The topn-metrics Flink job (Toptask.java) builds seven parallel windowed top-N pipelines over TSG session telemetry keyed by client_ip, server_ip, internal_ip, external_ip, server_domain, subscriber_id, and server_fqdn; MetricsCalculate and TopnHotItems compute top sessions/packets/bytes per key within each tumbling window (scoped by vsys_id/device_id/device_group/ data_center) and stream the results to Kafka as tagged metrics. subscriber_id is treated as a first-class real-time top-N analytics dimension on equal footing with IP addresses and domains.
buildJobTuple(configurationService,inputForSession,"client_ip"); buildJobTuple(configurationService,inputForSession,"server_ip"); buildJobTuple(configurationService,inputForSession,"internal_ip"); buildJobTuple(configurationService,inputForSession,"external_ip"); buildJobTuple(configurationService,inputForSession,"server_domain"); buildJobTuple(configurationService,inputForSession,"subscriber_id"); buildJobTuple(configurationService,inputForSession,"server_fqdn");
Defense implications
- Real-time top-N-by-subscriber traffic ranking runs continuously in production, independent of any specific query a human analyst issues -- a circumvention client that becomes an outlier by session count or bytes for a given subscriber_id is surfaced automatically, not just discoverable on manual lookup.
Cited artifacts
mesalab_git—galaxy/tsg_olap/topn-metrics.bundle:src/main/java/com/galaxy/tsg/Toptask.java(source-code)mesalab_git—galaxy/tsg_olap/topn-metrics.bundle:src/main/java/com/galaxy/tsg/function/MetricsCalculate.java(source-code)mesalab_git—galaxy/tsg_olap/topn-metrics.bundle:src/main/java/com/galaxy/tsg/function/TopnHotItems.java(source-code)mesalab_git—galaxy/tsg_olap/topn-metrics.bundle(git-commit-log)
Provenance pointers only — no leak content is rehosted. Raw material: Enlace Hacktivista.
Related findings
Release 24.04 (28 APR 2024) adds province/city-granularity ("administrative area") geo-tagging to every session and security-event log for both client and server -- client_country/client_super_administrative_area/ client_administrative_area/client_sub_administrative_area and the server-side equivalents -- plus Client ASN/Server ASN as dedicated Statistics Rule Metric datasets, confirming sub-national geolocation is a standard enrichment field across TSG's logging pipeline, not a specialized lookup.
The app_recommend Flink job (Recommendation.java, job name "RECOMMENDATION-APP-CIP") keys incoming traffic by (app_label, client_ip), computes a sliding-window top-N of active client IPs per identified application via TopnHotItem's priority queue, and HbaseSink persists the result as an app-to-client-IP-list association -- row key MD5(app_label), columns app_label/client_ip_list/last_update_time -- in HBase. This is the source of the "Recommend App Active Client IP" troubleshooting lookup referenced in galaxy-troubleshooting-api's Release 21.12 changelog.
galaxy-troubleshooting-api's Postman collection defines a full "DoS Threat Map" dashboard API suite (folder-scoped request names: dos-threat-map-top- source-countries, dos-threat-map-top-destination-countries, dos-threat-map- top-victims, dos-threat-map-attack-type, dos-threat-map-severity, dos-threat- map-destination-ip-distribution, dos-threat-map-attack-connection, dos-threat-map-attack-volume-summary, dos-threat-map-attack-volume-trend), plus a separate DNS-amplification "Resolver" detection dataset and a per-victim-IP historical traffic-trend query -- confirming Galaxy exposes operator-facing DDoS-detection/geolocation dashboards built on top of TSG telemetry, distinct from its censorship/content-blocking function.
The `session_record` schema includes explicit boolean-style flag columns ssl_esni_flag and ssl_ech_flag, confirming that TSG/Galaxy tags every session with whether Encrypted SNI or Encrypted ClientHello was used -- giving the operator session-level visibility into ECH/ESNI adoption even where it cannot decrypt the underlying SNI.
galaxy-troubleshooting-api's Release 22.08 (31 AUG 2022) changelog adds four dedicated "recommend" endpoints that resolve IMSI, IMEI, phone number, and APN to GTP tunnel-endpoint ID (TEID) -- i.e. mobile-core identity-to-tunnel correlation exposed as a first-class, individually testable API surface at Galaxy's OLAP layer, corroborating the tsg_olap subtree's relationship-gtpc-user component. A "Top Subscribers" report existed on the same platform until it was explicitly removed in Release 24.04 (28 APR 2024).
The same `session_record` schema includes a literal `mail_password` column alongside mail_account/mail_from/mail_to/mail_cc/mail_bcc/mail_subject/ mail_attachment_name and a full per-session `mail_eml_file` capture, plus `ftp_account` and `ftp_url` -- confirming Galaxy's OLAP layer stores cleartext mail and FTP credentials and full message content per session, not just connection metadata.