analyze performance upgrade

README.md

@@ -5,7 +5,8 @@ IoT PreTester 4.6 Demo is a partner-ready demonstration platform for security an
 ## Demo scope
 
 - Upload and analyze `.pcap` and `.pcapng` captures.
-- Detect credential exposure, secrets, suspicious traffic patterns, weak protocols, TLS issues, DNS anomalies, scanning, and possible exfiltration.
+- Detect credential exposure (FTP, Telnet, POP3, IMAP, SMTP, HTTP forms/JSON/Basic, MQTT, SNMP), secrets, suspicious traffic patterns, clear-text and legacy protocols (incl. MQTT, CoAP, RTSP, Modbus, TFTP), TLS issues (negotiated version/cipher, client capabilities, certificates), DNS anomalies, scanning, brute force, unprotected firmware transfers, and possible exfiltration.
+- Present a complete observation inventory (device peers, hosts, endpoints, services, TLS posture, DNS, coverage) so nothing is overlooked even when no finding is raised.
 - Review affected endpoints, evidence, packet references, severity, confidence, and recommendations.
 - Export reports as Markdown, plain text, or JSON.
 - Optionally run user-selected URL probes and offline hash checks.
@@ -19,7 +20,7 @@ Firmware binary analysis and historical prototype pages are intentionally not pa
 - At least 4 GB of free memory for the two application containers
 - A modern web browser
 
-No local Python, Node.js, tshark, nmap, or hashcat installation is required for the Docker workflow.
+No local Python, Node.js, tshark, nmap, or hashcat installation is required for the Docker workflow. For headless use outside Docker, install tshark (Wireshark 4.0 or newer) and `pip install -r requirements.txt`.
 
 ## Quick start
 
@@ -80,10 +81,26 @@ The analysis core can also run without Django:
 ```bash
 cd django_project
 python -m analyzer.cli ../demo_files/demo_capture.pcapng -f md -o report.md
+python -m analyzer.cli capture.pcapng -f json --device-ip 192.168.1.50 -o report.json
 ```
 
+`--device-ip` marks the device under test: findings that involve it are attributed and sorted first, and the report's observation inventory lists every peer, service, TLS handshake and DNS name of that device. The web UI passes the IP entered at upload time automatically.
+
 Exit code `0` means no high/critical findings, `2` means at least one high/critical finding, and `1` indicates an execution error.
 
+## Logs and troubleshooting
+
+| Where | What |
+| --- | --- |
+| `docker compose logs -f backend` | Application log (requests, analysis phases, errors with tracebacks) |
+| `/app/logs/backend.log` in the backend container | Same log as a rotating file (10 MB × 5) |
+| `/app/files/uploads/<capture>.analysis.log` | Complete log of one capture analysis; shown in the UI when an analysis fails |
+| `GET /api/get_analysis_log/<file_id>` | Tail of that per-capture log |
+| `GET /api/health` | tshark/hashcat/nmap availability, analyzer version, upload directory, log level |
+| Browser console | Client log with API timings; `window.__iotpDumpLogs()` copies the last 300 entries |
+
+Set `LOG_LEVEL=debug` in `.env` to log every detector step and the exact tshark command lines. Every API response carries an `X-Request-ID` header that also appears in the backend log line for that request. In the browser, `localStorage.setItem("iotp_log_level", "debug")` raises the client log level without a rebuild.
+
 ## Demo safety notes
 
 - Only upload captures that you are authorized to inspect. Captures can contain credentials, tokens, personal data, and internal addresses.