tabbed frametype filtering

debug_tui_flow_updates.py

@@ -0,0 +1,124 @@
+#!/usr/bin/env python3
+"""Debug TUI flow update process to find frame 2002/298 issue"""
+
+import sys
+sys.path.append('.')
+
+from analyzer.analysis import EthernetAnalyzer
+from analyzer.analysis.background_analyzer import BackgroundAnalyzer
+import time
+
+def debug_tui_flow_updates(pcap_file="1 PTPGM.pcapng", src_ip="192.168.4.89"):
+    """Debug TUI flow update process"""
+    
+    print("=== Debugging TUI Flow Update Process ===")
+    
+    # Create analyzer exactly like TUI does
+    analyzer = EthernetAnalyzer(enable_realtime=False, outlier_threshold_sigma=3.0)
+    
+    # Track flow updates like TUI does
+    update_count = 0
+    outlier_snapshots = []
+    
+    def flow_update_callback():
+        nonlocal update_count, outlier_snapshots
+        update_count += 1
+        
+        # Capture outlier state at each update (like TUI does)
+        try:
+            flows = bg_analyzer.get_current_flows()
+            for flow in flows.values():
+                if flow.src_ip == src_ip:
+                    # Check for problematic outliers at each update
+                    for frame_type, ft_stats in flow.frame_types.items():
+                        if hasattr(ft_stats, 'enhanced_outlier_details') and ft_stats.enhanced_outlier_details:
+                            for frame_num, prev_frame_num, delta_t in ft_stats.enhanced_outlier_details:
+                                # Look for the problematic case
+                                if frame_num == 2002 or prev_frame_num == 298:
+                                    outlier_snapshots.append({
+                                        'update': update_count,
+                                        'frame_type': frame_type,
+                                        'frame_num': frame_num,
+                                        'prev_frame_num': prev_frame_num,
+                                        'delta_t': delta_t,
+                                        'timestamp': time.time()
+                                    })
+                                    print(f"Update {update_count}: Found {frame_type} Frame {frame_num} (from {prev_frame_num})")
+                    break
+        except Exception as e:
+            print(f"Error in flow update callback: {e}")
+    
+    # Create background analyzer with flow updates like TUI
+    bg_analyzer = BackgroundAnalyzer(
+        analyzer,
+        num_threads=4,  # TUI uses multiple threads
+        flow_update_callback=flow_update_callback
+    )
+    
+    print(f"Starting background parsing with flow updates...")
+    bg_analyzer.start_parsing(pcap_file)
+    
+    # Monitor progress
+    while bg_analyzer.is_parsing:
+        time.sleep(0.1)
+    
+    print(f"Parsing complete. Total flow updates: {update_count}")
+    
+    if outlier_snapshots:
+        print(f"\n🔍 FOUND PROBLEMATIC OUTLIERS: {len(outlier_snapshots)}")
+        for snapshot in outlier_snapshots:
+            print(f"  Update {snapshot['update']}: {snapshot['frame_type']} Frame {snapshot['frame_num']} (from {snapshot['prev_frame_num']}): {snapshot['delta_t']*1000:.3f} ms")
+    else:
+        print(f"\n❌ No problematic outliers found during flow updates")
+    
+    # Final check of all outliers
+    print(f"\n=== Final State ===")
+    flows = bg_analyzer.get_current_flows()
+    for flow in flows.values():
+        if flow.src_ip == src_ip:
+            total_outliers = 0
+            for frame_type, ft_stats in flow.frame_types.items():
+                outlier_count = len(ft_stats.outlier_frames)
+                total_outliers += outlier_count
+                if outlier_count > 0:
+                    print(f"{frame_type}: {outlier_count} outliers")
+                    
+                    # Show enhanced details if available
+                    if hasattr(ft_stats, 'enhanced_outlier_details') and ft_stats.enhanced_outlier_details:
+                        for frame_num, prev_frame_num, delta_t in ft_stats.enhanced_outlier_details[:3]:
+                            deviation = (delta_t - ft_stats.avg_inter_arrival) / ft_stats.std_inter_arrival if ft_stats.std_inter_arrival > 0 else 0
+                            print(f"  Frame {frame_num} (from {prev_frame_num}): {delta_t * 1000:.3f} ms ({deviation:.1f}σ)")
+                        if len(ft_stats.enhanced_outlier_details) > 3:
+                            print(f"  ... and {len(ft_stats.enhanced_outlier_details) - 3} more")
+            
+            print(f"Total outliers: {total_outliers}")
+            break
+    
+    # Test if there might be a threading issue by running single-threaded
+    print(f"\n=== Testing Single-threaded Background Analyzer ===")
+    analyzer_single = EthernetAnalyzer(enable_realtime=False, outlier_threshold_sigma=3.0)
+    bg_analyzer_single = BackgroundAnalyzer(analyzer_single, num_threads=1)
+    
+    bg_analyzer_single.start_parsing(pcap_file)
+    while bg_analyzer_single.is_parsing:
+        time.sleep(0.1)
+    
+    flows_single = bg_analyzer_single.get_current_flows()
+    for flow in flows_single.values():
+        if flow.src_ip == src_ip:
+            # Check for the problematic outlier
+            for frame_type, ft_stats in flow.frame_types.items():
+                if hasattr(ft_stats, 'enhanced_outlier_details') and ft_stats.enhanced_outlier_details:
+                    for frame_num, prev_frame_num, delta_t in ft_stats.enhanced_outlier_details:
+                        if frame_num == 2002 or prev_frame_num == 298:
+                            print(f"Single-threaded: {frame_type} Frame {frame_num} (from {prev_frame_num})")
+            break
+    
+    bg_analyzer.cleanup()
+    bg_analyzer_single.cleanup()
+
+if __name__ == "__main__":
+    if len(sys.argv) > 1:
+        debug_tui_flow_updates(sys.argv[1])
+    else:
+        debug_tui_flow_updates()