<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Implementing Ransomware-Proof Network Architecture — API Reference

## nmap Segmentation Validation

| Command | Purpose | Example |
|---------|---------|---------|
| `nmap -sn <subnet>` | Host discovery in segment | `nmap -sn 10.10.0.0/24` |
| `nmap -Pn -p <ports>` | Port check without ping | `nmap -Pn -p 389,636 10.10.99.1` |
| `nmap --reason` | Show why port state determined | `nmap -Pn -p 445 10.10.0.5 --reason` |
| `nmap -sV` | Service version detection | `nmap -sV -p 22,443 10.99.0.0/24` |

## nftables Commands

```bash
# List all rulesets
nft list ruleset

# Add a table
nft add table inet my_filter

# Add a chain with default drop policy
nft add chain inet my_filter input '{ type filter hook input priority 0; policy drop; }'

# Add a rule allowing specific ports
nft add rule inet my_filter input tcp dport { 80, 443 } accept

# Delete a table
nft delete table inet my_filter

# Flush all rules
nft flush ruleset
```

## iptables Quarantine Commands

```bash
# Block all traffic from host
iptables -I FORWARD -s <IP> -j DROP
iptables -I FORWARD -d <IP> -j DROP

# Allow management access only
iptables -I FORWARD -s <IP> -d <MGMT_IP> -p tcp --dport 22 -j ACCEPT

# List quarantine rules
iptables -L FORWARD -n -v --line-numbers | grep DROP

# Remove quarantine
iptables -D FORWARD -s <IP> -j DROP
```

## Suricata Configuration

```yaml
# /etc/suricata/suricata.yaml key settings
vars:
  HOME_NET: "[10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16]"
  EXTERNAL_NET: "!$HOME_NET"

af-packet:
  - interface: eth1
    cluster-type: cluster_flow

rule-files:
  - ransomware-lateral.rules
  - emerging-threats.rules
```

## Zeek Network Analysis

```bash
# Monitor internal traffic
zeek -i eth1 local "Site::local_nets += { 10.0.0.0/8 }"

# Analyze SMB traffic for lateral movement
cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p proto service | grep smb

# Extract DNS queries for C2 detection
cat dns.log | zeek-cut query answers | sort | uniq -c | sort -rn
```

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `target_subnet` | Subnet to audit | `10.0.0.0/24` |
| `zone` | Segmentation zone name | `domain_controllers` |
| `blocked_ports` | Ports to verify filtered | `3389,445,135` |
| `quarantine_ip` | Host IP to isolate | `10.10.5.42` |
