StreamLens/debug_background_outlier_count.py

#!/usr/bin/env python3
"""Debug background analyzer outlier count"""

import sys
sys.path.append('.')

from analyzer.analysis import EthernetAnalyzer
from analyzer.analysis.background_analyzer import BackgroundAnalyzer
import time

def debug_background_outlier_count(pcap_file="1 PTPGM.pcapng", src_ip="192.168.4.89"):
    """Debug background analyzer outlier counting"""
    
    print("=== Debugging Background Analyzer Outlier Count ===")
    
    # Test background analyzer (used by TUI)
    analyzer = EthernetAnalyzer(enable_realtime=False, outlier_threshold_sigma=3.0)
    bg_analyzer = BackgroundAnalyzer(analyzer, num_threads=1)
    
    bg_analyzer.start_parsing(pcap_file)
    while bg_analyzer.is_parsing:
        time.sleep(0.1)
    
    # Find test flow
    test_flow = None
    for flow_key, flow in analyzer.flows.items():
        if flow.src_ip == src_ip:
            test_flow = flow
            break
    
    if not test_flow:
        print(f"❌ No flow found from {src_ip}")
        return
    
    print(f"\n✅ Found flow: {test_flow.src_ip}:{test_flow.src_port} → {test_flow.dst_ip}:{test_flow.dst_port}")
    
    # Check both flow-level and frame-type outliers
    print(f"\n=== Outlier Count Analysis ===")
    print(f"Flow-level outliers: {len(test_flow.outlier_frames)}")
    
    total_frame_type_outliers = 0
    for frame_type, ft_stats in test_flow.frame_types.items():
        outlier_count = len(ft_stats.outlier_frames)
        total_frame_type_outliers += outlier_count
        if outlier_count > 0:
            print(f"  {frame_type}: {outlier_count} outliers")
    
    print(f"Total frame-type outliers: {total_frame_type_outliers}")
    
    # This is what the TUI should be showing
    frame_type_outlier_count = sum(len(ft_stats.outlier_frames) for ft_stats in test_flow.frame_types.values())
    print(f"TUI should show: {frame_type_outlier_count} outliers")
    
    # Let's check if the flow-level outliers are contaminating things
    if len(test_flow.outlier_frames) != frame_type_outlier_count:
        print(f"\n⚠️  DISCREPANCY FOUND!")
        print(f"  Flow-level outliers: {len(test_flow.outlier_frames)}")
        print(f"  Frame-type outliers: {frame_type_outlier_count}")
        
        print(f"\nFlow-level outlier frames: {sorted(test_flow.outlier_frames)}")
        
        # Show which frames are different
        frame_type_outlier_frames = set()
        for ft_stats in test_flow.frame_types.values():
            frame_type_outlier_frames.update(ft_stats.outlier_frames)
        
        flow_level_set = set(test_flow.outlier_frames)
        frame_type_set = frame_type_outlier_frames
        
        only_in_flow_level = flow_level_set - frame_type_set
        only_in_frame_type = frame_type_set - flow_level_set
        
        if only_in_flow_level:
            print(f"Outliers only in flow-level: {sorted(only_in_flow_level)}")
        if only_in_frame_type:
            print(f"Outliers only in frame-type: {sorted(only_in_frame_type)}")
    
    # Check specific CH10-Data outliers in detail
    print(f"\n=== CH10-Data Detailed Analysis ===")
    ch10_stats = test_flow.frame_types.get('CH10-Data')
    if ch10_stats:
        print(f"CH10-Data outliers: {len(ch10_stats.outlier_frames)}")
        print(f"CH10-Data outlier frames: {sorted(ch10_stats.outlier_frames)}")
        
        # Check enhanced details
        if hasattr(ch10_stats, 'enhanced_outlier_details') and ch10_stats.enhanced_outlier_details:
            print(f"Enhanced outlier details: {len(ch10_stats.enhanced_outlier_details)}")
            for frame_num, prev_frame_num, delta_t in ch10_stats.enhanced_outlier_details:
                deviation = (delta_t - ch10_stats.avg_inter_arrival) / ch10_stats.std_inter_arrival if ch10_stats.std_inter_arrival > 0 else 0
                print(f"  Frame {frame_num} (from {prev_frame_num}): {delta_t * 1000:.3f} ms ({deviation:.1f}σ)")

if __name__ == "__main__":
    if len(sys.argv) > 1:
        debug_background_outlier_count(sys.argv[1])
    else:
        debug_background_outlier_count()