dlp_analyzer_v3.py

#!/usr/bin/env python3
"""
DLP Interference Analyzer v3
============================
Performs detailed network analysis to detect and quantify DLP/proxy interference.
Includes large file tests (100MB, 1GB) to detect buffering behavior.

Usage:
    python3 dlp_analyzer_v3.py                    # Standard tests
    python3 dlp_analyzer_v3.py --large            # Include 100MB tests  
    python3 dlp_analyzer_v3.py --xlarge           # Include 1GB tests (takes a while)
    python3 dlp_analyzer_v3.py -o report.txt      # Save report to file
"""

import argparse
import json
import os
import socket
import ssl
import statistics
import sys
import time
from dataclasses import dataclass, field
from datetime import datetime
from pathlib import Path
from typing import Dict, List, Optional, Tuple
from urllib.parse import urlparse
import urllib.request
import urllib.error


@dataclass
class DownloadMetrics:
    """Metrics collected during a download test."""
    url: str
    test_name: str
    start_time: float = 0
    dns_time: float = 0
    connect_time: float = 0
    ssl_time: float = 0
    ttfb: float = 0
    total_time: float = 0
    bytes_received: int = 0
    http_status: int = 0
    error: Optional[str] = None
    progress_samples: List[Tuple[float, int]] = field(default_factory=list)
    
    @property
    def throughput_mbps(self) -> float:
        if self.total_time <= 0 or self.bytes_received <= 0:
            return 0
        return (self.bytes_received * 8) / (self.total_time * 1_000_000)
    
    @property
    def ttfb_ms(self) -> float:
        return self.ttfb * 1000


@dataclass 
class CertificateInfo:
    """SSL certificate information."""
    host: str
    issuer: Dict[str, str]
    subject: Dict[str, str]
    not_before: str
    not_after: str
    serial: str = ""
    is_proxy_cert: bool = False
    proxy_indicators: List[str] = field(default_factory=list)


class DLPAnalyzer:
    """Main analyzer class for detecting DLP interference."""
    
    PROXY_CA_INDICATORS = [
        'palo alto', 'zscaler', 'bluecoat', 'symantec', 'forcepoint',
        'mcafee', 'websense', 'checkpoint', 'fortinet', 'sophos',
        'corporate', 'internal', 'proxy', 'firewall', 'security',
        'netskope', 'umbrella', 'cisco', 'watchguard', 'barracuda'
    ]
    
    # Base test endpoints (always run)
    BASE_ENDPOINTS = {
        'github_small': {
            'url': 'https://github.com/cli/cli/releases/download/v2.40.0/gh_2.40.0_checksums.txt',
            'description': 'GitHub small file (~1KB)',
            'follow_redirects': True,
            'expected_min_bytes': 500,
            'size_category': 'small',
        },
        'github_10mb': {
            'url': 'https://github.com/cli/cli/releases/download/v2.40.0/gh_2.40.0_linux_amd64.tar.gz',
            'description': 'GitHub release (~10MB)',
            'follow_redirects': True,
            'expected_min_bytes': 1_000_000,
            'size_category': 'medium',
        },
        'hf_config': {
            'url': 'https://huggingface.co/bert-base-uncased/resolve/main/config.json',
            'description': 'HuggingFace model config',
            'follow_redirects': True,
            'expected_min_bytes': 100,
            'size_category': 'small',
        },
        'hf_model_10mb': {
            'url': 'https://huggingface.co/bert-base-uncased/resolve/main/pytorch_model.bin',
            'description': 'HuggingFace model (10MB sample)',
            'follow_redirects': True,
            'expected_min_bytes': 1_000_000,
            'max_bytes': 10_485_760,
            'size_category': 'medium',
        },
        'cloudflare_1mb': {
            'url': 'https://speed.cloudflare.com/__down?bytes=1000000',
            'description': 'Cloudflare 1MB',
            'follow_redirects': False,
            'expected_min_bytes': 900_000,
            'size_category': 'small',
        },
        'cloudflare_10mb': {
            'url': 'https://speed.cloudflare.com/__down?bytes=10000000',
            'description': 'Cloudflare 10MB', 
            'follow_redirects': False,
            'expected_min_bytes': 9_000_000,
            'size_category': 'medium',
        },
        'docker_registry': {
            'url': 'https://registry-1.docker.io/v2/',
            'description': 'Docker Registry API',
            'follow_redirects': False,
            'expected_min_bytes': 0,
            'allow_401': True,
            'size_category': 'small',
        },
        'pypi_api': {
            'url': 'https://pypi.org/pypi/requests/json',
            'description': 'PyPI metadata',
            'follow_redirects': False,
            'expected_min_bytes': 1000,
            'size_category': 'small',
        },
    }
    
    # Large file endpoints (--large flag)
    LARGE_ENDPOINTS = {
        'cloudflare_100mb': {
            'url': 'https://speed.cloudflare.com/__down?bytes=100000000',
            'description': 'Cloudflare 100MB',
            'follow_redirects': False,
            'expected_min_bytes': 90_000_000,
            'size_category': 'large',
            'timeout': 300,
        },
        'hf_model_full': {
            'url': 'https://huggingface.co/bert-base-uncased/resolve/main/pytorch_model.bin',
            'description': 'HuggingFace BERT model (~440MB)',
            'follow_redirects': True,
            'expected_min_bytes': 400_000_000,
            'size_category': 'large',
            'timeout': 600,
        },
    }
    
    # Extra large file endpoints (--xlarge flag)  
    XLARGE_ENDPOINTS = {
        'cloudflare_1gb': {
            'url': 'https://speed.cloudflare.com/__down?bytes=1000000000',
            'description': 'Cloudflare 1GB',
            'follow_redirects': False,
            'expected_min_bytes': 900_000_000,
            'size_category': 'xlarge',
            'timeout': 900,
        },
        'ubuntu_iso': {
            'url': 'https://releases.ubuntu.com/24.04/ubuntu-24.04.1-desktop-amd64.iso',
            'description': 'Ubuntu 24.04 ISO (~2.5GB) - first 500MB',
            'follow_redirects': True,
            'expected_min_bytes': 400_000_000,
            'max_bytes': 524_288_000,  # Only first 500MB
            'size_category': 'xlarge',
            'timeout': 900,
        },
    }
    
    HOSTS_TO_CHECK = [
        'huggingface.co',
        'cdn-lfs.huggingface.co', 
        'github.com',
        'objects.githubusercontent.com',
        'registry-1.docker.io',
        'pypi.org',
        'speed.cloudflare.com',
    ]

    def __init__(self, include_large: bool = False, include_xlarge: bool = False):
        self.results: Dict[str, List[DownloadMetrics]] = {}
        self.cert_info: Dict[str, CertificateInfo] = {}
        
        # Build endpoint list
        self.endpoints = dict(self.BASE_ENDPOINTS)
        if include_large or include_xlarge:
            self.endpoints.update(self.LARGE_ENDPOINTS)
        if include_xlarge:
            self.endpoints.update(self.XLARGE_ENDPOINTS)
        
        self.include_large = include_large
        self.include_xlarge = include_xlarge
        
    def analyze_certificate(self, host: str, port: int = 443) -> CertificateInfo:
        """Analyze SSL certificate for proxy indicators."""
        try:
            context = ssl.create_default_context()
            with socket.create_connection((host, port), timeout=10) as sock:
                with context.wrap_socket(sock, server_hostname=host) as ssock:
                    cert = ssock.getpeercert()
                    
            issuer = dict(x[0] for x in cert.get('issuer', []))
            subject = dict(x[0] for x in cert.get('subject', []))
            
            cert_info = CertificateInfo(
                host=host,
                issuer=issuer,
                subject=subject,
                not_before=cert.get('notBefore', ''),
                not_after=cert.get('notAfter', ''),
                serial=str(cert.get('serialNumber', ''))
            )
            
            issuer_str = ' '.join(str(v).lower() for v in issuer.values())
            for indicator in self.PROXY_CA_INDICATORS:
                if indicator in issuer_str:
                    cert_info.is_proxy_cert = True
                    cert_info.proxy_indicators.append(indicator)
            
            return cert_info
            
        except ssl.SSLCertVerificationError as e:
            return CertificateInfo(
                host=host,
                issuer={'error': f'SSL Verification Failed: {e}'},
                subject={},
                not_before='',
                not_after='',
                is_proxy_cert=True,
                proxy_indicators=['ssl_verification_failed']
            )
        except Exception as e:
            return CertificateInfo(
                host=host,
                issuer={'error': str(e)},
                subject={},
                not_before='',
                not_after='',
            )
    
    def download_with_timing(self, url: str, test_name: str, 
                            config: dict) -> DownloadMetrics:
        """Download a file while collecting detailed timing metrics."""
        metrics = DownloadMetrics(url=url, test_name=test_name)
        metrics.start_time = time.time()
        metrics.progress_samples = []
        
        max_bytes = config.get('max_bytes', None)
        allow_401 = config.get('allow_401', False)
        timeout = config.get('timeout', 120)
        
        try:
            parsed = urlparse(url)
            host = parsed.hostname
            port = parsed.port or (443 if parsed.scheme == 'https' else 80)
            
            # DNS timing
            dns_start = time.time()
            socket.gethostbyname(host)
            metrics.dns_time = time.time() - dns_start
            
            # Connection timing
            connect_start = time.time()
            sock = socket.create_connection((host, port), timeout=30)
            metrics.connect_time = time.time() - connect_start
            
            # SSL timing
            if parsed.scheme == 'https':
                ssl_start = time.time()
                context = ssl.create_default_context()
                sock = context.wrap_socket(sock, server_hostname=host)
                metrics.ssl_time = time.time() - ssl_start
            
            sock.close()
            
            # Actual download
            request = urllib.request.Request(url, headers={
                'User-Agent': 'DLP-Analyzer/3.0'
            })
            
            download_start = time.time()
            first_byte_received = False
            total_bytes = 0
            last_progress_time = download_start
            
            try:
                response = urllib.request.urlopen(request, timeout=timeout)
                metrics.http_status = response.status
                
                while True:
                    if max_bytes and total_bytes >= max_bytes:
                        break
                    chunk = response.read(262144)  # 256KB chunks for large files
                    if not chunk:
                        break
                    
                    current_time = time.time()
                    
                    if not first_byte_received:
                        metrics.ttfb = current_time - download_start
                        first_byte_received = True
                    
                    total_bytes += len(chunk)
                    
                    # Sample progress every second
                    if current_time - last_progress_time >= 1.0:
                        metrics.progress_samples.append((
                            current_time - download_start,
                            total_bytes
                        ))
                        last_progress_time = current_time
                        
                        # Print progress for large files
                        if config.get('size_category') in ('large', 'xlarge'):
                            mb_done = total_bytes / 1_000_000
                            elapsed = current_time - download_start
                            speed = (total_bytes * 8) / (elapsed * 1_000_000) if elapsed > 0 else 0
                            print(f"\r    Progress: {mb_done:.1f}MB, {speed:.1f} Mbps", end='', flush=True)
                    
            except urllib.error.HTTPError as e:
                metrics.http_status = e.code
                if e.code == 401 and allow_401:
                    metrics.ttfb = time.time() - download_start
                    total_bytes = len(e.read() or b'')
                else:
                    raise
            
            metrics.bytes_received = total_bytes
            metrics.total_time = time.time() - download_start
            
            # Final progress sample
            if metrics.progress_samples or config.get('size_category') in ('large', 'xlarge'):
                metrics.progress_samples.append((metrics.total_time, total_bytes))
            
        except urllib.error.HTTPError as e:
            metrics.error = f"HTTP {e.code}: {e.reason}"
            metrics.http_status = e.code
        except urllib.error.URLError as e:
            metrics.error = f"URL Error: {e.reason}"
        except socket.timeout:
            metrics.error = "Connection timed out"
        except ssl.SSLCertVerificationError as e:
            metrics.error = f"SSL Certificate Error: {e}"
        except Exception as e:
            metrics.error = str(e)
        
        return metrics
    
    def run_tests(self, iterations: int = 2) -> Dict[str, List[DownloadMetrics]]:
        """Run download tests."""
        all_results = {name: [] for name in self.endpoints}
        
        # For large files, only run once
        large_categories = ('large', 'xlarge')
        
        for iteration in range(iterations):
            print(f"\n--- Iteration {iteration + 1}/{iterations} ---")
            
            for test_name, config in self.endpoints.items():
                # Skip large files on iteration > 1
                if iteration > 0 and config.get('size_category') in large_categories:
                    continue
                    
                desc = config.get('description', test_name)
                print(f"  {desc}...", end=' ', flush=True)
                
                metrics = self.download_with_timing(
                    config['url'], 
                    test_name,
                    config
                )
                
                all_results[test_name].append(metrics)
                
                # Clear progress line for large files
                if config.get('size_category') in large_categories:
                    print("\r" + " " * 60 + "\r", end='')
                    print(f"  {desc}...", end=' ')
                
                if metrics.error:
                    print(f"FAILED: {metrics.error[:50]}")
                else:
                    speed_str = f", {metrics.throughput_mbps:.1f} Mbps" if metrics.throughput_mbps > 0.1 else ""
                    size_str = f", {metrics.bytes_received/1_000_000:.1f}MB" if metrics.bytes_received > 1_000_000 else ""
                    print(f"OK ({metrics.ttfb_ms:.0f}ms TTFB{speed_str}{size_str})")
                
                time.sleep(0.5)
        
        return all_results
    
    def analyze_buffering_pattern(self, metrics: DownloadMetrics) -> dict:
        """Analyze download progress for buffering patterns."""
        if len(metrics.progress_samples) < 3:
            return {'pattern': 'insufficient_data'}
        
        # Calculate speeds between samples
        speeds = []
        for i in range(1, len(metrics.progress_samples)):
            t1, b1 = metrics.progress_samples[i-1]
            t2, b2 = metrics.progress_samples[i]
            dt = t2 - t1
            db = b2 - b1
            if dt > 0:
                speed_mbps = (db * 8) / (dt * 1_000_000)
                speeds.append(speed_mbps)
        
        if not speeds:
            return {'pattern': 'insufficient_data'}
        
        avg_speed = statistics.mean(speeds)
        
        # Check for stair-step pattern (periods of zero progress)
        zero_periods = sum(1 for s in speeds if s < 0.1)
        zero_ratio = zero_periods / len(speeds)
        
        # Check for initial delay (DLP buffering whole file)
        initial_delay = metrics.ttfb > 5.0  # More than 5 seconds
        
        if zero_ratio > 0.3:
            return {
                'pattern': 'bursty',
                'description': 'Data arrives in bursts - possible proxy buffering',
                'zero_ratio': zero_ratio,
                'avg_speed': avg_speed
            }
        elif initial_delay and avg_speed > 10:
            return {
                'pattern': 'delayed_start',
                'description': 'Long initial delay then fast transfer - DLP scanning likely',
                'ttfb_seconds': metrics.ttfb,
                'avg_speed': avg_speed
            }
        else:
            return {
                'pattern': 'smooth',
                'description': 'Continuous data flow - normal behavior',
                'avg_speed': avg_speed
            }
    
    def analyze_results(self, results: Dict[str, List[DownloadMetrics]]) -> Dict:
        """Analyze results for DLP indicators."""
        analysis = {
            'certificate_issues': [],
            'high_ttfb': [],
            'failed_tests': [],
            'low_throughput': [],
            'buffering_detected': [],
            'ttfb_scaling': False,
            'dlp_score': 0,
            'summary': '',
        }
        
        score = 0
        
        # Check certificates
        for host, cert in self.cert_info.items():
            if cert.is_proxy_cert:
                analysis['certificate_issues'].append({
                    'host': host,
                    'indicators': cert.proxy_indicators,
                    'issuer': cert.issuer
                })
                score += 30
        
        # Collect TTFB by file size for correlation analysis
        ttfb_by_size = []
        
        for test_name, metrics_list in results.items():
            config = self.endpoints.get(test_name, {})
            successful = [m for m in metrics_list if not m.error]
            failed = [m for m in metrics_list if m.error]
            
            if failed and not config.get('allow_401'):
                analysis['failed_tests'].append({
                    'test': test_name,
                    'errors': [m.error for m in failed]
                })
                score += 5
            
            if successful:
                avg_ttfb = statistics.mean([m.ttfb_ms for m in successful])
                avg_throughput = statistics.mean([m.throughput_mbps for m in successful if m.throughput_mbps > 0] or [0])
                avg_bytes = statistics.mean([m.bytes_received for m in successful])
                
                ttfb_by_size.append((avg_bytes, avg_ttfb, test_name))
                
                # Analyze buffering pattern for large files
                for m in successful:
                    if m.progress_samples:
                        pattern = self.analyze_buffering_pattern(m)
                        if pattern['pattern'] in ('bursty', 'delayed_start'):
                            analysis['buffering_detected'].append({
                                'test': test_name,
                                'pattern': pattern
                            })
                            score += 15
                
                # TTFB thresholds (higher for larger files due to redirect time)
                size_cat = config.get('size_category', 'small')
                ttfb_threshold = {'small': 2000, 'medium': 3000, 'large': 10000, 'xlarge': 30000}
                
                if avg_ttfb > ttfb_threshold.get(size_cat, 3000):
                    severity = 'critical' if avg_ttfb > ttfb_threshold[size_cat] * 3 else 'high'
                    analysis['high_ttfb'].append({
                        'test': test_name,
                        'avg_ttfb_ms': avg_ttfb,
                        'severity': severity,
                        'size_category': size_cat
                    })
                    score += 15 if severity == 'critical' else 8
                
                # Low throughput for large downloads
                if avg_bytes > 10_000_000 and avg_throughput < 5:
                    analysis['low_throughput'].append({
                        'test': test_name,
                        'throughput_mbps': avg_throughput,
                        'bytes': avg_bytes
                    })
                    score += 10
        
        # Check TTFB scaling with file size
        if len(ttfb_by_size) >= 4:
            ttfb_by_size.sort(key=lambda x: x[0])
            
            # Compare small vs large file TTFB
            small_ttfbs = [t[1] for t in ttfb_by_size if t[0] < 1_000_000]
            large_ttfbs = [t[1] for t in ttfb_by_size if t[0] > 10_000_000]
            
            if small_ttfbs and large_ttfbs:
                avg_small = statistics.mean(small_ttfbs)
                avg_large = statistics.mean(large_ttfbs)
                
                # TTFB shouldn't scale with file size in normal conditions
                if avg_large > avg_small * 10 and avg_large > 5000:
                    analysis['ttfb_scaling'] = True
                    analysis['ttfb_scaling_detail'] = {
                        'small_avg_ms': avg_small,
                        'large_avg_ms': avg_large,
                        'ratio': avg_large / avg_small if avg_small > 0 else 0
                    }
                    score += 25
        
        analysis['dlp_score'] = min(100, score)
        
        if score >= 60:
            analysis['summary'] = "HIGH likelihood of DLP/proxy interference"
        elif score >= 30:
            analysis['summary'] = "MODERATE indicators of network interference"
        elif score >= 10:
            analysis['summary'] = "MINOR anomalies detected"
        else:
            analysis['summary'] = "No significant DLP interference detected"
        
        return analysis
    
    def generate_report(self, results: Dict[str, List[DownloadMetrics]], 
                       analysis: Dict) -> str:
        """Generate a text report."""
        lines = []
        lines.append("=" * 75)
        lines.append("DLP/PROXY INTERFERENCE ANALYSIS REPORT v3")
        lines.append(f"Generated: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}")
        lines.append(f"Hostname: {socket.gethostname()}")
        test_mode = "XLARGE (1GB)" if self.include_xlarge else "LARGE (100MB)" if self.include_large else "STANDARD"
        lines.append(f"Test Mode: {test_mode}")
        lines.append("=" * 75)
        
        # Executive Summary
        lines.append(f"\n{'='*75}")
        lines.append("EXECUTIVE SUMMARY")
        lines.append(f"{'='*75}")
        lines.append(f"\n  DLP Interference Score: {analysis['dlp_score']}/100")
        lines.append(f"  Assessment: {analysis['summary']}")
        
        if analysis['dlp_score'] >= 30:
            lines.append(f"\n  Key Indicators:")
            if analysis['certificate_issues']:
                lines.append(f"    - SSL certificates show proxy interception")
            if analysis['ttfb_scaling']:
                detail = analysis.get('ttfb_scaling_detail', {})
                lines.append(f"    - TTFB scales with file size (small: {detail.get('small_avg_ms', 0):.0f}ms, large: {detail.get('large_avg_ms', 0):.0f}ms)")
            if analysis['buffering_detected']:
                lines.append(f"    - Buffering patterns detected in {len(analysis['buffering_detected'])} download(s)")
            if analysis['high_ttfb']:
                lines.append(f"    - {len(analysis['high_ttfb'])} test(s) with abnormally high TTFB")
        
        # Certificate Analysis
        lines.append(f"\n{'='*75}")
        lines.append("SSL CERTIFICATE ANALYSIS")
        lines.append(f"{'='*75}\n")
        
        for host, cert in self.cert_info.items():
            status = "⚠️  PROXY DETECTED" if cert.is_proxy_cert else "✓ OK"
            issuer_org = cert.issuer.get('organizationName', cert.issuer.get('O', str(cert.issuer)[:50]))
            lines.append(f"  {host}")
            lines.append(f"    Status: {status}")
            lines.append(f"    Issuer: {issuer_org}")
            if cert.not_after:
                lines.append(f"    Expires: {cert.not_after}")
            if cert.proxy_indicators:
                lines.append(f"    ⚠️  Proxy Indicators: {', '.join(cert.proxy_indicators)}")
            lines.append("")
        
        # Download Performance Table
        lines.append(f"{'='*75}")
        lines.append("DOWNLOAD PERFORMANCE")
        lines.append(f"{'='*75}\n")
        
        lines.append(f"  {'Test':<22} {'Size':<8} {'TTFB':<10} {'Speed':<12} {'Status':<10}")
        lines.append("  " + "-" * 70)
        
        for test_name, metrics_list in results.items():
            config = self.endpoints.get(test_name, {})
            successful = [m for m in metrics_list if not m.error]
            failed = [m for m in metrics_list if m.error]
            
            size_cat = config.get('size_category', '?')
            
            if successful:
                avg_ttfb = statistics.mean([m.ttfb_ms for m in successful])
                avg_speed = statistics.mean([m.throughput_mbps for m in successful if m.throughput_mbps > 0.1] or [0])
                avg_bytes = statistics.mean([m.bytes_received for m in successful])
                
                # Determine status
                ttfb_threshold = {'small': 2000, 'medium': 3000, 'large': 10000, 'xlarge': 30000}
                if avg_ttfb > ttfb_threshold.get(size_cat, 3000) * 2:
                    status = "⚠️ SLOW"
                elif avg_ttfb > ttfb_threshold.get(size_cat, 3000):
                    status = "⚡ WARN"
                else:
                    status = "✓ OK"
                
                ttfb_str = f"{avg_ttfb:.0f}ms"
                speed_str = f"{avg_speed:.1f} Mbps" if avg_speed > 0.1 else "N/A"
                
                lines.append(f"  {test_name:<22} {size_cat:<8} {ttfb_str:<10} {speed_str:<12} {status:<10}")
            else:
                error = failed[0].error[:25] if failed else "Unknown"
                lines.append(f"  {test_name:<22} {size_cat:<8} {'N/A':<10} {'N/A':<12} FAILED: {error}")
        
        # Buffering Analysis (for large files)
        if analysis['buffering_detected']:
            lines.append(f"\n{'='*75}")
            lines.append("BUFFERING PATTERN ANALYSIS")
            lines.append(f"{'='*75}\n")
            
            for item in analysis['buffering_detected']:
                pattern = item['pattern']
                lines.append(f"  {item['test']}:")
                lines.append(f"    Pattern: {pattern['pattern']}")
                lines.append(f"    Description: {pattern['description']}")
                if 'avg_speed' in pattern:
                    lines.append(f"    Average Speed: {pattern['avg_speed']:.1f} Mbps")
                lines.append("")
        
        # Issues Summary
        if analysis['failed_tests'] or analysis['low_throughput']:
            lines.append(f"\n{'='*75}")
            lines.append("ISSUES DETECTED")
            lines.append(f"{'='*75}\n")
            
            if analysis['failed_tests']:
                lines.append("  Failed Tests:")
                for issue in analysis['failed_tests']:
                    lines.append(f"    - {issue['test']}: {issue['errors'][0][:50]}")
                lines.append("")
            
            if analysis['low_throughput']:
                lines.append("  Low Throughput:")
                for issue in analysis['low_throughput']:
                    lines.append(f"    - {issue['test']}: {issue['throughput_mbps']:.1f} Mbps")
                lines.append("")
        
        # Raw Data Section (for comparison)
        lines.append(f"\n{'='*75}")
        lines.append("RAW TIMING DATA (for comparison between systems)")
        lines.append(f"{'='*75}\n")
        
        for test_name, metrics_list in results.items():
            successful = [m for m in metrics_list if not m.error]
            if successful:
                ttfbs = [f"{m.ttfb_ms:.0f}" for m in successful]
                speeds = [f"{m.throughput_mbps:.1f}" for m in successful if m.throughput_mbps > 0.1]
                bytes_rcv = [f"{m.bytes_received}" for m in successful]
                
                lines.append(f"  {test_name}:")
                lines.append(f"    TTFB (ms):    [{', '.join(ttfbs)}]")
                if speeds:
                    lines.append(f"    Speed (Mbps): [{', '.join(speeds)}]")
                lines.append(f"    Bytes:        [{', '.join(bytes_rcv)}]")
        
        lines.append("\n" + "=" * 75)
        lines.append("END OF REPORT")
        lines.append("=" * 75)
        
        return "\n".join(lines)
    
    def run(self, output_file: Optional[str] = None, iterations: int = 2):
        """Run the full analysis."""
        print("=" * 60)
        print("DLP INTERFERENCE ANALYZER v3")
        mode = "XLARGE" if self.include_xlarge else "LARGE" if self.include_large else "STANDARD"
        print(f"Mode: {mode}")
        print("=" * 60)
        
        # Certificate analysis
        print("\n[1/3] Analyzing SSL Certificates...")
        for host in self.HOSTS_TO_CHECK:
            print(f"  {host}...", end=' ', flush=True)
            cert = self.analyze_certificate(host)
            self.cert_info[host] = cert
            
            if cert.is_proxy_cert:
                print(f"⚠️  PROXY ({', '.join(cert.proxy_indicators)})")
            elif 'error' in cert.issuer:
                print(f"ERROR: {str(cert.issuer.get('error', ''))[:40]}")
            else:
                org = cert.issuer.get('organizationName', cert.issuer.get('O', 'Unknown'))
                print(f"✓ {org}")
        
        # Download tests
        print("\n[2/3] Running Download Tests...")
        results = self.run_tests(iterations)
        
        # Analysis
        print("\n[3/3] Analyzing Results...")
        analysis = self.analyze_results(results)
        
        # Generate report
        report = self.generate_report(results, analysis)
        
        # Output
        if output_file:
            with open(output_file, 'w') as f:
                f.write(report)
            print(f"\n✓ Report saved to: {output_file}")
        
        print("\n" + report)
        
        return analysis['dlp_score']


def main():
    parser = argparse.ArgumentParser(
        description='Analyze network for DLP/proxy interference',
        formatter_class=argparse.RawDescriptionHelpFormatter,
        epilog="""
Examples:
  python3 dlp_analyzer_v3.py                      # Standard tests (10MB max)
  python3 dlp_analyzer_v3.py --large              # Include 100MB tests
  python3 dlp_analyzer_v3.py --xlarge             # Include 1GB tests
  python3 dlp_analyzer_v3.py --large -o report.txt  # Save report
        """
    )
    parser.add_argument('--output', '-o', help='Output file for report')
    parser.add_argument('--iterations', '-n', type=int, default=2, 
                       help='Test iterations for small/medium files (default: 2)')
    parser.add_argument('--large', '-l', action='store_true',
                       help='Include 100MB file tests')
    parser.add_argument('--xlarge', '-x', action='store_true',
                       help='Include 1GB file tests (takes several minutes)')
    
    args = parser.parse_args()
    
    analyzer = DLPAnalyzer(
        include_large=args.large or args.xlarge,
        include_xlarge=args.xlarge
    )
    score = analyzer.run(output_file=args.output, iterations=args.iterations)
    
    sys.exit(0 if score < 30 else 1)


if __name__ == '__main__':
    main()