New: ProcNetScanner.scanEstablishedConnections() parses /proc/net/tcp,
tcp6, udp, udp6 for ESTABLISHED connections to public IPs. Identifies
VPN servers by port heuristics:
- UDP :51820 → WireGuard/Amnezia (90% confidence)
- TCP :443 → VLESS/Trojan (50% confidence)
- UDP :1194 → OpenVPN (80% confidence)
- IPSec :500/:4500, L2TP :1701, PPTP :1723
This works for ALL VPN types including Amnezia VPN, WireGuard, OpenVPN
which don't expose SOCKS5 proxy on localhost.
Integrated as Phase 0.6 in ScanOrchestrator between /proc/net/tcp
listening scan and DirectSigns check. Shows CRITICAL finding with
server IPs, ports, protocols, and server type guesses.
Updated report and SummaryCard with critical findings count.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
bab03c7d09