tshark test 3

backend/src/config.py

@@ -88,7 +88,7 @@ def load_settings() -> BackendSettings:
         telemetry_process_stop_timeout_seconds=_env_float("BACKEND_TELEMETRY_PROCESS_STOP_TIMEOUT_SECONDS", 3.0),
         telemetry_reader_join_timeout_seconds=_env_float("BACKEND_TELEMETRY_READER_JOIN_TIMEOUT_SECONDS", 2.0),
         tshark_enabled=_env_bool("BACKEND_TSHARK_ENABLED", True),
-        tshark_display_filter=_env_str("BACKEND_TSHARK_DISPLAY_FILTER", "http or tls or dns"),
+        tshark_display_filter=_env_str("BACKEND_TSHARK_DISPLAY_FILTER", ""),
         tshark_cache_ttl_seconds=_env_float("BACKEND_TSHARK_CACHE_TTL_SECONDS", 5.0),
         tshark_match_window_ms=_env_int("BACKEND_TSHARK_MATCH_WINDOW_MS", 5_000),
         tshark_reader_join_timeout_seconds=_env_float("BACKEND_TSHARK_READER_JOIN_TIMEOUT_SECONDS", 2.0),

backend/src/utilities/tshark_manager.py

@@ -282,11 +282,14 @@ class TsharkManager:
         self._cache: Dict[Tuple[str, int, str, str, int, int, int], List[Dict[str, Any]]] = {}
         self._last_error_by_iface: Dict[str, str] = {}
         self._stats: Dict[str, Any] = {
+            "raw_lines_total": 0,
             "events_total": 0,
             "events_useful": 0,
+            "parse_failures": 0,
             "lookup_hits": 0,
             "backfill_updates_total": 0,
             "last_event_by_iface": {},
+            "last_unparsed_line_by_iface": {},
         }
         self._lock = threading.Lock()
 
@@ -455,9 +458,14 @@ class TsharkManager:
             text = line.rstrip("\n")
             if not text:
                 continue
+            with self._lock:
+                self._stats["raw_lines_total"] += 1
 
             event = _parse_line(text, iface)
             if event is None:
+                with self._lock:
+                    self._stats["parse_failures"] += 1
+                    self._stats["last_unparsed_line_by_iface"][iface] = text
                 logger.debug("Ignoring unparsable tshark line on %s: %s", iface, text)
                 continue