# Hourly (UTC-aligned) information volume of unique subdomains per (host, base) on real dns.log files.
import sys, os, collections, math, importlib.util
here = os.path.dirname(os.path.abspath(__file__))
sp = importlib.util.spec_from_file_location('p3lib', os.path.join(here, 'p3lib.py')); L = importlib.util.module_from_spec(sp); sp.loader.exec_module(L)
def read(path):
    fields = None
    for line in open(path, errors='replace'):
        line = line.rstrip('\n')
        if line.startswith('#fields'): fields = line.split('\t')[1:]; continue
        if line.startswith('#') or not line: continue
        yield dict(zip(fields, line.split('\t')))
allmax = []
for path in sys.argv[1:]:
    b = collections.defaultdict(set)
    for r in read(path):
        q = r.get('query')
        if q in (None, '-', ''): continue
        base, sub = L.split(q)
        if sub: b[(r['id.orig_h'], base, int(float(r['ts']) // 3600))].add(sub)
    best = []
    for (h, base, hr), subs in b.items():
        cnt = collections.Counter(c for s in subs for c in L.chars(s))
        bits = L.H(cnt) * sum(len(L.chars(s)) for s in subs)
        best.append((bits, h, base, hr, len(subs)))
    best.sort(reverse=True)
    print(f"== {path}: (host,base,hour) groups={len(best)}; top3 hourly info bits:")
    for x in best[:3]: print(f"   bits={x[0]:.0f} host={x[1]} base={x[2]} U={x[4]}")