{
  "active_threshold": {
    "bytes_delta_min": 16384,
    "packets_delta_min": 10
  },
  "idle_threshold_seconds": 900,
  "implementation_note": "If per-peer nft dynamic counters are too heavy, collect aggregate conn/flow stats or render counters only for enabled peers.",
  "metric": "iif wg_paid ip saddr <tunnel_ip> oif transit_vpn counter",
  "not_metric": "WireGuard latest-handshake/keepalive alone",
  "preferred_location": "VM100 nft inet fw4 or dedicated table",
  "sample_window_seconds": 120
}