{
  "active_delta_formula": "delta_packets = out_delta_packets + in_delta_packets; delta_bytes = out_delta_bytes + in_delta_bytes",
  "active_threshold": {
    "bytes_min": 16384,
    "packets_min": 10,
    "window_seconds": 120
  },
  "counter_pairs_per_peer": 2,
  "directions": {
    "in_vpn": "iifname \"eth2\" oifname \"wg_paid\" ip daddr TUNNEL_IP",
    "out_vpn": "iifname \"wg_paid\" oifname \"eth2\" ip saddr TUNNEL_IP"
  },
  "idle_threshold_seconds": 900,
  "important_not_metric": "WireGuard latest-handshake/keepalive is not enough to mark peer active",
  "source": "nft named counters in table inet router_egress_activity",
  "why_both_directions": "Download-heavy clients may have small client->VPN request traffic but large VPN->client response traffic; both are useful inner traffic and load the egress slot."
}