Node Failure — Forwarding Plane Dies, Control Plane Green

from dataclasses import dataclass, field
from enum import Enum
from typing import List, Dict, Optional


class NodeType(Enum):
    ENDPOINT = "endpoint"
    ROUTER = "router"
    SWITCH = "switch"
    FIREWALL = "firewall"
    LOAD_BALANCER = "load_balancer"
    SERVER = "server"
    IOT_DEVICE = "iot_device"
    VIRTUAL = "virtual"


class NodeRole(Enum):
    """Topology position — determines blast radius and monitoring tier."""
    BACKBONE = "backbone"       # Core layer — all traffic passes through
    DISTRIBUTION = "distribution" # Aggregation layer — segment traffic
    ACCESS = "access"           # Edge layer — connects endpoints
    EDGE = "edge"               # Internet-facing boundary
    ENDPOINT = "endpoint"       # Source/destination only


@dataclass
class NetworkNode:
    """
    Represents a network node with addressing, role classification,
    and health monitoring attributes.

    The separation of node_type (what the device does) from role (where
    it sits in the topology) is intentional. A router at the backbone
    and a router at the access layer have different blast radii and
    different monitoring requirements, even though they are the same
    node type. Both dimensions matter for operational decisions.
    """
    node_id: str
    hostname: str
    node_type: NodeType
    role: NodeRole
    ip_addresses: List[str] = field(default_factory=list)
    mac_addresses: List[str] = field(default_factory=list)
    interfaces: List[str] = field(default_factory=list)
    is_reachable: bool = True
    latency_ms: float = 0.0
    packet_loss_percent: float = 0.0
    uptime_seconds: float = 0.0

    @property
    def is_critical(self) -> bool:
        """Critical nodes require active-active redundancy and sub-second monitoring."""
        return self.role in (NodeRole.BACKBONE, NodeRole.DISTRIBUTION)

    @property
    def monitoring_tier(self) -> str:
        """
        Determines polling interval and alerting urgency.
        Backbone: streaming telemetry, immediate page.
        Distribution: 10-second polls, high-priority alert.
        Access/Endpoint: 60-second polls, standard ticket.
        """
        tier_map = {
            NodeRole.BACKBONE: "tier-1-streaming",
            NodeRole.DISTRIBUTION: "tier-2-frequent",
            NodeRole.ACCESS: "tier-3-standard",
            NodeRole.EDGE: "tier-1-streaming",
            NodeRole.ENDPOINT: "tier-3-standard",
        }
        return tier_map.get(self.role, "tier-3-standard")

    @property
    def health_score(self) -> float:
        """
        Calculate node health score from 0.0 (down) to 1.0 (healthy).
        Latency and packet loss are penalized proportionally.
        This is a simplified model — production systems should weight
        penalties differently per node_type and role.
        """
        if not self.is_reachable:
            return 0.0
        latency_penalty = min(self.latency_ms / 100.0, 0.3)
        loss_penalty = min(self.packet_loss_percent / 10.0, 0.5)
        return max(0.0, 1.0 - latency_penalty - loss_penalty)


class NetworkTopology:
    """
    Manages a collection of network nodes and their interconnections.
    Provides topology analysis for blast radius assessment and
    identification of articulation points (nodes whose failure
    would partition the network into disconnected components).
    """

    def __init__(self):
        self.nodes: Dict[str, NetworkNode] = {}
        self.adjacency: Dict[str, List[str]] = {}

    def add_node(self, node: NetworkNode) -> None:
        self.nodes[node.node_id] = node
        if node.node_id not in self.adjacency:
            self.adjacency[node.node_id] = []

    def add_link(self, node_a: str, node_b: str) -> None:
        """Add a bidirectional link between two nodes."""
        for n_id in (node_a, node_b):
            if n_id not in self.adjacency:
                self.adjacency[n_id] = []
        if node_b not in self.adjacency[node_a]:
            self.adjacency[node_a].append(node_b)
        if node_a not in self.adjacency[node_b]:
            self.adjacency[node_b].append(node_a)

    def find_critical_nodes(self) -> List[NetworkNode]:
        """
        Identify nodes that are structural single points of failure.
        Includes both role-based critical nodes and topological
        articulation points (nodes with only one uplink path).
        """
        critical = []
        for node_id, node in self.nodes.items():
            if node.is_critical:
                critical.append(node)
            elif len(self.adjacency.get(node_id, [])) == 1:
                # Single uplink = articulation point regardless of role
                critical.append(node)
        return critical

    def get_blast_radius_estimate(self, node_id: str) -> str:
        """
        Estimate how many downstream nodes lose connectivity
        if this node fails.
        """
        if node_id not in self.adjacency:
            return "unknown"
        neighbor_count = len(self.adjacency[node_id])
        node = self.nodes.get(node_id)
        if not node:
            return "unknown"
        if node.role == NodeRole.BACKBONE:
            return f"entire data center — all east-west traffic ({neighbor_count} direct neighbors)"
        elif node.role == NodeRole.DISTRIBUTION:
            return f"multiple racks or segments ({neighbor_count} direct neighbors)"
        elif node.role == NodeRole.ACCESS:
            return f"single rack or floor segment ({neighbor_count} direct neighbors)"
        return f"single device or small group ({neighbor_count} direct neighbors)"


# --- Example topology definition ---
topology = NetworkTopology()

# Backbone core switch — single point of failure for all east-west traffic
topology.add_node(NetworkNode(
    node_id="core-sw-01",
    hostname="core-switch-01",
    node_type=NodeType.SWITCH,
    role=NodeRole.BACKBONE,
    ip_addresses=["10.0.0.1"],
    interfaces=["eth0", "eth1", "eth2", "eth3"]
))

# Web server — endpoint node, failure affects only this server's services
topology.add_node(NetworkNode(
    node_id="web-srv-01",
    hostname="web-server-01",
    node_type=NodeType.SERVER,
    role=NodeRole.ENDPOINT,
    ip_addresses=["10.0.1.10"],
    interfaces=["eth0"]
))

topology.add_link("core-sw-01", "web-srv-01")

print("Critical nodes (require redundancy and high-frequency monitoring):")
for node in topology.find_critical_nodes():
    blast = topology.get_blast_radius_estimate(node.node_id)
    print(f"  {node.hostname} | Role: {node.role.value} | Blast radius: {blast}")
    print(f"  Monitoring tier: {node.monitoring_tier}")

from dataclasses import dataclass
from typing import List, Dict, Optional
from io.thecodeforge.network.node_classifier import NodeType, NodeRole, NetworkNode


@dataclass
class NodeTypeCapabilities:
    """
    Operational characteristics of a network node type.
    Used to drive monitoring configuration, redundancy planning,
    and incident response prioritization.
    """
    node_type: str
    osi_layer: int
    forwarding_method: str
    address_type: str
    typical_redundancy: str
    state_synchronization_required: bool
    failure_blast_radius: str
    monitoring_priority: str
    key_metrics_to_watch: List[str]


class NodeTypeRegistry:
    """
    Registry of network node types with their capabilities
    and operational characteristics. Use this to drive
    automated monitoring configuration and redundancy planning
    rather than making per-device decisions manually.
    """

    TYPE_DEFINITIONS = {
        NodeType.ROUTER: NodeTypeCapabilities(
            node_type="Router",
            osi_layer=3,
            forwarding_method="IP routing table lookup via FIB (Forwarding Information Base)",
            address_type="IP address (destination-based routing)",
            typical_redundancy="VRRP/HSRP for gateway redundancy; ECMP for load distribution across peers",
            state_synchronization_required=False,  # Routing tables rebuilt from protocol exchange
            failure_blast_radius="All traffic between interconnected networks — can affect entire data center",
            monitoring_priority="critical — sub-second telemetry required",
            key_metrics_to_watch=[
                "routing table size and convergence time",
                "BGP/OSPF neighbor session state",
                "forwarding table utilization (TCAM)",
                "interface utilization per link",
                "CPU utilization on control plane vs forwarding plane"
            ]
        ),
        NodeType.SWITCH: NodeTypeCapabilities(
            node_type="Switch",
            osi_layer=2,
            forwarding_method="MAC address table lookup — hardware ASIC forwarding at line rate",
            address_type="MAC address (destination MAC in frame header)",
            typical_redundancy="MLAG for dual-homed server connectivity; RSTP for loop prevention",
            state_synchronization_required=False,  # MAC tables rebuilt from traffic observation
            failure_blast_radius="All devices on connected segments — scope depends on topology position",
            monitoring_priority="critical for backbone/distribution; standard for access layer",
            key_metrics_to_watch=[
                "MAC table utilization",
                "STP topology change events",
                "ASIC memory utilization",
                "interface error counters (CRC, runts, giants)",
                "buffer utilization and queue drops per port"
            ]
        ),
        NodeType.FIREWALL: NodeTypeCapabilities(
            node_type="Firewall",
            osi_layer=4,  # Inspects up to transport layer; NGFW inspects to Layer 7
            forwarding_method="Stateful packet inspection — maintains per-connection state table",
            address_type="IP address + port number (5-tuple for state tracking)",
            typical_redundancy="Active-passive HA with state table synchronization — active-active requires careful session affinity",
            state_synchronization_required=True,  # Connection state table must be replicated
            failure_blast_radius="All traffic crossing the security boundary — blocks all cross-zone communication",
            monitoring_priority="critical — data plane health check mandatory, not just ping",
            key_metrics_to_watch=[
                "connection state table utilization",
                "session establishment rate",
                "policy rule hit counts (detect misconfigurations)",
                "HA pair synchronization status",
                "throughput vs licensed capacity"
            ]
        ),
        NodeType.LOAD_BALANCER: NodeTypeCapabilities(
            node_type="Load Balancer",
            osi_layer=7,  # Layer 4 for TCP/UDP LB; Layer 7 for HTTP/gRPC LB
            forwarding_method="Algorithm-based connection distribution (round-robin, least-conn, IP hash)",
            address_type="Virtual IP (VIP) — single address representing the entire backend pool",
            typical_redundancy="Active-active — both nodes handle traffic; health checks remove failed backends",
            state_synchronization_required=False,  # Most LB algorithms are stateless per-connection
            failure_blast_radius="All services behind the VIP — every request to that address fails",
            monitoring_priority="critical — VIP availability directly maps to service availability",
            key_metrics_to_watch=[
                "backend pool health check pass rate",
                "active connections per backend",
                "connection queue depth",
                "SSL/TLS handshake rate and latency",
                "VIP response time from external probes"
            ]
        ),
        NodeType.SERVER: NodeTypeCapabilities(
            node_type="Server",
            osi_layer=7,
            forwarding_method="Application-level request processing — no packet forwarding",
            address_type="IP address (may have multiple IPs for different services)",
            typical_redundancy="Horizontal scaling behind a load balancer — no single server is critical",
            state_synchronization_required=False,  # Application-layer concern, not network-layer
            failure_blast_radius="Services hosted on this specific server — load balancer routes around it",
            monitoring_priority="standard — load balancer health checks handle automatic removal",
            key_metrics_to_watch=[
                "application response time",
                "error rate per endpoint",
                "connection count",
                "network interface utilization",
                "TCP retransmit rate"
            ]
        ),
        NodeType.ENDPOINT: NodeTypeCapabilities(
            node_type="Endpoint",
            osi_layer=7,
            forwarding_method="None — source or destination only, no forwarding responsibility",
            address_type="IP address (DHCP or static) + MAC address",
            typical_redundancy="None at network level — application-layer HA if required",
            state_synchronization_required=False,
            failure_blast_radius="Single user or device — no impact on other network participants",
            monitoring_priority="low — standard helpdesk ticket process",
            key_metrics_to_watch=[
                "connectivity to default gateway",
                "DNS resolution latency",
                "application-specific metrics"
            ]
        )
    }

    @staticmethod
    def get_capabilities(node_type: NodeType) -> Optional[NodeTypeCapabilities]:
        return NodeTypeRegistry.TYPE_DEFINITIONS.get(node_type)

    @staticmethod
    def classify_by_blast_radius(
        nodes: List[NetworkNode]
    ) -> Dict[str, List[NetworkNode]]:
        """
        Group nodes by failure blast radius for risk-based prioritization.
        Used to drive redundancy investment decisions and incident
        response escalation policies.
        """
        result: Dict[str, List[NetworkNode]] = {"critical": [], "high": [], "medium": [], "low": []}

        for node in nodes:
            if node.role in (NodeRole.BACKBONE, NodeRole.EDGE):
                result["critical"].append(node)
            elif node.role == NodeRole.DISTRIBUTION:
                result["high"].append(node)
            elif node.node_type in (NodeType.FIREWALL, NodeType.LOAD_BALANCER):
                result["high"].append(node)
            elif node.node_type == NodeType.SWITCH and node.role == NodeRole.ACCESS:
                result["medium"].append(node)
            else:
                result["low"].append(node)

        return result


# Display the type registry for documentation and tooling
print("Network Node Type Reference:")
print("-" * 60)
for ntype, caps in NodeTypeRegistry.TYPE_DEFINITIONS.items():
    print(f"\n{caps.node_type}")
    print(f"  OSI Layer:          {caps.osi_layer}")
    print(f"  Forwarding:         {caps.forwarding_method}")
    print(f"  Redundancy:         {caps.typical_redundancy}")
    print(f"  State sync needed:  {caps.state_synchronization_required}")
    print(f"  Blast radius:       {caps.failure_blast_radius}")
    print(f"  Monitoring:         {caps.monitoring_priority}")

from dataclasses import dataclass
from typing import List, Dict, Optional
from enum import Enum


class ProtocolLayer(Enum):
    PHYSICAL = 1      # Cables, optics, signal encoding
    DATA_LINK = 2     # MAC addresses, frames, VLANs
    NETWORK = 3       # IP addresses, packets, routing
    TRANSPORT = 4     # TCP/UDP, ports, connection state
    SESSION = 5       # Session establishment (rarely referenced in debugging)
    PRESENTATION = 6  # Encoding, encryption (TLS lives here)
    APPLICATION = 7   # HTTP, DNS, gRPC, application protocols


@dataclass
class PacketTrace:
    hop_number: int
    node_hostname: str
    node_ip: str
    ingress_interface: str
    egress_interface: str
    latency_ms: float
    ttl_remaining: int
    action: str  # 'forward', 'deliver', 'drop', 'reject'


class NodeCommunicationTracer:
    """
    Models packet flow through a sequence of network nodes.
    Used for pre-change path analysis and post-incident
    reconstruction of what actually happened.

    In production, this logic is implemented by tools like:
    - mtr / traceroute (active probing)
    - Wireshark / tcpdump (passive capture)
    - Network simulation tools (forward-looking path analysis)
    - Streaming telemetry with per-flow tracking
    """

    # Maps node types to the OSI layers they actively process
    # A switch terminates at Layer 2 — it does not inspect IP headers
    # A firewall terminates at Layer 4 — it reads port numbers for state tracking
    # A server terminates at Layer 7 — it parses application protocol payloads
    NODE_TYPE_LAYERS: Dict[str, List[ProtocolLayer]] = {
        "switch": [
            ProtocolLayer.PHYSICAL,
            ProtocolLayer.DATA_LINK
        ],
        "router": [
            ProtocolLayer.PHYSICAL,
            ProtocolLayer.DATA_LINK,
            ProtocolLayer.NETWORK
        ],
        "firewall": [
            ProtocolLayer.PHYSICAL,
            ProtocolLayer.DATA_LINK,
            ProtocolLayer.NETWORK,
            ProtocolLayer.TRANSPORT
        ],
        "load_balancer": [
            ProtocolLayer.PHYSICAL,
            ProtocolLayer.DATA_LINK,
            ProtocolLayer.NETWORK,
            ProtocolLayer.TRANSPORT,
            ProtocolLayer.APPLICATION  # HTTP/gRPC LBs inspect request headers
        ],
        "server": [layer for layer in ProtocolLayer],
        "endpoint": [layer for layer in ProtocolLayer]
    }

    @staticmethod
    def trace_route(
        source_ip: str,
        destination_ip: str,
        hops: List[Dict]
    ) -> List[PacketTrace]:
        """Simulate or reconstruct a packet path through network hops."""
        trace = []
        for i, hop in enumerate(hops):
            trace.append(PacketTrace(
                hop_number=i + 1,
                node_hostname=hop["hostname"],
                node_ip=hop["ip"],
                ingress_interface=hop.get("ingress", "N/A"),
                egress_interface=hop.get("egress", "N/A"),
                latency_ms=hop.get("latency_ms", 0.0),
                ttl_remaining=64 - (i + 1),
                action=hop.get("action", "forward")
            ))
        return trace

    @staticmethod
    def identify_failure_layer(
        icmp_works: bool,
        tcp_syn_works: bool,
        application_works: bool
    ) -> str:
        """
        Use connectivity test results to identify which OSI layer
        is failing. This is the systematic approach to avoid wasting
        time debugging the wrong layer.

        Call pattern: test each layer from bottom to top, stop at
        first failure — that layer is where you investigate.
        """
        if not icmp_works:
            return (
                "Layer 1-3 failure — physical connectivity or IP routing problem. "
                "Check: cable/optic status, ARP table, routing table, next-hop reachability."
            )
        if not tcp_syn_works:
            return (
                "Layer 4 failure — ICMP works but TCP is blocked. "
                "Check: firewall rules, security group policies, port filtering, "
                "TCP connection state table exhaustion on firewall."
            )
        if not application_works:
            return (
                "Layer 7 failure — TCP connects but application fails. "
                "Check: TLS certificate validity, HTTP response codes, "
                "application-level authentication, DNS resolution, "
                "load balancer backend pool health."
            )
        return "All layers functional — failure may be intermittent or load-dependent."

    @staticmethod
    def resolve_next_hop(
        destination_ip: str,
        layer: ProtocolLayer,
        arp_table: Dict[str, str],
        routing_table: List[Dict]
    ) -> Optional[str]:
        """
        Resolve the address of the next node at the appropriate layer.
        Layer 2: ARP table resolves IP to MAC for same-subnet destinations.
        Layer 3: Routing table resolves to next-hop IP for cross-network destinations.
        """
        if layer == ProtocolLayer.DATA_LINK:
            # Same-subnet communication — resolve MAC from ARP
            return arp_table.get(destination_ip)
        elif layer == ProtocolLayer.NETWORK:
            # Cross-network communication — find longest-prefix-match route
            matched_route = None
            longest_prefix = -1
            for route in routing_table:
                prefix_len = int(route["prefix"].split("/")[1]) if "/" in route["prefix"] else 0
                if destination_ip.startswith(route["prefix"].split("/")[0]):
                    if prefix_len > longest_prefix:
                        matched_route = route
                        longest_prefix = prefix_len
            return matched_route["next_hop"] if matched_route else None
        return None


# --- Example: reconstruct the packet path for a cross-tier API call ---
tracer = NodeCommunicationTracer()
trace = tracer.trace_route(
    source_ip="10.0.1.10",
    destination_ip="10.0.2.20",
    hops=[
        {"hostname": "access-sw-01", "ip": "10.0.1.1",
         "ingress": "port-42", "egress": "uplink-1", "latency_ms": 0.2, "action": "forward"},
        {"hostname": "core-rtr-01", "ip": "10.0.0.1",
         "ingress": "eth0", "egress": "eth1", "latency_ms": 0.5, "action": "forward"},
        {"hostname": "dist-sw-01", "ip": "10.0.2.1",
         "ingress": "uplink-1", "egress": "port-18", "latency_ms": 0.3, "action": "forward"},
        {"hostname": "api-srv-02", "ip": "10.0.2.20",
         "ingress": "eth0", "egress": "N/A", "latency_ms": 0.1, "action": "deliver"}
    ]
)

print("Packet trace from 10.0.1.10 to 10.0.2.20:")
for hop in trace:
    print(f"  Hop {hop.hop_number}: {hop.node_hostname:20} ({hop.node_ip:12}) "
          f"{hop.latency_ms:5.1f}ms  TTL:{hop.ttl_remaining:2d}  [{hop.action}]")

print()
# Systematic failure layer identification
print("Failure layer analysis:")
print(NodeCommunicationTracer.identify_failure_layer(
    icmp_works=True,
    tcp_syn_works=False,
    application_works=False
))

from dataclasses import dataclass
from enum import Enum
from typing import List, Dict, Optional
from io.thecodeforge.network.node_classifier import NodeType, NodeRole, NetworkNode


class RedundancyType(Enum):
    ACTIVE_ACTIVE = "active_active"    # Both nodes forward traffic simultaneously
    ACTIVE_PASSIVE = "active_passive"  # One active, one standby — failover on detection
    ECMP = "ecmp"                      # Equal-cost multipath — load distribution across N paths
    VRRP = "vrrp"                      # Virtual Router Redundancy Protocol — gateway HA
    MLAG = "mlag"                      # Multi-chassis Link Aggregation — switch HA
    ANYCAST = "anycast"                # Same IP announced from multiple locations via BGP


@dataclass
class RedundancyGroup:
    """
    A group of nodes providing redundant service for a traffic path.
    Encapsulates the redundancy configuration and health state for
    a complete HA unit.
    """
    group_id: str
    redundancy_type: RedundancyType
    primary_node: str
    secondary_nodes: List[str]
    virtual_ip: Optional[str] = None
    failover_time_ms: float = 0.0     # 0 = active-active, no failover needed
    state_sync_enabled: bool = False
    last_failover_test: Optional[str] = None  # ISO date of most recent drill
    config_sync_verified: bool = False

    @property
    def total_nodes(self) -> int:
        return 1 + len(self.secondary_nodes)

    @property
    def is_sufficiently_redundant(self) -> bool:
        """Minimum viable redundancy requires at least 2 nodes."""
        return self.total_nodes >= 2

    @property
    def failover_tested_recently(self) -> bool:
        """
        Check if failover has been tested within the last 90 days.
        Untested redundancy is not redundancy — it is an untested hypothesis.
        """
        if not self.last_failover_test:
            return False
        from datetime import datetime, timedelta
        try:
            test_date = datetime.fromisoformat(self.last_failover_test)
            return (datetime.now() - test_date) < timedelta(days=90)
        except ValueError:
            return False

    @property
    def operational_confidence(self) -> str:
        """Human-readable assessment of this redundancy group's readiness."""
        if not self.is_sufficiently_redundant:
            return "CRITICAL — single node, no redundancy"
        if not self.config_sync_verified:
            return "HIGH RISK — redundancy unverified, config drift possible"
        if not self.failover_tested_recently:
            return "MEDIUM RISK — failover not tested in 90+ days"
        return "HEALTHY — redundant, config-synced, recently tested"


class RedundancyPlanner:
    """
    Plans and validates redundancy configurations for network nodes.
    Provides recommendations based on node type and operational requirements.
    """

    RECOMMENDED_STRATEGIES: Dict = {
        NodeType.ROUTER: {
            "primary": RedundancyType.ECMP,        # Active-active, zero failover time
            "alternative": RedundancyType.VRRP,    # If ECMP not available
            "min_nodes": 2,
            "target_failover_ms": 0,               # ECMP = no failover event
            "state_sync": False,                   # Routing tables rebuilt from protocol
            "detection_mechanism": "BFD (Bidirectional Forwarding Detection) — sub-100ms"
        },
        NodeType.SWITCH: {
            "primary": RedundancyType.MLAG,
            "alternative": RedundancyType.ACTIVE_ACTIVE,
            "min_nodes": 2,
            "target_failover_ms": 500,
            "state_sync": False,                   # MAC tables rebuilt from traffic
            "detection_mechanism": "LACP with fast timers — sub-second"
        },
        NodeType.FIREWALL: {
            "primary": RedundancyType.ACTIVE_PASSIVE,
            "alternative": RedundancyType.ACTIVE_ACTIVE,  # Only with full state sync
            "min_nodes": 2,
            "target_failover_ms": 3000,            # State sync adds failover latency
            "state_sync": True,                    # Connection state table MUST be synced
            "detection_mechanism": "HA heartbeat with configurable interval"
        },
        NodeType.LOAD_BALANCER: {
            "primary": RedundancyType.ACTIVE_ACTIVE,
            "alternative": RedundancyType.ANYCAST,
            "min_nodes": 2,
            "target_failover_ms": 0,               # Active-active = no failover event
            "state_sync": False,
            "detection_mechanism": "Backend health checks — continuous, configurable interval"
        },
        NodeType.SERVER: {
            "primary": RedundancyType.ACTIVE_ACTIVE,
            "alternative": RedundancyType.ECMP,
            "min_nodes": 3,                        # N+1 minimum for maintenance capacity
            "target_failover_ms": 0,
            "state_sync": False,
            "detection_mechanism": "Load balancer health checks — HTTP endpoint verification"
        }
    }

    @staticmethod
    def plan_redundancy(
        node_type: NodeType,
        nodes: List[NetworkNode]
    ) -> RedundancyGroup:
        strategy = RedundancyPlanner.RECOMMENDED_STRATEGIES.get(node_type)
        if not strategy:
            raise ValueError(f"No redundancy strategy defined for node type: {node_type}")
        if len(nodes) < strategy["min_nodes"]:
            raise ValueError(
                f"{node_type.value} requires at least {strategy['min_nodes']} nodes. "
                f"Current: {len(nodes)}. Add more nodes before claiming HA."
            )
        return RedundancyGroup(
            group_id=f"{node_type.value}-ha-group-{nodes[0].node_id}",
            redundancy_type=strategy["primary"],
            primary_node=nodes[0].node_id,
            secondary_nodes=[n.node_id for n in nodes[1:]],
            failover_time_ms=strategy["target_failover_ms"],
            state_sync_enabled=strategy["state_sync"]
        )

    @staticmethod
    def audit_redundancy_group(group: RedundancyGroup) -> List[str]:
        """
        Identify operational risks in an existing redundancy configuration.
        Returns a list of findings — empty list means the group is healthy.
        """
        findings = []
        if not group.is_sufficiently_redundant:
            findings.append(f"CRITICAL: {group.group_id} has only {group.total_nodes} node — no redundancy")
        if not group.config_sync_verified:
            findings.append(f"HIGH: {group.group_id} configuration sync has not been verified — drift risk")
        if not group.failover_tested_recently:
            findings.append(f"MEDIUM: {group.group_id} failover test is overdue — schedule a drill")
        if group.state_sync_enabled and group.redundancy_type == RedundancyType.ACTIVE_PASSIVE:
            if group.failover_time_ms > 5000:
                findings.append(f"HIGH: {group.group_id} failover target {group.failover_time_ms}ms exceeds 5s SLA")
        return findings


# --- Example ---
routers = [
    NetworkNode("rtr-01", "router-primary", NodeType.ROUTER, NodeRole.BACKBONE,
                ip_addresses=["10.0.0.1"]),
    NetworkNode("rtr-02", "router-secondary", NodeType.ROUTER, NodeRole.BACKBONE,
                ip_addresses=["10.0.0.2"])
]
ha_group = RedundancyPlanner.plan_redundancy(NodeType.ROUTER, routers)
ha_group.last_failover_test = "2025-12-01"  # More than 90 days ago
ha_group.config_sync_verified = True

print(f"Group: {ha_group.group_id}")
print(f"Type: {ha_group.redundancy_type.value}")
print(f"Nodes: {ha_group.total_nodes}")
print(f"Confidence: {ha_group.operational_confidence}")
print()
findings = RedundancyPlanner.audit_redundancy_group(ha_group)
if findings:
    print("Audit findings:")
    for f in findings:
        print(f"  {f}")

from dataclasses import dataclass, field
from typing import List, Dict, Optional
from datetime import datetime
from io.thecodeforge.network.node_classifier import NetworkNode, NodeType


@dataclass
class NodeMetrics:
    """
    Comprehensive metrics snapshot for a network node.
    Collected via SNMP, streaming telemetry, or agent-based monitoring
    depending on the node type and criticality tier.

    Critical distinction: all metrics here are control-plane metrics
    unless explicitly noted otherwise. Data plane health must be
    verified separately via synthetic forwarding probes.
    """
    node_id: str
    timestamp: datetime

    # Control plane resource utilization
    cpu_percent: float = 0.0           # Management CPU — NOT forwarding ASIC CPU
    memory_percent: float = 0.0

    # Data plane metrics — interface-level
    interface_utilization: Dict[str, float] = field(default_factory=dict)  # per-interface, 0.0-1.0
    interface_error_rate: Dict[str, float] = field(default_factory=dict)   # CRC + input errors per second
    queue_drop_rate: Dict[str, float] = field(default_factory=dict)        # output queue drops per second

    # End-to-end health
    packet_loss_percent: float = 0.0   # From synthetic probes, not SNMP
    latency_ms: float = 0.0            # RTT from monitoring probe, not SNMP

    # Hardware-level (requires vendor-specific MIBs or CLI)
    asic_memory_percent: float = 0.0   # TCAM/FIB/CAM utilization on forwarding ASIC
    forwarding_table_percent: float = 0.0  # Route/MAC table fill percentage

    error_count: int = 0
    uptime_seconds: float = 0.0

    @property
    def has_interface_saturation(self) -> bool:
        """True if any interface is above 80% utilization — queue drops imminent."""
        return any(util > 0.80 for util in self.interface_utilization.values())

    @property
    def has_interface_errors(self) -> bool:
        """True if any interface is generating errors — physical layer issue."""
        return any(rate > 0 for rate in self.interface_error_rate.values())

    @property
    def is_healthy(self) -> bool:
        return (
            self.cpu_percent < 80.0
            and self.memory_percent < 85.0
            and self.asic_memory_percent < 80.0
            and self.packet_loss_percent < 0.1
            and self.latency_ms < 50.0
            and not self.has_interface_saturation
            and not self.has_interface_errors
        )

    @property
    def health_issues(self) -> List[str]:
        issues = []
        if self.cpu_percent >= 80.0:
            issues.append(f"Control plane CPU at {self.cpu_percent:.1f}% — routing protocols may be affected")
        if self.memory_percent >= 85.0:
            issues.append(f"Memory at {self.memory_percent:.1f}%")
        if self.asic_memory_percent >= 80.0:
            issues.append(f"ASIC memory at {self.asic_memory_percent:.1f}% — forwarding table exhaustion risk")
        if self.packet_loss_percent >= 0.1:
            issues.append(f"Packet loss at {self.packet_loss_percent:.3f}% from synthetic probes")
        if self.latency_ms >= 50.0:
            issues.append(f"Latency at {self.latency_ms:.1f}ms — investigate queuing or processing delay")
        if self.has_interface_saturation:
            saturated = [i for i, u in self.interface_utilization.items() if u > 0.80]
            issues.append(f"Interface saturation on: {', '.join(saturated)}")
        if self.has_interface_errors:
            errored = [i for i, r in self.interface_error_rate.items() if r > 0]
            issues.append(f"Interface errors on: {', '.join(errored)} — check physical layer")
        return issues


class NodeMonitor:
    """
    Type-specific node monitoring with differentiated thresholds.
    Backbone nodes get tighter thresholds because their failure
    blast radius demands earlier warning. Endpoint nodes get
    relaxed thresholds to reduce alert noise on non-critical events.
    """

    THRESHOLDS: Dict = {
        NodeType.ROUTER: {
            # Routers in busy networks legitimately run high CPU during routing changes
            "cpu_percent": 70.0,
            "memory_percent": 80.0,
            "asic_memory_percent": 75.0,  # TCAM exhaustion is a hard cliff, not a gradual slope
            "packet_loss_percent": 0.01,  # Any loss through a core router is significant
            "latency_ms": 10.0
        },
        NodeType.SWITCH: {
            "cpu_percent": 60.0,           # Switch control plane should be nearly idle
            "memory_percent": 75.0,
            "asic_memory_percent": 70.0,   # MAC/ARP table exhaustion causes flooding
            "packet_loss_percent": 0.001,  # Switches should be lossless at normal utilization
            "latency_ms": 5.0              # Wire-speed forwarding = microseconds, not milliseconds
        },
        NodeType.FIREWALL: {
            "cpu_percent": 75.0,
            "memory_percent": 85.0,
            "asic_memory_percent": 80.0,   # Connection state table fill percentage
            "packet_loss_percent": 0.1,
            "latency_ms": 20.0
        },
        NodeType.SERVER: {
            "cpu_percent": 85.0,
            "memory_percent": 90.0,
            "asic_memory_percent": 0.0,   # Servers don't have forwarding ASICs
            "packet_loss_percent": 0.1,
            "latency_ms": 50.0
        }
    }

    def __init__(self):
        self.metrics_history: Dict[str, List[NodeMetrics]] = {}

    def record_metrics(self, metrics: NodeMetrics) -> None:
        if metrics.node_id not in self.metrics_history:
            self.metrics_history[metrics.node_id] = []
        self.metrics_history[metrics.node_id].append(metrics)

    def check_thresholds(
        self,
        node_id: str,
        node_type: NodeType,
        metrics: NodeMetrics
    ) -> List[str]:
        alerts = []
        thresholds = self.THRESHOLDS.get(node_type, {})
        for metric, limit in thresholds.items():
            if limit == 0.0:
                continue  # Skip metrics that don't apply to this node type
            value = getattr(metrics, metric, None)
            if value is not None and value >= limit:
                alerts.append(
                    f"[{node_id}] {metric} = {value:.3f} exceeds {node_type.value} threshold of {limit}"
                )
        # Always check interface-level issues regardless of thresholds
        if metrics.has_interface_errors:
            alerts.append(f"[{node_id}] Interface errors detected — check physical layer immediately")
        return alerts

    def detect_sudden_changes(
        self,
        node_id: str
    ) -> List[str]:
        """
        Detect rapid changes that may indicate an incident in progress.
        Sudden CPU or packet loss spikes are more significant than
        gradual increases that trigger threshold alerts.
        """
        history = self.metrics_history.get(node_id, [])
        if len(history) < 2:
            return []
        anomalies = []
        recent = history[-1]
        previous = history[-2]

        cpu_delta = recent.cpu_percent - previous.cpu_percent
        if cpu_delta > 30.0:
            anomalies.append(f"CPU jumped {cpu_delta:.1f}% between samples — likely routing event or attack traffic")

        loss_delta = recent.packet_loss_percent - previous.packet_loss_percent
        if loss_delta > 1.0:
            anomalies.append(f"Packet loss increased by {loss_delta:.2f}% — investigate forwarding plane")

        asic_delta = recent.asic_memory_percent - previous.asic_memory_percent
        if asic_delta > 10.0:
            anomalies.append(f"ASIC memory grew {asic_delta:.1f}% between samples — table growth rate is unsustainable")

        return anomalies


# --- Example monitoring run ---
monitor = NodeMonitor()

# Healthy core router metrics — near thresholds but not over
healthy_metrics = NodeMetrics(
    node_id="core-rtr-01",
    timestamp=datetime.now(),
    cpu_percent=45.0,
    memory_percent=62.0,
    asic_memory_percent=68.0,  # Getting close to 75% threshold — worth watching
    packet_loss_percent=0.002,
    latency_ms=2.3,
    interface_utilization={"eth0": 0.45, "eth1": 0.38},
    interface_error_rate={"eth0": 0.0, "eth1": 0.0}
)
monitor.record_metrics(healthy_metrics)

alerts = monitor.check_thresholds("core-rtr-01", NodeType.ROUTER, healthy_metrics)
if alerts:
    for alert in alerts:
        print(f"ALERT: {alert}")
else:
    print(f"core-rtr-01: all metrics within {NodeType.ROUTER.value} thresholds")
    if healthy_metrics.asic_memory_percent > 60.0:
        print(f"WATCH: ASIC memory at {healthy_metrics.asic_memory_percent}% — approaching 75% threshold")