StreamLens/debug_tui_flow_updates.py

#!/usr/bin/env python3
"""Debug TUI flow update process to find frame 2002/298 issue"""

import sys
sys.path.append('.')

from analyzer.analysis import EthernetAnalyzer
from analyzer.analysis.background_analyzer import BackgroundAnalyzer
import time

def debug_tui_flow_updates(pcap_file="1 PTPGM.pcapng", src_ip="192.168.4.89"):
    """Debug TUI flow update process"""
    
    print("=== Debugging TUI Flow Update Process ===")
    
    # Create analyzer exactly like TUI does
    analyzer = EthernetAnalyzer(enable_realtime=False, outlier_threshold_sigma=3.0)
    
    # Track flow updates like TUI does
    update_count = 0
    outlier_snapshots = []
    
    def flow_update_callback():
        nonlocal update_count, outlier_snapshots
        update_count += 1
        
        # Capture outlier state at each update (like TUI does)
        try:
            flows = bg_analyzer.get_current_flows()
            for flow in flows.values():
                if flow.src_ip == src_ip:
                    # Check for problematic outliers at each update
                    for frame_type, ft_stats in flow.frame_types.items():
                        if hasattr(ft_stats, 'enhanced_outlier_details') and ft_stats.enhanced_outlier_details:
                            for frame_num, prev_frame_num, delta_t in ft_stats.enhanced_outlier_details:
                                # Look for the problematic case
                                if frame_num == 2002 or prev_frame_num == 298:
                                    outlier_snapshots.append({
                                        'update': update_count,
                                        'frame_type': frame_type,
                                        'frame_num': frame_num,
                                        'prev_frame_num': prev_frame_num,
                                        'delta_t': delta_t,
                                        'timestamp': time.time()
                                    })
                                    print(f"Update {update_count}: Found {frame_type} Frame {frame_num} (from {prev_frame_num})")
                    break
        except Exception as e:
            print(f"Error in flow update callback: {e}")
    
    # Create background analyzer with flow updates like TUI
    bg_analyzer = BackgroundAnalyzer(
        analyzer,
        num_threads=4,  # TUI uses multiple threads
        flow_update_callback=flow_update_callback
    )
    
    print(f"Starting background parsing with flow updates...")
    bg_analyzer.start_parsing(pcap_file)
    
    # Monitor progress
    while bg_analyzer.is_parsing:
        time.sleep(0.1)
    
    print(f"Parsing complete. Total flow updates: {update_count}")
    
    if outlier_snapshots:
        print(f"\n🔍 FOUND PROBLEMATIC OUTLIERS: {len(outlier_snapshots)}")
        for snapshot in outlier_snapshots:
            print(f"  Update {snapshot['update']}: {snapshot['frame_type']} Frame {snapshot['frame_num']} (from {snapshot['prev_frame_num']}): {snapshot['delta_t']*1000:.3f} ms")
    else:
        print(f"\n❌ No problematic outliers found during flow updates")
    
    # Final check of all outliers
    print(f"\n=== Final State ===")
    flows = bg_analyzer.get_current_flows()
    for flow in flows.values():
        if flow.src_ip == src_ip:
            total_outliers = 0
            for frame_type, ft_stats in flow.frame_types.items():
                outlier_count = len(ft_stats.outlier_frames)
                total_outliers += outlier_count
                if outlier_count > 0:
                    print(f"{frame_type}: {outlier_count} outliers")
                    
                    # Show enhanced details if available
                    if hasattr(ft_stats, 'enhanced_outlier_details') and ft_stats.enhanced_outlier_details:
                        for frame_num, prev_frame_num, delta_t in ft_stats.enhanced_outlier_details[:3]:
                            deviation = (delta_t - ft_stats.avg_inter_arrival) / ft_stats.std_inter_arrival if ft_stats.std_inter_arrival > 0 else 0
                            print(f"  Frame {frame_num} (from {prev_frame_num}): {delta_t * 1000:.3f} ms ({deviation:.1f}σ)")
                        if len(ft_stats.enhanced_outlier_details) > 3:
                            print(f"  ... and {len(ft_stats.enhanced_outlier_details) - 3} more")
            
            print(f"Total outliers: {total_outliers}")
            break
    
    # Test if there might be a threading issue by running single-threaded
    print(f"\n=== Testing Single-threaded Background Analyzer ===")
    analyzer_single = EthernetAnalyzer(enable_realtime=False, outlier_threshold_sigma=3.0)
    bg_analyzer_single = BackgroundAnalyzer(analyzer_single, num_threads=1)
    
    bg_analyzer_single.start_parsing(pcap_file)
    while bg_analyzer_single.is_parsing:
        time.sleep(0.1)
    
    flows_single = bg_analyzer_single.get_current_flows()
    for flow in flows_single.values():
        if flow.src_ip == src_ip:
            # Check for the problematic outlier
            for frame_type, ft_stats in flow.frame_types.items():
                if hasattr(ft_stats, 'enhanced_outlier_details') and ft_stats.enhanced_outlier_details:
                    for frame_num, prev_frame_num, delta_t in ft_stats.enhanced_outlier_details:
                        if frame_num == 2002 or prev_frame_num == 298:
                            print(f"Single-threaded: {frame_type} Frame {frame_num} (from {prev_frame_num})")
            break
    
    bg_analyzer.cleanup()
    bg_analyzer_single.cleanup()

if __name__ == "__main__":
    if len(sys.argv) > 1:
        debug_tui_flow_updates(sys.argv[1])
    else:
        debug_tui_flow_updates()