Audit room box egress against documented network requirements

Validate physical kaukus-streamer box on isolated hardware switch through laptop NetworkManager Ethernet NAT/Wi-Fi sharing against docs/box-network-requirements.typ. Target MAC 84:47:09:7b:fa:ac, current DHCP address 192.168.50.175. Passive pre-NAT capture is running since 2026-11-03T10:13:13+01:00 without changing switch, box, sharing, or firewall. Evidence directory: /home/mathias/.local/state/kaukus-network-audit/20261103T091303Z (private directory). Two transient systemd units: kaukus-box-audit-20261103t091303z-headers.service and kaukus-box-audit-20261103t091303z-details.service. Both auto-stop at one hour (11:13:13 CET), rotate every 5 minutes, retain at most 12 distinct files each without overwrite, and have a 128 MiB per-file size stop. Header snaplen 256 captures box-MAC traffic and DHCP; detail capture retains full DNS/DHCP and TCP records starting with TLS handshake type. Segmented/encrypted TLS names may be unavailable. Requirements snapshot, SHA-256/git revision, DNS and all route/rule/firewall baselines saved; session.json records scope and limits. Verified target ping and live NATS traffic to documented 204.168.249.25:4222. At 10:13:54, header capture had 50 packets, detail 4; both zero kernel drops. Current DNS A/AAAA for router and registry saved; documented IPv4 addresses match, os.kaukus.no returns NXDOMAIN. No enforcement applied. To stop safely: sudo systemctl stop both named units; preserve final journal statistics. User performed reboot and idle checkpoint. Verified reboot DHCP exchange at 10:15:05 CET retains .175; ACK supplies gateway/DNS .1 and no NTP option 42. Initial boot/idle audit fails documented-endpoints-only requirement: post-boot DNS query 2.fedora.pool.ntp.org resolves to 185.175.56.208, 80.203.110.169, 162.159.200.1 and 80.89.32.121, and all receive repeated UDP/123 request/reply exchanges; only 162.159.200.1 is in documented fixed fallback addresses. Before reboot, at 10:14:16, DNS plus exact TLS ClientHello SNI identify successful TCP/443 connections to cdn.fwupd.org at 151.101.130.49 and 151.101.2.49 with data transfer; originating process/artifact not established and not yet observed post-boot. Preboot NTP also contacted undocumented 185.35.202.197, 185.175.56.95, 79.160.225.13. Expected postboot SNI nats.kaukus.no at 204.168.249.25:4222 and cr.kaukus.no at 46.62.215.112:443 verified. DNS uses DHCP resolver. IPv6 observed only link-local mDNS/router solicitation; no global IPv6 uplink, so dual-stack behavior remains untested. Both captures report zero drops at 10:16:24 (1319 header/54 detail packets). Findings saved as boot-idle-findings.json in evidence directory. Capture continues without enforcement or configuration fixes. User then reported changing old default time servers to documented Cloudflare/Google. Wire verification at 10:22:10 CET shows change not yet effective: box still queried 2.fedora.pool.ntp.org at 10:20:25 and sent NTP at 10:21:35–36 to 185.175.56.95, 77.40.226.121, 195.72.61.39 and allowed 162.159.200.123. The allowed Cloudflare member does not prove configuration switch. Continuous capture stats 1961 header/96 detail packets, zero kernel drops. Saved ntp-change-check.json. Second user-performed reboot captured: DHCP completes 10:25:17 CET; box still queries 2.fedora.pool.ntp.org at 10:25:17.279584 and exchanges NTP with allowed 162.159.200.1 plus undocumented 195.16.73.226, 185.41.243.43, 79.160.225.150. New TCP connections go only to documented registry/NATS in this interval. Saved second-reboot-findings.json; at 10:26:04 both captures active, 2595 header/138 detail packets, zero kernel drops. Reboot did not remove Fedora pool behavior. User confirmed changing NTP through provisioner and authorized read-only SSH as streamer@192.168.50.175. Live chrony 4.8 diagnosis confirms root cause: provisioner wrote /etc/chrony.d/50-kaukus.conf with Cloudflare/Google server lines, but /etc/chrony.conf includes that directory with sourcedir, which only loads .sources files. chronyd -p omits custom servers and retains pool 2.fedora.pool.ntp.org; chronyc sources and boot logs match captured Fedora-pool addresses. No DHCP NTP source files present. Changing suffix alone is insufficient because provisioner also never replaces existing pool sources. gather_time_sync reports strings read from ignored drop-in rather than effective sources. Dedicated repair work recorded separately; no implementation authorized yet. Saved live-chrony-diagnosis.json. Maintenance SSH TCP/22 sessions are laptop-originated local diagnostic traffic, not appliance internet egress. No assistant-performed service restart or box mutation. Preview/stream/stop/upload/update/reconnect scenarios pending. User performs reboot and exercises workflows when capture is ready. Collect bounded, private packet evidence and DNS context; compare attempted destinations and ports with the documentation, including DHCP DNS/NTP behavior, IPv6, redirects and alternative routes. Distinguish attempted connections from successful ones and document encrypted/visibility limitations. Later repeat with temporary box-scoped stateful enforcement only after baseline review and coordination; do not allow existing sessions to bypass enforcement. Preserve unrelated laptop/VPN/container traffic and remove temporary enforcement when finished. Acceptance: capture verified running before reboot; observed boot/idle/preview/stream/stop/upload/update/reconnect scenarios recorded or explicitly untested; unexpected destinations evidence-backed; enforced-mode behavior and cleanup verified if undertaken. Finite observation is not proof of all future behavior. No code fixes, releases, updates or remote appliance actions authorized by this audit.