ed -n '/^def fw_events/,/^def [a-z]/p' /etc/wireguard/wgctl/core/json_helper.py
def fw_events(file, filter_ip, filter_type, clients_dir, net_file, limit):
    """
    Format firewall drop events with dedup, counts, and service annotation.
    Output per line: ts|client|dest_ip|dest_port|proto|service_name|count
    """
    import glob
    from datetime import datetime
    proto_map = {1: 'icmp', 6: 'tcp', 17: 'udp'}
 
    # Build ip->name map
    ip_to_name = {}
    for conf in glob.glob(f"{clients_dir}/*.conf"):
        name = os.path.basename(conf).replace('.conf', '')
        try:
            with open(conf) as f:
                for line in f:
                    if line.startswith('Address'):
                        ip = line.split('=')[1].strip().split('/')[0]
                        ip_to_name[ip] = name
        except Exception:
            pass
 
    # Load net services for reverse lookup
    net_data = {}
    if os.path.exists(net_file):
        try:
            with open(net_file) as f:
                net_data = json.load(f)
        except Exception:
            pass