Infer VPN packet traffic class

agents/rap-node-agent/internal/mesh/vpn_packet.go

@@ -5,6 +5,7 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
+	"strings"
 	"time"
 )
 
@@ -119,3 +120,28 @@ func cleanProductionVPNPacketBatch(packets [][]byte) [][]byte {
 	}
 	return cleaned
 }
+
+func inferVPNPacketTrafficClass(explicit string, packets [][]byte) string {
+	explicit = strings.TrimSpace(strings.ToLower(explicit))
+	if explicit != "" && explicit != "bulk" {
+		return explicit
+	}
+	for _, packet := range packets {
+		if isVPNPacketTCPControl(packet) {
+			return "interactive"
+		}
+	}
+	return explicit
+}
+
+func isVPNPacketTCPControl(packet []byte) bool {
+	if len(packet) < 20 || packet[0]>>4 != 4 {
+		return false
+	}
+	ihl := int(packet[0]&0x0f) * 4
+	if ihl < 20 || len(packet) < ihl+20 || packet[9] != 6 {
+		return false
+	}
+	flags := packet[ihl+13]
+	return flags&0x17 != 0
+}