package protocol

import (
    "context"
    "sync"
    "time"
    "net"
    "fmt"
    "encoding/binary"
    "github.com/google/gopacket"
    "github.com/google/gopacket/pcap"
    "github.com/google/gopacket/layers"
    "github.com/google/gopacket/pcapgo"
)

type CaptureFilter struct {
    InterfaceName   string            `json:"interface_name"`
    BPFFilter      string            `json:"bpf_filter"`
    SnapLength     int32             `json:"snap_length"`
    Promiscuous    bool              `json:"promiscuous"`
    Timeout        time.Duration     `json:"timeout"`
    Direction      CaptureDirection  `json:"direction"`
    PacketLimit    int               `json:"packet_limit"`
    SizeLimit      int64             `json:"size_limit"`
    TimeLimit      time.Duration     `json:"time_limit"`
}

type CaptureDirection int

const (
    DirectionBoth CaptureDirection = iota
    DirectionIn
    DirectionOut
)

type PacketInfo struct {
    Timestamp       time.Time                 `json:"timestamp"`
    Length          int                       `json:"length"`
    CaptureLength   int                       `json:"capture_length"`
    InterfaceIndex  int                       `json:"interface_index"`
    PacketType      string                    `json:"packet_type"`
    Direction       CaptureDirection          `json:"direction"`
    LayerInfo       map[string]LayerAnalysis  `json:"layer_info"`
    ProtocolStack   []string                  `json:"protocol_stack"`
    FlowKey         string                    `json:"flow_key"`
    ApplicationData []byte                    `json:"application_data,omitempty"`
}

type LayerAnalysis struct {
    LayerType    string                 `json:"layer_type"`
    Length       int                    `json:"length"`
    HeaderSize   int                    `json:"header_size"`
    PayloadSize  int                    `json:"payload_size"`
    Fields       map[string]interface{} `json:"fields"`
    Flags        []string               `json:"flags"`
    Checksums    map[string]bool        `json:"checksums"`
    Errors       []string               `json:"errors"`
}

type FlowInfo struct {
    FlowKey         string                    `json:"flow_key"`
    SourceIP        net.IP                    `json:"source_ip"`
    DestinationIP   net.IP                    `json:"destination_ip"`
    SourcePort      uint16                    `json:"source_port"`
    DestinationPort uint16                    `json:"destination_port"`
    Protocol        string                    `json:"protocol"`
    FirstSeen       time.Time                 `json:"first_seen"`
    LastSeen        time.Time                 `json:"last_seen"`
    PacketCount     uint64                    `json:"packet_count"`
    ByteCount       uint64                    `json:"byte_count"`
    Direction       string                    `json:"direction"`
    State           FlowState                 `json:"state"`
    ApplicationInfo ApplicationFlowInfo       `json:"application_info"`
    PerformanceMetrics FlowPerformanceMetrics `json:"performance_metrics"`
}

type FlowState int

const (
    FlowStateNew FlowState = iota
    FlowStateEstablished
    FlowStateClosing
    FlowStateClosed
    FlowStateTimeout
)

type ApplicationFlowInfo struct {
    Application     string            `json:"application"`
    Version         string            `json:"version"`
    UserAgent       string            `json:"user_agent"`
    ContentType     string            `json:"content_type"`
    Encryption      bool              `json:"encryption"`
    CipherSuite     string            `json:"cipher_suite"`
    Certificates    []string          `json:"certificates"`
    HttpMethods     []string          `json:"http_methods"`
    HostNames       []string          `json:"host_names"`
}

type FlowPerformanceMetrics struct {
    RTT             time.Duration     `json:"rtt"`
    Jitter          time.Duration     `json:"jitter"`
    PacketLoss      float64           `json:"packet_loss"`
    Retransmissions uint32            `json:"retransmissions"`
    OutOfOrder      uint32            `json:"out_of_order"`
    WindowSize      uint32            `json:"window_size"`
    Throughput      float64           `json:"throughput"`
}

type ProtocolAnalyzer struct {
    CaptureEngine     *PacketCaptureEngine
    FlowTracker       *FlowTracker
    ProtocolDecoders  map[string]ProtocolDecoder
    AnomalyDetector   *ProtocolAnomalyDetector
    PerformanceAnalyzer *ProtocolPerformanceAnalyzer
    SecurityAnalyzer  *ProtocolSecurityAnalyzer
    ReportGenerator   *AnalysisReportGenerator
    mutex             sync.RWMutex
}

func NewProtocolAnalyzer() *ProtocolAnalyzer {
    return &ProtocolAnalyzer{
        CaptureEngine:     NewPacketCaptureEngine(),
        FlowTracker:       NewFlowTracker(),
        ProtocolDecoders:  make(map[string]ProtocolDecoder),
        AnomalyDetector:   NewProtocolAnomalyDetector(),
        PerformanceAnalyzer: NewProtocolPerformanceAnalyzer(),
        SecurityAnalyzer:  NewProtocolSecurityAnalyzer(),
        ReportGenerator:   NewAnalysisReportGenerator(),
    }
}

func (pa *ProtocolAnalyzer) StartCapture(ctx context.Context, filter CaptureFilter) error {
    // Initialize capture session
    handle, err := pcap.OpenLive(
        filter.InterfaceName,
        filter.SnapLength,
        filter.Promiscuous,
        filter.Timeout,
    )
    if err != nil {
        return fmt.Errorf("failed to open capture: %v", err)
    }
    defer handle.Close()

    // Apply BPF filter
    if filter.BPFFilter != "" {
        err = handle.SetBPFFilter(filter.BPFFilter)
        if err != nil {
            return fmt.Errorf("failed to set BPF filter: %v", err)
        }
    }

    // Create packet source
    packetSource := gopacket.NewPacketSource(handle, handle.LinkType())

    // Start packet processing
    packetCount := 0
    startTime := time.Now()

    for packet := range packetSource.Packets() {
        select {
        case <-ctx.Done():
            return ctx.Err()
        default:
            // Process packet
            err := pa.processPacket(packet)
            if err != nil {
                continue // Log error but continue processing
            }

            packetCount++

            // Check limits
            if filter.PacketLimit > 0 && packetCount >= filter.PacketLimit {
                return nil
            }

            if filter.TimeLimit > 0 && time.Since(startTime) >= filter.TimeLimit {
                return nil
            }
        }
    }

    return nil
}

func (pa *ProtocolAnalyzer) processPacket(packet gopacket.Packet) error {
    // Extract packet information
    packetInfo := pa.extractPacketInfo(packet)
    
    // Update flow tracking
    pa.FlowTracker.UpdateFlow(packetInfo)
    
    // Perform protocol-specific analysis
    for _, decoder := range pa.ProtocolDecoders {
        decoder.AnalyzePacket(packetInfo)
    }
    
    // Check for anomalies
    anomalies := pa.AnomalyDetector.DetectAnomalies(packetInfo)
    if len(anomalies) > 0 {
        pa.handleAnomalies(packetInfo, anomalies)
    }
    
    // Update performance metrics
    pa.PerformanceAnalyzer.UpdateMetrics(packetInfo)
    
    // Security analysis
    securityAlerts := pa.SecurityAnalyzer.AnalyzePacket(packetInfo)
    if len(securityAlerts) > 0 {
        pa.handleSecurityAlerts(packetInfo, securityAlerts)
    }
    
    return nil
}

func (pa *ProtocolAnalyzer) extractPacketInfo(packet gopacket.Packet) PacketInfo {
    packetInfo := PacketInfo{
        Timestamp:     packet.Metadata().Timestamp,
        Length:        packet.Metadata().Length,
        CaptureLength: packet.Metadata().CaptureLength,
        LayerInfo:     make(map[string]LayerAnalysis),
        ProtocolStack: []string{},
        FlowKey:       "",
    }

    // Analyze each layer
    for _, layer := range packet.Layers() {
        layerType := layer.LayerType().String()
        layerAnalysis := pa.analyzeLayer(layer)
        
        packetInfo.LayerInfo[layerType] = layerAnalysis
        packetInfo.ProtocolStack = append(packetInfo.ProtocolStack, layerType)
    }

    // Generate flow key
    packetInfo.FlowKey = pa.generateFlowKey(packet)

    return packetInfo
}

func (pa *ProtocolAnalyzer) analyzeLayer(layer gopacket.Layer) LayerAnalysis {
    analysis := LayerAnalysis{
        LayerType:   layer.LayerType().String(),
        Length:      len(layer.LayerContents()) + len(layer.LayerPayload()),
        HeaderSize:  len(layer.LayerContents()),
        PayloadSize: len(layer.LayerPayload()),
        Fields:      make(map[string]interface{}),
        Flags:       []string{},
        Checksums:   make(map[string]bool),
        Errors:      []string{},
    }

    // Layer-specific analysis
    switch layer.LayerType() {
    case layers.LayerTypeEthernet:
        pa.analyzeEthernetLayer(layer.(*layers.Ethernet), &analysis)
    case layers.LayerTypeIPv4:
        pa.analyzeIPv4Layer(layer.(*layers.IPv4), &analysis)
    case layers.LayerTypeIPv6:
        pa.analyzeIPv6Layer(layer.(*layers.IPv6), &analysis)
    case layers.LayerTypeTCP:
        pa.analyzeTCPLayer(layer.(*layers.TCP), &analysis)
    case layers.LayerTypeUDP:
        pa.analyzeUDPLayer(layer.(*layers.UDP), &analysis)
    case layers.LayerTypeICMPv4:
        pa.analyzeICMPv4Layer(layer.(*layers.ICMPv4), &analysis)
    case layers.LayerTypeDNS:
        pa.analyzeDNSLayer(layer.(*layers.DNS), &analysis)
    case layers.LayerTypeHTTP:
        pa.analyzeHTTPLayer(layer, &analysis)
    }

    return analysis
}

func (pa *ProtocolAnalyzer) analyzeIPv4Layer(ipv4 *layers.IPv4, analysis *LayerAnalysis) {
    analysis.Fields["version"] = ipv4.Version
    analysis.Fields["ihl"] = ipv4.IHL
    analysis.Fields["tos"] = ipv4.TOS
    analysis.Fields["length"] = ipv4.Length
    analysis.Fields["id"] = ipv4.Id
    analysis.Fields["ttl"] = ipv4.TTL
    analysis.Fields["protocol"] = ipv4.Protocol.String()
    analysis.Fields["src_ip"] = ipv4.SrcIP.String()
    analysis.Fields["dst_ip"] = ipv4.DstIP.String()
    analysis.Fields["checksum"] = ipv4.Checksum

    // Validate checksum
    analysis.Checksums["header"] = pa.validateIPv4Checksum(ipv4)

    // Check for flags
    if ipv4.Flags&layers.IPv4DontFragment != 0 {
        analysis.Flags = append(analysis.Flags, "DF")
    }
    if ipv4.Flags&layers.IPv4MoreFragments != 0 {
        analysis.Flags = append(analysis.Flags, "MF")
    }

    // Check for fragmentation
    if ipv4.FragOffset > 0 {
        analysis.Fields["fragmented"] = true
        analysis.Fields["frag_offset"] = ipv4.FragOffset
    }

    // Validate header length
    if ipv4.IHL < 5 || ipv4.IHL > 15 {
        analysis.Errors = append(analysis.Errors, "Invalid IHL value")
    }

    // Check for reserved bit
    if ipv4.Flags&0x4 != 0 {
        analysis.Errors = append(analysis.Errors, "Reserved bit set")
    }
}

func (pa *ProtocolAnalyzer) analyzeTCPLayer(tcp *layers.TCP, analysis *LayerAnalysis) {
    analysis.Fields["src_port"] = tcp.SrcPort
    analysis.Fields["dst_port"] = tcp.DstPort
    analysis.Fields["seq"] = tcp.Seq
    analysis.Fields["ack"] = tcp.Ack
    analysis.Fields["data_offset"] = tcp.DataOffset
    analysis.Fields["window"] = tcp.Window
    analysis.Fields["checksum"] = tcp.Checksum
    analysis.Fields["urgent"] = tcp.Urgent

    // Analyze TCP flags
    if tcp.FIN {
        analysis.Flags = append(analysis.Flags, "FIN")
    }
    if tcp.SYN {
        analysis.Flags = append(analysis.Flags, "SYN")
    }
    if tcp.RST {
        analysis.Flags = append(analysis.Flags, "RST")
    }
    if tcp.PSH {
        analysis.Flags = append(analysis.Flags, "PSH")
    }
    if tcp.ACK {
        analysis.Flags = append(analysis.Flags, "ACK")
    }
    if tcp.URG {
        analysis.Flags = append(analysis.Flags, "URG")
    }
    if tcp.ECE {
        analysis.Flags = append(analysis.Flags, "ECE")
    }
    if tcp.CWR {
        analysis.Flags = append(analysis.Flags, "CWR")
    }
    if tcp.NS {
        analysis.Flags = append(analysis.Flags, "NS")
    }

    // Analyze TCP options
    if len(tcp.Options) > 0 {
        options := make(map[string]interface{})
        for _, option := range tcp.Options {
            switch option.OptionType {
            case layers.TCPOptionKindMSS:
                if len(option.OptionData) >= 2 {
                    mss := binary.BigEndian.Uint16(option.OptionData)
                    options["mss"] = mss
                }
            case layers.TCPOptionKindWindowScale:
                if len(option.OptionData) >= 1 {
                    options["window_scale"] = option.OptionData[0]
                }
            case layers.TCPOptionKindSACKPermitted:
                options["sack_permitted"] = true
            case layers.TCPOptionKindTimestamps:
                if len(option.OptionData) >= 8 {
                    tsval := binary.BigEndian.Uint32(option.OptionData[0:4])
                    tsecr := binary.BigEndian.Uint32(option.OptionData[4:8])
                    options["timestamps"] = map[string]uint32{
                        "tsval": tsval,
                        "tsecr": tsecr,
                    }
                }
            }
        }
        analysis.Fields["options"] = options
    }

    // Validate data offset
    if tcp.DataOffset < 5 || tcp.DataOffset > 15 {
        analysis.Errors = append(analysis.Errors, "Invalid TCP data offset")
    }

    // Check for invalid flag combinations
    if tcp.SYN && tcp.FIN {
        analysis.Errors = append(analysis.Errors, "Invalid SYN+FIN combination")
    }
    if tcp.SYN && tcp.RST {
        analysis.Errors = append(analysis.Errors, "Invalid SYN+RST combination")
    }
}

type FlowTracker struct {
    flows       map[string]*FlowInfo
    timeouts    map[string]time.Time
    mutex       sync.RWMutex
    cleanupTicker *time.Ticker
}

func NewFlowTracker() *FlowTracker {
    ft := &FlowTracker{
        flows:    make(map[string]*FlowInfo),
        timeouts: make(map[string]time.Time),
    }
    
    // Start cleanup routine
    ft.cleanupTicker = time.NewTicker(30 * time.Second)
    go ft.cleanupExpiredFlows()
    
    return ft
}

func (ft *FlowTracker) UpdateFlow(packetInfo PacketInfo) {
    ft.mutex.Lock()
    defer ft.mutex.Unlock()

    flowKey := packetInfo.FlowKey
    if flowKey == "" {
        return
    }

    // Get or create flow
    flow, exists := ft.flows[flowKey]
    if !exists {
        flow = ft.createNewFlow(packetInfo)
        ft.flows[flowKey] = flow
    }

    // Update flow information
    flow.LastSeen = packetInfo.Timestamp
    flow.PacketCount++
    flow.ByteCount += uint64(packetInfo.Length)

    // Update flow state based on packet
    ft.updateFlowState(flow, packetInfo)

    // Update application information
    ft.updateApplicationInfo(flow, packetInfo)

    // Calculate performance metrics
    ft.updatePerformanceMetrics(flow, packetInfo)

    // Update timeout
    ft.timeouts[flowKey] = time.Now().Add(5 * time.Minute)
}

func (ft *FlowTracker) createNewFlow(packetInfo PacketInfo) *FlowInfo {
    flow := &FlowInfo{
        FlowKey:     packetInfo.FlowKey,
        FirstSeen:   packetInfo.Timestamp,
        LastSeen:    packetInfo.Timestamp,
        PacketCount: 0,
        ByteCount:   0,
        State:       FlowStateNew,
        ApplicationInfo: ApplicationFlowInfo{},
        PerformanceMetrics: FlowPerformanceMetrics{},
    }

    // Extract IP and port information
    if ethLayer, exists := packetInfo.LayerInfo["Ethernet"]; exists {
        // Extract source and destination IPs
        if ipv4Layer, exists := packetInfo.LayerInfo["IPv4"]; exists {
            if srcIP, ok := ipv4Layer.Fields["src_ip"].(string); ok {
                flow.SourceIP = net.ParseIP(srcIP)
            }
            if dstIP, ok := ipv4Layer.Fields["dst_ip"].(string); ok {
                flow.DestinationIP = net.ParseIP(dstIP)
            }
            flow.Protocol = "IPv4"
        }

        // Extract port information
        if tcpLayer, exists := packetInfo.LayerInfo["TCP"]; exists {
            if srcPort, ok := tcpLayer.Fields["src_port"].(layers.TCPPort); ok {
                flow.SourcePort = uint16(srcPort)
            }
            if dstPort, ok := tcpLayer.Fields["dst_port"].(layers.TCPPort); ok {
                flow.DestinationPort = uint16(dstPort)
            }
        } else if udpLayer, exists := packetInfo.LayerInfo["UDP"]; exists {
            if srcPort, ok := udpLayer.Fields["src_port"].(layers.UDPPort); ok {
                flow.SourcePort = uint16(srcPort)
            }
            if dstPort, ok := udpLayer.Fields["dst_port"].(layers.UDPPort); ok {
                flow.DestinationPort = uint16(dstPort)
            }
        }
    }

    return flow
}

func (ft *FlowTracker) updateFlowState(flow *FlowInfo, packetInfo PacketInfo) {
    // TCP state tracking
    if tcpLayer, exists := packetInfo.LayerInfo["TCP"]; exists {
        flags := tcpLayer.Flags
        
        switch flow.State {
        case FlowStateNew:
            if contains(flags, "SYN") && !contains(flags, "ACK") {
                flow.State = FlowStateEstablished
            }
        case FlowStateEstablished:
            if contains(flags, "FIN") || contains(flags, "RST") {
                flow.State = FlowStateClosing
            }
        case FlowStateClosing:
            if contains(flags, "FIN") && contains(flags, "ACK") {
                flow.State = FlowStateClosed
            }
        }
    }
}

func contains(slice []string, item string) bool {
    for _, s := range slice {
        if s == item {
            return true
        }
    }
    return false
}

import asyncio
from typing import Dict, List, Any, Optional, Set, Tuple
from dataclasses import dataclass, field
from enum import Enum
import time
import logging
from datetime import datetime, timedelta
import numpy as np
import pandas as pd
from collections import defaultdict, deque

class ProtocolIssueType(Enum):
    CONNECTIVITY = "connectivity"
    PERFORMANCE = "performance"
    CONFIGURATION = "configuration"
    SECURITY = "security"
    COMPLIANCE = "compliance"
    COMPATIBILITY = "compatibility"

class SeverityLevel(Enum):
    LOW = "low"
    MEDIUM = "medium"
    HIGH = "high"
    CRITICAL = "critical"

@dataclass
class ProtocolIssue:
    issue_id: str
    timestamp: datetime
    issue_type: ProtocolIssueType
    severity: SeverityLevel
    protocol: str
    source_ip: str
    destination_ip: str
    description: str
    symptoms: List[str]
    root_cause: Optional[str] = None
    resolution_steps: List[str] = field(default_factory=list)
    related_packets: List[str] = field(default_factory=list)
    flow_context: Dict[str, Any] = field(default_factory=dict)

@dataclass
class DebugSession:
    session_id: str
    start_time: datetime
    target_protocols: List[str]
    capture_filters: List[str]
    analysis_scope: str
    issues_detected: List[ProtocolIssue] = field(default_factory=list)
    performance_metrics: Dict[str, Any] = field(default_factory=dict)
    recommendations: List[str] = field(default_factory=list)

class ProtocolDebugger:
    def __init__(self):
        self.issue_detectors = {
            'tcp': TCPIssueDetector(),
            'udp': UDPIssueDetector(),
            'dns': DNSIssueDetector(),
            'http': HTTPIssueDetector(),
            'tls': TLSIssueDetector(),
            'bgp': BGPIssueDetector(),
            'ospf': OSPFIssueDetector()
        }
        self.flow_correlator = FlowCorrelator()
        self.performance_analyzer = ProtocolPerformanceAnalyzer()
        self.root_cause_analyzer = RootCauseAnalyzer()
        self.resolution_engine = ResolutionEngine()
        
    async def start_debug_session(self, debug_config: Dict[str, Any]) -> DebugSession:
        """Start comprehensive protocol debugging session"""
        session = DebugSession(
            session_id=debug_config['session_id'],
            start_time=datetime.now(),
            target_protocols=debug_config.get('protocols', []),
            capture_filters=debug_config.get('filters', []),
            analysis_scope=debug_config.get('scope', 'comprehensive')
        )
        
        # Initialize detection engines
        for protocol in session.target_protocols:
            if protocol in self.issue_detectors:
                await self.issue_detectors[protocol].initialize(debug_config)
        
        return session
    
    async def analyze_protocol_issues(self, session: DebugSession, 
                                    packet_data: List[Dict[str, Any]]) -> List[ProtocolIssue]:
        """Analyze packets for protocol issues"""
        all_issues = []
        
        # Group packets by protocol
        protocol_packets = self._group_packets_by_protocol(packet_data)
        
        # Analyze each protocol
        for protocol, packets in protocol_packets.items():
            if protocol in self.issue_detectors:
                detector = self.issue_detectors[protocol]
                issues = await detector.detect_issues(packets)
                all_issues.extend(issues)
        
        # Correlate issues across protocols
        correlated_issues = await self.flow_correlator.correlate_issues(all_issues)
        
        # Perform root cause analysis
        for issue in correlated_issues:
            root_cause = await self.root_cause_analyzer.analyze(issue, packet_data)
            issue.root_cause = root_cause
            
            # Generate resolution steps
            resolution_steps = await self.resolution_engine.generate_resolution(issue)
            issue.resolution_steps = resolution_steps
        
        session.issues_detected.extend(correlated_issues)
        return correlated_issues
    
    def _group_packets_by_protocol(self, packet_data: List[Dict[str, Any]]) -> Dict[str, List[Dict[str, Any]]]:
        """Group packets by protocol type"""
        protocol_groups = defaultdict(list)
        
        for packet in packet_data:
            protocol_stack = packet.get('protocol_stack', [])
            
            # Determine primary protocol
            if 'TCP' in protocol_stack:
                if 'HTTP' in protocol_stack:
                    protocol_groups['http'].append(packet)
                elif 'TLS' in protocol_stack or 'SSL' in protocol_stack:
                    protocol_groups['tls'].append(packet)
                else:
                    protocol_groups['tcp'].append(packet)
            elif 'UDP' in protocol_stack:
                if 'DNS' in protocol_stack:
                    protocol_groups['dns'].append(packet)
                else:
                    protocol_groups['udp'].append(packet)
            elif 'BGP' in protocol_stack:
                protocol_groups['bgp'].append(packet)
            elif 'OSPF' in protocol_stack:
                protocol_groups['ospf'].append(packet)
        
        return protocol_groups

class TCPIssueDetector:
    """Detect TCP-specific protocol issues"""
    
    def __init__(self):
        self.connection_tracker = TCPConnectionTracker()
        self.performance_tracker = TCPPerformanceTracker()
        self.congestion_detector = TCPCongestionDetector()
        
    async def detect_issues(self, tcp_packets: List[Dict[str, Any]]) -> List[ProtocolIssue]:
        """Detect TCP protocol issues"""
        issues = []
        
        # Group packets by connection
        connections = self.connection_tracker.group_by_connection(tcp_packets)
        
        for conn_key, conn_packets in connections.items():
            # Detect connection establishment issues
            connection_issues = await self._detect_connection_issues(conn_key, conn_packets)
            issues.extend(connection_issues)
            
            # Detect performance issues
            performance_issues = await self._detect_performance_issues(conn_key, conn_packets)
            issues.extend(performance_issues)
            
            # Detect congestion issues
            congestion_issues = await self._detect_congestion_issues(conn_key, conn_packets)
            issues.extend(congestion_issues)
            
            # Detect reliability issues
            reliability_issues = await self._detect_reliability_issues(conn_key, conn_packets)
            issues.extend(reliability_issues)
        
        return issues
    
    async def _detect_connection_issues(self, conn_key: str, 
                                      packets: List[Dict[str, Any]]) -> List[ProtocolIssue]:
        """Detect TCP connection establishment issues"""
        issues = []
        
        # Analyze 3-way handshake
        handshake_analysis = self._analyze_handshake(packets)
        
        if handshake_analysis['incomplete']:
            issue = ProtocolIssue(
                issue_id=f"tcp_handshake_{conn_key}_{int(time.time())}",
                timestamp=datetime.now(),
                issue_type=ProtocolIssueType.CONNECTIVITY,
                severity=SeverityLevel.HIGH,
                protocol='TCP',
                source_ip=handshake_analysis['source_ip'],
                destination_ip=handshake_analysis['destination_ip'],
                description="Incomplete TCP handshake detected",
                symptoms=[
                    "SYN packet sent but no SYN-ACK received",
                    "Connection establishment timeout",
                    "Multiple SYN retransmissions"
                ],
                related_packets=handshake_analysis['packet_ids']
            )
            issues.append(issue)
        
        # Check for connection reset issues
        if handshake_analysis['reset_during_handshake']:
            issue = ProtocolIssue(
                issue_id=f"tcp_reset_{conn_key}_{int(time.time())}",
                timestamp=datetime.now(),
                issue_type=ProtocolIssueType.CONNECTIVITY,
                severity=SeverityLevel.MEDIUM,
                protocol='TCP',
                source_ip=handshake_analysis['source_ip'],
                destination_ip=handshake_analysis['destination_ip'],
                description="TCP connection reset during handshake",
                symptoms=[
                    "RST packet received during handshake",
                    "Connection refused by destination"
                ],
                related_packets=handshake_analysis['reset_packets']
            )
            issues.append(issue)
        
        return issues
    
    async def _detect_performance_issues(self, conn_key: str,
                                       packets: List[Dict[str, Any]]) -> List[ProtocolIssue]:
        """Detect TCP performance issues"""
        issues = []
        
        # Calculate performance metrics
        metrics = self.performance_tracker.calculate_metrics(packets)
        
        # Check for high RTT
        if metrics['average_rtt'] > 200:  # 200ms threshold
            issue = ProtocolIssue(
                issue_id=f"tcp_high_rtt_{conn_key}_{int(time.time())}",
                timestamp=datetime.now(),
                issue_type=ProtocolIssueType.PERFORMANCE,
                severity=SeverityLevel.MEDIUM,
                protocol='TCP',
                source_ip=metrics['source_ip'],
                destination_ip=metrics['destination_ip'],
                description=f"High RTT detected: {metrics['average_rtt']:.2f}ms",
                symptoms=[
                    f"Average RTT: {metrics['average_rtt']:.2f}ms",
                    "Slow response times",
                    "Delayed acknowledgments"
                ],
                flow_context={'rtt_samples': metrics['rtt_samples']}
            )
            issues.append(issue)
        
        # Check for excessive retransmissions
        retransmission_rate = metrics['retransmissions'] / metrics['total_packets']
        if retransmission_rate > 0.05:  # 5% threshold
            issue = ProtocolIssue(
                issue_id=f"tcp_retrans_{conn_key}_{int(time.time())}",
                timestamp=datetime.now(),
                issue_type=ProtocolIssueType.PERFORMANCE,
                severity=SeverityLevel.HIGH,
                protocol='TCP',
                source_ip=metrics['source_ip'],
                destination_ip=metrics['destination_ip'],
                description=f"High retransmission rate: {retransmission_rate:.2%}",
                symptoms=[
                    f"Retransmission rate: {retransmission_rate:.2%}",
                    "Packet loss detected",
                    "Degraded throughput"
                ],
                flow_context={'retransmission_details': metrics['retransmission_details']}
            )
            issues.append(issue)
        
        # Check for window scaling issues
        if metrics['zero_window_events'] > 0:
            issue = ProtocolIssue(
                issue_id=f"tcp_window_{conn_key}_{int(time.time())}",
                timestamp=datetime.now(),
                issue_type=ProtocolIssueType.PERFORMANCE,
                severity=SeverityLevel.MEDIUM,
                protocol='TCP',
                source_ip=metrics['source_ip'],
                destination_ip=metrics['destination_ip'],
                description="TCP window scaling issues detected",
                symptoms=[
                    f"Zero window events: {metrics['zero_window_events']}",
                    "Flow control issues",
                    "Reduced throughput"
                ],
                flow_context={'window_events': metrics['window_scaling_events']}
            )
            issues.append(issue)
        
        return issues
    
    def _analyze_handshake(self, packets: List[Dict[str, Any]]) -> Dict[str, Any]:
        """Analyze TCP 3-way handshake"""
        analysis = {
            'incomplete': False,
            'reset_during_handshake': False,
            'source_ip': '',
            'destination_ip': '',
            'packet_ids': [],
            'reset_packets': [],
            'handshake_duration': 0
        }
        
        syn_packets = []
        syn_ack_packets = []
        ack_packets = []
        rst_packets = []
        
        # Categorize packets
        for packet in packets:
            tcp_layer = packet.get('layer_info', {}).get('TCP', {})
            flags = tcp_layer.get('flags', [])
            
            packet_id = packet.get('packet_id', '')
            analysis['packet_ids'].append(packet_id)
            
            if 'SYN' in flags and 'ACK' not in flags:
                syn_packets.append(packet)
                analysis['source_ip'] = tcp_layer.get('fields', {}).get('src_ip', '')
                analysis['destination_ip'] = tcp_layer.get('fields', {}).get('dst_ip', '')
            elif 'SYN' in flags and 'ACK' in flags:
                syn_ack_packets.append(packet)
            elif 'ACK' in flags and 'SYN' not in flags:
                ack_packets.append(packet)
            elif 'RST' in flags:
                rst_packets.append(packet)
                analysis['reset_packets'].append(packet_id)
        
        # Check handshake completeness
        if syn_packets and not syn_ack_packets:
            analysis['incomplete'] = True
        elif syn_packets and syn_ack_packets and not ack_packets:
            analysis['incomplete'] = True
        
        # Check for resets during handshake
        if rst_packets and (syn_packets or syn_ack_packets):
            analysis['reset_during_handshake'] = True
        
        # Calculate handshake duration
        if syn_packets and ack_packets:
            first_syn = min(syn_packets, key=lambda p: p['timestamp'])
            last_ack = max(ack_packets, key=lambda p: p['timestamp'])
            analysis['handshake_duration'] = (
                last_ack['timestamp'] - first_syn['timestamp']
            ).total_seconds() * 1000  # Convert to milliseconds
        
        return analysis

class DNSIssueDetector:
    """Detect DNS-specific protocol issues"""
    
    def __init__(self):
        self.query_tracker = DNSQueryTracker()
        self.response_analyzer = DNSResponseAnalyzer()
        self.security_analyzer = DNSSecurityAnalyzer()
        
    async def detect_issues(self, dns_packets: List[Dict[str, Any]]) -> List[ProtocolIssue]:
        """Detect DNS protocol issues"""
        issues = []
        
        # Group packets by query ID
        queries = self.query_tracker.group_by_query_id(dns_packets)
        
        for query_id, query_packets in queries.items():
            # Detect resolution issues
            resolution_issues = await self._detect_resolution_issues(query_id, query_packets)
            issues.extend(resolution_issues)
            
            # Detect performance issues
            performance_issues = await self._detect_dns_performance_issues(query_id, query_packets)
            issues.extend(performance_issues)
            
            # Detect security issues
            security_issues = await self._detect_dns_security_issues(query_id, query_packets)
            issues.extend(security_issues)
        
        return issues
    
    async def _detect_resolution_issues(self, query_id: str,
                                      packets: List[Dict[str, Any]]) -> List[ProtocolIssue]:
        """Detect DNS resolution issues"""
        issues = []
        
        queries = [p for p in packets if p.get('dns_type') == 'query']
        responses = [p for p in packets if p.get('dns_type') == 'response']
        
        # Check for unanswered queries
        if queries and not responses:
            query_packet = queries[0]
            dns_layer = query_packet.get('layer_info', {}).get('DNS', {})
            
            issue = ProtocolIssue(
                issue_id=f"dns_no_response_{query_id}_{int(time.time())}",
                timestamp=datetime.now(),
                issue_type=ProtocolIssueType.CONNECTIVITY,
                severity=SeverityLevel.HIGH,
                protocol='DNS',
                source_ip=query_packet.get('source_ip', ''),
                destination_ip=query_packet.get('destination_ip', ''),
                description="DNS query without response",
                symptoms=[
                    "DNS query sent but no response received",
                    f"Query for: {dns_layer.get('fields', {}).get('query_name', 'unknown')}",
                    "DNS server timeout"
                ],
                related_packets=[p.get('packet_id', '') for p in queries]
            )
            issues.append(issue)
        
        # Check for DNS errors
        for response in responses:
            dns_layer = response.get('layer_info', {}).get('DNS', {})
            rcode = dns_layer.get('fields', {}).get('rcode', 0)
            
            if rcode != 0:  # Non-zero response code indicates error
                error_description = self._get_rcode_description(rcode)
                
                issue = ProtocolIssue(
                    issue_id=f"dns_error_{query_id}_{rcode}_{int(time.time())}",
                    timestamp=datetime.now(),
                    issue_type=ProtocolIssueType.CONFIGURATION,
                    severity=SeverityLevel.MEDIUM,
                    protocol='DNS',
                    source_ip=response.get('source_ip', ''),
                    destination_ip=response.get('destination_ip', ''),
                    description=f"DNS error response: {error_description}",
                    symptoms=[
                        f"DNS response code: {rcode} ({error_description})",
                        "Name resolution failure"
                    ],
                    related_packets=[response.get('packet_id', '')]
                )
                issues.append(issue)
        
        return issues
    
    def _get_rcode_description(self, rcode: int) -> str:
        """Get description for DNS response code"""
        rcode_descriptions = {
            1: "Format Error",
            2: "Server Failure",
            3: "Name Error (NXDOMAIN)",
            4: "Not Implemented",
            5: "Refused",
            6: "Name Exists",
            7: "RRset Exists",
            8: "RRset Does Not Exist",
            9: "Not Authorized",
            10: "Not Zone"
        }
        return rcode_descriptions.get(rcode, f"Unknown error ({rcode})")

class HTTPIssueDetector:
    """Detect HTTP-specific protocol issues"""
    
    def __init__(self):
        self.request_tracker = HTTPRequestTracker()
        self.response_analyzer = HTTPResponseAnalyzer()
        self.performance_analyzer = HTTPPerformanceAnalyzer()
        
    async def detect_issues(self, http_packets: List[Dict[str, Any]]) -> List[ProtocolIssue]:
        """Detect HTTP protocol issues"""
        issues = []
        
        # Group packets by session
        sessions = self.request_tracker.group_by_session(http_packets)
        
        for session_id, session_packets in sessions.items():
            # Detect HTTP errors
            error_issues = await self._detect_http_errors(session_id, session_packets)
            issues.extend(error_issues)
            
            # Detect performance issues
            performance_issues = await self._detect_http_performance_issues(session_id, session_packets)
            issues.extend(performance_issues)
            
            # Detect security issues
            security_issues = await self._detect_http_security_issues(session_id, session_packets)
            issues.extend(security_issues)
        
        return issues
    
    async def _detect_http_errors(self, session_id: str,
                                packets: List[Dict[str, Any]]) -> List[ProtocolIssue]:
        """Detect HTTP error responses"""
        issues = []
        
        for packet in packets:
            http_layer = packet.get('layer_info', {}).get('HTTP', {})
            
            if http_layer.get('message_type') == 'response':
                status_code = http_layer.get('fields', {}).get('status_code')
                
                if status_code and status_code >= 400:
                    severity = SeverityLevel.HIGH if status_code >= 500 else SeverityLevel.MEDIUM
                    
                    issue = ProtocolIssue(
                        issue_id=f"http_error_{session_id}_{status_code}_{int(time.time())}",
                        timestamp=datetime.now(),
                        issue_type=ProtocolIssueType.CONNECTIVITY if status_code >= 500 else ProtocolIssueType.CONFIGURATION,
                        severity=severity,
                        protocol='HTTP',
                        source_ip=packet.get('source_ip', ''),
                        destination_ip=packet.get('destination_ip', ''),
                        description=f"HTTP error response: {status_code}",
                        symptoms=[
                            f"HTTP status code: {status_code}",
                            f"URL: {http_layer.get('fields', {}).get('url', 'unknown')}",
                            "Client or server error"
                        ],
                        related_packets=[packet.get('packet_id', '')]
                    )
                    issues.append(issue)
        
        return issues

class RootCauseAnalyzer:
    """Analyze root causes of protocol issues"""
    
    def __init__(self):
        self.correlation_engine = CorrelationEngine()
        self.pattern_analyzer = PatternAnalyzer()
        self.knowledge_base = TroubleshootingKnowledgeBase()
        
    async def analyze(self, issue: ProtocolIssue, context_data: List[Dict[str, Any]]) -> str:
        """Analyze root cause of protocol issue"""
        analysis_result = {
            'primary_cause': '',
            'contributing_factors': [],
            'confidence': 0.0
        }
        
        # Correlate with other issues
        related_issues = await self.correlation_engine.find_related_issues(issue, context_data)
        
        # Analyze patterns
        patterns = await self.pattern_analyzer.analyze_issue_patterns(issue, related_issues)
        
        # Query knowledge base
        knowledge_match = await self.knowledge_base.find_similar_issues(issue, patterns)
        
        if knowledge_match:
            analysis_result['primary_cause'] = knowledge_match['root_cause']
            analysis_result['confidence'] = knowledge_match['confidence']
        else:
            # Generate hypothesis based on symptoms and patterns
            analysis_result = await self._generate_root_cause_hypothesis(issue, patterns)
        
        return analysis_result['primary_cause']
    
    async def _generate_root_cause_hypothesis(self, issue: ProtocolIssue,
                                           patterns: Dict[str, Any]) -> Dict[str, Any]:
        """Generate root cause hypothesis"""
        hypothesis = {
            'primary_cause': 'Unknown',
            'contributing_factors': [],
            'confidence': 0.0
        }
        
        # TCP-specific analysis
        if issue.protocol == 'TCP':
            if 'handshake' in issue.description.lower():
                if 'firewall' in patterns.get('network_context', []):
                    hypothesis['primary_cause'] = 'Firewall blocking connection'
                    hypothesis['confidence'] = 0.8
                elif 'timeout' in patterns.get('timing_patterns', []):
                    hypothesis['primary_cause'] = 'Network connectivity issue'
                    hypothesis['confidence'] = 0.7
                else:
                    hypothesis['primary_cause'] = 'Service not listening on target port'
                    hypothesis['confidence'] = 0.6
            
            elif 'retransmission' in issue.description.lower():
                if patterns.get('packet_loss_rate', 0) > 0.05:
                    hypothesis['primary_cause'] = 'Network congestion or packet loss'
                    hypothesis['confidence'] = 0.9
                elif patterns.get('high_rtt', False):
                    hypothesis['primary_cause'] = 'High latency in network path'
                    hypothesis['confidence'] = 0.7
        
        # DNS-specific analysis
        elif issue.protocol == 'DNS':
            if 'no response' in issue.description.lower():
                hypothesis['primary_cause'] = 'DNS server unreachable or not responding'
                hypothesis['confidence'] = 0.8
            elif 'NXDOMAIN' in issue.symptoms:
                hypothesis['primary_cause'] = 'Domain name does not exist or misconfigured'
                hypothesis['confidence'] = 0.9
        
        # HTTP-specific analysis
        elif issue.protocol == 'HTTP':
            if issue.issue_type == ProtocolIssueType.CONNECTIVITY:
                status_code = self._extract_status_code(issue.symptoms)
                if status_code and status_code >= 500:
                    hypothesis['primary_cause'] = 'Web server internal error or overload'
                    hypothesis['confidence'] = 0.8
                elif status_code and status_code == 404:
                    hypothesis['primary_cause'] = 'Requested resource not found'
                    hypothesis['confidence'] = 0.9
        
        return hypothesis

class ResolutionEngine:
    """Generate resolution steps for protocol issues"""
    
    def __init__(self):
        self.resolution_templates = ResolutionTemplates()
        self.automation_engine = AutomationEngine()
        
    async def generate_resolution(self, issue: ProtocolIssue) -> List[str]:
        """Generate resolution steps for issue"""
        resolution_steps = []
        
        # Get template based on issue type and protocol
        template = await self.resolution_templates.get_template(
            issue.protocol, issue.issue_type, issue.description
        )
        
        if template:
            # Customize template with issue-specific details
            resolution_steps = self._customize_resolution_steps(template, issue)
        else:
            # Generate generic resolution steps
            resolution_steps = self._generate_generic_resolution(issue)
        
        # Add automated resolution options
        automated_steps = await self.automation_engine.get_automated_resolutions(issue)
        if automated_steps:
            resolution_steps.extend([f"[AUTOMATED] {step}" for step in automated_steps])
        
        return resolution_steps
    
    def _customize_resolution_steps(self, template: Dict[str, Any],
                                  issue: ProtocolIssue) -> List[str]:
        """Customize resolution template with issue-specific details"""
        steps = []
        
        for step_template in template['steps']:
            # Replace placeholders with actual values
            step = step_template.replace('{source_ip}', issue.source_ip)
            step = step.replace('{destination_ip}', issue.destination_ip)
            step = step.replace('{protocol}', issue.protocol)
            
            # Add issue-specific context
            if issue.flow_context:
                for key, value in issue.flow_context.items():
                    step = step.replace(f'{{{key}}}', str(value))
            
            steps.append(step)
        
        return steps
    
    def _generate_generic_resolution(self, issue: ProtocolIssue) -> List[str]:
        """Generate generic resolution steps"""
        steps = [
            f"1. Verify network connectivity between {issue.source_ip} and {issue.destination_ip}",
            f"2. Check {issue.protocol} service status on destination host",
            "3. Examine firewall rules and security groups",
            "4. Review network routing and DNS resolution",
            "5. Analyze logs for additional error details",
            "6. Monitor network performance and retry operation"
        ]
        
        # Add protocol-specific steps
        if issue.protocol == 'TCP':
            steps.extend([
                "7. Check TCP port availability with telnet or nc",
                "8. Verify TCP window scaling and MSS settings",
                "9. Analyze TCP congestion control behavior"
            ])
        elif issue.protocol == 'DNS':
            steps.extend([
                "7. Test DNS resolution with nslookup or dig",
                "8. Check DNS server configuration and zone files",
                "9. Verify DNS forwarder and recursion settings"
            ])
        elif issue.protocol == 'HTTP':
            steps.extend([
                "7. Test HTTP endpoint with curl or wget",
                "8. Check web server logs and configuration",
                "9. Verify SSL/TLS certificate validity"
            ])
        
        return steps

class ProtocolAnalysisReportGenerator:
    """Generate comprehensive protocol analysis reports"""
    
    def __init__(self):
        self.visualization_engine = VisualizationEngine()
        self.statistics_calculator = StatisticsCalculator()
        
    def generate_comprehensive_report(self, debug_session: DebugSession,
                                    analysis_results: Dict[str, Any]) -> Dict[str, Any]:
        """Generate comprehensive protocol analysis report"""
        report = {
            'session_info': {
                'session_id': debug_session.session_id,
                'start_time': debug_session.start_time.isoformat(),
                'duration': (datetime.now() - debug_session.start_time).total_seconds(),
                'protocols_analyzed': debug_session.target_protocols,
                'capture_filters': debug_session.capture_filters
            },
            'executive_summary': self._generate_executive_summary(debug_session),
            'issue_analysis': self._generate_issue_analysis(debug_session.issues_detected),
            'performance_analysis': self._generate_performance_analysis(analysis_results),
            'security_analysis': self._generate_security_analysis(analysis_results),
            'recommendations': self._generate_recommendations(debug_session),
            'detailed_findings': self._generate_detailed_findings(analysis_results),
            'appendices': self._generate_appendices(analysis_results)
        }
        
        return report
    
    def _generate_executive_summary(self, debug_session: DebugSession) -> Dict[str, Any]:
        """Generate executive summary"""
        summary = {
            'total_issues': len(debug_session.issues_detected),
            'critical_issues': len([i for i in debug_session.issues_detected if i.severity == SeverityLevel.CRITICAL]),
            'high_issues': len([i for i in debug_session.issues_detected if i.severity == SeverityLevel.HIGH]),
            'medium_issues': len([i for i in debug_session.issues_detected if i.severity == SeverityLevel.MEDIUM]),
            'low_issues': len([i for i in debug_session.issues_detected if i.severity == SeverityLevel.LOW]),
            'key_findings': [],
            'immediate_actions': []
        }
        
        # Generate key findings
        if summary['critical_issues'] > 0:
            summary['key_findings'].append(f"{summary['critical_issues']} critical protocol issues requiring immediate attention")
        
        if summary['high_issues'] > 0:
            summary['key_findings'].append(f"{summary['high_issues']} high-priority issues affecting network performance")
        
        # Generate immediate actions
        critical_issues = [i for i in debug_session.issues_detected if i.severity == SeverityLevel.CRITICAL]
        for issue in critical_issues[:3]:  # Top 3 critical issues
            summary['immediate_actions'].append(f"Resolve {issue.protocol} {issue.issue_type.value}: {issue.description}")
        
        return summary
    
    def _generate_issue_analysis(self, issues: List[ProtocolIssue]) -> Dict[str, Any]:
        """Generate detailed issue analysis"""
        analysis = {
            'issues_by_protocol': {},
            'issues_by_type': {},
            'issues_by_severity': {},
            'temporal_distribution': {},
            'affected_endpoints': set()
        }
        
        # Group issues by protocol
        for issue in issues:
            protocol = issue.protocol
            if protocol not in analysis['issues_by_protocol']:
                analysis['issues_by_protocol'][protocol] = []
            analysis['issues_by_protocol'][protocol].append({
                'issue_id': issue.issue_id,
                'description': issue.description,
                'severity': issue.severity.value,
                'timestamp': issue.timestamp.isoformat()
            })
            
            # Track affected endpoints
            analysis['affected_endpoints'].add(f"{issue.source_ip}:{issue.destination_ip}")
        
        # Convert set to list for JSON serialization
        analysis['affected_endpoints'] = list(analysis['affected_endpoints'])
        
        return analysis