From 86573769ca9c246cc177b4f47895d0ea810fa54b Mon Sep 17 00:00:00 2001
From: DAProgs <info@daprogs.com>
Date: Wed, 11 Mar 2026 16:26:39 -0400
Subject: [PATCH] rolling top scores 24h

---
 includes/functions.php | 4 +++-
 index.php              | 4 ++--
 version.php            | 2 +-
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/includes/functions.php b/includes/functions.php
index caed362..1ddb5b2 100644
--- a/includes/functions.php
+++ b/includes/functions.php
@@ -294,6 +294,7 @@ function top_ips(int $n = TOP_N): array {
     $s = db()->prepare(
         'SELECT src_ip, COUNT(*) AS cnt
          FROM connections
+         WHERE occurred_at >= NOW() - INTERVAL 24 HOUR
          GROUP BY src_ip
          ORDER BY cnt DESC
          LIMIT ?'
@@ -306,6 +307,7 @@ function top_ports(int $n = TOP_N): array {
     $s = db()->prepare(
         'SELECT dst_port, COUNT(*) AS cnt
          FROM connections
+         WHERE occurred_at >= NOW() - INTERVAL 24 HOUR
          GROUP BY dst_port
          ORDER BY cnt DESC
          LIMIT ?'
@@ -318,7 +320,7 @@ function top_ips_by_node(int $node_id, int $n = TOP_N): array {
     $s = db()->prepare(
         'SELECT src_ip, COUNT(*) AS cnt
          FROM connections
-         WHERE node_id = ?
+         WHERE node_id = ? AND occurred_at >= NOW() - INTERVAL 24 HOUR
          GROUP BY src_ip
          ORDER BY cnt DESC
          LIMIT ?'
diff --git a/index.php b/index.php
index 2e4ab28..586f1b5 100644
--- a/index.php
+++ b/index.php
@@ -94,7 +94,7 @@ $update_available = $upstream_version && is_newer_version($upstream_version, APP
 <!-- Top IPs + Top Ports -->
 <div class="two-col">
   <div class="card">
-    <h2>Top source IPs</h2>
+    <h2>Top source IPs <small class="muted" style="font-size:.7rem;font-weight:400">(24 h)</small></h2>
     <?php if (empty($t_ips)): ?>
       <p class="muted">No data yet.</p>
     <?php else: ?>
@@ -118,7 +118,7 @@ $update_available = $upstream_version && is_newer_version($upstream_version, APP
   </div>
 
   <div class="card">
-    <h2>Top targeted ports</h2>
+    <h2>Top targeted ports <small class="muted" style="font-size:.7rem;font-weight:400">(24 h)</small></h2>
     <?php if (empty($t_ports)): ?>
       <p class="muted">No data yet.</p>
     <?php else: ?>
diff --git a/version.php b/version.php
index e896102..b52aac1 100644
--- a/version.php
+++ b/version.php
@@ -1,2 +1,2 @@
 <?php
-define('APP_VERSION', '2603.5');
+define('APP_VERSION', '2603.6');