feat(traffic): разделить плоскости IPFIX и показать путь JH→EN

Считать payload отдельно от overlay GRE/ESP и mesh; вкладка Пути и KPI Wire из счётчиков iface.

Co-authored-by: Cursor <[email protected]>

backend/src/services/traffic-flow-parse.ts

@@ -8,6 +8,47 @@ export interface ParsedFlow {
   packets: number
   inIface: string
   outIface: string
+  nextHop: string
+  flowStartMs: number
+  flowEndMs: number
+  natSrc: string
+  natDst: string
+}
+
+export function emptyParsedFlow(): ParsedFlow {
+  return {
+    src: "",
+    dst: "",
+    proto: 0,
+    srcPort: 0,
+    dstPort: 0,
+    bytes: 0,
+    packets: 0,
+    inIface: "",
+    outIface: "",
+    nextHop: "",
+    flowStartMs: 0,
+    flowEndMs: 0,
+    natSrc: "",
+    natDst: "",
+  }
+}
+
+export function normalizeParsedFlow(flow: Partial<ParsedFlow> & Pick<ParsedFlow, "src" | "dst" | "proto" | "bytes">): ParsedFlow {
+  return {
+    ...emptyParsedFlow(),
+    ...flow,
+    nextHop: flow.nextHop ?? "",
+    flowStartMs: flow.flowStartMs ?? 0,
+    flowEndMs: flow.flowEndMs ?? 0,
+    natSrc: flow.natSrc ?? "",
+    natDst: flow.natDst ?? "",
+    inIface: flow.inIface ?? "",
+    outIface: flow.outIface ?? "",
+    srcPort: flow.srcPort ?? 0,
+    dstPort: flow.dstPort ?? 0,
+    packets: flow.packets ?? 0,
+  }
 }
 
 interface FieldSpec {
@@ -105,7 +146,7 @@ function parseNetflowV5(buf: Buffer): ParsedFlow[] {
   const out: ParsedFlow[] = []
   let off = 24
   for (let i = 0; i < count && off + 48 <= buf.length; i++) {
-    out.push({
+    out.push(normalizeParsedFlow({
       src: ipv4(buf, off),
       dst: ipv4(buf, off + 4),
       packets: buf.readUInt32BE(off + 16),
@@ -115,7 +156,7 @@ function parseNetflowV5(buf: Buffer): ParsedFlow[] {
       proto: buf.readUInt8(off + 38),
       inIface: String(buf.readUInt16BE(off + 12)),
       outIface: String(buf.readUInt16BE(off + 14)),
-    })
+    }))
     off += 48
   }
   return out
@@ -166,6 +207,11 @@ function recordFromFields(
   let inIface = ""
   let outIface = ""
   let ifaceName = ""
+  let nextHop = ""
+  let flowStartMs = 0
+  let flowEndMs = 0
+  let natSrc = ""
+  let natDst = ""
   for (const f of fields) {
     const field = consumeField(buf, off, f.length, limit)
     if (!field) return null
@@ -183,11 +229,26 @@ function recordFromFields(
       case 28:
         if (data.length === 16 && !dst) dst = ipv6(data, 0)
         break
+      case 15:
+        if (data.length === 4 && !nextHop) nextHop = ipv4(data, 0)
+        break
+      case 18:
+        if (data.length === 4 && !nextHop) nextHop = ipv4(data, 0)
+        break
+      case 62:
+        if (data.length === 16 && !nextHop) nextHop = ipv6(data, 0)
+        break
       case 225:
-        if (data.length === 4 && !src) src = ipv4(data, 0)
+        if (data.length === 4) {
+          natSrc = ipv4(data, 0)
+          if (!src) src = natSrc
+        }
         break
       case 226:
-        if (data.length === 4 && !dst) dst = ipv4(data, 0)
+        if (data.length === 4) {
+          natDst = ipv4(data, 0)
+          if (!dst) dst = natDst
+        }
         break
       case 4:
         proto = readUint(data, 0, data.length)
@@ -216,6 +277,24 @@ function recordFromFields(
       case 14:
         outIface = String(readUint(data, 0, data.length))
         break
+      case 21:
+        if (!flowEndMs) flowEndMs = readUint(data, 0, data.length)
+        break
+      case 22:
+        if (!flowStartMs) flowStartMs = readUint(data, 0, data.length)
+        break
+      case 150:
+        if (!flowStartMs) flowStartMs = readUint(data, 0, data.length) * 1000
+        break
+      case 151:
+        if (!flowEndMs) flowEndMs = readUint(data, 0, data.length) * 1000
+        break
+      case 152:
+        flowStartMs = readUint(data, 0, data.length)
+        break
+      case 153:
+        flowEndMs = readUint(data, 0, data.length)
+        break
       case 82:
         ifaceName = data.toString("utf8").replace(/\0/g, "").trim()
         break
@@ -224,8 +303,13 @@ function recordFromFields(
     }
     off = field.next
   }
-  if (ifaceName) inIface = ifaceName
-  return { flow: { src, dst, proto, srcPort, dstPort, bytes, packets, inIface, outIface }, next: off }
+  if (ifaceName && !inIface) inIface = ifaceName
+  return {
+    flow: normalizeParsedFlow({
+      src, dst, proto, srcPort, dstPort, bytes, packets, inIface, outIface, nextHop, flowStartMs, flowEndMs, natSrc, natDst,
+    }),
+    next: off,
+  }
 }
 
 function parseDataRecords(