noisedestroyers/StreamLens
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tabbed frametype filtering

Browse Source
This commit is contained in:
noisedestroyers
2025-07-30 23:48:32 -04:00
parent 8d883f25c3
commit bb3eeb79d0
92 changed files with 33696 additions and 139 deletions
Download Patch File Download Diff File Expand all files Collapse all files

73
analyzer/main.py
View File

@@ -13,6 +13,7 @@ from .tui import TUIInterface
from .tui.modern_interface import ModernTUIInterface
from .tui.textual.app_v2 import StreamLensAppV2
from .utils import PCAPLoader, LiveCapture
from .reporting import FlowReportGenerator
def main():
@@ -28,6 +29,10 @@ def main():
help='Outlier detection threshold in standard deviations (default: 3.0)')
parser.add_argument('--report', action='store_true',
help='Generate comprehensive outlier report and exit (no TUI)')
parser.add_argument('--flow-report', metavar='OUTPUT_FILE',
help='Generate comprehensive flow analysis report to specified file and exit')
parser.add_argument('--report-format', choices=['markdown', 'html', 'text'], default='markdown',
help='Report output format (default: markdown)')
parser.add_argument('--gui', action='store_true',
help='Launch GUI mode (requires PySide6)')
parser.add_argument('--classic', action='store_true',
@@ -114,6 +119,11 @@ def main():
generate_outlier_report(analyzer, args.outlier_threshold)
return
# Handle flow report mode
if args.flow_report:
generate_flow_report(analyzer, args.flow_report, args.report_format)
return
# TUI mode - choose between classic, modern curses, and textual interface
if args.textual:
# Use new Textual-based interface (TipTop-inspired) with background parsing
@@ -251,6 +261,31 @@ def print_console_results(analyzer: EthernetAnalyzer):
print(f"{flow.src_ip} -> {flow.dst_ip}: CV = {cv:.3f}")
def generate_flow_report(analyzer: EthernetAnalyzer, output_file: str, format_type: str):
"""Generate comprehensive flow analysis report"""
print(f"Generating {format_type} flow analysis report...")
try:
# Create report generator
report_generator = FlowReportGenerator(analyzer)
# Generate report
report_content = report_generator.generate_report(output_file, format_type)
print(f"✅ Flow analysis report generated successfully!")
print(f"📄 Output file: {output_file}")
print(f"📊 Format: {format_type}")
print(f"📈 Flows analyzed: {len(analyzer.flows)}")
# Show preview of report length
lines = report_content.count('\n')
print(f"📝 Report length: {lines} lines")
except Exception as e:
print(f"❌ Error generating flow report: {e}")
sys.exit(1)
def generate_outlier_report(analyzer: EthernetAnalyzer, threshold_sigma: float):
"""Generate comprehensive outlier report without TUI"""
summary = analyzer.get_summary()
@@ -334,18 +369,34 @@ def generate_outlier_report(analyzer: EthernetAnalyzer, threshold_sigma: float):
threshold = ft_stats.avg_inter_arrival + (threshold_sigma * ft_stats.std_inter_arrival)
print(f" Threshold: {threshold:.6f}s (>{threshold_sigma}σ from mean {ft_stats.avg_inter_arrival:.6f}s)")
print(f" {'Frame#':<10} {'Inter-arrival':<15} {'Deviation':<12}")
print(f" {'-' * 10} {'-' * 15} {'-' * 12}")
for frame_num, inter_arrival_time in ft_stats.outlier_details:
if ft_stats.avg_inter_arrival > 0:
deviation = inter_arrival_time - ft_stats.avg_inter_arrival
sigma_dev = deviation / ft_stats.std_inter_arrival if ft_stats.std_inter_arrival > 0 else 0
dev_str = f"+{sigma_dev:.1f}σ"
else:
dev_str = "N/A"
# Use enhanced outlier details if available
if hasattr(ft_stats, 'enhanced_outlier_details') and ft_stats.enhanced_outlier_details:
print(f" {'Frame#':<10} {'From Frame':<10} {'Inter-arrival':<15} {'Deviation':<12}")
print(f" {'-' * 10} {'-' * 10} {'-' * 15} {'-' * 12}")
print(f" {frame_num:<10} {inter_arrival_time:.6f}s{'':<3} {dev_str:<12}")
for frame_num, prev_frame_num, inter_arrival_time in ft_stats.enhanced_outlier_details:
if ft_stats.avg_inter_arrival > 0:
deviation = inter_arrival_time - ft_stats.avg_inter_arrival
sigma_dev = deviation / ft_stats.std_inter_arrival if ft_stats.std_inter_arrival > 0 else 0
dev_str = f"+{sigma_dev:.1f}σ"
else:
dev_str = "N/A"
print(f" {frame_num:<10} {prev_frame_num:<10} {inter_arrival_time:.6f}s{'':<3} {dev_str:<12}")
else:
# Fallback to legacy outlier details
print(f" {'Frame#':<10} {'Inter-arrival':<15} {'Deviation':<12}")
print(f" {'-' * 10} {'-' * 15} {'-' * 12}")
for frame_num, inter_arrival_time in ft_stats.outlier_details:
if ft_stats.avg_inter_arrival > 0:
deviation = inter_arrival_time - ft_stats.avg_inter_arrival
sigma_dev = deviation / ft_stats.std_inter_arrival if ft_stats.std_inter_arrival > 0 else 0
dev_str = f"+{sigma_dev:.1f}σ"
else:
dev_str = "N/A"
print(f" {frame_num:<10} {inter_arrival_time:.6f}s{'':<3} {dev_str:<12}")
# High jitter flows summary
high_jitter = analyzer.get_high_jitter_flows()