.prefix)
-    if (!parsed) continue
-    if (!ipInCidrV4(trimmed, entry.prefix)) continue
-    if (parsed.prefixLen > bestLen) {
-      best = entry
-      bestLen = parsed.prefixLen
+  for (const row of candidates) {
+    if (!isFresh(row.entry)) continue
+    if (((addr & row.mask) >>> 0) !== row.net) continue
+    if (row.prefixLen > bestLen) {
+      best = row.entry
+      bestLen = row.prefixLen
     }
   }
   return best
@@ -316,13 +382,13 @@ async function resolveIp(ip: string): Promise<FlowIpMeta | null> {
         ok: Boolean(asn || country),
         fetchedAt: Date.now(),
       }
-      mem.set(prefix, entry)
+      remember(entry)
       persist(entry)
       return entry
     } catch {
       const prefix = `${ip}/32`
       const entry = negative(prefix)
-      mem.set(prefix, entry)
+      remember(entry)
       persist(entry)
       return entry
     } finally {

backend/src/services/traffic-flow-settings.ts

@@ -53,6 +53,7 @@ export function toTrafficFlowSettingsDto(
     hubServerId: row.hubServerId ?? null,
     retentionHours: row.retentionHours,
     topN: row.topN,
+    mapServiceMinSharePct: Number(row.mapServiceMinSharePct ?? 5),
     lastDatagramAt: row.lastDatagramAt ?? null,
     lastExporterIp: row.lastExporterIp ?? null,
     lastError: row.lastError || null,
@@ -75,6 +76,9 @@ export function updateTrafficFlowSettings(patch: TrafficFlowSettingsPatch) {
     hubServerId: patch.hubServerId === undefined ? row.hubServerId : patch.hubServerId,
     retentionHours: patch.retentionHours ?? row.retentionHours,
     topN: patch.topN ?? row.topN,
+    mapServiceMinSharePct: patch.mapServiceMinSharePct == null
+      ? row.mapServiceMinSharePct
+      : Math.min(100, Math.max(0, patch.mapServiceMinSharePct)),
     updatedAt: nowIso(),
   }).where(eq(trafficFlowSettings.id, 1)).run()
   return getTrafficFlowSettingsRow()
@@ -131,3 +135,13 @@ export function enableTrafficFlowIngest() {
 export function listHostPeers(): FlowHostPeer[] {
   return parsePeers(getTrafficFlowSettingsRow().peersJson)
 }
+
+export function resetFlowIngestCounters(): void {
+  db.update(trafficFlowSettings).set({
+    packetsReceived: 0,
+    lastDatagramAt: null,
+    lastExporterIp: null,
+    lastError: "",
+    updatedAt: nowIso(),
+  }).where(eq(trafficFlowSettings.id, 1)).run()
+}

backend/src/services/traffic-flow-topology.ts

@@ -0,0 +1,164 @@
+import { db, sqliteDatabase } from "../db/index.js"
+import { appUsers, servers, userInterfaceBindings } from "../db/schema.js"
+import { mapRosInterfaceType } from "../modules/users/iface-type.js"
+import type { PlaneTopology } from "./traffic-flow-planes.js"
+
+export interface FlowClientBinding {
+  userId: string
+  login: string
+  name: string
+  serverId: number
+  interfaceName: string
+}
+
+export interface FlowEnNode {
+  id: number
+  name: string
+  hosts: string[]
+}
+
+export interface FlowTopology {
+  clientIfaces: Map<number, Set<string>>
+  clientByIface: Map<string, FlowClientBinding>
+  enNodes: FlowEnNode[]
+  enHosts: Set<string>
+  jhHosts: Set<string>
+  wanIfaces: Map<number, Set<string>>
+  plane: PlaneTopology
+}
+
+let seeded: FlowTopology | null = null
+
+function parseWanUplinks(raw: string): Array<{ iface?: string; ip?: string }> {
+  try {
+    const parsed = JSON.parse(raw || "[]") as unknown
+    return Array.isArray(parsed) ? parsed as Array<{ iface?: string; ip?: string }> : []
+  } catch {
+    return []
+  }
+}
+
+function ifaceKey(serverId: number, name: string): string {
+  return `${serverId}|${name}`
+}
+
+export function loadFlowTopology(): FlowTopology {
+  if (seeded) return seeded
+  const serverRows = db.select().from(servers).all()
+  const users = db.select().from(appUsers).all()
+  const binds = db.select().from(userInterfaceBindings).all()
+  const loginById = new Map(users.map((u) => [u.id, u]))
+  const clientIfaces = new Map<number, Set<string>>()
+  const clientByIface = new Map<string, FlowClientBinding>()
+  const allClientNames = new Set<string>()
+  for (const b of binds) {
+    const set = clientIfaces.get(b.serverId) ?? new Set<string>()
+    set.add(b.interfaceName)
+    clientIfaces.set(b.serverId, set)
+    allClientNames.add(b.interfaceName)
+    const user = loginById.get(b.userId)
+    clientByIface.set(ifaceKey(b.serverId, b.interfaceName), {
+      userId: b.userId,
+      login: user?.login || b.userId,
+      name: user?.name || user?.login || b.userId,
+      serverId: b.serverId,
+      interfaceName: b.interfaceName,
+    })
+  }
+  const enHosts = new Set<string>()
+  const jhHosts = new Set<string>()
+  const enNodes: FlowEnNode[] = []
+  const wanIfaces = new Map<number, Set<string>>()
+  for (const s of serverRows) {
+    const wans = parseWanUplinks(s.wanUplinks)
+    const hosts = [s.host, ...wans.map((w) => String(w.ip ?? "").trim())].filter(Boolean)
+    const wanSet = new Set(wans.map((w) => String(w.iface ?? "").trim()).filter(Boolean))
+    if (wanSet.size) wanIfaces.set(s.id, wanSet)
+    if (s.type === "exit-node") {
+      for (const h of hosts) enHosts.add(h)
+      enNodes.push({ id: s.id, name: s.name || s.host, hosts })
+    }
+    if (s.type === "jump-host") {
+      for (const h of hosts) jhHosts.add(h)
+    }
+  }
+  return {
+    clientIfaces,
+    clientByIface,
+    enNodes,
+    enHosts,
+    jhHosts,
+    wanIfaces,
+    plane: {
+      clientIfaceNames: allClientNames,
+      enHosts,
+      jhHosts,
+    },
+  }
+}
+
+export function seedFlowTopologyForTests(topo: FlowTopology | null): void {
+  seeded = topo
+}
+
+export function resolveClient(
+  topo: FlowTopology,
+  serverId: number,
+  inIfaceName: string,
+): FlowClientBinding | null {
+  return topo.clientByIface.get(ifaceKey(serverId, inIfaceName)) ?? null
+}
+
+export function resolveEn(
+  topo: FlowTopology,
+  nextHop: string,
+  outIfaceName: string,
+): FlowEnNode | null {
+  if (nextHop) {
+    const hit = topo.enNodes.find((n) => n.hosts.includes(nextHop))
+    if (hit) return hit
+  }
+  const needle = outIfaceName.trim().toLowerCase()
+  if (!needle) return null
+  return topo.enNodes.find((n) => {
+    const name = n.name.toLowerCase()
+    const host = (n.hosts[0] ?? "").toLowerCase()
+    return (name && needle.includes(name)) || (host && needle.includes(host.split(".")[0] ?? ""))
+  }) ?? null
+}
+
+export function enGreIfaceNames(topo: FlowTopology, serverId: number, ifaceNames: string[]): string[] {
+  const client = topo.clientIfaces.get(serverId) ?? new Set<string>()
+  return ifaceNames.filter((name) => {
+    if (client.has(name)) return false
+    if (name === "wg-flow") return false
+    return mapRosInterfaceType("", name) === "gre"
+  })
+}
+
+export function latestWireBps(serverId: number, ifaceNames: string[]): { bps: number; bytes: number } {
+  if (!ifaceNames.length) return { bps: 0, bytes: 0 }
+  const placeholders = ifaceNames.map(() => "?").join(",")
+  const rows = sqliteDatabase.prepare(`
+    SELECT interface_name AS name, rx_bps AS rxBps, tx_bps AS txBps, rx_bytes AS rxBytes, tx_bytes AS txBytes
+    FROM traffic_samples
+    WHERE server_id = ? AND interface_name IN (${placeholders})
+    ORDER BY sampled_at DESC
+  `).all(serverId, ...ifaceNames) as Array<{
+    name: string
+    rxBps: number
+    txBps: number
+    rxBytes: number
+    txBytes: number
+  }>
+  const seen = new Set<string>()
+  let bps = 0
+  let bytes = 0
+  for (const r of rows) {
+    if (seen.has(r.name)) continue
+    seen.add(r.name)
+    bps += (Number(r.rxBps) || 0) + (Number(r.txBps) || 0)
+    bytes += (Number(r.rxBytes) || 0) + (Number(r.txBytes) || 0)
+  }
+  return { bps, bytes }
+}

backend/tsconfig.json

@@ -15,5 +15,5 @@
     "sourceMap": true
   },
   "include": ["src/**/*"],
-  "exclude": ["node_modules", "dist"]
+  "exclude": ["node_modules", "dist", "src/**/*.test.ts"]
 }

components/data-grids/traffic-flows-data-grid.tsx

@@ -28,12 +28,19 @@ function TrafficFlowsDataGrid({
 }) {
   const columns = useMemo<ColumnDef<FlowTalkerDto>[]>(
     () => [
+      {
+        id: "client",
+        accessorFn: (r) => r.clientName ?? "",
+        header: () => <span className="text-xs font-medium text-muted-foreground">Клиент</span>,
+        cell: ({ row }) => <span className="text-xs">{row.original.clientName || "—"}</span>,
+        meta: { headerClassName: DATA_GRID_CELL_PAD_FIRST, cellClassName: DATA_GRID_CELL_PAD_FIRST },
+      },
       {
         id: "server",
         accessorKey: "serverName",
         header: () => <span className="text-xs font-medium text-muted-foreground">JH</span>,
         cell: ({ row }) => <span className="text-sm font-medium">{row.original.serverName}</span>,
-        meta: { headerClassName: DATA_GRID_CELL_PAD_FIRST, cellClassName: DATA_GRID_CELL_PAD_FIRST },
+        meta: { headerClassName: DATA_GRID_CELL_PAD, cellClassName: DATA_GRID_CELL_PAD },
       },
       {
         id: "src",
@@ -96,6 +103,20 @@ function TrafficFlowsDataGrid({
         cell: ({ row }) => <span className="text-xs tabular-nums">{formatBytes(row.original.bytes)}</span>,
         meta: { headerClassName: DATA_GRID_CELL_PAD, cellClassName: DATA_GRID_CELL_PAD },
       },
+      {
+        id: "en",
+        accessorFn: (r) => r.enName ?? "",
+        header: () => <span className="text-xs font-medium text-muted-foreground">EN</span>,
+        cell: ({ row }) => <span className="text-xs">{row.original.enName || "—"}</span>,
+        meta: { headerClassName: DATA_GRID_CELL_PAD, cellClassName: DATA_GRID_CELL_PAD },
+      },
+      {
+        id: "plane",
+        accessorFn: (r) => r.plane ?? "",
+        header: () => <span className="text-xs font-medium text-muted-foreground">Плоскость</span>,
+        cell: ({ row }) => <span className="text-xs text-muted-foreground">{row.original.plane || "—"}</span>,
+        meta: { headerClassName: DATA_GRID_CELL_PAD, cellClassName: DATA_GRID_CELL_PAD },
+      },
       {
         id: "iface",
         accessorKey: "inIface",

components/network-map/service-brand-icon.tsx

@@ -0,0 +1,131 @@
+"use client"
+
+import type { ReactNode } from "react"
+
+function slug(label: string): string {
+  return label.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "")
+}
+
+function GenericCloud({ size }: { size: number }) {
+  return (
+    <svg width={size} height={size} viewBox="0 0 24 24" aria-hidden>
+      <path
+        d="M7.5 18h9.2A4.3 4.3 0 0 0 21 13.8a4.2 4.2 0 0 0-3.7-4.2A6.1 6.1 0 0 0 6.2 11 3.8 3.8 0 0 0 3 14.7 3.7 3.7 0 0 0 6.8 18Z"
+        fill="#38bdf8"
+        opacity="0.92"
+      />
+    </svg>
+  )
+}
+
+function BrandSvg({ children, size }: { children: ReactNode; size: number }) {
+  return (
+    <svg width={size} height={size} viewBox="0 0 24 24" aria-hidden>
+      {children}
+    </svg>
+  )
+}
+
+export function ServiceBrandIcon({ label, size = 22 }: { label: string; size?: number }) {
+  switch (slug(label)) {
+    case "cloudflare":
+      return (
+        <BrandSvg size={size}>
+          <path d="M6.2 15.4h12.4c1.6 0 2.6-1.1 2.4-2.4-.2-1.4-1.4-2.1-2.8-2.1-.3-2.4-2.3-4.1-4.8-4.1-1.9 0-3.5 1-4.4 2.5-.4-.2-.9-.3-1.4-.3-1.7 0-3.1 1.3-3.2 3-.1 1.8 1.3 3.4 3.2 3.4Z" fill="#F38020" />
+        </BrandSvg>
+      )
+    case "google":
+      return (
+        <BrandSvg size={size}>
+          <path d="M12 11.2h10.2A10 10 0 1 0 12 22a9.6 9.6 0 0 0 6.6-2.6l-2.7-2.1A5.8 5.8 0 1 1 12 6.2c1.5 0 2.8.5 3.8 1.5l2.6-2.6A9.8 9.8 0 0 0 12 2Z" fill="#4285F4" />
+          <path d="M3.2 7.2 6.6 9.7A5.8 5.8 0 0 1 16 8.2l2.7-2.6A9.8 9.8 0 0 0 3.2 7.2Z" fill="#EA4335" />
+          <path d="M12 22a9.6 9.6 0 0 0 6.6-2.6l-2.7-2.1A5.8 5.8 0 0 1 6.5 14.4L3 17A9.8 9.8 0 0 0 12 22Z" fill="#34A853" />
+          <path d="M21.8 12.2H12v3.6h5.6A5.5 5.5 0 0 1 15.9 17.3l2.7 2.1A9.4 9.4 0 0 0 22 12.2Z" fill="#FBBC05" />
+        </BrandSvg>
+      )
+    case "aws":
+    case "amazon":
+      return (
+        <BrandSvg size={size}>
+          <path d="M6.2 8.2 12 5.4l5.8 2.8v3.4L12 14.6 6.2 11.6Z" fill="#232F3E" />
+          <path d="M5.2 15.6c3.6 2.6 9.8 2.7 13.6 0" fill="none" stroke="#FF9900" strokeWidth="1.8" strokeLinecap="round" />
+        </BrandSvg>
+      )
+    case "steam":
+      return (
+        <BrandSvg size={size}>
+          <circle cx="12" cy="12" r="10" fill="#1b2838" />
+          <circle cx="8.2" cy="14.4" r="3.1" fill="#66c0f4" />
+          <circle cx="15.4" cy="9.2" r="3.6" fill="#c7d5e0" />
+          <circle cx="15.4" cy="9.2" r="1.5" fill="#1b2838" />
+        </BrandSvg>
+      )
+    case "blizzard":
+      return (
+        <BrandSvg size={size}>
+          <path d="M6 5h7.4c3 0 4.8 1.6 4.8 4.1 0 1.8-1 3.1-2.6 3.7 2 .5 3.2 2 3.2 4.1 0 2.8-2.1 4.6-5.6 4.6H6Z" fill="#00AEFF" />
+          <path d="M9.2 8.2h3.4c1.2 0 1.8.6 1.8 1.5s-.6 1.5-1.8 1.5H9.2Zm0 5.2h3.8c1.3 0 2 .6 2 1.6s-.7 1.6-2 1.6H9.2Z" fill="#06121f" />
+        </BrandSvg>
+      )
+    case "youtube":
+      return (
+        <BrandSvg size={size}>
+          <rect x="2" y="6" width="20" height="12" rx="3" fill="#FF0000" />
+          <path d="M10.2 9.2v5.6L15.6 12Z" fill="#fff" />
+        </BrandSvg>
+      )
+    case "netflix":
+      return (
+        <BrandSvg size={size}>
+          <path d="M6 3h3.2l5.6 18H11.6Z" fill="#E50914" />
+          <path d="M14.8 3H18v18h-3.2Z" fill="#B81D24" />
+        </BrandSvg>
+      )
+    case "microsoft":
+      return (
+        <BrandSvg size={size}>
+          <rect x="3" y="3" width="8" height="8" fill="#F25022" />
+          <rect x="13" y="3" width="8" height="8" fill="#7FBA00" />
+          <rect x="3" y="13" width="8" height="8" fill="#00A4EF" />
+          <rect x="13" y="13" width="8" height="8" fill="#FFB900" />
+        </BrandSvg>
+      )
+    case "meta":
+      return (
+        <BrandSvg size={size}>
+          <path d="M4 14.5c1.8-4.2 4-7.5 6.4-7.5 1.6 0 2.5 1.3 4.6 6.3 1.4 3.4 2.2 4.7 3.4 4.7 1.8 0 3.6-2.6 4.6-5" fill="none" stroke="#0081FB" strokeWidth="2.2" strokeLinecap="round" />
+        </BrandSvg>
+      )
+    case "telegram":
+      return (
+        <BrandSvg size={size}>
+          <circle cx="12" cy="12" r="10" fill="#229ED9" />
+          <path d="M7.2 12.1 16.8 8.4 15 16.2l-3.1-1.8-1.6 1.6-.2-2.6Z" fill="#fff" />
+        </BrandSvg>
+      )
+    case "discord":
+      return (
+        <BrandSvg size={size}>
+          <path d="M7.2 5.8 8.6 4.6c2.1.8 4.2 1.2 6.4 1.2h.8L17 5.8c1.8 2.4 2.6 5.4 2.4 8.6-1.6 1.2-3.3 2.1-5.2 2.6L13 15.2c.7-.2 1.3-.6 1.8-1.1-2 .9-4.2.9-6.2 0 .5.5 1.1.9 1.8 1.1L8.8 17c-1.9-.5-3.6-1.4-5.2-2.6C3.4 11.2 4.2 8.2 6 5.8Z" fill="#5865F2" />
+          <circle cx="9.2" cy="11.2" r="1.2" fill="#fff" />
+          <circle cx="14.8" cy="11.2" r="1.2" fill="#fff" />
+        </BrandSvg>
+      )
+    case "twitch":
+      return (
+        <BrandSvg size={size}>
+          <path d="M5 4h14v10.2l-4 4H11l-2.2 2.2H7.2V18.2H5Z" fill="#9146FF" />
+          <path d="M7.4 6.4h1.8v5.2H7.4Zm4 0h1.8v5.2H11.4Z" fill="#fff" />
+        </BrandSvg>
+      )
+    case "tiktok":
+      return (
+        <BrandSvg size={size}>
+          <path d="M14.2 4v9.1a3.3 3.3 0 1 1-2.8-3.3V7.2c1.6.9 3.2 1.4 5 1.5V5.4c-1.4-.1-2.7-.6-3.8-1.4H14.2Z" fill="#25F4EE" />
+          <path d="M13.4 4v9.1a3.3 3.3 0 1 1-2.8-3.3V7.2c1.6.9 3.2 1.4 5 1.5V5.4c-1.4-.1-2.7-.6-3.8-1.4H13.4Z" fill="#FE2C55" transform="translate(1.2 1)" />
+        </BrandSvg>
+      )
+    default:
+      return <GenericCloud size={size} />
+  }
+}

components/traffic/flow-analytics-panel.tsx

@@ -2,10 +2,10 @@
 
 import { useMemo, useState } from "react"
 import { type ColumnDef, getCoreRowModel, useReactTable } from "@tanstack/react-table"
-import type { FlowAnalyticsDto, FlowBreakdownRow, FlowEntityCard, FlowTalkerDto } from "@mmapp/contracts/traffic-flow"
-import { ArrowDownIcon, ArrowUpIcon, GitBranchIcon, GlobeIcon, LayersIcon, UsersIcon } from "lucide-react"
+import type { FlowAnalyticsDto, FlowBreakdownRow, FlowEntityCard, FlowPathRow, FlowTalkerDto } from "@mmapp/contracts/traffic-flow"
+import { ArrowDownIcon, ArrowUpIcon, GitBranchIcon, GlobeIcon, LayersIcon, NetworkIcon, RouteIcon, ShieldIcon, UsersIcon } from "lucide-react"
 import { Badge } from "@/components/reui/badge"
-import { KpiStatGrid } from "@/components/reui-kit/kpi-stat-grid"
+import { KpiStatGrid, type KpiStatItem } from "@/components/reui-kit/kpi-stat-grid"
 import { TrafficRxTxChart } from "@/components/reui-kit/traffic-rx-tx-chart"
 import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs"
 import { Switch } from "@/components/ui/switch"
@@ -110,7 +110,7 @@ export function FlowEntityCardView({
 }
 
 type SessionFilter = {
-  kind: "application" | "category" | "service" | "asn" | "country" | "protocol" | "source" | "destination" | "iface"
+  kind: "application" | "category" | "service" | "asn" | "country" | "protocol" | "source" | "destination" | "iface" | "client" | "en"
   value: string
   label: string
 }
@@ -126,6 +126,8 @@ function talkerMatchesFilter(row: FlowTalkerDto, filter: SessionFilter): boolean
     case "source": return row.src === filter.value
     case "destination": return row.dst === filter.value
     case "iface": return row.inIface === filter.value
+    case "client": return (row.clientId || "unknown") === filter.value
+    case "en": return (row.enId || "") === filter.value
   }
 }
 
@@ -210,6 +212,101 @@ function FlowBreakdownGrid({
   )
 }
 
+function FlowPathsGrid({
+  rows,
+  empty,
+  onPick,
+}: {
+  rows: FlowPathRow[]
+  empty?: string
+  onPick?: (row: FlowPathRow) => void
+}) {
+  const columns = useMemo<ColumnDef<FlowPathRow>[]>(
+    () => [
+      {
+        id: "client",
+        accessorKey: "clientName",
+        header: () => <span className="text-xs font-medium text-muted-foreground">Клиент</span>,
+        cell: ({ row }) => <span className="text-sm font-medium">{row.original.clientName}</span>,
+        meta: { headerClassName: DATA_GRID_CELL_PAD_FIRST, cellClassName: DATA_GRID_CELL_PAD_FIRST },
+      },
+      {
+        id: "ifaces",
+        accessorKey: "ifaces",
+        header: () => <span className="text-xs font-medium text-muted-foreground">Ifaces</span>,
+        cell: ({ row }) => <span className="font-mono text-xs text-muted-foreground">{row.original.ifaces}</span>,
+        meta: { headerClassName: DATA_GRID_CELL_PAD, cellClassName: DATA_GRID_CELL_PAD },
+      },
+      {
+        id: "jh",
+        accessorKey: "serverName",
+        header: () => <span className="text-xs font-medium text-muted-foreground">JH</span>,
+        cell: ({ row }) => <span className="text-xs">{row.original.serverName}</span>,
+        meta: { headerClassName: DATA_GRID_CELL_PAD, cellClassName: DATA_GRID_CELL_PAD },
+      },
+      {
+        id: "in",
+        accessorKey: "inIface",
+        header: () => <span className="text-xs font-medium text-muted-foreground">In</span>,
+        cell: ({ row }) => <span className="font-mono text-xs">{row.original.inIface}</span>,
+        meta: { headerClassName: DATA_GRID_CELL_PAD, cellClassName: DATA_GRID_CELL_PAD },
+      },
+      {
+        id: "en",
+        accessorKey: "enName",
+        header: () => <span className="text-xs font-medium text-muted-foreground">EN</span>,
+        cell: ({ row }) => <span className="text-xs">{row.original.enName || "—"}</span>,
+        meta: { headerClassName: DATA_GRID_CELL_PAD, cellClassName: DATA_GRID_CELL_PAD },
+      },
+      {
+        id: "dst",
+        accessorKey: "dst",
+        header: () => <span className="text-xs font-medium text-muted-foreground">Dest</span>,
+        cell: ({ row }) => (
+          <span className="flex min-w-0 flex-col gap-0.5 text-xs">
+            <span className="font-mono">{row.original.dst}</span>
+            <span className="text-[10px] text-muted-foreground truncate">
+              {[row.original.category, row.original.service].filter(Boolean).join(" · ")}
+            </span>
+          </span>
+        ),
+        meta: { headerClassName: DATA_GRID_CELL_PAD, cellClassName: DATA_GRID_CELL_PAD },
+      },
+      {
+        id: "rate",
+        accessorFn: (r) => r.bps,
+        header: () => <span className="text-xs font-medium text-muted-foreground">Скорость</span>,
+        cell: ({ row }) => <span className="text-xs tabular-nums">{fmtRate(row.original.bps / 1_000_000)}</span>,
+        meta: { headerClassName: DATA_GRID_CELL_PAD, cellClassName: DATA_GRID_CELL_PAD },
+      },
+      {
+        id: "bytes",
+        accessorKey: "bytes",
+        header: () => <span className="text-xs font-medium text-muted-foreground">Байты</span>,
+        cell: ({ row }) => <span className="text-xs tabular-nums">{formatBytes(row.original.bytes)}</span>,
+        meta: { headerClassName: DATA_GRID_CELL_PAD_LAST, cellClassName: DATA_GRID_CELL_PAD_LAST },
+      },
+    ],
+    [],
+  )
+
+  const table = useReactTable({
+    data: rows,
+    columns,
+    getCoreRowModel: getCoreRowModel(),
+    getRowId: (row) => row.id,
+  })
+
+  return (
+    <DataGridShell
+      table={table}
+      recordCount={rows.length}
+      emptyMessage={empty ?? "Нет путей"}
+      onRowClick={onPick}
+    />
+  )
+}
+
 export function FlowAnalyticsDetail({
   card,
   analytics,
@@ -219,6 +316,10 @@ export function FlowAnalyticsDetail({
   onIface,
   dedup,
   onDedup,
+  excludeMesh,
+  onExcludeMesh,
+  excludeOverlay,
+  onExcludeOverlay,
   liveHint,
   emptyHint,
 }: {
@@ -230,6 +331,10 @@ export function FlowAnalyticsDetail({
   onIface: (name: string) => void
   dedup: boolean
   onDedup: (value: boolean) => void
+  excludeMesh: boolean
+  onExcludeMesh: (value: boolean) => void
+  excludeOverlay: boolean
+  onExcludeOverlay: (value: boolean) => void
   liveHint?: string
   emptyHint?: string
 }) {
@@ -276,6 +381,26 @@ export function FlowAnalyticsDetail({
               Без дублей
             </Label>
           </div>
+          <div className="flex items-center gap-2">
+            <Switch
+              id="flow-exclude-overlay"
+              checked={excludeOverlay}
+              onCheckedChange={onExcludeOverlay}
+            />
+            <Label htmlFor="flow-exclude-overlay" className="text-xs text-muted-foreground whitespace-nowrap">
+              Без overlay
+            </Label>
+          </div>
+          <div className="flex items-center gap-2">
+            <Switch
+              id="flow-exclude-mesh"
+              checked={excludeMesh}
+              onCheckedChange={onExcludeMesh}
+            />
+            <Label htmlFor="flow-exclude-mesh" className="text-xs text-muted-foreground whitespace-nowrap">
+              Без mesh
+            </Label>
+          </div>
           <div className="flex gap-1">
             {RANGE_KEYS.map((r) => (
               <button
@@ -344,7 +469,7 @@ export function FlowAnalyticsDetail({
       <div className="mt-4 pt-4 border-t">
         <KpiStatGrid
           aria-label="Скорость потоков"
-          items={[
+          items={([
             {
               id: "bps-now",
               label: "Скорость сейчас",
@@ -355,11 +480,38 @@ export function FlowAnalyticsDetail({
             },
             {
               id: "bytes",
-              label: "Байт за период",
+              label: "Payload",
               value: formatBytes(bytes),
+              hint: "inner IPFIX",
               icon: <ArrowUpIcon className="size-4" />,
               iconClassName: "text-info",
             },
+            {
+              id: "overlay",
+              label: "JH↔EN overlay",
+              value: fmtRate((analytics?.bpsOverlay ?? 0) / 1_000_000),
+              hint: analytics?.bytesOverlay ? formatBytes(analytics.bytesOverlay) : undefined,
+              icon: <ShieldIcon className="size-4" />,
+              iconClassName: "text-warning",
+            },
+            {
+              id: "wire",
+              label: "Wire GRE",
+              value: fmtRate((analytics?.bpsWire ?? 0) / 1_000_000),
+              hint: "счётчик iface",
+              icon: <RouteIcon className="size-4" />,
+              iconClassName: "text-primary",
+            },
+            ...(!excludeMesh
+              ? [{
+                  id: "mesh",
+                  label: "Mesh",
+                  value: formatBytes(analytics?.bytesMesh ?? 0),
+                  hint: "клиент↔клиент",
+                  icon: <NetworkIcon className="size-4" />,
+                  iconClassName: "text-muted-foreground",
+                }]
+              : []),
             {
               id: "flows",
               label: "Сессии",
@@ -384,7 +536,7 @@ export function FlowAnalyticsDetail({
               icon: <LayersIcon className="size-4" />,
               iconClassName: "text-primary",
             },
-          ]}
+          ] satisfies KpiStatItem[])}
         />
       </div>
 
@@ -404,6 +556,7 @@ export function FlowAnalyticsDetail({
             <TabsTrigger value="protocols">Протоколы</TabsTrigger>
             <TabsTrigger value="sources">Источники</TabsTrigger>
             <TabsTrigger value="destinations">Назначения</TabsTrigger>
+            <TabsTrigger value="paths">Пути</TabsTrigger>
             <TabsTrigger value="sessions">Сессии</TabsTrigger>
             <TabsTrigger value="interfaces">Интерфейсы</TabsTrigger>
           </TabsList>
@@ -440,6 +593,20 @@ export function FlowAnalyticsDetail({
           <TabsContent value="destinations">
             <FlowBreakdownGrid rows={analytics?.destinations ?? []} onPick={(row) => pickBreakdown("destination", row)} />
           </TabsContent>
+          <TabsContent value="paths">
+            <FlowPathsGrid
+              rows={analytics?.paths ?? []}
+              empty="Нет путей за период"
+              onPick={(row) => {
+                setSessionFilter({
+                  kind: "client",
+                  value: row.clientId,
+                  label: `${row.clientName} → ${row.enName || row.dst}`,
+                })
+                setSlice("sessions")
+              }}
+            />
+          </TabsContent>
           <TabsContent value="sessions">
             {sessionFilter ? (
               <div className="flex items-center gap-2 mb-2">

components/traffic/netflow-purge-dialog.tsx

@@ -0,0 +1,72 @@
+"use client"
+
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogMedia,
+  AlertDialogTitle,
+} from "@/components/ui/alert-dialog"
+import type { FlowPurgeDto } from "@mmapp/contracts/traffic-flow"
+import { AlertCircleIcon, LoaderCircleIcon } from "lucide-react"
+
+function formatDbFileBytes(n: number): string {
+  if (n < 1024) return `${n} Б`
+  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} КБ`
+  return `${(n / (1024 * 1024)).toFixed(1)} МБ`
+}
+
+export function formatFlowPurgeResult(result: FlowPurgeDto): string {
+  const rows =
+    result.deleted.buckets +
+    result.deleted.minuteStats +
+    result.deleted.minuteDims +
+    result.deleted.dailyDims
+  const vacuumHint = result.vacuumed ? "" : " VACUUM не выполнен."
+  return `Удалено строк: ${rows}. Файл ${formatDbFileBytes(result.fileBytesBefore)} → ${formatDbFileBytes(result.fileBytesAfter)}.${vacuumHint}`
+}
+
+export function NetflowPurgeConfirm({
+  open,
+  busy,
+  onConfirm,
+  onCancel,
+}: {
+  open: boolean
+  busy?: boolean
+  onConfirm: () => void
+  onCancel: () => void
+}) {
+  return (
+    <AlertDialog open={open} onOpenChange={(v) => { if (!v && !busy) onCancel() }}>
+      <AlertDialogContent size="default">
+        <AlertDialogHeader>
+          <AlertDialogMedia className="bg-destructive/10 text-destructive">
+            <AlertCircleIcon />
+          </AlertDialogMedia>
+          <AlertDialogTitle>Сбросить данные NetFlow?</AlertDialogTitle>
+          <AlertDialogDescription>
+            Будут удалены сессии и агрегаты (minute/daily) из SQLite, затем VACUUM.
+            Ключи WireGuard, пиры JH, настройки коллектора и кэш RIPE сохранятся.
+            На время операции приём IPFIX остановится.
+          </AlertDialogDescription>
+        </AlertDialogHeader>
+        <AlertDialogFooter>
+          <AlertDialogCancel disabled={busy} onClick={onCancel}>Отмена</AlertDialogCancel>
+          <AlertDialogAction
+            variant="destructive"
+            disabled={busy}
+            onClick={onConfirm}
+          >
+            {busy ? <LoaderCircleIcon className="size-4 animate-spin" /> : null}
+            {busy ? "Сброс…" : "Сбросить"}
+          </AlertDialogAction>
+        </AlertDialogFooter>
+      </AlertDialogContent>
+    </AlertDialog>
+  )
+}

components/traffic/netflow-settings-panel.tsx

@@ -14,8 +14,10 @@ import {
   generateTrafficFlowKeys,
   getTrafficFlowHostFiles,
   getTrafficFlowSettings,
+  purgeTrafficFlowData,
   putTrafficFlowSettings,
 } from "@/shared/api/traffic-flow"
+import { formatFlowPurgeResult, NetflowPurgeConfirm } from "@/components/traffic/netflow-purge-dialog"
 import { KeyRoundIcon, DownloadIcon, InfoIcon } from "lucide-react"
 
 const HOST_STEPS = [
@@ -45,7 +47,11 @@ function NetflowSettingsPanel({
   const [endpoint, setEndpoint] = useState("")
   const [retention, setRetention] = useState("24")
   const [topN, setTopN] = useState("200")
+  const [shareOn, setShareOn] = useState(true)
+  const [sharePct, setSharePct] = useState("5")
   const [ingestOn, setIngestOn] = useState(false)
+  const [purgeOpen, setPurgeOpen] = useState(false)
+  const [purgeBusy, setPurgeBusy] = useState(false)
 
   const load = useCallback(async () => {
     if (!enabled) return
@@ -58,6 +64,9 @@ function NetflowSettingsPanel({
     setEndpoint(s.publicEndpoint)
     setRetention(String(s.retentionHours))
     setTopN(String(s.topN))
+    const pct = Number(s.mapServiceMinSharePct ?? 5)
+    setShareOn(pct > 0)
+    setSharePct(String(pct > 0 ? pct : 5))
     setIngestOn(s.enabled)
   }, [backendUrl, enabled])
 
@@ -79,6 +88,9 @@ function NetflowSettingsPanel({
         publicEndpoint: endpoint,
         retentionHours: Number.parseInt(retention, 10) || 24,
         topN: Number.parseInt(topN, 10) || 200,
+        mapServiceMinSharePct: shareOn
+          ? Math.min(100, Math.max(1, Number.parseFloat(sharePct) || 5))
+          : 0,
       })
       setSettings(res.settings)
       toast.success("Настройки NetFlow сохранены")
@@ -102,6 +114,20 @@ function NetflowSettingsPanel({
     }
   }
 
+  async function handlePurgeConfirm() {
+    setPurgeBusy(true)
+    try {
+      const result = await purgeTrafficFlowData(backendUrl)
+      toast.success(formatFlowPurgeResult(result))
+      setPurgeOpen(false)
+      await load()
+    } catch (e) {
+      toast.error(e instanceof Error ? e.message : "Не удалось сбросить NetFlow")
+    } finally {
+      setPurgeBusy(false)
+    }
+  }
+
   async function handleExport() {
     setBusy(true)
     try {
@@ -175,6 +201,29 @@ function NetflowSettingsPanel({
           <FormField label="Top-N разговоров">
             <Input value={topN} onChange={(e) => setTopN(e.target.value)} inputMode="numeric" />
           </FormField>
+          <div className="sm:col-span-2 flex flex-col gap-2">
+            <div className="flex items-center gap-3">
+              <FormToggle
+                checked={shareOn}
+                onChange={(on) => {
+                  setShareOn(on)
+                  if (on && (!sharePct || sharePct === "0")) setSharePct("5")
+                }}
+              />
+              <span className="text-sm">Порог доли на карте</span>
+            </div>
+            <FormField
+              label="Минимум % окна"
+              hint="Узел сервиса, если доля байт окна ≥ N%. Выключить — показать все распознанные бренды (макс. 20)"
+            >
+              <Input
+                value={sharePct}
+                onChange={(e) => setSharePct(e.target.value)}
+                inputMode="decimal"
+                disabled={!shareOn}
+              />
+            </FormField>
+          </div>
         </div>
 
         <p className="text-xs text-muted-foreground">
@@ -196,18 +245,35 @@ function NetflowSettingsPanel({
         </div>
 
         <div className="flex flex-wrap gap-2">
-          <Button size="sm" disabled={busy} onClick={() => { void handleSave() }}>
+          <Button size="sm" disabled={busy || purgeBusy} onClick={() => { void handleSave() }}>
             Сохранить NetFlow
           </Button>
-          <Button size="sm" variant="outline" disabled={busy} onClick={() => { void handleKeys() }}>
+          <Button size="sm" variant="outline" disabled={busy || purgeBusy} onClick={() => { void handleKeys() }}>
             <KeyRoundIcon className="size-4" />
             Ключи хоста
           </Button>
-          <Button size="sm" variant="outline" disabled={busy} onClick={() => { void handleExport() }}>
+          <Button size="sm" variant="outline" disabled={busy || purgeBusy} onClick={() => { void handleExport() }}>
             <DownloadIcon className="size-4" />
             wg-quick / compose / firewall
           </Button>
         </div>
+
+        <div className="flex items-center justify-between gap-4 rounded-md border border-destructive/30 px-4 py-3">
+          <div className="min-w-0">
+            <p className="text-sm font-medium">Сбросить данные NetFlow</p>
+            <p className="text-xs text-muted-foreground mt-0.5">
+              Удалит сессии и агрегаты из SQLite, затем VACUUM. Ключи WG и пиры не трогает.
+            </p>
+          </div>
+          <Button
+            size="sm"
+            variant="destructive"
+            disabled={busy || purgeBusy}
+            onClick={() => setPurgeOpen(true)}
+          >
+            Сбросить
+          </Button>
+        </div>
       </OpsPanel>
 
       <CodeExportSheet
@@ -217,6 +283,13 @@ function NetflowSettingsPanel({
         description="wg-quick, фрагмент compose и firewall. Хост, не контейнер backend."
         formats={formats}
       />
+
+      <NetflowPurgeConfirm
+        open={purgeOpen}
+        busy={purgeBusy}
+        onConfirm={() => { void handlePurgeConfirm() }}
+        onCancel={() => { if (!purgeBusy) setPurgeOpen(false) }}
+      />
     </>
   )
 }

hooks/use-flow-live.ts

@@ -23,6 +23,8 @@ export function useFlowLive(opts: {
   userId?: string
   iface?: string
   dedup?: boolean
+  excludeMesh?: boolean
+  excludeOverlay?: boolean
 }): { sample: FlowAnalyticsDto | null; error: string | null } {
   const [sample, setSample] = useState<FlowAnalyticsDto | null>(null)
   const [error, setError] = useState<string | null>(null)
@@ -43,6 +45,8 @@ export function useFlowLive(opts: {
       userId: opts.userId,
       iface: opts.iface,
       dedup: opts.dedup,
+      excludeMesh: opts.excludeMesh,
+      excludeOverlay: opts.excludeOverlay,
     })}`
     const url = resolveApiUrl(opts.backendUrl, path)
 
@@ -87,7 +91,7 @@ export function useFlowLive(opts: {
     })()
 
     return () => ac.abort()
-  }, [opts.enabled, opts.backendUrl, opts.range, opts.serverId, opts.userId, opts.iface, opts.dedup])
+  }, [opts.enabled, opts.backendUrl, opts.range, opts.serverId, opts.userId, opts.iface, opts.dedup, opts.excludeMesh, opts.excludeOverlay])
 
   return { sample, error }
 }

lib/map-netflow-hops.ts

@@ -0,0 +1,103 @@
+import type { FlowMapHop } from "@mmapp/contracts/traffic-flow"
+import { fmtRate } from "@/lib/fmt-rate"
+
+export interface MatchedNetflowHop {
+  bps: number
+  bpsFwd: number
+  bpsRev: number
+  bytes: number
+}
+
+function ifaceNorm(s: string | undefined): string {
+  return (s ?? "").trim().toLowerCase()
+}
+
+function pairKey(a: string, b: string): string {
+  const x = String(a)
+  const y = String(b)
+  return x <= y ? `${x}\t${y}` : `${y}\t${x}`
+}
+
+function mergeDirected(hops: FlowMapHop[], mapFromId: string): MatchedNetflowHop {
+  let bytes = 0
+  let bpsFwd = 0
+  let bpsRev = 0
+  const from = String(mapFromId)
+  for (const h of hops) {
+    bytes += h.bytes
+    if (h.fromId === from) {
+      bpsFwd += h.bpsFwd
+      bpsRev += h.bpsRev
+    } else {
+      bpsFwd += h.bpsRev
+      bpsRev += h.bpsFwd
+    }
+  }
+  return { bytes, bpsFwd, bpsRev, bps: bpsFwd + bpsRev }
+}
+
+export function hopHasRate(h: MatchedNetflowHop | undefined): h is MatchedNetflowHop {
+  return h != null && Number.isFinite(h.bps) && h.bps > 0
+}
+
+export function formatNetflowRate(hop: MatchedNetflowHop): string {
+  return fmtRate(hop.bps / 1_000_000)
+}
+
+export function formatNetflowDir(hop: MatchedNetflowHop): string {
+  return `↓${fmtRate(hop.bpsFwd / 1_000_000)} ↑${fmtRate(hop.bpsRev / 1_000_000)}`
+}
+
+/** GRE: сначала имя интерфейса туннеля на любом конце, иначе пара узлов. */
+export function matchNetflowForGreEdge(
+  edge: {
+    tunnel: { name: string }
+    fromServer: { id: string }
+    toServer: { id: string }
+  },
+  hops: FlowMapHop[],
+): MatchedNetflowHop | undefined {
+  const name = ifaceNorm(edge.tunnel.name)
+  const fromId = String(edge.fromServer.id)
+  const toId = String(edge.toServer.id)
+  if (name) {
+    const ifaceHits = hops.filter((h) =>
+      h.kind === "iface"
+      && ifaceNorm(h.iface) === name
+      && (h.fromId === fromId || h.fromId === toId),
+    )
+    if (ifaceHits.length) return mergeDirected(ifaceHits, fromId)
+    const greNamed = hops.filter((h) =>
+      h.kind === "gre"
+      && ifaceNorm(h.iface) === name
+      && (h.fromId === fromId || h.fromId === toId || h.toId === fromId || h.toId === toId),
+    )
+    if (greNamed.length) return mergeDirected(greNamed, fromId)
+  }
+  const want = pairKey(fromId, toId)
+  const pairHits = hops.filter((h) =>
+    h.kind === "gre" && Boolean(h.toId) && pairKey(h.fromId, h.toId) === want,
+  )
+  if (pairHits.length) return mergeDirected(pairHits, fromId)
+  return undefined
+}
+
+/** WAN-аплинк HR: kind wan, иначе iface с тем же именем на homeId. */
+export function matchNetflowForWan(
+  homeId: string,
+  wanIface: string,
+  hops: FlowMapHop[],
+): MatchedNetflowHop | undefined {
+  const id = String(homeId)
+  const iface = ifaceNorm(wanIface)
+  if (!iface) return undefined
+  const wanHits = hops.filter((h) =>
+    h.kind === "wan" && h.fromId === id && ifaceNorm(h.iface) === iface,
+  )
+  if (wanHits.length) return mergeDirected(wanHits, id)
+  const ifaceHits = hops.filter((h) =>
+    h.kind === "iface" && h.fromId === id && ifaceNorm(h.iface) === iface,
+  )
+  if (ifaceHits.length) return mergeDirected(ifaceHits, id)
+  return undefined
+}

lib/network-map-layout.ts

@@ -35,9 +35,10 @@ export function greTunnelProbe(t: GreTunnel): TunnelProbe {
   }
 }
 
-const W = 1060
+const W = 1240
 const H = 580
 const MARGIN = 72
+const SERVICE_COL_W = 150
 
 /** Одна горизонтальная «полка» на карте: Home → JH → Exit слева направо. */
 export const NETWORK_MAP_PIPELINE_Y = 300
@@ -68,7 +69,9 @@ function layerOfServer(s: Server): number | null {
  * Увеличивать при изменении алгоритма раскладки спутников/узлов.
  * Страница карты сбрасывает сохранённые перетаскивания при смене значения (в т.ч. после hot reload).
  */
-export const NETWORK_MAP_LAYOUT_REVISION = 6
+export const NETWORK_MAP_W = W
+export const NETWORK_MAP_H = H
+export const NETWORK_MAP_LAYOUT_REVISION = 7
 
 export interface WanJhEdge {
   homeId: string
@@ -254,7 +257,7 @@ export function computeNetworkMapLayout(
   const nodePos: Record<string, { x: number; y: number }> = {}
   const wanSatPos: Record<string, { x: number; y: number }[]> = {}
 
-  const span = W - 2 * MARGIN
+  const span = W - 2 * MARGIN - SERVICE_COL_W
   const laneGap = Math.min(44, span * 0.04)
   const laneW = (span - 2 * laneGap) / 3
 
@@ -425,6 +428,28 @@ export function computeNetworkMapLayout(
   return { nodePos, wanSatPos }
 }
 
+/** Колонка конечных сервисов справа от EN. */
+export function placeServiceNodes(
+  serviceIds: string[],
+  enPositions: Array<{ x: number; y: number }>,
+): Record<string, { x: number; y: number }> {
+  const out: Record<string, { x: number; y: number }> = {}
+  if (serviceIds.length === 0) return out
+  const minY = MARGIN + 70
+  const maxY = H - 72
+  const x = W - MARGIN - SERVICE_COL_W / 2
+  const enYs = enPositions.map((p) => p.y).filter((y) => Number.isFinite(y))
+  const centerY = enYs.length ? enYs.reduce((a, b) => a + b, 0) / enYs.length : (minY + maxY) / 2
+  const n = serviceIds.length
+  const gap = Math.min(96, (maxY - minY) / Math.max(1, n))
+  const span = gap * (n - 1)
+  const start = clamp(centerY - span / 2, minY, maxY - span)
+  serviceIds.forEach((id, i) => {
+    out[id] = { x, y: n === 1 ? clamp(centerY, minY, maxY) : start + i * gap }
+  })
+  return out
+}
+
 /**
  * Суммарная задержка «дом → JH» в миллисекундах: те же поля `Server.latency`, что показываются в разделе Серверы.
  * Отдельного ICMP по ребру нет — это не замер линии, а сумма каталожных latency концов.

package-lock.json

@@ -14259,6 +14259,21 @@
       "dependencies": {
         "zod": "^4.4.1"
       }
+    },
+    "node_modules/@next/swc-win32-x64-msvc": {
+      "version": "16.2.4",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.2.4.tgz",
+      "integrity": "sha512-kMVGgsqhO5YTYODD9IPGGhA6iprWidQckK3LmPeW08PIFENRmgfb4MjXHO+p//d+ts2rpjvK5gXWzXSMrPl9cw==",
+      "cpu": [
+        "x64"
+      ],
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
     }
   }
 }

packages/contracts/src/traffic-flow.ts

@@ -21,6 +21,7 @@ export const trafficFlowSettingsDtoSchema = z.object({
   hubServerId: z.number().int().positive().nullable(),
   retentionHours: z.number().int().positive(),
   topN: z.number().int().positive(),
+  mapServiceMinSharePct: z.number().min(0).max(100),
   lastDatagramAt: z.string().nullable(),
   lastExporterIp: z.string().nullable(),
   lastError: z.string().nullable(),
@@ -40,6 +41,7 @@ export const trafficFlowSettingsPatchSchema = z.object({
   hubServerId: z.number().int().positive().nullable().optional(),
   retentionHours: z.number().int().positive().optional(),
   topN: z.number().int().positive().max(1000).optional(),
+  mapServiceMinSharePct: z.number().min(0).max(100).optional(),
 })
 
 export const trafficFlowOverlayRequestSchema = z.object({
@@ -80,11 +82,18 @@ export const flowTalkerDtoSchema = z.object({
   bps: z.number().nonnegative(),
   inIface: z.string(),
   inIfaceIndex: z.string().optional(),
+  outIface: z.string().optional(),
+  nextHop: z.string().optional(),
   application: z.string().optional(),
   category: z.string().optional(),
   service: z.string().optional(),
   dstCountry: z.string().optional(),
   dstAsn: z.number().int().optional(),
+  clientId: z.string().optional(),
+  clientName: z.string().optional(),
+  enId: z.string().optional(),
+  enName: z.string().optional(),
+  plane: z.string().optional(),
 })
 
 export const flowStatsDtoSchema = z.object({
@@ -148,6 +157,26 @@ export const flowMapEdgeSchema = z.object({
   bps: z.number().nonnegative(),
 })
 
+export const flowPathRowSchema = z.object({
+  id: z.string(),
+  clientId: z.string(),
+  clientName: z.string(),
+  ifaces: z.string(),
+  serverId: z.string(),
+  serverName: z.string(),
+  inIface: z.string(),
+  outIface: z.string(),
+  enId: z.string(),
+  enName: z.string(),
+  dst: z.string(),
+  service: z.string(),
+  category: z.string(),
+  plane: z.string(),
+  bytes: z.number().nonnegative(),
+  packets: z.number().nonnegative(),
+  bps: z.number().nonnegative(),
+})
+
 export const flowAnalyticsDtoSchema = z.object({
   bpsNow: z.number().nonnegative(),
   bytes: z.number().nonnegative(),
@@ -171,10 +200,19 @@ export const flowAnalyticsDtoSchema = z.object({
   services: z.array(flowBreakdownRowSchema).optional(),
   mapEdges: z.array(flowMapEdgeSchema).optional(),
   conversationsList: z.array(flowTalkerDtoSchema),
+  paths: z.array(flowPathRowSchema).optional(),
   ifaces: z.array(flowIfaceChipSchema),
   live: z.boolean(),
   dedupApplied: z.boolean().optional(),
   degraded: z.boolean().optional(),
+  bytesPayload: z.number().nonnegative().optional(),
+  bytesOverlay: z.number().nonnegative().optional(),
+  bytesMesh: z.number().nonnegative().optional(),
+  bytesWire: z.number().nonnegative().optional(),
+  bpsOverlay: z.number().nonnegative().optional(),
+  bpsWire: z.number().nonnegative().optional(),
+  excludeMeshApplied: z.boolean().optional(),
+  excludeOverlayApplied: z.boolean().optional(),
 })
 
 export const flowExportersDtoSchema = z.object({
@@ -199,13 +237,80 @@ export const flowMonthlyDtoSchema = z.object({
   asns: z.array(flowBreakdownRowSchema),
 })
 
+export const flowPurgeDtoSchema = z.object({
+  ok: z.literal(true),
+  deleted: z.object({
+    buckets: z.number().int().nonnegative(),
+    minuteStats: z.number().int().nonnegative(),
+    minuteDims: z.number().int().nonnegative(),
+    dailyDims: z.number().int().nonnegative(),
+  }),
+  fileBytesBefore: z.number().int().nonnegative(),
+  fileBytesAfter: z.number().int().nonnegative(),
+  vacuumed: z.boolean(),
+})
+
+export const flowMapHopKindSchema = z.enum(["gre", "wan", "iface"])
+
+export const flowMapHopDtoSchema = z.object({
+  fromId: z.string(),
+  fromLabel: z.string(),
+  toId: z.string(),
+  toLabel: z.string(),
+  kind: flowMapHopKindSchema,
+  iface: z.string().optional(),
+  bytes: z.number().nonnegative(),
+  bps: z.number().nonnegative(),
+  bpsFwd: z.number().nonnegative(),
+  bpsRev: z.number().nonnegative(),
+})
+
+export const flowMapServiceDtoSchema = z.object({
+  id: z.string(),
+  label: z.string(),
+  category: z.string(),
+  bytes: z.number().nonnegative(),
+  bps: z.number().nonnegative(),
+  share: z.number().min(0).max(1),
+})
+
+export const flowMapServiceEdgeDtoSchema = z.object({
+  fromId: z.string(),
+  toId: z.string(),
+  bytes: z.number().nonnegative(),
+  bps: z.number().nonnegative(),
+  bpsFwd: z.number().nonnegative(),
+  bpsRev: z.number().nonnegative(),
+})
+
+export const flowMapHopsDtoSchema = z.object({
+  hops: z.array(flowMapHopDtoSchema),
+  live: z.boolean(),
+  rangeMinutes: z.number().int().positive(),
+  windowSec: z.number().positive(),
+  totalBytes: z.number().nonnegative().optional(),
+  services: z.array(flowMapServiceDtoSchema).optional(),
+  serviceEdges: z.array(flowMapServiceEdgeDtoSchema).optional(),
+  mapServiceMinSharePct: z.number().min(0).max(100).optional(),
+  dedupApplied: z.boolean(),
+  excludeMeshApplied: z.boolean(),
+  excludeOverlayApplied: z.boolean(),
+})
+
 export type FlowTalkerDto = z.infer<typeof flowTalkerDtoSchema>
 export type FlowStatsDto = z.infer<typeof flowStatsDtoSchema>
 export type FlowBreakdownRow = z.infer<typeof flowBreakdownRowSchema>
 export type FlowIfaceChip = z.infer<typeof flowIfaceChipSchema>
 export type FlowEntityCard = z.infer<typeof flowEntityCardSchema>
 export type FlowMapEdge = z.infer<typeof flowMapEdgeSchema>
+export type FlowPathRow = z.infer<typeof flowPathRowSchema>
 export type FlowAnalyticsDto = z.infer<typeof flowAnalyticsDtoSchema>
 export type FlowExportersDto = z.infer<typeof flowExportersDtoSchema>
 export type FlowClientsDto = z.infer<typeof flowClientsDtoSchema>
 export type FlowMonthlyDto = z.infer<typeof flowMonthlyDtoSchema>
+export type FlowPurgeDto = z.infer<typeof flowPurgeDtoSchema>
+export type FlowMapHopKind = z.infer<typeof flowMapHopKindSchema>
+export type FlowMapHop = z.infer<typeof flowMapHopDtoSchema>
+export type FlowMapService = z.infer<typeof flowMapServiceDtoSchema>
+export type FlowMapServiceEdge = z.infer<typeof flowMapServiceEdgeDtoSchema>
+export type FlowMapHopsDto = z.infer<typeof flowMapHopsDtoSchema>

shared/api/traffic-flow.ts

@@ -2,7 +2,9 @@ import type {
   FlowAnalyticsDto,
   FlowClientsDto,
   FlowExportersDto,
+  FlowMapHopsDto,
   FlowMonthlyDto,
+  FlowPurgeDto,
   FlowStatsDto,
   TrafficFlowHostFile,
   TrafficFlowOverlayResult,
@@ -61,6 +63,8 @@ function flowQuery(params: {
   userId?: string
   iface?: string
   dedup?: boolean
+  excludeMesh?: boolean
+  excludeOverlay?: boolean
 }): string {
   const q = new URLSearchParams()
   if (params.range) q.set("range", params.range)
@@ -69,6 +73,10 @@ function flowQuery(params: {
   if (params.iface && params.iface !== "__all__") q.set("iface", params.iface)
   if (params.dedup === false) q.set("dedup", "0")
   else if (params.dedup === true) q.set("dedup", "1")
+  if (params.excludeMesh === false) q.set("excludeMesh", "0")
+  else if (params.excludeMesh === true) q.set("excludeMesh", "1")
+  if (params.excludeOverlay === false) q.set("excludeOverlay", "0")
+  else if (params.excludeOverlay === true) q.set("excludeOverlay", "1")
   const s = q.toString()
   return s ? `?${s}` : ""
 }
@@ -81,9 +89,40 @@ export async function getFlowClients(baseUrl: string, range = "5m"): Promise<Flo
   return requestJson<FlowClientsDto>(baseUrl, `/api/traffic/flow/clients?range=${encodeURIComponent(range)}`)
 }
 
+export async function getFlowMapHops(
+  baseUrl: string,
+  params: {
+    range?: string
+    serverId?: string
+    userId?: string
+    iface?: string
+    dedup?: boolean
+    excludeMesh?: boolean
+    excludeOverlay?: boolean
+  } = {},
+): Promise<FlowMapHopsDto> {
+  return requestJson<FlowMapHopsDto>(baseUrl, `/api/traffic/flow/map-hops${flowQuery({
+    range: params.range ?? "5m",
+    serverId: params.serverId,
+    userId: params.userId,
+    iface: params.iface,
+    dedup: params.dedup,
+    excludeMesh: params.excludeMesh,
+    excludeOverlay: params.excludeOverlay,
+  })}`)
+}
+
 export async function getFlowAnalytics(
   baseUrl: string,
-  params: { range?: string; serverId?: string; userId?: string; iface?: string; dedup?: boolean },
+  params: {
+    range?: string
+    serverId?: string
+    userId?: string
+    iface?: string
+    dedup?: boolean
+    excludeMesh?: boolean
+    excludeOverlay?: boolean
+  },
 ): Promise<FlowAnalyticsDto> {
   return requestJson<FlowAnalyticsDto>(baseUrl, `/api/traffic/flow/analytics${flowQuery(params)}`)
 }
@@ -98,4 +137,8 @@ export async function getFlowMonthly(
   return requestJson<FlowMonthlyDto>(baseUrl, `/api/traffic/flow/monthly?${q.toString()}`)
 }
 
+export async function purgeTrafficFlowData(baseUrl: string): Promise<FlowPurgeDto> {
+  return requestJson<FlowPurgeDto>(baseUrl, "/api/traffic/flow/purge", { method: "POST" })
+}
+
 export { flowQuery }