139 lines
5.4 KiB
Python
139 lines
5.4 KiB
Python
#!/usr/bin/env python3
|
|
"""Debug frame 475 classification issue"""
|
|
|
|
import sys
|
|
sys.path.append('.')
|
|
|
|
from analyzer.analysis import EthernetAnalyzer
|
|
from analyzer.utils import PCAPLoader
|
|
|
|
def debug_frame_475(pcap_file="1 PTPGM.pcapng", src_ip="192.168.4.89"):
|
|
"""Debug why frame 475 is not in CH10-Data"""
|
|
|
|
print("=== Debugging Frame 475 Classification ===")
|
|
|
|
analyzer = EthernetAnalyzer(enable_realtime=False, outlier_threshold_sigma=3.0)
|
|
|
|
loader = PCAPLoader(pcap_file)
|
|
packets = loader.load_all()
|
|
|
|
# Track frame 475 specifically during processing
|
|
frame_475_details = None
|
|
|
|
for i, packet in enumerate(packets, 1):
|
|
if i == 475:
|
|
# Manually dissect to see the raw data_type_name
|
|
try:
|
|
dissection_results = analyzer.flow_manager._dissect_packet(packet, i)
|
|
layers = dissection_results.get('layers', {})
|
|
|
|
if 'chapter10' in layers and not layers['chapter10'].get('error'):
|
|
ch10_info = layers['chapter10']
|
|
if 'decoded_payload' in ch10_info:
|
|
decoded = ch10_info['decoded_payload']
|
|
data_type_name = decoded.get('data_type_name', 'Unknown')
|
|
|
|
# Classify using current logic
|
|
classified_type = analyzer.flow_manager._classify_frame_type(packet, dissection_results)
|
|
|
|
frame_475_details = {
|
|
'data_type_name': data_type_name,
|
|
'classified_as': classified_type
|
|
}
|
|
|
|
print(f"Frame 475: data_type_name='{data_type_name}' -> classified as '{classified_type}'")
|
|
except Exception as e:
|
|
print(f"Error dissecting frame 475: {e}")
|
|
|
|
analyzer._process_single_packet(packet, i)
|
|
|
|
analyzer.calculate_statistics()
|
|
|
|
# Find test flow
|
|
test_flow = None
|
|
for flow_key, flow in analyzer.flows.items():
|
|
if flow.src_ip == src_ip:
|
|
test_flow = flow
|
|
break
|
|
|
|
if not test_flow:
|
|
print(f"❌ No flow found from {src_ip}")
|
|
return
|
|
|
|
print(f"\n✅ Found flow: {test_flow.src_ip}:{test_flow.src_port} → {test_flow.dst_ip}:{test_flow.dst_port}")
|
|
|
|
# Check which frame type frame 475 ended up in
|
|
print(f"\n=== Frame 475 Final Classification ===")
|
|
found_frame_475 = False
|
|
|
|
for frame_type, ft_stats in test_flow.frame_types.items():
|
|
if 475 in ft_stats.frame_numbers:
|
|
frame_index = ft_stats.frame_numbers.index(475)
|
|
timestamp = ft_stats.timestamps[frame_index]
|
|
print(f"Frame 475 found in: {frame_type} (index {frame_index})")
|
|
print(f" Timestamp: {timestamp}")
|
|
found_frame_475 = True
|
|
|
|
# Show sequence around frame 475 in this frame type
|
|
start_idx = max(0, frame_index - 3)
|
|
end_idx = min(len(ft_stats.frame_numbers), frame_index + 4)
|
|
|
|
print(f" Sequence in {frame_type}:")
|
|
for i in range(start_idx, end_idx):
|
|
marker = " -> " if i == frame_index else " "
|
|
frame_num = ft_stats.frame_numbers[i]
|
|
print(f"{marker}[{i}] Frame {frame_num}")
|
|
break
|
|
|
|
if not found_frame_475:
|
|
print("❌ Frame 475 not found in any frame type!")
|
|
|
|
# Check CH10-Data sequence around where frame 475 should be
|
|
ch10_data_stats = test_flow.frame_types.get('CH10-Data')
|
|
if ch10_data_stats:
|
|
print(f"\n=== CH10-Data Sequence Around Frame 475 ===")
|
|
|
|
# Find frames around 475 in CH10-Data
|
|
nearby_frames = []
|
|
for i, frame_num in enumerate(ch10_data_stats.frame_numbers):
|
|
if abs(frame_num - 475) <= 5:
|
|
nearby_frames.append((i, frame_num))
|
|
|
|
print(f"CH10-Data frames near 475:")
|
|
for index, frame_num in nearby_frames:
|
|
marker = " -> " if frame_num == 476 else " "
|
|
print(f"{marker}[{index}] Frame {frame_num}")
|
|
|
|
# Show timing analysis around frame 475-476
|
|
print(f"\n=== Timing Analysis Around 475-476 ===")
|
|
|
|
# Get all CH10 frames (any type) and sort by frame number
|
|
all_ch10_frames = []
|
|
for frame_type, ft_stats in test_flow.frame_types.items():
|
|
if frame_type.startswith('CH10'):
|
|
for i, frame_num in enumerate(ft_stats.frame_numbers):
|
|
timestamp = ft_stats.timestamps[i]
|
|
all_ch10_frames.append((frame_num, timestamp, frame_type))
|
|
|
|
# Sort by frame number
|
|
all_ch10_frames.sort(key=lambda x: x[0])
|
|
|
|
# Show frames around 475-476
|
|
for i, (frame_num, timestamp, frame_type) in enumerate(all_ch10_frames):
|
|
if 473 <= frame_num <= 478:
|
|
# Calculate delta from previous frame
|
|
if i > 0:
|
|
prev_timestamp = all_ch10_frames[i-1][1]
|
|
delta_t = timestamp - prev_timestamp
|
|
delta_str = f"Δt: {delta_t*1000:.1f}ms"
|
|
else:
|
|
delta_str = ""
|
|
|
|
marker = " -> " if frame_num in [475, 476] else " "
|
|
print(f"{marker}Frame {frame_num}: {frame_type} {delta_str}")
|
|
|
|
if __name__ == "__main__":
|
|
if len(sys.argv) > 1:
|
|
debug_frame_475(sys.argv[1])
|
|
else:
|
|
debug_frame_475() |