Modern TUI with Enhanced Protocol Hierarchy Interface

Major Features:
- Complete modern TUI interface with three focused views
- Enhanced multi-column layout: Source | Proto | Destination | Extended | Frame Type | Metrics
- Simplified navigation with 1/2/3 hotkeys instead of F1/F2/F3
- Protocol hierarchy: Transport (TCP/UDP) → Extended (CH10/PTP) → Frame Types
- Classic TUI preserved with --classic flag

Views Implemented:
1. Flow Analysis View: Enhanced multi-column flow overview with protocol detection
2. Packet Decoder View: Three-panel deep inspection (Flows | Frames | Fields)
3. Statistical Analysis View: Four analysis modes with timing and quality metrics

Technical Improvements:
- Left-aligned text columns with IP:port precision
- Transport protocol separation from extended protocols
- Frame type identification (CH10-Data, TMATS, PTP Sync)
- Cross-view communication with persistent flow selection
- Context-sensitive help and status bars
- Comprehensive error handling with console fallback
This commit is contained in:
2025-07-26 22:46:49 -04:00
parent 0f2fc8f92c
commit 5c2cb1a4ed
22 changed files with 4207 additions and 35 deletions

102
README.md
View File

@@ -20,9 +20,12 @@ python streamlens.py --gui --pcap file.pcap
# GUI mode only (then open file via File menu)
python streamlens.py --gui
# Analyze pcap file with TUI (flows sorted by largest sigma outliers)
# Analyze pcap file with modern TUI (Flow Analysis, Packet Decoder, Statistical Analysis views)
python streamlens.py --pcap file.pcap
# Use classic TUI interface instead of modern (preserves original layout)
python streamlens.py --pcap file.pcap --classic
# Live capture with real-time statistics
python streamlens.py --live --interface eth0
@@ -62,13 +65,37 @@ python streamlens.py --live --filter "port 319 or port 320"
- **Threading Safety**: Main-thread plot creation eliminates Qt threading violations
- **No Floating Windows**: All plots stay embedded in the grid interface
### Enhanced TUI Interface
- **Three-Panel Layout**: Flows list (top-left), flow details (top-right), timing visualization (bottom)
### 🖥️ Modern TUI Interface (Default) with Three Focused Views
- **1: Flow Analysis View**: Enhanced multi-column flow overview with protocol hierarchy
- **Source | Proto | Destination | Extended | Frame Type | Metrics** layout
- Transport protocols (TCP, UDP, ICMP, IGMP) clearly separated from extended protocols
- Extended protocol column for specialized protocols (CH10, PTP, IENA, NTP)
- Frame type column showing most common frame type per flow (CH10-Data, TMATS, PTP Sync)
- Left-aligned text columns with IP:port format for precise endpoint identification
- Performance rankings by packet count, outliers, and enhanced decoder availability
- **2: Packet Decoder View**: Deep protocol inspection and field extraction
- Three-panel layout: Enhanced Flows | Frame Analysis | Field Inspector
- Real-time decoded field display with tree-view navigation
- Tab-based interface switching with comprehensive field value inspection
- **3: Statistical Analysis View**: Timing analysis, outliers, and quality metrics
- Four analysis modes: Overview, Outlier Analysis, Quality Metrics, Timing Analysis
- Performance ranking with health metrics and network consistency indicators
- Detailed outlier breakdown with sigma deviation calculations
- **Modern Navigation**: 1/2/3 view switching with context-sensitive help and status bars
- **Enhanced Protocol Support**: Specialized views for Chapter 10, PTP, IENA with quality indicators
- **Cross-View Communication**: Selected flows persist across view switches for comprehensive analysis
### 📊 Classic TUI Interface (--classic flag) with Professional Table Layout
- **Optimized Three-Panel Layout**: Flows list (70% width), flow details (30% width), optional timeline (bottom)
- **Professional Table Formatting**: Right-aligned numeric columns (#Frames, Bytes, ΔT Avg) with proper spacing
- **Comprehensive Flow Display**: Shows Src:Port, Dst:Port, Transport Protocol, Traffic Classification, and Encoding
- **Transport Layer Analysis**: Displays TCP, UDP, ICMP, IGMP protocols with port information
- **Traffic Classification**: Identifies Unicast, Multicast, and Broadcast traffic patterns
- **Hierarchical Frame Types**: Expandable tree view showing packet type breakdowns with aligned sub-rows
- **Magnitude Indicators**: Consistent byte formatting (1.2M, 428K, 1234B) with right alignment
- **Sigma-Based Flow Sorting**: Flows automatically sorted by largest outlier sigma deviation
- **Real-time Navigation**: Arrow keys to navigate between flows with instant detail updates
- **Protocol-aware Display**: Shows detected protocols in flow list and details
- **Smart Protocol Detection**: Prioritizes specialized protocols (Chapter 10, PTP, IENA) over generic ones
- **Detailed Outlier Analysis**: Individual rows showing frame numbers and exact time deltas for outlier packets
- **Visual Timeline**: ASCII timeline showing frame timing deviations with outlier highlighting
- **Live Statistics**: Real-time running averages and outlier detection during capture
@@ -140,19 +167,55 @@ Generate detailed outlier reports with `--report` flag showing frame-by-frame si
- **Status Bar**: Loading progress and operation feedback
### Workflow
1. **Launch GUI with PCAP**: `python streamlens.py --gui --pcap file.pcap` (recommended)
2. **Alternative Launch**: `python streamlens.py --gui`, then File → Open PCAP...
3. **Immediate Analysis**: Flow table displays instantly with all flow data and wide embedded plots
4. **Optimized Display**: Content-fitted columns, 25% taller rows, and full-width utilization
5. **Wide Plot Visualization**: Chapter 10 flows show detailed signal plots with minimal margins
6. **Browse Flows**: View flows in the dark-themed table (Chapter 10 flows highlighted in modern blue)
7. **Analyze Details**: Select flows to view detailed information in the dark-themed bottom panel
8. **Adjust Threshold**: Use toolbar spinner to change outlier detection sensitivity
9. **Multi-Flow Comparison**: Compare signals across different flows in the same optimized view
#### GUI Mode (Recommended)
1. **Launch GUI with PCAP**: `python streamlens.py --gui --pcap file.pcap`
2. **Immediate Analysis**: Flow table displays instantly with all flow data and wide embedded plots
3. **Optimized Display**: Content-fitted columns, 25% taller rows, and full-width utilization
4. **Wide Plot Visualization**: Chapter 10 flows show detailed signal plots with minimal margins
5. **Browse Flows**: View flows in the dark-themed table (Chapter 10 flows highlighted in modern blue)
6. **Analyze Details**: Select flows to view detailed information in the dark-themed bottom panel
7. **Adjust Threshold**: Use toolbar spinner to change outlier detection sensitivity
#### Modern TUI Mode (Default)
1. **Launch Modern TUI**: `python streamlens.py --pcap file.pcap`
2. **Flow Analysis View (1)**: Visual flow overview with protocol detection and performance ranking
3. **Packet Decoder View (2)**: Deep packet inspection with three-panel layout for field analysis
4. **Statistical Analysis View (3)**: Comprehensive timing analysis and outlier detection
5. **View Navigation**: Use 1/2/3 to switch between analysis perspectives
6. **Context-Sensitive Help**: Press H for detailed help overlay with all controls
7. **Enhanced Protocol Analysis**: Specialized displays for Chapter 10, PTP, IENA protocols
#### Classic TUI Mode (--classic flag)
1. **Launch Classic TUI**: `python streamlens.py --pcap file.pcap --classic`
2. **Professional Table View**: Right-aligned numeric columns with transport protocol and classification
3. **Navigate Flows**: Use ↑↓ to browse flows sorted by sigma deviation
4. **Expand Details**: Use → to show frame type breakdowns with hierarchical display
5. **Signal Visualization**: Press 'v' on Chapter 10 flows to generate signal plot files
6. **Timeline Analysis**: Press 't' to toggle timing visualization panel
7. **Live Monitoring**: Real-time statistics updates during network capture
## TUI Controls
- **↑↓**: Navigate between flows in main view
### Modern TUI Controls (Default)
- **1**: Switch to Flow Analysis View (enhanced multi-column layout)
- **2**: Switch to Packet Decoder View (three-panel inspection)
- **3**: Switch to Statistical Analysis View (timing and quality analysis)
- **H**: Toggle comprehensive help overlay
- **↑↓**: Navigate items in current view
- **Enter**: Select flow/packet for detailed analysis
- **Tab**: Switch panels (when available)
- **V**: Visualize signals (Flow Analysis)
- **D**: Deep decode selected flow
- **E**: Export decoded data
- **R**: Refresh statistics
- **O**: Show outlier details
- **Q**: Quit application
### Classic TUI Controls (--classic flag)
- **↑↓**: Navigate between flows and frame types in main view
- **→**: Expand flow to show frame type breakdowns
- **←**: Collapse flow details
- **v**: Visualize Chapter 10 signals for selected flow (saves plot files)
- **t**: Toggle timeline panel on/off
- **d**: Switch to frame dissection view
@@ -194,9 +257,14 @@ streamlens/
│ │ ├── main_window.py # PySide6 main window with docking system
│ │ └── dock_panels.py # Dockable panel implementations (flow list, plots, details)
│ ├── tui/ # Text User Interface
│ │ ├── interface.py # Main TUI controller
│ │ ├── interface.py # Classic TUI controller
│ │ ├── modern_interface.py # Modern TUI with three-view interface
│ │ ├── navigation.py # Navigation handling
│ │ ── panels/ # UI panel components
│ │ ── modern_views/ # Modern TUI view controllers
│ │ │ ├── flow_analysis.py # Flow Analysis View (F1)
│ │ │ ├── packet_decoder.py # Packet Decoder View (F2)
│ │ │ └── statistical_analysis.py # Statistical Analysis View (F3)
│ │ └── panels/ # Classic TUI panel components
│ │ ├── flow_list.py # Flow list panel
│ │ ├── detail_panel.py # Flow details panel
│ │ └── timeline.py # Timeline visualization panel