network-core 0.5.2__tar.gz → 0.5.4__tar.gz

{network_core-0.5.2 → network_core-0.5.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: network_core
-Version: 0.5.2
+Version: 0.5.4
 Summary: Core networking utilities and data models
 Author: Your Name
 Requires-Python: >=3.9

{network_core-0.5.2 → network_core-0.5.4}/network_core/__init__.py

@@ -16,3 +16,4 @@ from .analysis import (
     conn_features,
     nan_to_none,
 )
+from .pcap import process_pcap, process_pcap_auto, process_pcap_tree

{network_core-0.5.2 → network_core-0.5.4}/network_core/analysis.py

@@ -300,8 +300,11 @@ def conn_features(
 
     ub = _burst_stats(lengths, timestamps, directions, direction=0, gap_ms=500)
 
-    small_ups   = up_len[up_len < 200]
-    idle_up_med = float(np.median(small_ups)) if len(small_ups) >= 3 else float("nan")
+    # Median size (bytes) of upload packets < 200 B — captures the ACK/header
+    # packet baseline. Agents send large bursts separated by pure ACK traffic
+    # (66 B), while chat sessions mix in more small-but-nonzero request packets.
+    small_ups        = up_len[up_len < 200]
+    up_small_pkt_med = float(np.median(small_ups)) if len(small_ups) >= 3 else float("nan")
 
     pattern = _classify_pattern(
         n_pkts=n_pkts,
@@ -378,7 +381,7 @@ def conn_features(
         "up_interburst_cv":      ub["interburst_cv"],
         "up_interburst_p95_ms":  ub["interburst_p95_ms"],
         "ttfb_ms":               ttfb_ms,
-        "idle_up_med":           idle_up_med,
+        "up_small_pkt_med":      up_small_pkt_med,
         "traffic_pattern":       pattern,
     }
 

network_core-0.5.4/network_core/pcap.py

@@ -0,0 +1,99 @@
+"""Wrapper around the bundled process_pcap Go binary."""
+
+import os
+import signal
+import subprocess
+from pathlib import Path
+
+_BIN = Path(__file__).parent / "bin" / "process_pcap"
+
+
+def _ensure_binary() -> Path:
+    if not _BIN.exists():
+        raise RuntimeError(
+            f"process_pcap binary not found at {_BIN}. "
+            "Run `make build` in the network_core repo root."
+        )
+    return _BIN
+
+
+def process_pcap(pcap_path: str, flows_path: str, packets_path: str) -> None:
+    """Run the Go flow extractor on a single pcap file.
+
+    Writes {flows_path} and {packets_path} as flat CSVs.
+    Removes stale outputs before running so partial prior runs never linger.
+    Blocks until the Go process exits.
+    """
+    pcap = Path(pcap_path)
+    if not pcap.exists():
+        raise FileNotFoundError(f"pcap not found: {pcap_path}")
+    if pcap.suffix not in {".pcap", ".pcapng"}:
+        raise ValueError(f"Expected .pcap or .pcapng, got: {pcap.name}")
+
+    Path(flows_path).unlink(missing_ok=True)
+    Path(packets_path).unlink(missing_ok=True)
+
+    result = subprocess.run(
+        [str(_ensure_binary()), str(pcap), flows_path, packets_path],
+        capture_output=True,
+        text=True,
+    )
+    if result.returncode != 0:
+        raise RuntimeError(
+            f"process_pcap failed (exit {result.returncode}):\n{result.stderr.strip()}"
+        )
+
+
+def _derive_output_paths(pcap_path: str) -> tuple[str, str]:
+    """Return (flows_path, packets_path) derived from a pcap file path."""
+    p = Path(pcap_path)
+    stem = p.stem
+    return str(p.parent / f"{stem}Flows.csv"), str(p.parent / f"{stem}Packets.csv")
+
+
+def process_pcap_auto(pcap_path: str) -> tuple[str, str]:
+    """Run process_pcap with output paths derived from the pcap filename.
+
+    Returns (flows_path, packets_path).
+    """
+    flows_path, packets_path = _derive_output_paths(pcap_path)
+    process_pcap(pcap_path, flows_path, packets_path)
+    return flows_path, packets_path
+
+
+def _iter_pcaps(root: str):
+    """Yield (pcap_path, flows_path, packets_path) for every pcap under root."""
+    p = Path(root)
+    if p.is_dir():
+        for child in p.iterdir():
+            yield from _iter_pcaps(str(child))
+    elif p.suffix in {".pcap", ".pcapng"}:
+        flows, packets = _derive_output_paths(str(p))
+        yield str(p.resolve()), str(Path(flows).resolve()), str(Path(packets).resolve())
+
+
+def process_pcap_tree(root: str, force: bool = False) -> None:
+    """Run process_pcap on every pcap file found recursively under root.
+
+    Skips files whose output CSVs already exist unless force=True.
+    Runs in a new process group so Ctrl-C cleanly kills the subprocess.
+    """
+    for pcap_path, flows_path, packets_path in _iter_pcaps(root):
+        if not force and Path(flows_path).exists() and Path(packets_path).exists():
+            print(f"Skipping {Path(pcap_path).name} (outputs already exist)")
+            continue
+
+        Path(flows_path).unlink(missing_ok=True)
+        Path(packets_path).unlink(missing_ok=True)
+
+        proc = subprocess.Popen(
+            [str(_ensure_binary()), pcap_path, flows_path, packets_path],
+            preexec_fn=os.setsid,
+        )
+        try:
+            proc.wait()
+        except KeyboardInterrupt:
+            os.killpg(proc.pid, signal.SIGTERM)
+            raise
+        if proc.returncode != 0:
+            raise RuntimeError(f"process_pcap failed (exit {proc.returncode}) on {pcap_path}")

{network_core-0.5.2 → network_core-0.5.4}/network_core.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: network_core
-Version: 0.5.2
+Version: 0.5.4
 Summary: Core networking utilities and data models
 Author: Your Name
 Requires-Python: >=3.9

{network_core-0.5.2 → network_core-0.5.4}/network_core.egg-info/SOURCES.txt

@@ -4,11 +4,13 @@ network_core/analysis.py
 network_core/conn.py
 network_core/connOps.py
 network_core/dataModels.py
+network_core/pcap.py
 network_core.egg-info/PKG-INFO
 network_core.egg-info/SOURCES.txt
 network_core.egg-info/dependency_links.txt
 network_core.egg-info/requires.txt
 network_core.egg-info/top_level.txt
+network_core/bin/process_pcap
 network_core/http/__init__.py
 network_core/http/httpIO.py
 network_core/http/httpExtract/__init__.py

{network_core-0.5.2 → network_core-0.5.4}/network_core.egg-info/top_level.txt

@@ -1,2 +1,3 @@
 dist
+go_src
 network_core

{network_core-0.5.2 → network_core-0.5.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "network_core"
-version = "0.5.2"
+version = "0.5.4"
 description = "Core networking utilities and data models"
 authors = [{ name = "Your Name" }]
 readme = "README.md"
@@ -22,4 +22,7 @@ requires = ["setuptools>=61.0"]
 build-backend = "setuptools.build_meta"
 
 [tool.setuptools.packages.find]
-where = ["."]
+where = ["."]
+
+[tool.setuptools.package-data]
+network_core = ["bin/process_pcap"]