Metrics attribute traffic to interfaces and containers, but not to host-level processes or remote endpoints.

Assisted-by: GLM-5.3 via pi

diff --git a/lotus-land-story/main.yml b/lotus-land-story/main.yml
index 15678e2..2baacb0 100644
--- a/lotus-land-story/main.yml
+++ b/lotus-land-story/main.yml
@@ -30,6 +30,11 @@
       ansible.builtin.apt:
         pkg:
           - prometheus-node-exporter
+          # For debugging sustained network traffic.
+          - iftop     # live per-connection bandwidth
+          - nethogs   # live per-process bandwidth
+          - tcpdump   # packet capture
+          - vnstat    # persistent traffic accounting by interface
         state: present
 
 - import_playbook: ../playbooks/tailscale.yml # noqa: name[play]