{
  "counter_name_regex": "peer_10_253_1_(\\\\d+)_(out|in)_vpn",
  "db_write_policy": "read-only in STEP_044I; later sampler may update last counters, last_activity_at, state",
  "not_activity_metric": "WireGuard handshake/keepalive",
  "per_peer_formula": {
    "active_now": "total_delta_packets >= 10 OR total_delta_bytes >= 16384",
    "total_delta_bytes": "out_delta_bytes + in_delta_bytes",
    "total_delta_packets": "out_delta_packets + in_delta_packets"
  },
  "production_sample_seconds": 120,
  "sample_window_seconds_used_in_step": 2,
  "source_command": "nft list counters table inet router_egress_activity"
}