# WireGuard cross-node capture (api->db) — HISTORICAL run (original capped script)
# NOTE: this file records the run made by the ORIGINAL capture-wg.sh — capped at
# `tcpdump -c 40` and WITHOUT the REQOK traffic-flow gate. The current
# scripts/capture-wg.sh removes the cap and adds the gate, but the cluster was torn
# down before it could be re-run, so this summary is NOT regenerated by the new script.
# Re-run scripts/capture-wg.sh on a live cross-node cluster to produce a measured, gated
# summary that replaces this one.
cluster-context : kind-cloudsec
api pod / node  : api-869ff48968-v5q7v @ cloudsec-worker
db  pod / node  : db-cbbb899bd-fnj58 @ cloudsec-worker2 (capture site: host netns, iface eth0)
api node IP     : 172.18.0.2    db pod IP: 10.244.1.138    wireguard udp port: 51871
positive (WG UDP/51871 pkts) : 40   <- this is the -c 40 CAPTURE CEILING, not a measured total
negative (plaintext X-User/HTTP on eth0) : 0   (corroborating; absence also consistent with encapsulation)
dispositive evidence : WG-packet presence + cross-node placement (ET1).
reproduce       : scripts/capture-wg.sh   (regenerates a measured, gated summary on a live cluster)