From 872d1b1ee13e358c18956945d71d3667d19fca8a Mon Sep 17 00:00:00 2001 From: merrimanr Date: Thu, 12 Apr 2018 09:57:48 -0500 Subject: [PATCH 01/14] Merge branch 'pcap-front' of https://github.com/simonellistonball/metron into pcaprest Conflicts: metron-interface/metron-alerts/src/app/app.module.ts --- .../src/app/app-routing.module.ts | 3 +- .../metron-alerts/src/app/app.component.html | 8 + .../metron-alerts/src/app/app.component.scss | 18 + .../metron-alerts/src/app/app.module.ts | 6 +- .../src/app/pcap/model/pcap.request.ts | 28 + .../metron-alerts/src/app/pcap/model/pdml.ts | 42 + .../pcap-filters/pcap-filters.component.html | 29 + .../pcap-filters/pcap-filters.component.scss | 52 + .../pcap-filters.component.spec.ts | 25 + .../pcap-filters/pcap-filters.component.ts | 23 + .../pcap/pcap-list/pcap-list.component.html | 24 + .../pcap/pcap-list/pcap-list.component.scss | 4 + .../pcap-list/pcap-list.component.spec.ts | 25 + .../app/pcap/pcap-list/pcap-list.component.ts | 22 + .../pcap-packet-line.component.html | 6 + .../pcap-packet-line.component.scss | 0 .../pcap-packet-line.component.spec.ts | 25 + .../pcap-packet-line.component.ts | 38 + .../pcap-packet/pcap-packet.component.html | 8 + .../pcap-packet/pcap-packet.component.scss | 15 + .../pcap-packet/pcap-packet.component.spec.ts | 25 + .../pcap/pcap-packet/pcap-packet.component.ts | 22 + .../pcap/pcap-panel/pcap-panel.component.html | 8 + .../pcap/pcap-panel/pcap-panel.component.scss | 0 .../pcap-panel/pcap-panel.component.spec.ts | 25 + .../pcap/pcap-panel/pcap-panel.component.ts | 35 + .../metron-alerts/src/app/pcap/pcap.module.ts | 50 + .../src/app/pcap/pcap.routing.ts | 27 + .../src/app/pcap/service/pcap.service.spec.ts | 1734 ++++++++++ .../src/app/pcap/service/pcap.service.ts | 2994 +++++++++++++++++ 30 files changed, 5317 insertions(+), 4 deletions(-) create mode 100644 metron-interface/metron-alerts/src/app/pcap/model/pcap.request.ts create mode 100644 metron-interface/metron-alerts/src/app/pcap/model/pdml.ts create mode 100644 metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.html create mode 100644 metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.scss create mode 100644 metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.spec.ts create mode 100644 metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.ts create mode 100644 metron-interface/metron-alerts/src/app/pcap/pcap-list/pcap-list.component.html create mode 100644 metron-interface/metron-alerts/src/app/pcap/pcap-list/pcap-list.component.scss create mode 100644 metron-interface/metron-alerts/src/app/pcap/pcap-list/pcap-list.component.spec.ts create mode 100644 metron-interface/metron-alerts/src/app/pcap/pcap-list/pcap-list.component.ts create mode 100644 metron-interface/metron-alerts/src/app/pcap/pcap-packet-line/pcap-packet-line.component.html create mode 100644 metron-interface/metron-alerts/src/app/pcap/pcap-packet-line/pcap-packet-line.component.scss create mode 100644 metron-interface/metron-alerts/src/app/pcap/pcap-packet-line/pcap-packet-line.component.spec.ts create mode 100644 metron-interface/metron-alerts/src/app/pcap/pcap-packet-line/pcap-packet-line.component.ts create mode 100644 metron-interface/metron-alerts/src/app/pcap/pcap-packet/pcap-packet.component.html create mode 100644 metron-interface/metron-alerts/src/app/pcap/pcap-packet/pcap-packet.component.scss create mode 100644 metron-interface/metron-alerts/src/app/pcap/pcap-packet/pcap-packet.component.spec.ts create mode 100644 metron-interface/metron-alerts/src/app/pcap/pcap-packet/pcap-packet.component.ts create mode 100644 metron-interface/metron-alerts/src/app/pcap/pcap-panel/pcap-panel.component.html create mode 100644 metron-interface/metron-alerts/src/app/pcap/pcap-panel/pcap-panel.component.scss create mode 100644 metron-interface/metron-alerts/src/app/pcap/pcap-panel/pcap-panel.component.spec.ts create mode 100644 metron-interface/metron-alerts/src/app/pcap/pcap-panel/pcap-panel.component.ts create mode 100644 metron-interface/metron-alerts/src/app/pcap/pcap.module.ts create mode 100644 metron-interface/metron-alerts/src/app/pcap/pcap.routing.ts create mode 100644 metron-interface/metron-alerts/src/app/pcap/service/pcap.service.spec.ts create mode 100644 metron-interface/metron-alerts/src/app/pcap/service/pcap.service.ts diff --git a/metron-interface/metron-alerts/src/app/app-routing.module.ts b/metron-interface/metron-alerts/src/app/app-routing.module.ts index 8357d66941..56ad41c636 100644 --- a/metron-interface/metron-alerts/src/app/app-routing.module.ts +++ b/metron-interface/metron-alerts/src/app/app-routing.module.ts @@ -26,7 +26,8 @@ const routes: Routes = [ { path: 'alerts-list', loadChildren: 'app/alerts/alerts-list/alerts-list.module#AlertsListModule', canActivate: [AuthGuard]}, { path: 'save-search', loadChildren: 'app/alerts/save-search/save-search.module#SaveSearchModule', canActivate: [AuthGuard]}, { path: 'saved-searches', loadChildren: 'app/alerts/saved-searches/saved-searches.module.ts#SavedSearchesModule', - canActivate: [AuthGuard]} + canActivate: [AuthGuard]}, + { path: 'pcap', loadChildren: 'app/pcap/pcap.module#PcapModule', canActivate: [AuthGuard] } ]; @NgModule({ diff --git a/metron-interface/metron-alerts/src/app/app.component.html b/metron-interface/metron-alerts/src/app/app.component.html index 8867a9b0de..1b992ca2be 100644 --- a/metron-interface/metron-alerts/src/app/app.component.html +++ b/metron-interface/metron-alerts/src/app/app.component.html @@ -16,6 +16,14 @@ +
Logged in as {{authService.currentUser}} - Logout
diff --git a/metron-interface/metron-alerts/src/app/app.component.scss b/metron-interface/metron-alerts/src/app/app.component.scss index 8358e7fff0..8505ee84af 100644 --- a/metron-interface/metron-alerts/src/app/app.component.scss +++ b/metron-interface/metron-alerts/src/app/app.component.scss @@ -27,6 +27,24 @@ max-height: 50px; } +.nav-link +{ + padding-bottom: 0; + padding-top: 0; + color: inherit; +} + +.nav-item.active +{ + border-bottom: 3px solid #32abe2; + margin-bottom: 5px; +} + +.nav-link.active +{ + color: #ffffff; +} + .logout { padding-left: 10px; } diff --git a/metron-interface/metron-alerts/src/app/app.module.ts b/metron-interface/metron-alerts/src/app/app.module.ts index 227eaab58d..82b4970a10 100644 --- a/metron-interface/metron-alerts/src/app/app.module.ts +++ b/metron-interface/metron-alerts/src/app/app.module.ts @@ -46,8 +46,7 @@ import {MetaAlertService} from './service/meta-alert.service'; import {MetaAlertsModule} from './alerts/meta-alerts/meta-alerts.module'; import {SearchService} from './service/search.service'; import { GlobalConfigService } from './service/global-config.service'; - - +import {PcapModule} from './pcap/pcap.module'; export function initConfig(config: ColumnNamesService) { return () => config.list(); @@ -70,7 +69,8 @@ export function initConfig(config: ColumnNamesService) { ConfigureRowsModule, SaveSearchModule, SavedSearchesModule, - SwitchModule + SwitchModule, + PcapModule ], providers: [{ provide: APP_INITIALIZER, useFactory: initConfig, deps: [ColumnNamesService], multi: true }, { provide: DataSource, useClass: ElasticSearchLocalstorageImpl }, diff --git a/metron-interface/metron-alerts/src/app/pcap/model/pcap.request.ts b/metron-interface/metron-alerts/src/app/pcap/model/pcap.request.ts new file mode 100644 index 0000000000..5ae35efbf9 --- /dev/null +++ b/metron-interface/metron-alerts/src/app/pcap/model/pcap.request.ts @@ -0,0 +1,28 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing software + * distributed under the License is distributed on an "AS IS" BASIS + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +export class PcapRequest { + from: number + to: number + ip_src_addr: string + ip_src_port: number + ip_dest_addr: string + ip_dest_port: number + protocol: string + filter: string +} diff --git a/metron-interface/metron-alerts/src/app/pcap/model/pdml.ts b/metron-interface/metron-alerts/src/app/pcap/model/pdml.ts new file mode 100644 index 0000000000..17b4deaba6 --- /dev/null +++ b/metron-interface/metron-alerts/src/app/pcap/model/pdml.ts @@ -0,0 +1,42 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing software + * distributed under the License is distributed on an "AS IS" BASIS + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + + export class PdmlField { + public $: any[] + public field?: PdmlField[] +} + +export class PdmlProto { + public $: any + public field: PdmlField[] + + public static findField(p: PdmlProto, name: string): PdmlField { + return p.field.find(f => f['$']['name'] == name) + } +} + + +export class PdmlPacket { + public $: any + public proto: PdmlProto[] + public expanded: boolean = false +} + +export class Pdml { + public pdml: { S: any, packet: PdmlPacket[] } +} diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.html b/metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.html new file mode 100644 index 0000000000..0219723513 --- /dev/null +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.html @@ -0,0 +1,29 @@ + diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.scss b/metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.scss new file mode 100644 index 0000000000..ffb26c98c6 --- /dev/null +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.scss @@ -0,0 +1,52 @@ +@import "../../../vendor.scss"; +@import "../../../styles.scss"; +@import "../../../variables.scss"; + +.ng-valid[required], .ng-valid.required { + +} + +.ng-invalid:not(form) { + border-left: 5px solid #a94442; /* red */ +} + +.form-group { + padding-right: 0.75em; + label { + margin-right: 1em; + } +} + +.btn-search { + + min-width: 42px; + padding-left: 0; + padding-right: 0; + border: 1px solid $blue-chill !important; + + &:focus { + box-shadow: none; + } + + &::before { + font-family: "FontAwesome"; + content: '\f002'; + color: $piction-blue; + } +} + +.pcap-search { + + padding-bottom: 15px; + + label { + font-size: 15px; + } + + button { + padding-top: 6px; + padding-bottom: 6px; + background: $icon-button-background; + cursor: pointer; + } +} diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.spec.ts b/metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.spec.ts new file mode 100644 index 0000000000..c3d20c1795 --- /dev/null +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.spec.ts @@ -0,0 +1,25 @@ +import { async, ComponentFixture, TestBed } from '@angular/core/testing'; + +import { PcapFiltersComponent } from './pcap-filters.component'; + +describe('PcapFiltersComponent', () => { + let component: PcapFiltersComponent; + let fixture: ComponentFixture; + + beforeEach(async(() => { + TestBed.configureTestingModule({ + declarations: [ PcapFiltersComponent ] + }) + .compileComponents(); + })); + + beforeEach(() => { + fixture = TestBed.createComponent(PcapFiltersComponent); + component = fixture.componentInstance; + fixture.detectChanges(); + }); + + it('should create', () => { + expect(component).toBeTruthy(); + }); +}); diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.ts b/metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.ts new file mode 100644 index 0000000000..6156f9d84b --- /dev/null +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.ts @@ -0,0 +1,23 @@ +import { Component, OnInit, Output, EventEmitter } from '@angular/core'; +import { PcapRequest } from '../model/pcap.request' + +@Component({ + selector: 'app-pcap-filters', + templateUrl: './pcap-filters.component.html', + styleUrls: ['./pcap-filters.component.scss'] +}) +export class PcapFiltersComponent implements OnInit { + + @Output() search: EventEmitter = new EventEmitter() + + model = new PcapRequest() + + constructor() { } + + ngOnInit() { + } + + onSubmit() { + this.search.emit(this.model) + } +} diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-list/pcap-list.component.html b/metron-interface/metron-alerts/src/app/pcap/pcap-list/pcap-list.component.html new file mode 100644 index 0000000000..a69ffb7436 --- /dev/null +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-list/pcap-list.component.html @@ -0,0 +1,24 @@ +
+ + + + + + + + + + + + + + + + + + + +
TimestampSource AddrSource PortDest AddrDest PortProtocol
+ +
+
diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-list/pcap-list.component.scss b/metron-interface/metron-alerts/src/app/pcap/pcap-list/pcap-list.component.scss new file mode 100644 index 0000000000..f402e4295a --- /dev/null +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-list/pcap-list.component.scss @@ -0,0 +1,4 @@ +.pcap-packet { + padding-top: 0; + border-top: none; +} \ No newline at end of file diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-list/pcap-list.component.spec.ts b/metron-interface/metron-alerts/src/app/pcap/pcap-list/pcap-list.component.spec.ts new file mode 100644 index 0000000000..03112ae35e --- /dev/null +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-list/pcap-list.component.spec.ts @@ -0,0 +1,25 @@ +import { async, ComponentFixture, TestBed } from '@angular/core/testing'; + +import { PcapListComponent } from './pcap-list.component'; + +describe('PcapListComponent', () => { + let component: PcapListComponent; + let fixture: ComponentFixture; + + beforeEach(async(() => { + TestBed.configureTestingModule({ + declarations: [ PcapListComponent ] + }) + .compileComponents(); + })); + + beforeEach(() => { + fixture = TestBed.createComponent(PcapListComponent); + component = fixture.componentInstance; + fixture.detectChanges(); + }); + + it('should create', () => { + expect(component).toBeTruthy(); + }); +}); diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-list/pcap-list.component.ts b/metron-interface/metron-alerts/src/app/pcap/pcap-list/pcap-list.component.ts new file mode 100644 index 0000000000..cff6219134 --- /dev/null +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-list/pcap-list.component.ts @@ -0,0 +1,22 @@ +import { Component, OnInit, Input } from '@angular/core'; +import { Pdml,PdmlPacket } from '../model/pdml' + +@Component({ + selector: 'app-pcap-list', + templateUrl: './pcap-list.component.html', + styleUrls: ['./pcap-list.component.scss'] +}) +export class PcapListComponent implements OnInit { + + @Input() packets: PdmlPacket[] + + constructor() { } + + ngOnInit() { + } + + toggle(packet) { + packet.expanded= !packet.expanded + } + +} diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-packet-line/pcap-packet-line.component.html b/metron-interface/metron-alerts/src/app/pcap/pcap-packet-line/pcap-packet-line.component.html new file mode 100644 index 0000000000..a14a9f5f29 --- /dev/null +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-packet-line/pcap-packet-line.component.html @@ -0,0 +1,6 @@ +{{ip.timestamp.$.value}} {{ip.timestamp.$.show}} +{{ip.ip_src_addr.$.show}} +{{ip.ip_src_port.$.show}} +{{ip.ip_dest_addr.$.show}} +{{ip.ip_dest_port.$.show}} +{{ip.protocol.$.showname}} diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-packet-line/pcap-packet-line.component.scss b/metron-interface/metron-alerts/src/app/pcap/pcap-packet-line/pcap-packet-line.component.scss new file mode 100644 index 0000000000..e69de29bb2 diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-packet-line/pcap-packet-line.component.spec.ts b/metron-interface/metron-alerts/src/app/pcap/pcap-packet-line/pcap-packet-line.component.spec.ts new file mode 100644 index 0000000000..8b0ea0457e --- /dev/null +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-packet-line/pcap-packet-line.component.spec.ts @@ -0,0 +1,25 @@ +import { async, ComponentFixture, TestBed } from '@angular/core/testing'; + +import { PcapPacketLineComponent } from './pcap-packet-line.component'; + +describe('PcapPacketLineComponent', () => { + let component: PcapPacketLineComponent; + let fixture: ComponentFixture; + + beforeEach(async(() => { + TestBed.configureTestingModule({ + declarations: [ PcapPacketLineComponent ] + }) + .compileComponents(); + })); + + beforeEach(() => { + fixture = TestBed.createComponent(PcapPacketLineComponent); + component = fixture.componentInstance; + fixture.detectChanges(); + }); + + it('should create', () => { + expect(component).toBeTruthy(); + }); +}); diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-packet-line/pcap-packet-line.component.ts b/metron-interface/metron-alerts/src/app/pcap/pcap-packet-line/pcap-packet-line.component.ts new file mode 100644 index 0000000000..35732645c2 --- /dev/null +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-packet-line/pcap-packet-line.component.ts @@ -0,0 +1,38 @@ +import { Component, OnInit, Input } from '@angular/core'; +import { PdmlPacket, PdmlProto, PdmlField } from '../model/pdml' + +@Component({ + selector: '[app-pcap-packet-line]', + templateUrl: './pcap-packet-line.component.html', + styleUrls: ['./pcap-packet-line.component.scss'] +}) +export class PcapPacketLineComponent implements OnInit { + + @Input() packet: PdmlPacket + + ip: { + timestamp: PdmlField, + ip_src_addr: PdmlField, ip_src_port: PdmlField, + ip_dest_addr: PdmlField, ip_dest_port: PdmlField, + protocol: PdmlField + } + + constructor() { } + + ngOnInit() { + let gen_proto: PdmlProto = this.packet.proto.filter(p => p['$'].name == "geninfo")[0] + let ip_proto: PdmlProto = this.packet.proto.filter(p => p['$'].name == "ip")[0] + let tcp_proto: PdmlProto = this.packet.proto.filter(p => p['$'].name == "tcp")[0] + + this.ip = { + timestamp: PdmlProto.findField(gen_proto,'timestamp'), + ip_src_addr: PdmlProto.findField(ip_proto,'ip.src'), + ip_src_port: PdmlProto.findField(tcp_proto,'tcp.srcport'), + ip_dest_addr: PdmlProto.findField(ip_proto,'ip.dst'), + ip_dest_port: PdmlProto.findField(tcp_proto,'tcp.dstport'), + protocol: PdmlProto.findField(ip_proto,'ip.proto') + }; + } + + +} diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-packet/pcap-packet.component.html b/metron-interface/metron-alerts/src/app/pcap/pcap-packet/pcap-packet.component.html new file mode 100644 index 0000000000..d9263445c0 --- /dev/null +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-packet/pcap-packet.component.html @@ -0,0 +1,8 @@ +
+
{{ proto['$'].showname }}
+
+
+ {{ field['$'].name}} {{ field['$'].showname}} +
+
+
diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-packet/pcap-packet.component.scss b/metron-interface/metron-alerts/src/app/pcap/pcap-packet/pcap-packet.component.scss new file mode 100644 index 0000000000..287cbf95c6 --- /dev/null +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-packet/pcap-packet.component.scss @@ -0,0 +1,15 @@ +@import "../../../_variables.scss"; + +.proto-header { + font-weight: bold; + border-top: 1px solid $table-border-color; +} + +.proto { + margin-left: 1em; +} + + +.field-name { + display: none +} diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-packet/pcap-packet.component.spec.ts b/metron-interface/metron-alerts/src/app/pcap/pcap-packet/pcap-packet.component.spec.ts new file mode 100644 index 0000000000..f2e2edd8f3 --- /dev/null +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-packet/pcap-packet.component.spec.ts @@ -0,0 +1,25 @@ +import { async, ComponentFixture, TestBed } from '@angular/core/testing'; + +import { PcapPacketComponent } from './pcap-packet.component'; + +describe('PcapPacketComponent', () => { + let component: PcapPacketComponent; + let fixture: ComponentFixture; + + beforeEach(async(() => { + TestBed.configureTestingModule({ + declarations: [ PcapPacketComponent ] + }) + .compileComponents(); + })); + + beforeEach(() => { + fixture = TestBed.createComponent(PcapPacketComponent); + component = fixture.componentInstance; + fixture.detectChanges(); + }); + + it('should create', () => { + expect(component).toBeTruthy(); + }); +}); diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-packet/pcap-packet.component.ts b/metron-interface/metron-alerts/src/app/pcap/pcap-packet/pcap-packet.component.ts new file mode 100644 index 0000000000..30657e3805 --- /dev/null +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-packet/pcap-packet.component.ts @@ -0,0 +1,22 @@ +import { Component, OnInit, Input } from '@angular/core'; + +import { PdmlPacket } from '../model/pdml' + +@Component({ + selector: 'app-pcap-packet', + templateUrl: './pcap-packet.component.html', + styleUrls: ['./pcap-packet.component.scss'] +}) +export class PcapPacketComponent implements OnInit { + @Input() packet: PdmlPacket + + constructor() { } + + ngOnInit() { + } + + toggle() { + this.packet.expanded = !this.packet.expanded + } + +} diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-panel/pcap-panel.component.html b/metron-interface/metron-alerts/src/app/pcap/pcap-panel/pcap-panel.component.html new file mode 100644 index 0000000000..02b6c7868f --- /dev/null +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-panel/pcap-panel.component.html @@ -0,0 +1,8 @@ +
+
+ +
+
+ +
+
diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-panel/pcap-panel.component.scss b/metron-interface/metron-alerts/src/app/pcap/pcap-panel/pcap-panel.component.scss new file mode 100644 index 0000000000..e69de29bb2 diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-panel/pcap-panel.component.spec.ts b/metron-interface/metron-alerts/src/app/pcap/pcap-panel/pcap-panel.component.spec.ts new file mode 100644 index 0000000000..a6960105d2 --- /dev/null +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-panel/pcap-panel.component.spec.ts @@ -0,0 +1,25 @@ +import { async, ComponentFixture, TestBed } from '@angular/core/testing'; + +import { PcapPanelComponent } from './pcap-panel.component'; + +describe('PcapPanelComponent', () => { + let component: PcapPanelComponent; + let fixture: ComponentFixture; + + beforeEach(async(() => { + TestBed.configureTestingModule({ + declarations: [ PcapPanelComponent ] + }) + .compileComponents(); + })); + + beforeEach(() => { + fixture = TestBed.createComponent(PcapPanelComponent); + component = fixture.componentInstance; + fixture.detectChanges(); + }); + + it('should create', () => { + expect(component).toBeTruthy(); + }); +}); diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-panel/pcap-panel.component.ts b/metron-interface/metron-alerts/src/app/pcap/pcap-panel/pcap-panel.component.ts new file mode 100644 index 0000000000..31f9bd6960 --- /dev/null +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-panel/pcap-panel.component.ts @@ -0,0 +1,35 @@ +import { Component, OnInit, Input } from '@angular/core'; + +import { PcapService } from '../service/pcap.service' +import { PcapRequest } from '../model/pcap.request' +import { Pdml } from '../model/pdml' + +@Component({ + selector: 'app-pcap-panel', + templateUrl: './pcap-panel.component.html', + styleUrls: ['./pcap-panel.component.scss'] +}) +export class PcapPanelComponent implements OnInit { + + @Input() pdml: Pdml = null + + @Input() search: PcapRequest + + constructor(private pcap: PcapService ) { } + + ngOnInit() { + } + + onSearch(search) { + this.pcap.getPackets(search).subscribe(response => this.pdml = response) + } + + test() { + console.log('test') + this.pcap.getTestPackets(this.search).subscribe(response => { + this.pdml = response + }) + } + + +} diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap.module.ts b/metron-interface/metron-alerts/src/app/pcap/pcap.module.ts new file mode 100644 index 0000000000..c66b965c2f --- /dev/null +++ b/metron-interface/metron-alerts/src/app/pcap/pcap.module.ts @@ -0,0 +1,50 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +import {NgModule} from '@angular/core'; +import { CommonModule } from '@angular/common'; +import { FormsModule } from '@angular/forms'; +import { HttpModule } from '@angular/http'; + +import { routing } from './pcap.routing'; + +import { PcapListComponent } from './pcap-list/pcap-list.component'; +import { PcapPacketComponent } from './pcap-packet/pcap-packet.component'; +import { PcapFiltersComponent } from './pcap-filters/pcap-filters.component'; +import { PcapPanelComponent } from './pcap-panel/pcap-panel.component'; +import { PcapPacketLineComponent } from './pcap-packet-line/pcap-packet-line.component'; + +import { PcapService } from './service/pcap.service' + +@NgModule({ + imports: [ + routing, + CommonModule, + FormsModule, + HttpModule + ], + declarations: [ + PcapListComponent, + PcapPacketComponent, + PcapFiltersComponent, + PcapPanelComponent, + PcapPacketLineComponent + ], + exports: [ PcapPanelComponent ], + providers: [ PcapService ] +}) +export class PcapModule {} diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap.routing.ts b/metron-interface/metron-alerts/src/app/pcap/pcap.routing.ts new file mode 100644 index 0000000000..25ee0eded8 --- /dev/null +++ b/metron-interface/metron-alerts/src/app/pcap/pcap.routing.ts @@ -0,0 +1,27 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +import { Routes, RouterModule } from '@angular/router'; +import { ModuleWithProviders } from '@angular/core'; + +import {PcapPanelComponent} from './pcap-panel/pcap-panel.component'; + +export const routes: Routes = [ + {path: '', component: PcapPanelComponent}, +]; + +export const routing: ModuleWithProviders = RouterModule.forChild(routes); diff --git a/metron-interface/metron-alerts/src/app/pcap/service/pcap.service.spec.ts b/metron-interface/metron-alerts/src/app/pcap/service/pcap.service.spec.ts new file mode 100644 index 0000000000..c62f84e4f5 --- /dev/null +++ b/metron-interface/metron-alerts/src/app/pcap/service/pcap.service.spec.ts @@ -0,0 +1,1734 @@ +import { TestBed, async, inject } from '@angular/core/testing'; +import { + BaseRequestOptions, + HttpModule, + Http, + Response, + ResponseOptions +} from '@angular/http'; +import { MockBackend } from '@angular/http/testing'; + +import { PcapService } from './pcap.service'; +import { PcapRequest } from '../model/pcap.request'; + +describe('PcapService', () => { + beforeEach(() => { + + TestBed.configureTestingModule({ + imports: [HttpModule], + providers: [ + PcapService, + { + provide: Http, + useFactory: (mockBackend, options) => { + return new Http(mockBackend, options); + }, + deps: [MockBackend, BaseRequestOptions] + }, + MockBackend, + BaseRequestOptions + ] + }); + }); + describe('getPackets()', () => { + it('should return an Observable', + inject([PcapService, MockBackend], (pcapService, mockBackend) => { + + let request: PcapRequest = { + from: 0, + to: 0, + ip_src_addr: '0.0.0.0', + ip_src_port: 80, + ip_dest_addr: '0.0.0.0', + ip_dest_port: 80, + protocol: '*', + filter: '*' + } + + mockBackend.connections.subscribe((connection) => { + connection.mockRespond(new Response(new ResponseOptions({body: pdml_json()}))); + }); + let packets; + pcapService.getPackets(request).subscribe(r => packets = r) + expect(packets).toBeTruthy() + expect(packets.pdml).toBeTruthy() + expect(packets.pdml.packet.length).toBe(1) + expect(packets.pdml.packet[0].proto.length).toBeGreaterThan(3) + + console.log(packets) + })) + + + it('should ...', inject([PcapService], (service: PcapService) => { + expect(service).toBeTruthy(); + })); + + }) + +}); + + + + +function pdml_json() { + return `{ + "pdml": { + "$": { + "version": "0", + "creator": "wireshark/2.4.2", + "time": "Tue Mar 27 21:55:25 2018", + "capture_file": "./metron-platform/metron-api/src/test/resources/test-tcp-packet.pcap" + }, + "packet": [ + { + "proto": [ + { + "$": { + "name": "geninfo", + "pos": "0", + "showname": "General information", + "size": "104" + }, + "field": [ + { + "$": { + "name": "num", + "pos": "0", + "show": "1", + "showname": "Number", + "value": "1", + "size": "104" + } + }, + { + "$": { + "name": "len", + "pos": "0", + "show": "104", + "showname": "Frame Length", + "value": "68", + "size": "104" + } + }, + { + "$": { + "name": "caplen", + "pos": "0", + "show": "104", + "showname": "Captured Length", + "value": "68", + "size": "104" + } + }, + { + "$": { + "name": "timestamp", + "pos": "0", + "show": "Mar 26, 2014 19:59:40.024362000 GMT", + "showname": "Captured Time", + "value": "1395863980.024362000", + "size": "104" + } + } + ] + }, + { + "$": { + "name": "frame", + "showname": "Frame 1: 104 bytes on wire (832 bits), 104 bytes captured (832 bits)", + "size": "104", + "pos": "0" + }, + "field": [ + { + "$": { + "name": "frame.encap_type", + "showname": "Encapsulation type: Ethernet (1)", + "size": "0", + "pos": "0", + "show": "1" + } + }, + { + "$": { + "name": "frame.time", + "showname": "Arrival Time: Mar 26, 2014 19:59:40.024362000 GMT", + "size": "0", + "pos": "0", + "show": "Mar 26, 2014 19:59:40.024362000 GMT" + } + }, + { + "$": { + "name": "frame.offset_shift", + "showname": "Time shift for this packet: 0.000000000 seconds", + "size": "0", + "pos": "0", + "show": "0.000000000" + } + }, + { + "$": { + "name": "frame.time_epoch", + "showname": "Epoch Time: 1395863980.024362000 seconds", + "size": "0", + "pos": "0", + "show": "1395863980.024362000" + } + }, + { + "$": { + "name": "frame.time_delta", + "showname": "Time delta from previous captured frame: 0.000000000 seconds", + "size": "0", + "pos": "0", + "show": "0.000000000" + } + }, + { + "$": { + "name": "frame.time_delta_displayed", + "showname": "Time delta from previous displayed frame: 0.000000000 seconds", + "size": "0", + "pos": "0", + "show": "0.000000000" + } + }, + { + "$": { + "name": "frame.time_relative", + "showname": "Time since reference or first frame: 0.000000000 seconds", + "size": "0", + "pos": "0", + "show": "0.000000000" + } + }, + { + "$": { + "name": "frame.number", + "showname": "Frame Number: 1", + "size": "0", + "pos": "0", + "show": "1" + } + }, + { + "$": { + "name": "frame.len", + "showname": "Frame Length: 104 bytes (832 bits)", + "size": "0", + "pos": "0", + "show": "104" + } + }, + { + "$": { + "name": "frame.cap_len", + "showname": "Capture Length: 104 bytes (832 bits)", + "size": "0", + "pos": "0", + "show": "104" + } + }, + { + "$": { + "name": "frame.marked", + "showname": "Frame is marked: False", + "size": "0", + "pos": "0", + "show": "0" + } + }, + { + "$": { + "name": "frame.ignored", + "showname": "Frame is ignored: False", + "size": "0", + "pos": "0", + "show": "0" + } + }, + { + "$": { + "name": "frame.protocols", + "showname": "Protocols in frame: eth:ethertype:ip:tcp:smtp", + "size": "0", + "pos": "0", + "show": "eth:ethertype:ip:tcp:smtp" + } + } + ] + }, + { + "$": { + "name": "eth", + "showname": "Ethernet II, Src: MS-NLB-PhysServer-26_c5:01:00:02 (02:1a:c5:01:00:02), Dst: MS-NLB-PhysServer-26_c5:05:00:02 (02:1a:c5:05:00:02)", + "size": "14", + "pos": "0" + }, + "field": [ + { + "$": { + "name": "eth.dst", + "showname": "Destination: MS-NLB-PhysServer-26_c5:05:00:02 (02:1a:c5:05:00:02)", + "size": "6", + "pos": "0", + "show": "02:1a:c5:05:00:02", + "value": "021ac5050002" + }, + "field": [ + { + "$": { + "name": "eth.dst_resolved", + "showname": "Destination (resolved): MS-NLB-PhysServer-26_c5:05:00:02", + "hide": "yes", + "size": "6", + "pos": "0", + "show": "MS-NLB-PhysServer-26_c5:05:00:02", + "value": "021ac5050002" + } + }, + { + "$": { + "name": "eth.addr", + "showname": "Address: MS-NLB-PhysServer-26_c5:05:00:02 (02:1a:c5:05:00:02)", + "size": "6", + "pos": "0", + "show": "02:1a:c5:05:00:02", + "value": "021ac5050002" + } + }, + { + "$": { + "name": "eth.addr_resolved", + "showname": "Address (resolved): MS-NLB-PhysServer-26_c5:05:00:02", + "hide": "yes", + "size": "6", + "pos": "0", + "show": "MS-NLB-PhysServer-26_c5:05:00:02", + "value": "021ac5050002" + } + }, + { + "$": { + "name": "eth.lg", + "showname": ".... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)", + "size": "3", + "pos": "0", + "show": "1", + "value": "1", + "unmaskedvalue": "021ac5" + } + }, + { + "$": { + "name": "eth.ig", + "showname": ".... ...0 .... .... .... .... = IG bit: Individual address (unicast)", + "size": "3", + "pos": "0", + "show": "0", + "value": "0", + "unmaskedvalue": "021ac5" + } + } + ] + }, + { + "$": { + "name": "eth.src", + "showname": "Source: MS-NLB-PhysServer-26_c5:01:00:02 (02:1a:c5:01:00:02)", + "size": "6", + "pos": "6", + "show": "02:1a:c5:01:00:02", + "value": "021ac5010002" + }, + "field": [ + { + "$": { + "name": "eth.src_resolved", + "showname": "Source (resolved): MS-NLB-PhysServer-26_c5:01:00:02", + "hide": "yes", + "size": "6", + "pos": "6", + "show": "MS-NLB-PhysServer-26_c5:01:00:02", + "value": "021ac5010002" + } + }, + { + "$": { + "name": "eth.addr", + "showname": "Address: MS-NLB-PhysServer-26_c5:01:00:02 (02:1a:c5:01:00:02)", + "size": "6", + "pos": "6", + "show": "02:1a:c5:01:00:02", + "value": "021ac5010002" + } + }, + { + "$": { + "name": "eth.addr_resolved", + "showname": "Address (resolved): MS-NLB-PhysServer-26_c5:01:00:02", + "hide": "yes", + "size": "6", + "pos": "6", + "show": "MS-NLB-PhysServer-26_c5:01:00:02", + "value": "021ac5010002" + } + }, + { + "$": { + "name": "eth.lg", + "showname": ".... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)", + "size": "3", + "pos": "6", + "show": "1", + "value": "1", + "unmaskedvalue": "021ac5" + } + }, + { + "$": { + "name": "eth.ig", + "showname": ".... ...0 .... .... .... .... = IG bit: Individual address (unicast)", + "size": "3", + "pos": "6", + "show": "0", + "value": "0", + "unmaskedvalue": "021ac5" + } + } + ] + }, + { + "$": { + "name": "eth.type", + "showname": "Type: IPv4 (0x0800)", + "size": "2", + "pos": "12", + "show": "0x00000800", + "value": "0800" + } + }, + { + "$": { + "name": "eth.fcs", + "showname": "Frame check sequence: 0x26469e92 [correct]", + "size": "4", + "pos": "100", + "show": "0x26469e92", + "value": "26469e92" + } + }, + { + "$": { + "name": "eth.fcs.status", + "showname": "FCS Status: Good", + "size": "0", + "pos": "100", + "show": "1" + } + } + ] + }, + { + "$": { + "name": "ip", + "showname": "Internet Protocol Version 4, Src: 24.0.0.2, Dst: 24.128.0.2", + "size": "20", + "pos": "14" + }, + "field": [ + { + "$": { + "name": "ip.version", + "showname": "0100 .... = Version: 4", + "size": "1", + "pos": "14", + "show": "4", + "value": "4", + "unmaskedvalue": "45" + } + }, + { + "$": { + "name": "ip.hdr_len", + "showname": ".... 0101 = Header Length: 20 bytes (5)", + "size": "1", + "pos": "14", + "show": "20", + "value": "45" + } + }, + { + "$": { + "name": "ip.dsfield", + "showname": "Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)", + "size": "1", + "pos": "15", + "show": "0x00000000", + "value": "00" + }, + "field": [ + { + "$": { + "name": "ip.dsfield.dscp", + "showname": "0000 00.. = Differentiated Services Codepoint: Default (0)", + "size": "1", + "pos": "15", + "show": "0", + "value": "0", + "unmaskedvalue": "00" + } + }, + { + "$": { + "name": "ip.dsfield.ecn", + "showname": ".... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)", + "size": "1", + "pos": "15", + "show": "0", + "value": "0", + "unmaskedvalue": "00" + } + } + ] + }, + { + "$": { + "name": "ip.len", + "showname": "Total Length: 86", + "size": "2", + "pos": "16", + "show": "86", + "value": "0056" + } + }, + { + "$": { + "name": "ip.id", + "showname": "Identification: 0xcff6 (53238)", + "size": "2", + "pos": "18", + "show": "0x0000cff6", + "value": "cff6" + } + }, + { + "$": { + "name": "ip.flags", + "showname": "Flags: 0x02 (Don't Fragment)", + "size": "1", + "pos": "20", + "show": "0x00000002", + "value": "40" + }, + "field": [ + { + "$": { + "name": "ip.flags.rb", + "showname": "0... .... = Reserved bit: Not set", + "size": "1", + "pos": "20", + "show": "0", + "value": "40" + } + }, + { + "$": { + "name": "ip.flags.df", + "showname": ".1.. .... = Don't fragment: Set", + "size": "1", + "pos": "20", + "show": "1", + "value": "40" + } + }, + { + "$": { + "name": "ip.flags.mf", + "showname": "..0. .... = More fragments: Not set", + "size": "1", + "pos": "20", + "show": "0", + "value": "40" + } + } + ] + }, + { + "$": { + "name": "ip.frag_offset", + "showname": "Fragment offset: 0", + "size": "2", + "pos": "20", + "show": "0", + "value": "4000" + } + }, + { + "$": { + "name": "ip.ttl", + "showname": "Time to live: 32", + "size": "1", + "pos": "22", + "show": "32", + "value": "20" + } + }, + { + "$": { + "name": "ip.proto", + "showname": "Protocol: TCP (6)", + "size": "1", + "pos": "23", + "show": "6", + "value": "06" + } + }, + { + "$": { + "name": "ip.checksum", + "showname": "Header checksum: 0x5a28 [validation disabled]", + "size": "2", + "pos": "24", + "show": "0x00005a28", + "value": "5a28" + } + }, + { + "$": { + "name": "ip.checksum.status", + "showname": "Header checksum status: Unverified", + "size": "0", + "pos": "24", + "show": "2" + } + }, + { + "$": { + "name": "ip.src", + "showname": "Source: 24.0.0.2", + "size": "4", + "pos": "26", + "show": "24.0.0.2", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.addr", + "showname": "Source or Destination Address: 24.0.0.2", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "24.0.0.2", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.src_host", + "showname": "Source Host: 24.0.0.2", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "24.0.0.2", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.host", + "showname": "Source or Destination Host: 24.0.0.2", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "24.0.0.2", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.dst", + "showname": "Destination: 24.128.0.2", + "size": "4", + "pos": "30", + "show": "24.128.0.2", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.addr", + "showname": "Source or Destination Address: 24.128.0.2", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "24.128.0.2", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.dst_host", + "showname": "Destination Host: 24.128.0.2", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "24.128.0.2", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.host", + "showname": "Source or Destination Host: 24.128.0.2", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "24.128.0.2", + "value": "18800002" + } + }, + { + "$": { + "name": "", + "show": "Source GeoIP: United States, Woodbridge, NJ, AS7922 Comcast Cable Communications, LLC, United States, Woodbridge, NJ, AS7922 Comcast Cable Communications, LLC, 40.557598, -74.284599", + "size": "4", + "pos": "26", + "value": "18000002" + }, + "field": [ + { + "$": { + "name": "ip.geoip.src_country", + "showname": "Source GeoIP Country: United States", + "size": "4", + "pos": "26", + "show": "United States", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.country", + "showname": "Source or Destination GeoIP Country: United States", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "United States", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.src_city", + "showname": "Source GeoIP City: Woodbridge, NJ", + "size": "4", + "pos": "26", + "show": "Woodbridge, NJ", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.city", + "showname": "Source or Destination GeoIP City: Woodbridge, NJ", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "Woodbridge, NJ", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.src_asnum", + "showname": "Source GeoIP AS Number: AS7922 Comcast Cable Communications, LLC", + "size": "4", + "pos": "26", + "show": "AS7922 Comcast Cable Communications, LLC", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.asnum", + "showname": "Source or Destination GeoIP AS Number: AS7922 Comcast Cable Communications, LLC", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "AS7922 Comcast Cable Communications, LLC", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.src_country", + "showname": "Source GeoIP Country: United States", + "size": "4", + "pos": "26", + "show": "United States", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.country", + "showname": "Source or Destination GeoIP Country: United States", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "United States", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.src_city", + "showname": "Source GeoIP City: Woodbridge, NJ", + "size": "4", + "pos": "26", + "show": "Woodbridge, NJ", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.city", + "showname": "Source or Destination GeoIP City: Woodbridge, NJ", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "Woodbridge, NJ", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.src_asnum", + "showname": "Source GeoIP AS Number: AS7922 Comcast Cable Communications, LLC", + "size": "4", + "pos": "26", + "show": "AS7922 Comcast Cable Communications, LLC", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.asnum", + "showname": "Source or Destination GeoIP AS Number: AS7922 Comcast Cable Communications, LLC", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "AS7922 Comcast Cable Communications, LLC", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.src_lat", + "showname": "Source GeoIP Latitude: 40.557598", + "size": "4", + "pos": "26", + "show": "40.557598", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.lat", + "showname": "Source or Destination GeoIP Latitude: 40.557598", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "40.557598", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.src_lon", + "showname": "Source GeoIP Longitude: -74.284599", + "size": "4", + "pos": "26", + "show": "-74.284599", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.lon", + "showname": "Source or Destination GeoIP Longitude: -74.284599", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "-74.284599", + "value": "18000002" + } + } + ] + }, + { + "$": { + "name": "", + "show": "Destination GeoIP: United States, Groton, CT, AS7922 Comcast Cable Communications, LLC, United States, Groton, CT, AS7922 Comcast Cable Communications, LLC, 41.353199, -72.038597", + "size": "4", + "pos": "30", + "value": "18800002" + }, + "field": [ + { + "$": { + "name": "ip.geoip.dst_country", + "showname": "Destination GeoIP Country: United States", + "size": "4", + "pos": "30", + "show": "United States", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.country", + "showname": "Source or Destination GeoIP Country: United States", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "United States", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.dst_city", + "showname": "Destination GeoIP City: Groton, CT", + "size": "4", + "pos": "30", + "show": "Groton, CT", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.city", + "showname": "Source or Destination GeoIP City: Groton, CT", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "Groton, CT", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.dst_asnum", + "showname": "Destination GeoIP AS Number: AS7922 Comcast Cable Communications, LLC", + "size": "4", + "pos": "30", + "show": "AS7922 Comcast Cable Communications, LLC", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.asnum", + "showname": "Source or Destination GeoIP AS Number: AS7922 Comcast Cable Communications, LLC", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "AS7922 Comcast Cable Communications, LLC", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.dst_country", + "showname": "Destination GeoIP Country: United States", + "size": "4", + "pos": "30", + "show": "United States", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.country", + "showname": "Source or Destination GeoIP Country: United States", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "United States", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.dst_city", + "showname": "Destination GeoIP City: Groton, CT", + "size": "4", + "pos": "30", + "show": "Groton, CT", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.city", + "showname": "Source or Destination GeoIP City: Groton, CT", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "Groton, CT", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.dst_asnum", + "showname": "Destination GeoIP AS Number: AS7922 Comcast Cable Communications, LLC", + "size": "4", + "pos": "30", + "show": "AS7922 Comcast Cable Communications, LLC", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.asnum", + "showname": "Source or Destination GeoIP AS Number: AS7922 Comcast Cable Communications, LLC", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "AS7922 Comcast Cable Communications, LLC", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.dst_lat", + "showname": "Destination GeoIP Latitude: 41.353199", + "size": "4", + "pos": "30", + "show": "41.353199", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.lat", + "showname": "Source or Destination GeoIP Latitude: 41.353199", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "41.353199", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.dst_lon", + "showname": "Destination GeoIP Longitude: -72.038597", + "size": "4", + "pos": "30", + "show": "-72.038597", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.lon", + "showname": "Source or Destination GeoIP Longitude: -72.038597", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "-72.038597", + "value": "18800002" + } + } + ] + } + ] + }, + { + "$": { + "name": "tcp", + "showname": "Transmission Control Protocol, Src Port: 2137, Dst Port: 25, Seq: 1, Ack: 1, Len: 34", + "size": "32", + "pos": "34" + }, + "field": [ + { + "$": { + "name": "tcp.srcport", + "showname": "Source Port: 2137", + "size": "2", + "pos": "34", + "show": "2137", + "value": "0859" + } + }, + { + "$": { + "name": "tcp.dstport", + "showname": "Destination Port: 25", + "size": "2", + "pos": "36", + "show": "25", + "value": "0019" + } + }, + { + "$": { + "name": "tcp.port", + "showname": "Source or Destination Port: 2137", + "hide": "yes", + "size": "2", + "pos": "34", + "show": "2137", + "value": "0859" + } + }, + { + "$": { + "name": "tcp.port", + "showname": "Source or Destination Port: 25", + "hide": "yes", + "size": "2", + "pos": "36", + "show": "25", + "value": "0019" + } + }, + { + "$": { + "name": "tcp.stream", + "showname": "Stream index: 0", + "size": "0", + "pos": "34", + "show": "0" + } + }, + { + "$": { + "name": "tcp.len", + "showname": "TCP Segment Len: 34", + "size": "1", + "pos": "46", + "show": "34", + "value": "80" + } + }, + { + "$": { + "name": "tcp.seq", + "showname": "Sequence number: 1 (relative sequence number)", + "size": "4", + "pos": "38", + "show": "1", + "value": "f88900ce" + } + }, + { + "$": { + "name": "tcp.nxtseq", + "showname": "Next sequence number: 35 (relative sequence number)", + "size": "0", + "pos": "34", + "show": "35" + } + }, + { + "$": { + "name": "tcp.ack", + "showname": "Acknowledgment number: 1 (relative ack number)", + "size": "4", + "pos": "42", + "show": "1", + "value": "365aa74f" + } + }, + { + "$": { + "name": "tcp.hdr_len", + "showname": "1000 .... = Header Length: 32 bytes (8)", + "size": "1", + "pos": "46", + "show": "32", + "value": "80" + } + }, + { + "$": { + "name": "tcp.flags", + "showname": "Flags: 0x018 (PSH, ACK)", + "size": "2", + "pos": "46", + "show": "0x00000018", + "value": "18", + "unmaskedvalue": "8018" + }, + "field": [ + { + "$": { + "name": "tcp.flags.res", + "showname": "000. .... .... = Reserved: Not set", + "size": "1", + "pos": "46", + "show": "0", + "value": "0", + "unmaskedvalue": "80" + } + }, + { + "$": { + "name": "tcp.flags.ns", + "showname": "...0 .... .... = Nonce: Not set", + "size": "1", + "pos": "46", + "show": "0", + "value": "0", + "unmaskedvalue": "80" + } + }, + { + "$": { + "name": "tcp.flags.cwr", + "showname": ".... 0... .... = Congestion Window Reduced (CWR): Not set", + "size": "1", + "pos": "47", + "show": "0", + "value": "0", + "unmaskedvalue": "18" + } + }, + { + "$": { + "name": "tcp.flags.ecn", + "showname": ".... .0.. .... = ECN-Echo: Not set", + "size": "1", + "pos": "47", + "show": "0", + "value": "0", + "unmaskedvalue": "18" + } + }, + { + "$": { + "name": "tcp.flags.urg", + "showname": ".... ..0. .... = Urgent: Not set", + "size": "1", + "pos": "47", + "show": "0", + "value": "0", + "unmaskedvalue": "18" + } + }, + { + "$": { + "name": "tcp.flags.ack", + "showname": ".... ...1 .... = Acknowledgment: Set", + "size": "1", + "pos": "47", + "show": "1", + "value": "1", + "unmaskedvalue": "18" + } + }, + { + "$": { + "name": "tcp.flags.push", + "showname": ".... .... 1... = Push: Set", + "size": "1", + "pos": "47", + "show": "1", + "value": "1", + "unmaskedvalue": "18" + } + }, + { + "$": { + "name": "tcp.flags.reset", + "showname": ".... .... .0.. = Reset: Not set", + "size": "1", + "pos": "47", + "show": "0", + "value": "0", + "unmaskedvalue": "18" + } + }, + { + "$": { + "name": "tcp.flags.syn", + "showname": ".... .... ..0. = Syn: Not set", + "size": "1", + "pos": "47", + "show": "0", + "value": "0", + "unmaskedvalue": "18" + } + }, + { + "$": { + "name": "tcp.flags.fin", + "showname": ".... .... ...0 = Fin: Not set", + "size": "1", + "pos": "47", + "show": "0", + "value": "0", + "unmaskedvalue": "18" + } + }, + { + "$": { + "name": "tcp.flags.str", + "showname": "TCP Flags: \\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7AP\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7", + "size": "2", + "pos": "46", + "show": "\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7AP\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7", + "value": "8018" + } + } + ] + }, + { + "$": { + "name": "tcp.window_size_value", + "showname": "Window size value: 7240", + "size": "2", + "pos": "48", + "show": "7240", + "value": "1c48" + } + }, + { + "$": { + "name": "tcp.window_size", + "showname": "Calculated window size: 7240", + "size": "2", + "pos": "48", + "show": "7240", + "value": "1c48" + } + }, + { + "$": { + "name": "tcp.window_size_scalefactor", + "showname": "Window size scaling factor: -1 (unknown)", + "size": "2", + "pos": "48", + "show": "-1", + "value": "1c48" + } + }, + { + "$": { + "name": "tcp.checksum", + "showname": "Checksum: 0x681f [unverified]", + "size": "2", + "pos": "50", + "show": "0x0000681f", + "value": "681f" + } + }, + { + "$": { + "name": "tcp.checksum.status", + "showname": "Checksum Status: Unverified", + "size": "0", + "pos": "50", + "show": "2" + } + }, + { + "$": { + "name": "tcp.urgent_pointer", + "showname": "Urgent pointer: 0", + "size": "2", + "pos": "52", + "show": "0", + "value": "0000" + } + }, + { + "$": { + "name": "tcp.options", + "showname": "Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps", + "size": "12", + "pos": "54", + "show": "01:01:08:0a:eb:83:4b:08:e8:8c:de:cb", + "value": "0101080aeb834b08e88cdecb" + }, + "field": [ + { + "$": { + "name": "tcp.options.nop", + "showname": "TCP Option - No-Operation (NOP)", + "size": "1", + "pos": "54", + "show": "01", + "value": "01" + }, + "field": [ + { + "$": { + "name": "tcp.option_kind", + "showname": "Kind: No-Operation (1)", + "size": "1", + "pos": "54", + "show": "1", + "value": "01" + } + } + ] + }, + { + "$": { + "name": "tcp.options.nop", + "showname": "TCP Option - No-Operation (NOP)", + "size": "1", + "pos": "55", + "show": "01", + "value": "01" + }, + "field": [ + { + "$": { + "name": "tcp.option_kind", + "showname": "Kind: No-Operation (1)", + "size": "1", + "pos": "55", + "show": "1", + "value": "01" + } + } + ] + }, + { + "$": { + "name": "tcp.options.timestamp", + "showname": "TCP Option - Timestamps: TSval 3951250184, TSecr 3901546187", + "size": "10", + "pos": "56", + "show": "08:0a:eb:83:4b:08:e8:8c:de:cb", + "value": "080aeb834b08e88cdecb" + }, + "field": [ + { + "$": { + "name": "tcp.option_kind", + "showname": "Kind: Time Stamp Option (8)", + "size": "1", + "pos": "56", + "show": "8", + "value": "08" + } + }, + { + "$": { + "name": "tcp.option_len", + "showname": "Length: 10", + "size": "1", + "pos": "57", + "show": "10", + "value": "0a" + } + }, + { + "$": { + "name": "tcp.options.timestamp.tsval", + "showname": "Timestamp value: 3951250184", + "size": "4", + "pos": "58", + "show": "3951250184", + "value": "eb834b08" + } + }, + { + "$": { + "name": "tcp.options.timestamp.tsecr", + "showname": "Timestamp echo reply: 3901546187", + "size": "4", + "pos": "62", + "show": "3901546187", + "value": "e88cdecb" + } + } + ] + } + ] + }, + { + "$": { + "name": "tcp.analysis", + "showname": "SEQ/ACK analysis", + "size": "0", + "pos": "34", + "show": "", + "value": "" + }, + "field": [ + { + "$": { + "name": "tcp.analysis.bytes_in_flight", + "showname": "Bytes in flight: 34", + "size": "0", + "pos": "34", + "show": "34" + } + }, + { + "$": { + "name": "tcp.analysis.push_bytes_sent", + "showname": "Bytes sent since last PSH flag: 34", + "size": "0", + "pos": "34", + "show": "34" + } + } + ] + }, + { + "$": { + "name": "tcp.payload", + "showname": "TCP payload (34 bytes)", + "size": "34", + "pos": "66", + "show": "45:48:4c:4f:20:63:6c:69:65:6e:74:2d:31:38:30:30:30:30:30:33:2e:65:78:61:6d:70:6c:65:2e:69:6e:74:0d:0a", + "value": "45484c4f20636c69656e742d31383030303030332e6578616d706c652e696e740d0a" + } + } + ] + }, + { + "$": { + "name": "smtp", + "showname": "Simple Mail Transfer Protocol", + "size": "34", + "pos": "66" + }, + "field": [ + { + "$": { + "name": "smtp.req", + "showname": "Request: True", + "hide": "yes", + "size": "0", + "pos": "66", + "show": "1" + } + }, + { + "$": { + "name": "smtp.command_line", + "showname": "Command Line: EHLO client-18000003.example.int\\\\r\\\\n", + "size": "34", + "pos": "66", + "show": "EHLO client-18000003.example.int\\\\xd\\\\xa", + "value": "45484c4f20636c69656e742d31383030303030332e6578616d706c652e696e740d0a" + }, + "field": [ + { + "$": { + "name": "smtp.req.command", + "showname": "Command: EHLO", + "size": "4", + "pos": "66", + "show": "EHLO", + "value": "45484c4f" + } + }, + { + "$": { + "name": "smtp.req.parameter", + "showname": "Request parameter: client-18000003.example.int", + "size": "27", + "pos": "71", + "show": "client-18000003.example.int", + "value": "636c69656e742d31383030303030332e6578616d706c652e696e74" + } + } + ] + } + ] + } + ] + } + ] + } +} +` +} + +function pdml() { + return ` + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ` +} diff --git a/metron-interface/metron-alerts/src/app/pcap/service/pcap.service.ts b/metron-interface/metron-alerts/src/app/pcap/service/pcap.service.ts new file mode 100644 index 0000000000..44024bea2a --- /dev/null +++ b/metron-interface/metron-alerts/src/app/pcap/service/pcap.service.ts @@ -0,0 +1,2994 @@ +import { Injectable } from '@angular/core'; +import { Observable, Subject } from 'rxjs/Rx'; +import { Http, Headers, RequestOptions, Response } from '@angular/http'; +import { HttpUtil } from '../../utils/httpUtil'; + +import 'rxjs/add/operator/map'; + +import { PcapRequest } from '../model/pcap.request'; +import { Pdml } from '../model/pdml' + +@Injectable() +export class PcapService { + + constructor(private http: Http) { + } + + public getPackets(request: PcapRequest): Observable { + console.log(request) + return this.http.get('/api/v1/pcap', new RequestOptions({ + params: request + })).map(r => r.json()).catch(HttpUtil.handleError) + } + + public getTestPackets(request: PcapRequest): Observable { + return Observable.create((o) => o.next(JSON.parse(pdml_json()))) + } +} + + + + +function pdml_json() { + return `{ + "pdml": { + "$": { + "version": "0", + "creator": "wireshark/2.4.2", + "time": "Tue Mar 27 21:55:25 2018", + "capture_file": "./metron-platform/metron-api/src/test/resources/test-tcp-packet.pcap" + }, + "packet": [ + { + "proto": [ + { + "$": { + "name": "geninfo", + "pos": "0", + "showname": "General information", + "size": "104" + }, + "field": [ + { + "$": { + "name": "num", + "pos": "0", + "show": "1", + "showname": "Number", + "value": "1", + "size": "104" + } + }, + { + "$": { + "name": "len", + "pos": "0", + "show": "104", + "showname": "Frame Length", + "value": "68", + "size": "104" + } + }, + { + "$": { + "name": "caplen", + "pos": "0", + "show": "104", + "showname": "Captured Length", + "value": "68", + "size": "104" + } + }, + { + "$": { + "name": "timestamp", + "pos": "0", + "show": "Mar 26, 2014 19:59:40.024362000 GMT", + "showname": "Captured Time", + "value": "1395863980.024362000", + "size": "104" + } + } + ] + }, + { + "$": { + "name": "frame", + "showname": "Frame 1: 104 bytes on wire (832 bits), 104 bytes captured (832 bits)", + "size": "104", + "pos": "0" + }, + "field": [ + { + "$": { + "name": "frame.encap_type", + "showname": "Encapsulation type: Ethernet (1)", + "size": "0", + "pos": "0", + "show": "1" + } + }, + { + "$": { + "name": "frame.time", + "showname": "Arrival Time: Mar 26, 2014 19:59:40.024362000 GMT", + "size": "0", + "pos": "0", + "show": "Mar 26, 2014 19:59:40.024362000 GMT" + } + }, + { + "$": { + "name": "frame.offset_shift", + "showname": "Time shift for this packet: 0.000000000 seconds", + "size": "0", + "pos": "0", + "show": "0.000000000" + } + }, + { + "$": { + "name": "frame.time_epoch", + "showname": "Epoch Time: 1395863980.024362000 seconds", + "size": "0", + "pos": "0", + "show": "1395863980.024362000" + } + }, + { + "$": { + "name": "frame.time_delta", + "showname": "Time delta from previous captured frame: 0.000000000 seconds", + "size": "0", + "pos": "0", + "show": "0.000000000" + } + }, + { + "$": { + "name": "frame.time_delta_displayed", + "showname": "Time delta from previous displayed frame: 0.000000000 seconds", + "size": "0", + "pos": "0", + "show": "0.000000000" + } + }, + { + "$": { + "name": "frame.time_relative", + "showname": "Time since reference or first frame: 0.000000000 seconds", + "size": "0", + "pos": "0", + "show": "0.000000000" + } + }, + { + "$": { + "name": "frame.number", + "showname": "Frame Number: 1", + "size": "0", + "pos": "0", + "show": "1" + } + }, + { + "$": { + "name": "frame.len", + "showname": "Frame Length: 104 bytes (832 bits)", + "size": "0", + "pos": "0", + "show": "104" + } + }, + { + "$": { + "name": "frame.cap_len", + "showname": "Capture Length: 104 bytes (832 bits)", + "size": "0", + "pos": "0", + "show": "104" + } + }, + { + "$": { + "name": "frame.marked", + "showname": "Frame is marked: False", + "size": "0", + "pos": "0", + "show": "0" + } + }, + { + "$": { + "name": "frame.ignored", + "showname": "Frame is ignored: False", + "size": "0", + "pos": "0", + "show": "0" + } + }, + { + "$": { + "name": "frame.protocols", + "showname": "Protocols in frame: eth:ethertype:ip:tcp:smtp", + "size": "0", + "pos": "0", + "show": "eth:ethertype:ip:tcp:smtp" + } + } + ] + }, + { + "$": { + "name": "eth", + "showname": "Ethernet II, Src: MS-NLB-PhysServer-26_c5:01:00:02 (02:1a:c5:01:00:02), Dst: MS-NLB-PhysServer-26_c5:05:00:02 (02:1a:c5:05:00:02)", + "size": "14", + "pos": "0" + }, + "field": [ + { + "$": { + "name": "eth.dst", + "showname": "Destination: MS-NLB-PhysServer-26_c5:05:00:02 (02:1a:c5:05:00:02)", + "size": "6", + "pos": "0", + "show": "02:1a:c5:05:00:02", + "value": "021ac5050002" + }, + "field": [ + { + "$": { + "name": "eth.dst_resolved", + "showname": "Destination (resolved): MS-NLB-PhysServer-26_c5:05:00:02", + "hide": "yes", + "size": "6", + "pos": "0", + "show": "MS-NLB-PhysServer-26_c5:05:00:02", + "value": "021ac5050002" + } + }, + { + "$": { + "name": "eth.addr", + "showname": "Address: MS-NLB-PhysServer-26_c5:05:00:02 (02:1a:c5:05:00:02)", + "size": "6", + "pos": "0", + "show": "02:1a:c5:05:00:02", + "value": "021ac5050002" + } + }, + { + "$": { + "name": "eth.addr_resolved", + "showname": "Address (resolved): MS-NLB-PhysServer-26_c5:05:00:02", + "hide": "yes", + "size": "6", + "pos": "0", + "show": "MS-NLB-PhysServer-26_c5:05:00:02", + "value": "021ac5050002" + } + }, + { + "$": { + "name": "eth.lg", + "showname": ".... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)", + "size": "3", + "pos": "0", + "show": "1", + "value": "1", + "unmaskedvalue": "021ac5" + } + }, + { + "$": { + "name": "eth.ig", + "showname": ".... ...0 .... .... .... .... = IG bit: Individual address (unicast)", + "size": "3", + "pos": "0", + "show": "0", + "value": "0", + "unmaskedvalue": "021ac5" + } + } + ] + }, + { + "$": { + "name": "eth.src", + "showname": "Source: MS-NLB-PhysServer-26_c5:01:00:02 (02:1a:c5:01:00:02)", + "size": "6", + "pos": "6", + "show": "02:1a:c5:01:00:02", + "value": "021ac5010002" + }, + "field": [ + { + "$": { + "name": "eth.src_resolved", + "showname": "Source (resolved): MS-NLB-PhysServer-26_c5:01:00:02", + "hide": "yes", + "size": "6", + "pos": "6", + "show": "MS-NLB-PhysServer-26_c5:01:00:02", + "value": "021ac5010002" + } + }, + { + "$": { + "name": "eth.addr", + "showname": "Address: MS-NLB-PhysServer-26_c5:01:00:02 (02:1a:c5:01:00:02)", + "size": "6", + "pos": "6", + "show": "02:1a:c5:01:00:02", + "value": "021ac5010002" + } + }, + { + "$": { + "name": "eth.addr_resolved", + "showname": "Address (resolved): MS-NLB-PhysServer-26_c5:01:00:02", + "hide": "yes", + "size": "6", + "pos": "6", + "show": "MS-NLB-PhysServer-26_c5:01:00:02", + "value": "021ac5010002" + } + }, + { + "$": { + "name": "eth.lg", + "showname": ".... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)", + "size": "3", + "pos": "6", + "show": "1", + "value": "1", + "unmaskedvalue": "021ac5" + } + }, + { + "$": { + "name": "eth.ig", + "showname": ".... ...0 .... .... .... .... = IG bit: Individual address (unicast)", + "size": "3", + "pos": "6", + "show": "0", + "value": "0", + "unmaskedvalue": "021ac5" + } + } + ] + }, + { + "$": { + "name": "eth.type", + "showname": "Type: IPv4 (0x0800)", + "size": "2", + "pos": "12", + "show": "0x00000800", + "value": "0800" + } + }, + { + "$": { + "name": "eth.fcs", + "showname": "Frame check sequence: 0x26469e92 [correct]", + "size": "4", + "pos": "100", + "show": "0x26469e92", + "value": "26469e92" + } + }, + { + "$": { + "name": "eth.fcs.status", + "showname": "FCS Status: Good", + "size": "0", + "pos": "100", + "show": "1" + } + } + ] + }, + { + "$": { + "name": "ip", + "showname": "Internet Protocol Version 4, Src: 24.0.0.2, Dst: 24.128.0.2", + "size": "20", + "pos": "14" + }, + "field": [ + { + "$": { + "name": "ip.version", + "showname": "0100 .... = Version: 4", + "size": "1", + "pos": "14", + "show": "4", + "value": "4", + "unmaskedvalue": "45" + } + }, + { + "$": { + "name": "ip.hdr_len", + "showname": ".... 0101 = Header Length: 20 bytes (5)", + "size": "1", + "pos": "14", + "show": "20", + "value": "45" + } + }, + { + "$": { + "name": "ip.dsfield", + "showname": "Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)", + "size": "1", + "pos": "15", + "show": "0x00000000", + "value": "00" + }, + "field": [ + { + "$": { + "name": "ip.dsfield.dscp", + "showname": "0000 00.. = Differentiated Services Codepoint: Default (0)", + "size": "1", + "pos": "15", + "show": "0", + "value": "0", + "unmaskedvalue": "00" + } + }, + { + "$": { + "name": "ip.dsfield.ecn", + "showname": ".... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)", + "size": "1", + "pos": "15", + "show": "0", + "value": "0", + "unmaskedvalue": "00" + } + } + ] + }, + { + "$": { + "name": "ip.len", + "showname": "Total Length: 86", + "size": "2", + "pos": "16", + "show": "86", + "value": "0056" + } + }, + { + "$": { + "name": "ip.id", + "showname": "Identification: 0xcff6 (53238)", + "size": "2", + "pos": "18", + "show": "0x0000cff6", + "value": "cff6" + } + }, + { + "$": { + "name": "ip.flags", + "showname": "Flags: 0x02 (Don't Fragment)", + "size": "1", + "pos": "20", + "show": "0x00000002", + "value": "40" + }, + "field": [ + { + "$": { + "name": "ip.flags.rb", + "showname": "0... .... = Reserved bit: Not set", + "size": "1", + "pos": "20", + "show": "0", + "value": "40" + } + }, + { + "$": { + "name": "ip.flags.df", + "showname": ".1.. .... = Don't fragment: Set", + "size": "1", + "pos": "20", + "show": "1", + "value": "40" + } + }, + { + "$": { + "name": "ip.flags.mf", + "showname": "..0. .... = More fragments: Not set", + "size": "1", + "pos": "20", + "show": "0", + "value": "40" + } + } + ] + }, + { + "$": { + "name": "ip.frag_offset", + "showname": "Fragment offset: 0", + "size": "2", + "pos": "20", + "show": "0", + "value": "4000" + } + }, + { + "$": { + "name": "ip.ttl", + "showname": "Time to live: 32", + "size": "1", + "pos": "22", + "show": "32", + "value": "20" + } + }, + { + "$": { + "name": "ip.proto", + "showname": "Protocol: TCP (6)", + "size": "1", + "pos": "23", + "show": "6", + "value": "06" + } + }, + { + "$": { + "name": "ip.checksum", + "showname": "Header checksum: 0x5a28 [validation disabled]", + "size": "2", + "pos": "24", + "show": "0x00005a28", + "value": "5a28" + } + }, + { + "$": { + "name": "ip.checksum.status", + "showname": "Header checksum status: Unverified", + "size": "0", + "pos": "24", + "show": "2" + } + }, + { + "$": { + "name": "ip.src", + "showname": "Source: 24.0.0.2", + "size": "4", + "pos": "26", + "show": "24.0.0.2", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.addr", + "showname": "Source or Destination Address: 24.0.0.2", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "24.0.0.2", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.src_host", + "showname": "Source Host: 24.0.0.2", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "24.0.0.2", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.host", + "showname": "Source or Destination Host: 24.0.0.2", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "24.0.0.2", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.dst", + "showname": "Destination: 24.128.0.2", + "size": "4", + "pos": "30", + "show": "24.128.0.2", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.addr", + "showname": "Source or Destination Address: 24.128.0.2", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "24.128.0.2", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.dst_host", + "showname": "Destination Host: 24.128.0.2", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "24.128.0.2", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.host", + "showname": "Source or Destination Host: 24.128.0.2", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "24.128.0.2", + "value": "18800002" + } + }, + { + "$": { + "name": "", + "show": "Source GeoIP: United States, Woodbridge, NJ, AS7922 Comcast Cable Communications, LLC, United States, Woodbridge, NJ, AS7922 Comcast Cable Communications, LLC, 40.557598, -74.284599", + "size": "4", + "pos": "26", + "value": "18000002" + }, + "field": [ + { + "$": { + "name": "ip.geoip.src_country", + "showname": "Source GeoIP Country: United States", + "size": "4", + "pos": "26", + "show": "United States", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.country", + "showname": "Source or Destination GeoIP Country: United States", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "United States", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.src_city", + "showname": "Source GeoIP City: Woodbridge, NJ", + "size": "4", + "pos": "26", + "show": "Woodbridge, NJ", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.city", + "showname": "Source or Destination GeoIP City: Woodbridge, NJ", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "Woodbridge, NJ", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.src_asnum", + "showname": "Source GeoIP AS Number: AS7922 Comcast Cable Communications, LLC", + "size": "4", + "pos": "26", + "show": "AS7922 Comcast Cable Communications, LLC", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.asnum", + "showname": "Source or Destination GeoIP AS Number: AS7922 Comcast Cable Communications, LLC", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "AS7922 Comcast Cable Communications, LLC", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.src_country", + "showname": "Source GeoIP Country: United States", + "size": "4", + "pos": "26", + "show": "United States", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.country", + "showname": "Source or Destination GeoIP Country: United States", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "United States", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.src_city", + "showname": "Source GeoIP City: Woodbridge, NJ", + "size": "4", + "pos": "26", + "show": "Woodbridge, NJ", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.city", + "showname": "Source or Destination GeoIP City: Woodbridge, NJ", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "Woodbridge, NJ", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.src_asnum", + "showname": "Source GeoIP AS Number: AS7922 Comcast Cable Communications, LLC", + "size": "4", + "pos": "26", + "show": "AS7922 Comcast Cable Communications, LLC", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.asnum", + "showname": "Source or Destination GeoIP AS Number: AS7922 Comcast Cable Communications, LLC", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "AS7922 Comcast Cable Communications, LLC", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.src_lat", + "showname": "Source GeoIP Latitude: 40.557598", + "size": "4", + "pos": "26", + "show": "40.557598", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.lat", + "showname": "Source or Destination GeoIP Latitude: 40.557598", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "40.557598", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.src_lon", + "showname": "Source GeoIP Longitude: -74.284599", + "size": "4", + "pos": "26", + "show": "-74.284599", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.lon", + "showname": "Source or Destination GeoIP Longitude: -74.284599", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "-74.284599", + "value": "18000002" + } + } + ] + }, + { + "$": { + "name": "", + "show": "Destination GeoIP: United States, Groton, CT, AS7922 Comcast Cable Communications, LLC, United States, Groton, CT, AS7922 Comcast Cable Communications, LLC, 41.353199, -72.038597", + "size": "4", + "pos": "30", + "value": "18800002" + }, + "field": [ + { + "$": { + "name": "ip.geoip.dst_country", + "showname": "Destination GeoIP Country: United States", + "size": "4", + "pos": "30", + "show": "United States", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.country", + "showname": "Source or Destination GeoIP Country: United States", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "United States", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.dst_city", + "showname": "Destination GeoIP City: Groton, CT", + "size": "4", + "pos": "30", + "show": "Groton, CT", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.city", + "showname": "Source or Destination GeoIP City: Groton, CT", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "Groton, CT", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.dst_asnum", + "showname": "Destination GeoIP AS Number: AS7922 Comcast Cable Communications, LLC", + "size": "4", + "pos": "30", + "show": "AS7922 Comcast Cable Communications, LLC", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.asnum", + "showname": "Source or Destination GeoIP AS Number: AS7922 Comcast Cable Communications, LLC", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "AS7922 Comcast Cable Communications, LLC", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.dst_country", + "showname": "Destination GeoIP Country: United States", + "size": "4", + "pos": "30", + "show": "United States", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.country", + "showname": "Source or Destination GeoIP Country: United States", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "United States", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.dst_city", + "showname": "Destination GeoIP City: Groton, CT", + "size": "4", + "pos": "30", + "show": "Groton, CT", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.city", + "showname": "Source or Destination GeoIP City: Groton, CT", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "Groton, CT", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.dst_asnum", + "showname": "Destination GeoIP AS Number: AS7922 Comcast Cable Communications, LLC", + "size": "4", + "pos": "30", + "show": "AS7922 Comcast Cable Communications, LLC", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.asnum", + "showname": "Source or Destination GeoIP AS Number: AS7922 Comcast Cable Communications, LLC", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "AS7922 Comcast Cable Communications, LLC", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.dst_lat", + "showname": "Destination GeoIP Latitude: 41.353199", + "size": "4", + "pos": "30", + "show": "41.353199", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.lat", + "showname": "Source or Destination GeoIP Latitude: 41.353199", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "41.353199", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.dst_lon", + "showname": "Destination GeoIP Longitude: -72.038597", + "size": "4", + "pos": "30", + "show": "-72.038597", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.lon", + "showname": "Source or Destination GeoIP Longitude: -72.038597", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "-72.038597", + "value": "18800002" + } + } + ] + } + ] + }, + { + "$": { + "name": "tcp", + "showname": "Transmission Control Protocol, Src Port: 2137, Dst Port: 25, Seq: 1, Ack: 1, Len: 34", + "size": "32", + "pos": "34" + }, + "field": [ + { + "$": { + "name": "tcp.srcport", + "showname": "Source Port: 2137", + "size": "2", + "pos": "34", + "show": "2137", + "value": "0859" + } + }, + { + "$": { + "name": "tcp.dstport", + "showname": "Destination Port: 25", + "size": "2", + "pos": "36", + "show": "25", + "value": "0019" + } + }, + { + "$": { + "name": "tcp.port", + "showname": "Source or Destination Port: 2137", + "hide": "yes", + "size": "2", + "pos": "34", + "show": "2137", + "value": "0859" + } + }, + { + "$": { + "name": "tcp.port", + "showname": "Source or Destination Port: 25", + "hide": "yes", + "size": "2", + "pos": "36", + "show": "25", + "value": "0019" + } + }, + { + "$": { + "name": "tcp.stream", + "showname": "Stream index: 0", + "size": "0", + "pos": "34", + "show": "0" + } + }, + { + "$": { + "name": "tcp.len", + "showname": "TCP Segment Len: 34", + "size": "1", + "pos": "46", + "show": "34", + "value": "80" + } + }, + { + "$": { + "name": "tcp.seq", + "showname": "Sequence number: 1 (relative sequence number)", + "size": "4", + "pos": "38", + "show": "1", + "value": "f88900ce" + } + }, + { + "$": { + "name": "tcp.nxtseq", + "showname": "Next sequence number: 35 (relative sequence number)", + "size": "0", + "pos": "34", + "show": "35" + } + }, + { + "$": { + "name": "tcp.ack", + "showname": "Acknowledgment number: 1 (relative ack number)", + "size": "4", + "pos": "42", + "show": "1", + "value": "365aa74f" + } + }, + { + "$": { + "name": "tcp.hdr_len", + "showname": "1000 .... = Header Length: 32 bytes (8)", + "size": "1", + "pos": "46", + "show": "32", + "value": "80" + } + }, + { + "$": { + "name": "tcp.flags", + "showname": "Flags: 0x018 (PSH, ACK)", + "size": "2", + "pos": "46", + "show": "0x00000018", + "value": "18", + "unmaskedvalue": "8018" + }, + "field": [ + { + "$": { + "name": "tcp.flags.res", + "showname": "000. .... .... = Reserved: Not set", + "size": "1", + "pos": "46", + "show": "0", + "value": "0", + "unmaskedvalue": "80" + } + }, + { + "$": { + "name": "tcp.flags.ns", + "showname": "...0 .... .... = Nonce: Not set", + "size": "1", + "pos": "46", + "show": "0", + "value": "0", + "unmaskedvalue": "80" + } + }, + { + "$": { + "name": "tcp.flags.cwr", + "showname": ".... 0... .... = Congestion Window Reduced (CWR): Not set", + "size": "1", + "pos": "47", + "show": "0", + "value": "0", + "unmaskedvalue": "18" + } + }, + { + "$": { + "name": "tcp.flags.ecn", + "showname": ".... .0.. .... = ECN-Echo: Not set", + "size": "1", + "pos": "47", + "show": "0", + "value": "0", + "unmaskedvalue": "18" + } + }, + { + "$": { + "name": "tcp.flags.urg", + "showname": ".... ..0. .... = Urgent: Not set", + "size": "1", + "pos": "47", + "show": "0", + "value": "0", + "unmaskedvalue": "18" + } + }, + { + "$": { + "name": "tcp.flags.ack", + "showname": ".... ...1 .... = Acknowledgment: Set", + "size": "1", + "pos": "47", + "show": "1", + "value": "1", + "unmaskedvalue": "18" + } + }, + { + "$": { + "name": "tcp.flags.push", + "showname": ".... .... 1... = Push: Set", + "size": "1", + "pos": "47", + "show": "1", + "value": "1", + "unmaskedvalue": "18" + } + }, + { + "$": { + "name": "tcp.flags.reset", + "showname": ".... .... .0.. = Reset: Not set", + "size": "1", + "pos": "47", + "show": "0", + "value": "0", + "unmaskedvalue": "18" + } + }, + { + "$": { + "name": "tcp.flags.syn", + "showname": ".... .... ..0. = Syn: Not set", + "size": "1", + "pos": "47", + "show": "0", + "value": "0", + "unmaskedvalue": "18" + } + }, + { + "$": { + "name": "tcp.flags.fin", + "showname": ".... .... ...0 = Fin: Not set", + "size": "1", + "pos": "47", + "show": "0", + "value": "0", + "unmaskedvalue": "18" + } + }, + { + "$": { + "name": "tcp.flags.str", + "showname": "TCP Flags: \\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7AP\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7", + "size": "2", + "pos": "46", + "show": "\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7AP\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7", + "value": "8018" + } + } + ] + }, + { + "$": { + "name": "tcp.window_size_value", + "showname": "Window size value: 7240", + "size": "2", + "pos": "48", + "show": "7240", + "value": "1c48" + } + }, + { + "$": { + "name": "tcp.window_size", + "showname": "Calculated window size: 7240", + "size": "2", + "pos": "48", + "show": "7240", + "value": "1c48" + } + }, + { + "$": { + "name": "tcp.window_size_scalefactor", + "showname": "Window size scaling factor: -1 (unknown)", + "size": "2", + "pos": "48", + "show": "-1", + "value": "1c48" + } + }, + { + "$": { + "name": "tcp.checksum", + "showname": "Checksum: 0x681f [unverified]", + "size": "2", + "pos": "50", + "show": "0x0000681f", + "value": "681f" + } + }, + { + "$": { + "name": "tcp.checksum.status", + "showname": "Checksum Status: Unverified", + "size": "0", + "pos": "50", + "show": "2" + } + }, + { + "$": { + "name": "tcp.urgent_pointer", + "showname": "Urgent pointer: 0", + "size": "2", + "pos": "52", + "show": "0", + "value": "0000" + } + }, + { + "$": { + "name": "tcp.options", + "showname": "Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps", + "size": "12", + "pos": "54", + "show": "01:01:08:0a:eb:83:4b:08:e8:8c:de:cb", + "value": "0101080aeb834b08e88cdecb" + }, + "field": [ + { + "$": { + "name": "tcp.options.nop", + "showname": "TCP Option - No-Operation (NOP)", + "size": "1", + "pos": "54", + "show": "01", + "value": "01" + }, + "field": [ + { + "$": { + "name": "tcp.option_kind", + "showname": "Kind: No-Operation (1)", + "size": "1", + "pos": "54", + "show": "1", + "value": "01" + } + } + ] + }, + { + "$": { + "name": "tcp.options.nop", + "showname": "TCP Option - No-Operation (NOP)", + "size": "1", + "pos": "55", + "show": "01", + "value": "01" + }, + "field": [ + { + "$": { + "name": "tcp.option_kind", + "showname": "Kind: No-Operation (1)", + "size": "1", + "pos": "55", + "show": "1", + "value": "01" + } + } + ] + }, + { + "$": { + "name": "tcp.options.timestamp", + "showname": "TCP Option - Timestamps: TSval 3951250184, TSecr 3901546187", + "size": "10", + "pos": "56", + "show": "08:0a:eb:83:4b:08:e8:8c:de:cb", + "value": "080aeb834b08e88cdecb" + }, + "field": [ + { + "$": { + "name": "tcp.option_kind", + "showname": "Kind: Time Stamp Option (8)", + "size": "1", + "pos": "56", + "show": "8", + "value": "08" + } + }, + { + "$": { + "name": "tcp.option_len", + "showname": "Length: 10", + "size": "1", + "pos": "57", + "show": "10", + "value": "0a" + } + }, + { + "$": { + "name": "tcp.options.timestamp.tsval", + "showname": "Timestamp value: 3951250184", + "size": "4", + "pos": "58", + "show": "3951250184", + "value": "eb834b08" + } + }, + { + "$": { + "name": "tcp.options.timestamp.tsecr", + "showname": "Timestamp echo reply: 3901546187", + "size": "4", + "pos": "62", + "show": "3901546187", + "value": "e88cdecb" + } + } + ] + } + ] + }, + { + "$": { + "name": "tcp.analysis", + "showname": "SEQ/ACK analysis", + "size": "0", + "pos": "34", + "show": "", + "value": "" + }, + "field": [ + { + "$": { + "name": "tcp.analysis.bytes_in_flight", + "showname": "Bytes in flight: 34", + "size": "0", + "pos": "34", + "show": "34" + } + }, + { + "$": { + "name": "tcp.analysis.push_bytes_sent", + "showname": "Bytes sent since last PSH flag: 34", + "size": "0", + "pos": "34", + "show": "34" + } + } + ] + }, + { + "$": { + "name": "tcp.payload", + "showname": "TCP payload (34 bytes)", + "size": "34", + "pos": "66", + "show": "45:48:4c:4f:20:63:6c:69:65:6e:74:2d:31:38:30:30:30:30:30:33:2e:65:78:61:6d:70:6c:65:2e:69:6e:74:0d:0a", + "value": "45484c4f20636c69656e742d31383030303030332e6578616d706c652e696e740d0a" + } + } + ] + }, + { + "$": { + "name": "smtp", + "showname": "Simple Mail Transfer Protocol", + "size": "34", + "pos": "66" + }, + "field": [ + { + "$": { + "name": "smtp.req", + "showname": "Request: True", + "hide": "yes", + "size": "0", + "pos": "66", + "show": "1" + } + }, + { + "$": { + "name": "smtp.command_line", + "showname": "Command Line: EHLO client-18000003.example.int\\\\r\\\\n", + "size": "34", + "pos": "66", + "show": "EHLO client-18000003.example.int\\\\xd\\\\xa", + "value": "45484c4f20636c69656e742d31383030303030332e6578616d706c652e696e740d0a" + }, + "field": [ + { + "$": { + "name": "smtp.req.command", + "showname": "Command: EHLO", + "size": "4", + "pos": "66", + "show": "EHLO", + "value": "45484c4f" + } + }, + { + "$": { + "name": "smtp.req.parameter", + "showname": "Request parameter: client-18000003.example.int", + "size": "27", + "pos": "71", + "show": "client-18000003.example.int", + "value": "636c69656e742d31383030303030332e6578616d706c652e696e74" + } + } + ] + } + ] + } + ] + }, + { + "proto": [ + { + "$": { + "name": "geninfo", + "pos": "0", + "showname": "General information", + "size": "104" + }, + "field": [ + { + "$": { + "name": "num", + "pos": "0", + "show": "1", + "showname": "Number", + "value": "1", + "size": "104" + } + }, + { + "$": { + "name": "len", + "pos": "0", + "show": "104", + "showname": "Frame Length", + "value": "68", + "size": "104" + } + }, + { + "$": { + "name": "caplen", + "pos": "0", + "show": "104", + "showname": "Captured Length", + "value": "68", + "size": "104" + } + }, + { + "$": { + "name": "timestamp", + "pos": "0", + "show": "Mar 26, 2014 19:59:40.024362000 GMT", + "showname": "Captured Time", + "value": "1395863980.024362000", + "size": "104" + } + } + ] + }, + { + "$": { + "name": "frame", + "showname": "Frame 1: 104 bytes on wire (832 bits), 104 bytes captured (832 bits)", + "size": "104", + "pos": "0" + }, + "field": [ + { + "$": { + "name": "frame.encap_type", + "showname": "Encapsulation type: Ethernet (1)", + "size": "0", + "pos": "0", + "show": "1" + } + }, + { + "$": { + "name": "frame.time", + "showname": "Arrival Time: Mar 26, 2014 19:59:40.024362000 GMT", + "size": "0", + "pos": "0", + "show": "Mar 26, 2014 19:59:40.024362000 GMT" + } + }, + { + "$": { + "name": "frame.offset_shift", + "showname": "Time shift for this packet: 0.000000000 seconds", + "size": "0", + "pos": "0", + "show": "0.000000000" + } + }, + { + "$": { + "name": "frame.time_epoch", + "showname": "Epoch Time: 1395863980.024362000 seconds", + "size": "0", + "pos": "0", + "show": "1395863980.024362000" + } + }, + { + "$": { + "name": "frame.time_delta", + "showname": "Time delta from previous captured frame: 0.000000000 seconds", + "size": "0", + "pos": "0", + "show": "0.000000000" + } + }, + { + "$": { + "name": "frame.time_delta_displayed", + "showname": "Time delta from previous displayed frame: 0.000000000 seconds", + "size": "0", + "pos": "0", + "show": "0.000000000" + } + }, + { + "$": { + "name": "frame.time_relative", + "showname": "Time since reference or first frame: 0.000000000 seconds", + "size": "0", + "pos": "0", + "show": "0.000000000" + } + }, + { + "$": { + "name": "frame.number", + "showname": "Frame Number: 1", + "size": "0", + "pos": "0", + "show": "1" + } + }, + { + "$": { + "name": "frame.len", + "showname": "Frame Length: 104 bytes (832 bits)", + "size": "0", + "pos": "0", + "show": "104" + } + }, + { + "$": { + "name": "frame.cap_len", + "showname": "Capture Length: 104 bytes (832 bits)", + "size": "0", + "pos": "0", + "show": "104" + } + }, + { + "$": { + "name": "frame.marked", + "showname": "Frame is marked: False", + "size": "0", + "pos": "0", + "show": "0" + } + }, + { + "$": { + "name": "frame.ignored", + "showname": "Frame is ignored: False", + "size": "0", + "pos": "0", + "show": "0" + } + }, + { + "$": { + "name": "frame.protocols", + "showname": "Protocols in frame: eth:ethertype:ip:tcp:smtp", + "size": "0", + "pos": "0", + "show": "eth:ethertype:ip:tcp:smtp" + } + } + ] + }, + { + "$": { + "name": "eth", + "showname": "Ethernet II, Src: MS-NLB-PhysServer-26_c5:01:00:02 (02:1a:c5:01:00:02), Dst: MS-NLB-PhysServer-26_c5:05:00:02 (02:1a:c5:05:00:02)", + "size": "14", + "pos": "0" + }, + "field": [ + { + "$": { + "name": "eth.dst", + "showname": "Destination: MS-NLB-PhysServer-26_c5:05:00:02 (02:1a:c5:05:00:02)", + "size": "6", + "pos": "0", + "show": "02:1a:c5:05:00:02", + "value": "021ac5050002" + }, + "field": [ + { + "$": { + "name": "eth.dst_resolved", + "showname": "Destination (resolved): MS-NLB-PhysServer-26_c5:05:00:02", + "hide": "yes", + "size": "6", + "pos": "0", + "show": "MS-NLB-PhysServer-26_c5:05:00:02", + "value": "021ac5050002" + } + }, + { + "$": { + "name": "eth.addr", + "showname": "Address: MS-NLB-PhysServer-26_c5:05:00:02 (02:1a:c5:05:00:02)", + "size": "6", + "pos": "0", + "show": "02:1a:c5:05:00:02", + "value": "021ac5050002" + } + }, + { + "$": { + "name": "eth.addr_resolved", + "showname": "Address (resolved): MS-NLB-PhysServer-26_c5:05:00:02", + "hide": "yes", + "size": "6", + "pos": "0", + "show": "MS-NLB-PhysServer-26_c5:05:00:02", + "value": "021ac5050002" + } + }, + { + "$": { + "name": "eth.lg", + "showname": ".... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)", + "size": "3", + "pos": "0", + "show": "1", + "value": "1", + "unmaskedvalue": "021ac5" + } + }, + { + "$": { + "name": "eth.ig", + "showname": ".... ...0 .... .... .... .... = IG bit: Individual address (unicast)", + "size": "3", + "pos": "0", + "show": "0", + "value": "0", + "unmaskedvalue": "021ac5" + } + } + ] + }, + { + "$": { + "name": "eth.src", + "showname": "Source: MS-NLB-PhysServer-26_c5:01:00:02 (02:1a:c5:01:00:02)", + "size": "6", + "pos": "6", + "show": "02:1a:c5:01:00:02", + "value": "021ac5010002" + }, + "field": [ + { + "$": { + "name": "eth.src_resolved", + "showname": "Source (resolved): MS-NLB-PhysServer-26_c5:01:00:02", + "hide": "yes", + "size": "6", + "pos": "6", + "show": "MS-NLB-PhysServer-26_c5:01:00:02", + "value": "021ac5010002" + } + }, + { + "$": { + "name": "eth.addr", + "showname": "Address: MS-NLB-PhysServer-26_c5:01:00:02 (02:1a:c5:01:00:02)", + "size": "6", + "pos": "6", + "show": "02:1a:c5:01:00:02", + "value": "021ac5010002" + } + }, + { + "$": { + "name": "eth.addr_resolved", + "showname": "Address (resolved): MS-NLB-PhysServer-26_c5:01:00:02", + "hide": "yes", + "size": "6", + "pos": "6", + "show": "MS-NLB-PhysServer-26_c5:01:00:02", + "value": "021ac5010002" + } + }, + { + "$": { + "name": "eth.lg", + "showname": ".... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)", + "size": "3", + "pos": "6", + "show": "1", + "value": "1", + "unmaskedvalue": "021ac5" + } + }, + { + "$": { + "name": "eth.ig", + "showname": ".... ...0 .... .... .... .... = IG bit: Individual address (unicast)", + "size": "3", + "pos": "6", + "show": "0", + "value": "0", + "unmaskedvalue": "021ac5" + } + } + ] + }, + { + "$": { + "name": "eth.type", + "showname": "Type: IPv4 (0x0800)", + "size": "2", + "pos": "12", + "show": "0x00000800", + "value": "0800" + } + }, + { + "$": { + "name": "eth.fcs", + "showname": "Frame check sequence: 0x26469e92 [correct]", + "size": "4", + "pos": "100", + "show": "0x26469e92", + "value": "26469e92" + } + }, + { + "$": { + "name": "eth.fcs.status", + "showname": "FCS Status: Good", + "size": "0", + "pos": "100", + "show": "1" + } + } + ] + }, + { + "$": { + "name": "ip", + "showname": "Internet Protocol Version 4, Src: 24.0.0.2, Dst: 24.128.0.2", + "size": "20", + "pos": "14" + }, + "field": [ + { + "$": { + "name": "ip.version", + "showname": "0100 .... = Version: 4", + "size": "1", + "pos": "14", + "show": "4", + "value": "4", + "unmaskedvalue": "45" + } + }, + { + "$": { + "name": "ip.hdr_len", + "showname": ".... 0101 = Header Length: 20 bytes (5)", + "size": "1", + "pos": "14", + "show": "20", + "value": "45" + } + }, + { + "$": { + "name": "ip.dsfield", + "showname": "Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)", + "size": "1", + "pos": "15", + "show": "0x00000000", + "value": "00" + }, + "field": [ + { + "$": { + "name": "ip.dsfield.dscp", + "showname": "0000 00.. = Differentiated Services Codepoint: Default (0)", + "size": "1", + "pos": "15", + "show": "0", + "value": "0", + "unmaskedvalue": "00" + } + }, + { + "$": { + "name": "ip.dsfield.ecn", + "showname": ".... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)", + "size": "1", + "pos": "15", + "show": "0", + "value": "0", + "unmaskedvalue": "00" + } + } + ] + }, + { + "$": { + "name": "ip.len", + "showname": "Total Length: 86", + "size": "2", + "pos": "16", + "show": "86", + "value": "0056" + } + }, + { + "$": { + "name": "ip.id", + "showname": "Identification: 0xcff6 (53238)", + "size": "2", + "pos": "18", + "show": "0x0000cff6", + "value": "cff6" + } + }, + { + "$": { + "name": "ip.flags", + "showname": "Flags: 0x02 (Don't Fragment)", + "size": "1", + "pos": "20", + "show": "0x00000002", + "value": "40" + }, + "field": [ + { + "$": { + "name": "ip.flags.rb", + "showname": "0... .... = Reserved bit: Not set", + "size": "1", + "pos": "20", + "show": "0", + "value": "40" + } + }, + { + "$": { + "name": "ip.flags.df", + "showname": ".1.. .... = Don't fragment: Set", + "size": "1", + "pos": "20", + "show": "1", + "value": "40" + } + }, + { + "$": { + "name": "ip.flags.mf", + "showname": "..0. .... = More fragments: Not set", + "size": "1", + "pos": "20", + "show": "0", + "value": "40" + } + } + ] + }, + { + "$": { + "name": "ip.frag_offset", + "showname": "Fragment offset: 0", + "size": "2", + "pos": "20", + "show": "0", + "value": "4000" + } + }, + { + "$": { + "name": "ip.ttl", + "showname": "Time to live: 32", + "size": "1", + "pos": "22", + "show": "32", + "value": "20" + } + }, + { + "$": { + "name": "ip.proto", + "showname": "Protocol: TCP (6)", + "size": "1", + "pos": "23", + "show": "6", + "value": "06" + } + }, + { + "$": { + "name": "ip.checksum", + "showname": "Header checksum: 0x5a28 [validation disabled]", + "size": "2", + "pos": "24", + "show": "0x00005a28", + "value": "5a28" + } + }, + { + "$": { + "name": "ip.checksum.status", + "showname": "Header checksum status: Unverified", + "size": "0", + "pos": "24", + "show": "2" + } + }, + { + "$": { + "name": "ip.src", + "showname": "Source: 24.0.0.2", + "size": "4", + "pos": "26", + "show": "24.0.0.2", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.addr", + "showname": "Source or Destination Address: 24.0.0.2", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "24.0.0.2", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.src_host", + "showname": "Source Host: 24.0.0.2", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "24.0.0.2", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.host", + "showname": "Source or Destination Host: 24.0.0.2", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "24.0.0.2", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.dst", + "showname": "Destination: 24.128.0.2", + "size": "4", + "pos": "30", + "show": "24.128.0.2", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.addr", + "showname": "Source or Destination Address: 24.128.0.2", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "24.128.0.2", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.dst_host", + "showname": "Destination Host: 24.128.0.2", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "24.128.0.2", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.host", + "showname": "Source or Destination Host: 24.128.0.2", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "24.128.0.2", + "value": "18800002" + } + }, + { + "$": { + "name": "", + "show": "Source GeoIP: United States, Woodbridge, NJ, AS7922 Comcast Cable Communications, LLC, United States, Woodbridge, NJ, AS7922 Comcast Cable Communications, LLC, 40.557598, -74.284599", + "size": "4", + "pos": "26", + "value": "18000002" + }, + "field": [ + { + "$": { + "name": "ip.geoip.src_country", + "showname": "Source GeoIP Country: United States", + "size": "4", + "pos": "26", + "show": "United States", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.country", + "showname": "Source or Destination GeoIP Country: United States", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "United States", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.src_city", + "showname": "Source GeoIP City: Woodbridge, NJ", + "size": "4", + "pos": "26", + "show": "Woodbridge, NJ", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.city", + "showname": "Source or Destination GeoIP City: Woodbridge, NJ", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "Woodbridge, NJ", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.src_asnum", + "showname": "Source GeoIP AS Number: AS7922 Comcast Cable Communications, LLC", + "size": "4", + "pos": "26", + "show": "AS7922 Comcast Cable Communications, LLC", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.asnum", + "showname": "Source or Destination GeoIP AS Number: AS7922 Comcast Cable Communications, LLC", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "AS7922 Comcast Cable Communications, LLC", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.src_country", + "showname": "Source GeoIP Country: United States", + "size": "4", + "pos": "26", + "show": "United States", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.country", + "showname": "Source or Destination GeoIP Country: United States", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "United States", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.src_city", + "showname": "Source GeoIP City: Woodbridge, NJ", + "size": "4", + "pos": "26", + "show": "Woodbridge, NJ", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.city", + "showname": "Source or Destination GeoIP City: Woodbridge, NJ", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "Woodbridge, NJ", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.src_asnum", + "showname": "Source GeoIP AS Number: AS7922 Comcast Cable Communications, LLC", + "size": "4", + "pos": "26", + "show": "AS7922 Comcast Cable Communications, LLC", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.asnum", + "showname": "Source or Destination GeoIP AS Number: AS7922 Comcast Cable Communications, LLC", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "AS7922 Comcast Cable Communications, LLC", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.src_lat", + "showname": "Source GeoIP Latitude: 40.557598", + "size": "4", + "pos": "26", + "show": "40.557598", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.lat", + "showname": "Source or Destination GeoIP Latitude: 40.557598", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "40.557598", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.src_lon", + "showname": "Source GeoIP Longitude: -74.284599", + "size": "4", + "pos": "26", + "show": "-74.284599", + "value": "18000002" + } + }, + { + "$": { + "name": "ip.geoip.lon", + "showname": "Source or Destination GeoIP Longitude: -74.284599", + "hide": "yes", + "size": "4", + "pos": "26", + "show": "-74.284599", + "value": "18000002" + } + } + ] + }, + { + "$": { + "name": "", + "show": "Destination GeoIP: United States, Groton, CT, AS7922 Comcast Cable Communications, LLC, United States, Groton, CT, AS7922 Comcast Cable Communications, LLC, 41.353199, -72.038597", + "size": "4", + "pos": "30", + "value": "18800002" + }, + "field": [ + { + "$": { + "name": "ip.geoip.dst_country", + "showname": "Destination GeoIP Country: United States", + "size": "4", + "pos": "30", + "show": "United States", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.country", + "showname": "Source or Destination GeoIP Country: United States", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "United States", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.dst_city", + "showname": "Destination GeoIP City: Groton, CT", + "size": "4", + "pos": "30", + "show": "Groton, CT", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.city", + "showname": "Source or Destination GeoIP City: Groton, CT", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "Groton, CT", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.dst_asnum", + "showname": "Destination GeoIP AS Number: AS7922 Comcast Cable Communications, LLC", + "size": "4", + "pos": "30", + "show": "AS7922 Comcast Cable Communications, LLC", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.asnum", + "showname": "Source or Destination GeoIP AS Number: AS7922 Comcast Cable Communications, LLC", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "AS7922 Comcast Cable Communications, LLC", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.dst_country", + "showname": "Destination GeoIP Country: United States", + "size": "4", + "pos": "30", + "show": "United States", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.country", + "showname": "Source or Destination GeoIP Country: United States", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "United States", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.dst_city", + "showname": "Destination GeoIP City: Groton, CT", + "size": "4", + "pos": "30", + "show": "Groton, CT", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.city", + "showname": "Source or Destination GeoIP City: Groton, CT", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "Groton, CT", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.dst_asnum", + "showname": "Destination GeoIP AS Number: AS7922 Comcast Cable Communications, LLC", + "size": "4", + "pos": "30", + "show": "AS7922 Comcast Cable Communications, LLC", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.asnum", + "showname": "Source or Destination GeoIP AS Number: AS7922 Comcast Cable Communications, LLC", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "AS7922 Comcast Cable Communications, LLC", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.dst_lat", + "showname": "Destination GeoIP Latitude: 41.353199", + "size": "4", + "pos": "30", + "show": "41.353199", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.lat", + "showname": "Source or Destination GeoIP Latitude: 41.353199", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "41.353199", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.dst_lon", + "showname": "Destination GeoIP Longitude: -72.038597", + "size": "4", + "pos": "30", + "show": "-72.038597", + "value": "18800002" + } + }, + { + "$": { + "name": "ip.geoip.lon", + "showname": "Source or Destination GeoIP Longitude: -72.038597", + "hide": "yes", + "size": "4", + "pos": "30", + "show": "-72.038597", + "value": "18800002" + } + } + ] + } + ] + }, + { + "$": { + "name": "tcp", + "showname": "Transmission Control Protocol, Src Port: 2137, Dst Port: 25, Seq: 1, Ack: 1, Len: 34", + "size": "32", + "pos": "34" + }, + "field": [ + { + "$": { + "name": "tcp.srcport", + "showname": "Source Port: 2137", + "size": "2", + "pos": "34", + "show": "2137", + "value": "0859" + } + }, + { + "$": { + "name": "tcp.dstport", + "showname": "Destination Port: 25", + "size": "2", + "pos": "36", + "show": "25", + "value": "0019" + } + }, + { + "$": { + "name": "tcp.port", + "showname": "Source or Destination Port: 2137", + "hide": "yes", + "size": "2", + "pos": "34", + "show": "2137", + "value": "0859" + } + }, + { + "$": { + "name": "tcp.port", + "showname": "Source or Destination Port: 25", + "hide": "yes", + "size": "2", + "pos": "36", + "show": "25", + "value": "0019" + } + }, + { + "$": { + "name": "tcp.stream", + "showname": "Stream index: 0", + "size": "0", + "pos": "34", + "show": "0" + } + }, + { + "$": { + "name": "tcp.len", + "showname": "TCP Segment Len: 34", + "size": "1", + "pos": "46", + "show": "34", + "value": "80" + } + }, + { + "$": { + "name": "tcp.seq", + "showname": "Sequence number: 1 (relative sequence number)", + "size": "4", + "pos": "38", + "show": "1", + "value": "f88900ce" + } + }, + { + "$": { + "name": "tcp.nxtseq", + "showname": "Next sequence number: 35 (relative sequence number)", + "size": "0", + "pos": "34", + "show": "35" + } + }, + { + "$": { + "name": "tcp.ack", + "showname": "Acknowledgment number: 1 (relative ack number)", + "size": "4", + "pos": "42", + "show": "1", + "value": "365aa74f" + } + }, + { + "$": { + "name": "tcp.hdr_len", + "showname": "1000 .... = Header Length: 32 bytes (8)", + "size": "1", + "pos": "46", + "show": "32", + "value": "80" + } + }, + { + "$": { + "name": "tcp.flags", + "showname": "Flags: 0x018 (PSH, ACK)", + "size": "2", + "pos": "46", + "show": "0x00000018", + "value": "18", + "unmaskedvalue": "8018" + }, + "field": [ + { + "$": { + "name": "tcp.flags.res", + "showname": "000. .... .... = Reserved: Not set", + "size": "1", + "pos": "46", + "show": "0", + "value": "0", + "unmaskedvalue": "80" + } + }, + { + "$": { + "name": "tcp.flags.ns", + "showname": "...0 .... .... = Nonce: Not set", + "size": "1", + "pos": "46", + "show": "0", + "value": "0", + "unmaskedvalue": "80" + } + }, + { + "$": { + "name": "tcp.flags.cwr", + "showname": ".... 0... .... = Congestion Window Reduced (CWR): Not set", + "size": "1", + "pos": "47", + "show": "0", + "value": "0", + "unmaskedvalue": "18" + } + }, + { + "$": { + "name": "tcp.flags.ecn", + "showname": ".... .0.. .... = ECN-Echo: Not set", + "size": "1", + "pos": "47", + "show": "0", + "value": "0", + "unmaskedvalue": "18" + } + }, + { + "$": { + "name": "tcp.flags.urg", + "showname": ".... ..0. .... = Urgent: Not set", + "size": "1", + "pos": "47", + "show": "0", + "value": "0", + "unmaskedvalue": "18" + } + }, + { + "$": { + "name": "tcp.flags.ack", + "showname": ".... ...1 .... = Acknowledgment: Set", + "size": "1", + "pos": "47", + "show": "1", + "value": "1", + "unmaskedvalue": "18" + } + }, + { + "$": { + "name": "tcp.flags.push", + "showname": ".... .... 1... = Push: Set", + "size": "1", + "pos": "47", + "show": "1", + "value": "1", + "unmaskedvalue": "18" + } + }, + { + "$": { + "name": "tcp.flags.reset", + "showname": ".... .... .0.. = Reset: Not set", + "size": "1", + "pos": "47", + "show": "0", + "value": "0", + "unmaskedvalue": "18" + } + }, + { + "$": { + "name": "tcp.flags.syn", + "showname": ".... .... ..0. = Syn: Not set", + "size": "1", + "pos": "47", + "show": "0", + "value": "0", + "unmaskedvalue": "18" + } + }, + { + "$": { + "name": "tcp.flags.fin", + "showname": ".... .... ...0 = Fin: Not set", + "size": "1", + "pos": "47", + "show": "0", + "value": "0", + "unmaskedvalue": "18" + } + }, + { + "$": { + "name": "tcp.flags.str", + "showname": "TCP Flags: \\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7AP\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7", + "size": "2", + "pos": "46", + "show": "\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7AP\\\\xc2\\\\xb7\\\\xc2\\\\xb7\\\\xc2\\\\xb7", + "value": "8018" + } + } + ] + }, + { + "$": { + "name": "tcp.window_size_value", + "showname": "Window size value: 7240", + "size": "2", + "pos": "48", + "show": "7240", + "value": "1c48" + } + }, + { + "$": { + "name": "tcp.window_size", + "showname": "Calculated window size: 7240", + "size": "2", + "pos": "48", + "show": "7240", + "value": "1c48" + } + }, + { + "$": { + "name": "tcp.window_size_scalefactor", + "showname": "Window size scaling factor: -1 (unknown)", + "size": "2", + "pos": "48", + "show": "-1", + "value": "1c48" + } + }, + { + "$": { + "name": "tcp.checksum", + "showname": "Checksum: 0x681f [unverified]", + "size": "2", + "pos": "50", + "show": "0x0000681f", + "value": "681f" + } + }, + { + "$": { + "name": "tcp.checksum.status", + "showname": "Checksum Status: Unverified", + "size": "0", + "pos": "50", + "show": "2" + } + }, + { + "$": { + "name": "tcp.urgent_pointer", + "showname": "Urgent pointer: 0", + "size": "2", + "pos": "52", + "show": "0", + "value": "0000" + } + }, + { + "$": { + "name": "tcp.options", + "showname": "Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps", + "size": "12", + "pos": "54", + "show": "01:01:08:0a:eb:83:4b:08:e8:8c:de:cb", + "value": "0101080aeb834b08e88cdecb" + }, + "field": [ + { + "$": { + "name": "tcp.options.nop", + "showname": "TCP Option - No-Operation (NOP)", + "size": "1", + "pos": "54", + "show": "01", + "value": "01" + }, + "field": [ + { + "$": { + "name": "tcp.option_kind", + "showname": "Kind: No-Operation (1)", + "size": "1", + "pos": "54", + "show": "1", + "value": "01" + } + } + ] + }, + { + "$": { + "name": "tcp.options.nop", + "showname": "TCP Option - No-Operation (NOP)", + "size": "1", + "pos": "55", + "show": "01", + "value": "01" + }, + "field": [ + { + "$": { + "name": "tcp.option_kind", + "showname": "Kind: No-Operation (1)", + "size": "1", + "pos": "55", + "show": "1", + "value": "01" + } + } + ] + }, + { + "$": { + "name": "tcp.options.timestamp", + "showname": "TCP Option - Timestamps: TSval 3951250184, TSecr 3901546187", + "size": "10", + "pos": "56", + "show": "08:0a:eb:83:4b:08:e8:8c:de:cb", + "value": "080aeb834b08e88cdecb" + }, + "field": [ + { + "$": { + "name": "tcp.option_kind", + "showname": "Kind: Time Stamp Option (8)", + "size": "1", + "pos": "56", + "show": "8", + "value": "08" + } + }, + { + "$": { + "name": "tcp.option_len", + "showname": "Length: 10", + "size": "1", + "pos": "57", + "show": "10", + "value": "0a" + } + }, + { + "$": { + "name": "tcp.options.timestamp.tsval", + "showname": "Timestamp value: 3951250184", + "size": "4", + "pos": "58", + "show": "3951250184", + "value": "eb834b08" + } + }, + { + "$": { + "name": "tcp.options.timestamp.tsecr", + "showname": "Timestamp echo reply: 3901546187", + "size": "4", + "pos": "62", + "show": "3901546187", + "value": "e88cdecb" + } + } + ] + } + ] + }, + { + "$": { + "name": "tcp.analysis", + "showname": "SEQ/ACK analysis", + "size": "0", + "pos": "34", + "show": "", + "value": "" + }, + "field": [ + { + "$": { + "name": "tcp.analysis.bytes_in_flight", + "showname": "Bytes in flight: 34", + "size": "0", + "pos": "34", + "show": "34" + } + }, + { + "$": { + "name": "tcp.analysis.push_bytes_sent", + "showname": "Bytes sent since last PSH flag: 34", + "size": "0", + "pos": "34", + "show": "34" + } + } + ] + }, + { + "$": { + "name": "tcp.payload", + "showname": "TCP payload (34 bytes)", + "size": "34", + "pos": "66", + "show": "45:48:4c:4f:20:63:6c:69:65:6e:74:2d:31:38:30:30:30:30:30:33:2e:65:78:61:6d:70:6c:65:2e:69:6e:74:0d:0a", + "value": "45484c4f20636c69656e742d31383030303030332e6578616d706c652e696e740d0a" + } + } + ] + }, + { + "$": { + "name": "smtp", + "showname": "Simple Mail Transfer Protocol", + "size": "34", + "pos": "66" + }, + "field": [ + { + "$": { + "name": "smtp.req", + "showname": "Request: True", + "hide": "yes", + "size": "0", + "pos": "66", + "show": "1" + } + }, + { + "$": { + "name": "smtp.command_line", + "showname": "Command Line: EHLO client-18000003.example.int\\\\r\\\\n", + "size": "34", + "pos": "66", + "show": "EHLO client-18000003.example.int\\\\xd\\\\xa", + "value": "45484c4f20636c69656e742d31383030303030332e6578616d706c652e696e740d0a" + }, + "field": [ + { + "$": { + "name": "smtp.req.command", + "showname": "Command: EHLO", + "size": "4", + "pos": "66", + "show": "EHLO", + "value": "45484c4f" + } + }, + { + "$": { + "name": "smtp.req.parameter", + "showname": "Request parameter: client-18000003.example.int", + "size": "27", + "pos": "71", + "show": "client-18000003.example.int", + "value": "636c69656e742d31383030303030332e6578616d706c652e696e74" + } + } + ] + } + ] + } + ] + } + ] + } +} +` +} From b1b6a7dabea1a1d0d132482c8d97af29c0ac2683 Mon Sep 17 00:00:00 2001 From: merrimanr Date: Fri, 13 Apr 2018 10:00:15 -0500 Subject: [PATCH 02/14] initial commit Conflicts: metron-interface/metron-rest/src/main/java/org/apache/metron/rest/MetronRestApplication.java metron-interface/metron-rest/src/main/java/org/apache/metron/rest/controller/PcapQueryController.java metron-interface/metron-rest/src/main/java/org/apache/metron/rest/util/pcapQueryThread.java --- .../src/app/pcap/model/pcap.request.ts | 19 +- .../metron-alerts/src/app/pcap/model/pdml.ts | 21 +- .../pcap-filters/pcap-filters.component.html | 22 +- .../pcap-filters/pcap-filters.component.scss | 2 +- .../pcap-filters/pcap-filters.component.ts | 7 +- .../pcap-packet-line.component.html | 12 +- .../pcap-packet-line.component.ts | 6 +- .../pcap-packet/pcap-packet.component.html | 8 +- .../pcap-packet/pcap-packet.component.scss | 4 + .../pcap/pcap-panel/pcap-panel.component.html | 22 +- .../pcap/pcap-panel/pcap-panel.component.scss | 35 + .../pcap/pcap-panel/pcap-panel.component.ts | 48 +- .../src/app/pcap/service/pcap.service.ts | 7232 ++++++++++++++++- 13 files changed, 7367 insertions(+), 71 deletions(-) diff --git a/metron-interface/metron-alerts/src/app/pcap/model/pcap.request.ts b/metron-interface/metron-alerts/src/app/pcap/model/pcap.request.ts index 5ae35efbf9..88ff5a23d7 100644 --- a/metron-interface/metron-alerts/src/app/pcap/model/pcap.request.ts +++ b/metron-interface/metron-alerts/src/app/pcap/model/pcap.request.ts @@ -17,12 +17,13 @@ */ export class PcapRequest { - from: number - to: number - ip_src_addr: string - ip_src_port: number - ip_dest_addr: string - ip_dest_port: number - protocol: string - filter: string -} + startTime: number = 1; + endTime: number = 150000000000000000; + srcIp: string = ''; + srcPort: string = ''; + dstIp: string = ''; + dstPort: string = ''; + protocol: string = ''; + packetFilter: string = ''; + includeReverseTraffic: boolean = false; +} \ No newline at end of file diff --git a/metron-interface/metron-alerts/src/app/pcap/model/pdml.ts b/metron-interface/metron-alerts/src/app/pcap/model/pdml.ts index 17b4deaba6..42da9483ed 100644 --- a/metron-interface/metron-alerts/src/app/pcap/model/pdml.ts +++ b/metron-interface/metron-alerts/src/app/pcap/model/pdml.ts @@ -17,26 +17,31 @@ */ export class PdmlField { - public $: any[] - public field?: PdmlField[] + //public $: any[] + public name: string; + public fields?: PdmlField[] } export class PdmlProto { - public $: any - public field: PdmlField[] + //public $: any + public name: string; + public showname: string; + public fields: PdmlField[] public static findField(p: PdmlProto, name: string): PdmlField { - return p.field.find(f => f['$']['name'] == name) + return p.fields.find(f => f['name'] == name) } } export class PdmlPacket { - public $: any - public proto: PdmlProto[] + //public $: any + public name: string; + public protos: PdmlProto[] public expanded: boolean = false } export class Pdml { - public pdml: { S: any, packet: PdmlPacket[] } + public name: string; + public packets: PdmlPacket[]; } diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.html b/metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.html index 0219723513..1c54026278 100644 --- a/metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.html +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.html @@ -1,29 +1,39 @@ diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.scss b/metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.scss index ffb26c98c6..2571950c65 100644 --- a/metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.scss +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.scss @@ -23,6 +23,7 @@ padding-left: 0; padding-right: 0; border: 1px solid $blue-chill !important; + cursor: pointer; &:focus { box-shadow: none; @@ -47,6 +48,5 @@ padding-top: 6px; padding-bottom: 6px; background: $icon-button-background; - cursor: pointer; } } diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.ts b/metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.ts index 6156f9d84b..11492fea85 100644 --- a/metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.ts +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.ts @@ -1,4 +1,4 @@ -import { Component, OnInit, Output, EventEmitter } from '@angular/core'; +import { Component, OnInit, Input, Output, EventEmitter } from '@angular/core'; import { PcapRequest } from '../model/pcap.request' @Component({ @@ -8,9 +8,10 @@ import { PcapRequest } from '../model/pcap.request' }) export class PcapFiltersComponent implements OnInit { - @Output() search: EventEmitter = new EventEmitter() + @Input() queryRunning: boolean = true; + @Output() search: EventEmitter = new EventEmitter(); - model = new PcapRequest() + model = new PcapRequest(); constructor() { } diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-packet-line/pcap-packet-line.component.html b/metron-interface/metron-alerts/src/app/pcap/pcap-packet-line/pcap-packet-line.component.html index a14a9f5f29..072dcc2f22 100644 --- a/metron-interface/metron-alerts/src/app/pcap/pcap-packet-line/pcap-packet-line.component.html +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-packet-line/pcap-packet-line.component.html @@ -1,6 +1,6 @@ -{{ip.timestamp.$.value}} {{ip.timestamp.$.show}} -{{ip.ip_src_addr.$.show}} -{{ip.ip_src_port.$.show}} -{{ip.ip_dest_addr.$.show}} -{{ip.ip_dest_port.$.show}} -{{ip.protocol.$.showname}} +{{ip.timestamp.value}} {{ip.timestamp.show}} +{{ip.ip_src_addr.show}} +{{ip.ip_src_port.show}} +{{ip.ip_dest_addr.show}} +{{ip.ip_dest_port.show}} +{{ip.protocol.showname}} diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-packet-line/pcap-packet-line.component.ts b/metron-interface/metron-alerts/src/app/pcap/pcap-packet-line/pcap-packet-line.component.ts index 35732645c2..318b655800 100644 --- a/metron-interface/metron-alerts/src/app/pcap/pcap-packet-line/pcap-packet-line.component.ts +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-packet-line/pcap-packet-line.component.ts @@ -20,9 +20,9 @@ export class PcapPacketLineComponent implements OnInit { constructor() { } ngOnInit() { - let gen_proto: PdmlProto = this.packet.proto.filter(p => p['$'].name == "geninfo")[0] - let ip_proto: PdmlProto = this.packet.proto.filter(p => p['$'].name == "ip")[0] - let tcp_proto: PdmlProto = this.packet.proto.filter(p => p['$'].name == "tcp")[0] + let gen_proto: PdmlProto = this.packet.protos.filter(p => p.name == "geninfo")[0] + let ip_proto: PdmlProto = this.packet.protos.filter(p => p.name == "ip")[0] + let tcp_proto: PdmlProto = this.packet.protos.filter(p => p.name == "tcp")[0] this.ip = { timestamp: PdmlProto.findField(gen_proto,'timestamp'), diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-packet/pcap-packet.component.html b/metron-interface/metron-alerts/src/app/pcap/pcap-packet/pcap-packet.component.html index d9263445c0..2f9ac52b3c 100644 --- a/metron-interface/metron-alerts/src/app/pcap/pcap-packet/pcap-packet.component.html +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-packet/pcap-packet.component.html @@ -1,8 +1,8 @@ -
-
{{ proto['$'].showname }}
+
+
{{ proto.showname }}
-
- {{ field['$'].name}} {{ field['$'].showname}} +
+ {{ field.name}} {{ field.showname}}
diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-packet/pcap-packet.component.scss b/metron-interface/metron-alerts/src/app/pcap/pcap-packet/pcap-packet.component.scss index 287cbf95c6..85786ade04 100644 --- a/metron-interface/metron-alerts/src/app/pcap/pcap-packet/pcap-packet.component.scss +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-packet/pcap-packet.component.scss @@ -9,6 +9,10 @@ margin-left: 1em; } +.proto-fields { + margin-left: 1em; +} + .field-name { display: none diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-panel/pcap-panel.component.html b/metron-interface/metron-alerts/src/app/pcap/pcap-panel/pcap-panel.component.html index 02b6c7868f..77a896d799 100644 --- a/metron-interface/metron-alerts/src/app/pcap/pcap-panel/pcap-panel.component.html +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-panel/pcap-panel.component.html @@ -1,8 +1,26 @@
- +
+ + + + + + + + + + + + + + +
+
{{progressWidth}}%
+
- +
+
diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-panel/pcap-panel.component.scss b/metron-interface/metron-alerts/src/app/pcap/pcap-panel/pcap-panel.component.scss index e69de29bb2..3656d091d1 100644 --- a/metron-interface/metron-alerts/src/app/pcap/pcap-panel/pcap-panel.component.scss +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-panel/pcap-panel.component.scss @@ -0,0 +1,35 @@ +@import "../../../vendor.scss"; +@import "../../../styles.scss"; +@import "../../../variables.scss"; + +.pcap-progress-background { + background-color: #2E2E2E; +} + +.pcap-progress { + background-color: #0F6F9E; + transition-duration:2s; + animation-duration: 2s; +} + +.progress-bar { + width: 0; + animation: progress 1.5s ease-in-out forwards; +} + +@keyframes progress { + from { + width: 0; + } + to { + width: 100%; + } +} +@keyframes show { + from { + opacity: 0; + } + to { + opacity: 1; + } +} \ No newline at end of file diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-panel/pcap-panel.component.ts b/metron-interface/metron-alerts/src/app/pcap/pcap-panel/pcap-panel.component.ts index 31f9bd6960..805a7cc595 100644 --- a/metron-interface/metron-alerts/src/app/pcap/pcap-panel/pcap-panel.component.ts +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-panel/pcap-panel.component.ts @@ -3,6 +3,7 @@ import { Component, OnInit, Input } from '@angular/core'; import { PcapService } from '../service/pcap.service' import { PcapRequest } from '../model/pcap.request' import { Pdml } from '../model/pdml' +import {Subscription} from "rxjs/Rx"; @Component({ selector: 'app-pcap-panel', @@ -11,22 +12,51 @@ import { Pdml } from '../model/pdml' }) export class PcapPanelComponent implements OnInit { - @Input() pdml: Pdml = null + @Input() pdml: Pdml = null; - @Input() search: PcapRequest + @Input() pcapRequest: PcapRequest; + + private statusSubscription: Subscription; + private queryRunning: boolean = false; + private progressWidth: number = 0; - constructor(private pcap: PcapService ) { } + constructor(private pcapService: PcapService ) { } ngOnInit() { } - - onSearch(search) { - this.pcap.getPackets(search).subscribe(response => this.pdml = response) + + onSearch(pcapRequest) { + console.log(pcapRequest); + this.pdml = null; + this.progressWidth = 0; + this.pcapService.submitRequest(pcapRequest).subscribe(id => { + this.queryRunning = true; + this.statusSubscription = this.pcapService.pollStatus(id).subscribe(status => { + //console.log(this.statusSubscription.closed); + if (this.progressWidth == 100) { + //this.progressWidth = 0; + } else { + this.progressWidth += 5; + } + if ('Finished' === status) { + this.statusSubscription.unsubscribe(); + console.log(this.statusSubscription.closed); + this.queryRunning = false; + this.pcapService.getPackets(id).subscribe(pdml => { + this.pdml = pdml; + }) + } + }); + }); + + // this.pcapService.getTestPackets(this.pcapRequest).subscribe(response => { + // this.pdml = response + // }); } - test() { - console.log('test') - this.pcap.getTestPackets(this.search).subscribe(response => { + test(pcapRequest) { + console.log(pcapRequest); + this.pcapService.getTestPackets(this.pcapRequest).subscribe(response => { this.pdml = response }) } diff --git a/metron-interface/metron-alerts/src/app/pcap/service/pcap.service.ts b/metron-interface/metron-alerts/src/app/pcap/service/pcap.service.ts index 44024bea2a..a6726abc5d 100644 --- a/metron-interface/metron-alerts/src/app/pcap/service/pcap.service.ts +++ b/metron-interface/metron-alerts/src/app/pcap/service/pcap.service.ts @@ -1,36 +1,7228 @@ -import { Injectable } from '@angular/core'; -import { Observable, Subject } from 'rxjs/Rx'; -import { Http, Headers, RequestOptions, Response } from '@angular/http'; -import { HttpUtil } from '../../utils/httpUtil'; +import {Injectable, NgZone} from '@angular/core'; +import {Observable, Subject} from 'rxjs/Rx'; +import {Http, Headers, RequestOptions, Response} from '@angular/http'; +import {HttpUtil} from '../../utils/httpUtil'; import 'rxjs/add/operator/map'; -import { PcapRequest } from '../model/pcap.request'; -import { Pdml } from '../model/pdml' +import {PcapRequest} from '../model/pcap.request'; +import {Pdml} from '../model/pdml' @Injectable() export class PcapService { - constructor(private http: Http) { - } + private statusInterval = 4; + defaultHeaders = {'Content-Type': 'application/json', 'X-Requested-With': 'XMLHttpRequest'}; - public getPackets(request: PcapRequest): Observable { - console.log(request) - return this.http.get('/api/v1/pcap', new RequestOptions({ - params: request - })).map(r => r.json()).catch(HttpUtil.handleError) - } - - public getTestPackets(request: PcapRequest): Observable { - return Observable.create((o) => o.next(JSON.parse(pdml_json()))) - } -} + constructor(private http: Http, private ngZone: NgZone) { + } + + public pollStatus(id: string): Observable { + return this.ngZone.runOutsideAngular(() => { + return this.ngZone.run(() => { + return Observable.interval(this.statusInterval * 1000).switchMap(() => { + return this.getStatus(id); + }); + }); + }); + } + + public submitRequest(pcapRequest: PcapRequest): Observable { + return this.http.post('/api/v1/pcap/pcapqueryfilterasync/submit', pcapRequest, new RequestOptions({headers: new Headers(this.defaultHeaders)})) + .map(HttpUtil.extractString) + .catch(HttpUtil.handleError) + .onErrorResumeNext(); + } + + public getStatus(id: string): Observable { + return this.http.get('/api/v1/pcap/pcapqueryfilterasync/status?idQuery=' + id, + new RequestOptions({headers: new Headers(this.defaultHeaders)})) + .map(HttpUtil.extractString) + .catch(HttpUtil.handleError) + } + + public getPackets(id: string): Observable { + return this.http.get('/api/v1/pcap/pcapqueryfilterasync/resultJson?idQuery=' + id, new RequestOptions({headers: new Headers(this.defaultHeaders)})) + .map(HttpUtil.extractData) + .catch(HttpUtil.handleError) + .onErrorResumeNext(); + } + public getTestPackets(request: PcapRequest): Observable { + return Observable.create((o) => o.next(JSON.parse(pdml_json2()))) + } +} +function pdml_json2() { + return `{ + "version": "0", + "creator": "wireshark/1.8.10", + "time": "Thu Apr 12 19:41:33 2018", + "capture_file": "/tmp/pcapQuery_116205077406675/pcap-data-201804121940-9d557e044ec6445aa395414feceba2f3+0001.pcap", + "packets": [ + { + "protos": [ + { + "name": "geninfo", + "pos": "0", + "showname": "General information", + "size": "66", + "hide": null, + "fields": [ + { + "name": "num", + "pos": "0", + "showname": "Number", + "size": "66", + "value": "1", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "len", + "pos": "0", + "showname": "Frame Length", + "size": "66", + "value": "42", + "show": "66", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "caplen", + "pos": "0", + "showname": "Captured Length", + "size": "66", + "value": "42", + "show": "66", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "timestamp", + "pos": "0", + "showname": "Captured Time", + "size": "66", + "value": "1522244608.113998000", + "show": "Mar 28, 2018 13:43:28.113998000 UTC", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ] + }, + { + "name": "frame", + "pos": "0", + "showname": "Frame 1: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)", + "size": "66", + "hide": null, + "fields": [ + { + "name": "frame.dlt", + "pos": "0", + "showname": "WTAP_ENCAP: 1", + "size": "0", + "value": null, + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time", + "pos": "0", + "showname": "Arrival Time: Mar 28, 2018 13:43:28.113998000 UTC", + "size": "0", + "value": null, + "show": "Mar 28, 2018 13:43:28.113998000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.offset_shift", + "pos": "0", + "showname": "Time shift for this packet: 0.000000000 seconds", + "size": "0", + "value": null, + "show": "0.000000000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time_epoch", + "pos": "0", + "showname": "Epoch Time: 1522244608.113998000 seconds", + "size": "0", + "value": null, + "show": "1522244608.113998000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time_delta", + "pos": "0", + "showname": "Time delta from previous captured frame: 0.000000000 seconds", + "size": "0", + "value": null, + "show": "0.000000000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time_delta_displayed", + "pos": "0", + "showname": "Time delta from previous displayed frame: 0.000000000 seconds", + "size": "0", + "value": null, + "show": "0.000000000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time_relative", + "pos": "0", + "showname": "Time since reference or first frame: 0.000000000 seconds", + "size": "0", + "value": null, + "show": "0.000000000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.number", + "pos": "0", + "showname": "Frame Number: 1", + "size": "0", + "value": null, + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.len", + "pos": "0", + "showname": "Frame Length: 66 bytes (528 bits)", + "size": "0", + "value": null, + "show": "66", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.cap_len", + "pos": "0", + "showname": "Capture Length: 66 bytes (528 bits)", + "size": "0", + "value": null, + "show": "66", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.marked", + "pos": "0", + "showname": "Frame is marked: False", + "size": "0", + "value": null, + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.ignored", + "pos": "0", + "showname": "Frame is ignored: False", + "size": "0", + "value": null, + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.protocols", + "pos": "0", + "showname": "Protocols in frame: eth:ip:tcp", + "size": "0", + "value": null, + "show": "eth:ip:tcp", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ] + }, + { + "name": "eth", + "pos": "0", + "showname": "Ethernet II, Src: Cisco_5b:e8:c1 (84:78:ac:5b:e8:c1), Dst: fa:16:3e:04:cd:37 (fa:16:3e:04:cd:37)", + "size": "14", + "hide": null, + "fields": [ + { + "name": "eth.dst", + "pos": "0", + "showname": "Destination: fa:16:3e:04:cd:37 (fa:16:3e:04:cd:37)", + "size": "6", + "value": "fa163e04cd37", + "show": "fa:16:3e:04:cd:37", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "eth.addr", + "pos": "0", + "showname": "Address: fa:16:3e:04:cd:37 (fa:16:3e:04:cd:37)", + "size": "6", + "value": "fa163e04cd37", + "show": "fa:16:3e:04:cd:37", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "eth.lg", + "pos": "0", + "showname": ".... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)", + "size": "3", + "value": "1", + "show": "1", + "unmaskedvalue": "fa163e", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "eth.ig", + "pos": "0", + "showname": ".... ...0 .... .... .... .... = IG bit: Individual address (unicast)", + "size": "3", + "value": "0", + "show": "0", + "unmaskedvalue": "fa163e", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "eth.src", + "pos": "6", + "showname": "Source: Cisco_5b:e8:c1 (84:78:ac:5b:e8:c1)", + "size": "6", + "value": "8478ac5be8c1", + "show": "84:78:ac:5b:e8:c1", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "eth.addr", + "pos": "6", + "showname": "Address: Cisco_5b:e8:c1 (84:78:ac:5b:e8:c1)", + "size": "6", + "value": "8478ac5be8c1", + "show": "84:78:ac:5b:e8:c1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "eth.lg", + "pos": "6", + "showname": ".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)", + "size": "3", + "value": "0", + "show": "0", + "unmaskedvalue": "8478ac", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "eth.ig", + "pos": "6", + "showname": ".... ...0 .... .... .... .... = IG bit: Individual address (unicast)", + "size": "3", + "value": "0", + "show": "0", + "unmaskedvalue": "8478ac", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "eth.type", + "pos": "12", + "showname": "Type: IP (0x0800)", + "size": "2", + "value": "0800", + "show": "0x0800", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ] + }, + { + "name": "ip", + "pos": "14", + "showname": "Internet Protocol Version 4, Src: 10.200.10.172 (10.200.10.172), Dst: 172.26.215.106 (172.26.215.106)", + "size": "20", + "hide": null, + "fields": [ + { + "name": "ip.version", + "pos": "14", + "showname": "Version: 4", + "size": "1", + "value": "45", + "show": "4", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.hdr_len", + "pos": "14", + "showname": "Header length: 20 bytes", + "size": "1", + "value": "45", + "show": "20", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.dsfield", + "pos": "15", + "showname": "Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))", + "size": "1", + "value": "00", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.dsfield.dscp", + "pos": "15", + "showname": "0000 00.. = Differentiated Services Codepoint: Default (0x00)", + "size": "1", + "value": "0", + "show": "0x00", + "unmaskedvalue": "00", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.dsfield.ecn", + "pos": "15", + "showname": ".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)", + "size": "1", + "value": "0", + "show": "0x00", + "unmaskedvalue": "00", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "ip.len", + "pos": "16", + "showname": "Total Length: 52", + "size": "2", + "value": "0034", + "show": "52", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.id", + "pos": "18", + "showname": "Identification: 0x0000 (0)", + "size": "2", + "value": "0000", + "show": "0x0000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.flags", + "pos": "20", + "showname": "Flags: 0x02 (Don't Fragment)", + "size": "1", + "value": "40", + "show": "0x02", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.flags.rb", + "pos": "20", + "showname": "0... .... = Reserved bit: Not set", + "size": "1", + "value": "40", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.flags.df", + "pos": "20", + "showname": ".1.. .... = Don't fragment: Set", + "size": "1", + "value": "40", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.flags.mf", + "pos": "20", + "showname": "..0. .... = More fragments: Not set", + "size": "1", + "value": "40", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "ip.frag_offset", + "pos": "20", + "showname": "Fragment offset: 0", + "size": "2", + "value": "4000", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.ttl", + "pos": "22", + "showname": "Time to live: 62", + "size": "1", + "value": "3e", + "show": "62", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.proto", + "pos": "23", + "showname": "Protocol: TCP (6)", + "size": "1", + "value": "06", + "show": "6", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.checksum", + "pos": "24", + "showname": "Header checksum: 0xa3cb [correct]", + "size": "2", + "value": "a3cb", + "show": "0xa3cb", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.checksum_good", + "pos": "24", + "showname": "Good: True", + "size": "2", + "value": "a3cb", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.checksum_bad", + "pos": "24", + "showname": "Bad: False", + "size": "2", + "value": "a3cb", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "ip.src", + "pos": "26", + "showname": "Source: 10.200.10.172 (10.200.10.172)", + "size": "4", + "value": "0ac80aac", + "show": "10.200.10.172", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.addr", + "pos": "26", + "showname": "Source or Destination Address: 10.200.10.172 (10.200.10.172)", + "size": "4", + "value": "0ac80aac", + "show": "10.200.10.172", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.src_host", + "pos": "26", + "showname": "Source Host: 10.200.10.172", + "size": "4", + "value": "0ac80aac", + "show": "10.200.10.172", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.host", + "pos": "26", + "showname": "Source or Destination Host: 10.200.10.172", + "size": "4", + "value": "0ac80aac", + "show": "10.200.10.172", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.dst", + "pos": "30", + "showname": "Destination: 172.26.215.106 (172.26.215.106)", + "size": "4", + "value": "ac1ad76a", + "show": "172.26.215.106", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.addr", + "pos": "30", + "showname": "Source or Destination Address: 172.26.215.106 (172.26.215.106)", + "size": "4", + "value": "ac1ad76a", + "show": "172.26.215.106", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.dst_host", + "pos": "30", + "showname": "Destination Host: 172.26.215.106", + "size": "4", + "value": "ac1ad76a", + "show": "172.26.215.106", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.host", + "pos": "30", + "showname": "Source or Destination Host: 172.26.215.106", + "size": "4", + "value": "ac1ad76a", + "show": "172.26.215.106", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + } + ] + }, + { + "name": "tcp", + "pos": "34", + "showname": "Transmission Control Protocol, Src Port: 52834 (52834), Dst Port: ssh (22), Seq: 1, Ack: 1, Len: 0", + "size": "32", + "hide": null, + "fields": [ + { + "name": "tcp.srcport", + "pos": "34", + "showname": "Source port: 52834 (52834)", + "size": "2", + "value": "ce62", + "show": "52834", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.dstport", + "pos": "36", + "showname": "Destination port: ssh (22)", + "size": "2", + "value": "0016", + "show": "22", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.port", + "pos": "34", + "showname": "Source or Destination Port: 52834", + "size": "2", + "value": "ce62", + "show": "52834", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "tcp.port", + "pos": "36", + "showname": "Source or Destination Port: 22", + "size": "2", + "value": "0016", + "show": "22", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "tcp.stream", + "pos": "34", + "showname": "Stream index: 0", + "size": "0", + "value": null, + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.len", + "pos": "46", + "showname": "TCP Segment Len: 0", + "size": "1", + "value": "80", + "show": "0", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "tcp.seq", + "pos": "38", + "showname": "Sequence number: 1 (relative sequence number)", + "size": "4", + "value": "3e7a345c", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.ack", + "pos": "42", + "showname": "Acknowledgment number: 1 (relative ack number)", + "size": "4", + "value": "342f6f2e", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.hdr_len", + "pos": "46", + "showname": "Header length: 32 bytes", + "size": "1", + "value": "80", + "show": "32", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags", + "pos": "46", + "showname": "Flags: 0x010 (ACK)", + "size": "2", + "value": "10", + "show": "0x0010", + "unmaskedvalue": "8010", + "hide": null, + "fields": [ + { + "name": "tcp.flags.res", + "pos": "46", + "showname": "000. .... .... = Reserved: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "80", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.ns", + "pos": "46", + "showname": "...0 .... .... = Nonce: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "80", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.cwr", + "pos": "47", + "showname": ".... 0... .... = Congestion Window Reduced (CWR): Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.ecn", + "pos": "47", + "showname": ".... .0.. .... = ECN-Echo: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.urg", + "pos": "47", + "showname": ".... ..0. .... = Urgent: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.ack", + "pos": "47", + "showname": ".... ...1 .... = Acknowledgment: Set", + "size": "1", + "value": "1", + "show": "1", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.push", + "pos": "47", + "showname": ".... .... 0... = Push: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.reset", + "pos": "47", + "showname": ".... .... .0.. = Reset: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.syn", + "pos": "47", + "showname": ".... .... ..0. = Syn: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.fin", + "pos": "47", + "showname": ".... .... ...0 = Fin: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "tcp.window_size_value", + "pos": "48", + "showname": "Window size value: 4094", + "size": "2", + "value": "0ffe", + "show": "4094", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.window_size", + "pos": "48", + "showname": "Calculated window size: 4094", + "size": "2", + "value": "0ffe", + "show": "4094", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.window_size_scalefactor", + "pos": "48", + "showname": "Window size scaling factor: -1 (unknown)", + "size": "2", + "value": "0ffe", + "show": "-1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.checksum", + "pos": "50", + "showname": "Checksum: 0xf22c [validation disabled]", + "size": "2", + "value": "f22c", + "show": "0xf22c", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "tcp.checksum_good", + "pos": "50", + "showname": "Good Checksum: False", + "size": "2", + "value": "f22c", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.checksum_bad", + "pos": "50", + "showname": "Bad Checksum: False", + "size": "2", + "value": "f22c", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "tcp.options", + "pos": "54", + "showname": "Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps", + "size": "12", + "value": "0101080a1ec843d604758fd9", + "show": "01:01:08:0a:1e:c8:43:d6:04:75:8f:d9", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "", + "pos": "54", + "showname": null, + "size": "1", + "value": "01", + "show": "No-Operation (NOP)", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.opt.type", + "pos": "54", + "showname": "Type: 1", + "size": "1", + "value": "01", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.opt.type.copy", + "pos": "54", + "showname": "0... .... = Copy on fragmentation: No", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.opt.type.class", + "pos": "54", + "showname": ".00. .... = Class: Control (0)", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.opt.type.number", + "pos": "54", + "showname": "...0 0001 = Number: No-Operation (NOP) (1)", + "size": "1", + "value": "1", + "show": "1", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + } + ], + "protos": null + }, + { + "name": "", + "pos": "55", + "showname": null, + "size": "1", + "value": "01", + "show": "No-Operation (NOP)", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.opt.type", + "pos": "55", + "showname": "Type: 1", + "size": "1", + "value": "01", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.opt.type.copy", + "pos": "55", + "showname": "0... .... = Copy on fragmentation: No", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.opt.type.class", + "pos": "55", + "showname": ".00. .... = Class: Control (0)", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.opt.type.number", + "pos": "55", + "showname": "...0 0001 = Number: No-Operation (NOP) (1)", + "size": "1", + "value": "1", + "show": "1", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + } + ], + "protos": null + }, + { + "name": "", + "pos": "56", + "showname": null, + "size": "10", + "value": "080a1ec843d604758fd9", + "show": "Timestamps: TSval 516441046, TSecr 74813401", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "tcp.option_kind", + "pos": "56", + "showname": "Kind: Timestamp (8)", + "size": "1", + "value": "08", + "show": "8", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.option_len", + "pos": "57", + "showname": "Length: 10", + "size": "1", + "value": "0a", + "show": "10", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.options.timestamp.tsval", + "pos": "58", + "showname": "Timestamp value: 516441046", + "size": "4", + "value": "1ec843d6", + "show": "516441046", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.options.timestamp.tsecr", + "pos": "62", + "showname": "Timestamp echo reply: 74813401", + "size": "4", + "value": "04758fd9", + "show": "74813401", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + } + ], + "protos": null + } + ] + } + ] + }, + { + "protos": [ + { + "name": "geninfo", + "pos": "0", + "showname": "General information", + "size": "66", + "hide": null, + "fields": [ + { + "name": "num", + "pos": "0", + "showname": "Number", + "size": "66", + "value": "2", + "show": "2", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "len", + "pos": "0", + "showname": "Frame Length", + "size": "66", + "value": "42", + "show": "66", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "caplen", + "pos": "0", + "showname": "Captured Length", + "size": "66", + "value": "42", + "show": "66", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "timestamp", + "pos": "0", + "showname": "Captured Time", + "size": "66", + "value": "1522244608.165212000", + "show": "Mar 28, 2018 13:43:28.165212000 UTC", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ] + }, + { + "name": "frame", + "pos": "0", + "showname": "Frame 2: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)", + "size": "66", + "hide": null, + "fields": [ + { + "name": "frame.dlt", + "pos": "0", + "showname": "WTAP_ENCAP: 1", + "size": "0", + "value": null, + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time", + "pos": "0", + "showname": "Arrival Time: Mar 28, 2018 13:43:28.165212000 UTC", + "size": "0", + "value": null, + "show": "Mar 28, 2018 13:43:28.165212000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.offset_shift", + "pos": "0", + "showname": "Time shift for this packet: 0.000000000 seconds", + "size": "0", + "value": null, + "show": "0.000000000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time_epoch", + "pos": "0", + "showname": "Epoch Time: 1522244608.165212000 seconds", + "size": "0", + "value": null, + "show": "1522244608.165212000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time_delta", + "pos": "0", + "showname": "Time delta from previous captured frame: 0.051214000 seconds", + "size": "0", + "value": null, + "show": "0.051214000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time_delta_displayed", + "pos": "0", + "showname": "Time delta from previous displayed frame: 0.051214000 seconds", + "size": "0", + "value": null, + "show": "0.051214000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time_relative", + "pos": "0", + "showname": "Time since reference or first frame: 0.051214000 seconds", + "size": "0", + "value": null, + "show": "0.051214000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.number", + "pos": "0", + "showname": "Frame Number: 2", + "size": "0", + "value": null, + "show": "2", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.len", + "pos": "0", + "showname": "Frame Length: 66 bytes (528 bits)", + "size": "0", + "value": null, + "show": "66", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.cap_len", + "pos": "0", + "showname": "Capture Length: 66 bytes (528 bits)", + "size": "0", + "value": null, + "show": "66", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.marked", + "pos": "0", + "showname": "Frame is marked: False", + "size": "0", + "value": null, + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.ignored", + "pos": "0", + "showname": "Frame is ignored: False", + "size": "0", + "value": null, + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.protocols", + "pos": "0", + "showname": "Protocols in frame: eth:ip:tcp", + "size": "0", + "value": null, + "show": "eth:ip:tcp", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ] + }, + { + "name": "eth", + "pos": "0", + "showname": "Ethernet II, Src: Cisco_5b:e8:c1 (84:78:ac:5b:e8:c1), Dst: fa:16:3e:04:cd:37 (fa:16:3e:04:cd:37)", + "size": "14", + "hide": null, + "fields": [ + { + "name": "eth.dst", + "pos": "0", + "showname": "Destination: fa:16:3e:04:cd:37 (fa:16:3e:04:cd:37)", + "size": "6", + "value": "fa163e04cd37", + "show": "fa:16:3e:04:cd:37", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "eth.addr", + "pos": "0", + "showname": "Address: fa:16:3e:04:cd:37 (fa:16:3e:04:cd:37)", + "size": "6", + "value": "fa163e04cd37", + "show": "fa:16:3e:04:cd:37", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "eth.lg", + "pos": "0", + "showname": ".... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)", + "size": "3", + "value": "1", + "show": "1", + "unmaskedvalue": "fa163e", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "eth.ig", + "pos": "0", + "showname": ".... ...0 .... .... .... .... = IG bit: Individual address (unicast)", + "size": "3", + "value": "0", + "show": "0", + "unmaskedvalue": "fa163e", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "eth.src", + "pos": "6", + "showname": "Source: Cisco_5b:e8:c1 (84:78:ac:5b:e8:c1)", + "size": "6", + "value": "8478ac5be8c1", + "show": "84:78:ac:5b:e8:c1", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "eth.addr", + "pos": "6", + "showname": "Address: Cisco_5b:e8:c1 (84:78:ac:5b:e8:c1)", + "size": "6", + "value": "8478ac5be8c1", + "show": "84:78:ac:5b:e8:c1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "eth.lg", + "pos": "6", + "showname": ".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)", + "size": "3", + "value": "0", + "show": "0", + "unmaskedvalue": "8478ac", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "eth.ig", + "pos": "6", + "showname": ".... ...0 .... .... .... .... = IG bit: Individual address (unicast)", + "size": "3", + "value": "0", + "show": "0", + "unmaskedvalue": "8478ac", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "eth.type", + "pos": "12", + "showname": "Type: IP (0x0800)", + "size": "2", + "value": "0800", + "show": "0x0800", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ] + }, + { + "name": "ip", + "pos": "14", + "showname": "Internet Protocol Version 4, Src: 10.200.10.172 (10.200.10.172), Dst: 172.26.215.106 (172.26.215.106)", + "size": "20", + "hide": null, + "fields": [ + { + "name": "ip.version", + "pos": "14", + "showname": "Version: 4", + "size": "1", + "value": "45", + "show": "4", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.hdr_len", + "pos": "14", + "showname": "Header length: 20 bytes", + "size": "1", + "value": "45", + "show": "20", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.dsfield", + "pos": "15", + "showname": "Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))", + "size": "1", + "value": "00", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.dsfield.dscp", + "pos": "15", + "showname": "0000 00.. = Differentiated Services Codepoint: Default (0x00)", + "size": "1", + "value": "0", + "show": "0x00", + "unmaskedvalue": "00", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.dsfield.ecn", + "pos": "15", + "showname": ".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)", + "size": "1", + "value": "0", + "show": "0x00", + "unmaskedvalue": "00", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "ip.len", + "pos": "16", + "showname": "Total Length: 52", + "size": "2", + "value": "0034", + "show": "52", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.id", + "pos": "18", + "showname": "Identification: 0x0000 (0)", + "size": "2", + "value": "0000", + "show": "0x0000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.flags", + "pos": "20", + "showname": "Flags: 0x02 (Don't Fragment)", + "size": "1", + "value": "40", + "show": "0x02", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.flags.rb", + "pos": "20", + "showname": "0... .... = Reserved bit: Not set", + "size": "1", + "value": "40", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.flags.df", + "pos": "20", + "showname": ".1.. .... = Don't fragment: Set", + "size": "1", + "value": "40", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.flags.mf", + "pos": "20", + "showname": "..0. .... = More fragments: Not set", + "size": "1", + "value": "40", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "ip.frag_offset", + "pos": "20", + "showname": "Fragment offset: 0", + "size": "2", + "value": "4000", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.ttl", + "pos": "22", + "showname": "Time to live: 62", + "size": "1", + "value": "3e", + "show": "62", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.proto", + "pos": "23", + "showname": "Protocol: TCP (6)", + "size": "1", + "value": "06", + "show": "6", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.checksum", + "pos": "24", + "showname": "Header checksum: 0xa3cb [correct]", + "size": "2", + "value": "a3cb", + "show": "0xa3cb", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.checksum_good", + "pos": "24", + "showname": "Good: True", + "size": "2", + "value": "a3cb", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.checksum_bad", + "pos": "24", + "showname": "Bad: False", + "size": "2", + "value": "a3cb", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "ip.src", + "pos": "26", + "showname": "Source: 10.200.10.172 (10.200.10.172)", + "size": "4", + "value": "0ac80aac", + "show": "10.200.10.172", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.addr", + "pos": "26", + "showname": "Source or Destination Address: 10.200.10.172 (10.200.10.172)", + "size": "4", + "value": "0ac80aac", + "show": "10.200.10.172", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.src_host", + "pos": "26", + "showname": "Source Host: 10.200.10.172", + "size": "4", + "value": "0ac80aac", + "show": "10.200.10.172", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.host", + "pos": "26", + "showname": "Source or Destination Host: 10.200.10.172", + "size": "4", + "value": "0ac80aac", + "show": "10.200.10.172", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.dst", + "pos": "30", + "showname": "Destination: 172.26.215.106 (172.26.215.106)", + "size": "4", + "value": "ac1ad76a", + "show": "172.26.215.106", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.addr", + "pos": "30", + "showname": "Source or Destination Address: 172.26.215.106 (172.26.215.106)", + "size": "4", + "value": "ac1ad76a", + "show": "172.26.215.106", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.dst_host", + "pos": "30", + "showname": "Destination Host: 172.26.215.106", + "size": "4", + "value": "ac1ad76a", + "show": "172.26.215.106", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.host", + "pos": "30", + "showname": "Source or Destination Host: 172.26.215.106", + "size": "4", + "value": "ac1ad76a", + "show": "172.26.215.106", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + } + ] + }, + { + "name": "tcp", + "pos": "34", + "showname": "Transmission Control Protocol, Src Port: 52834 (52834), Dst Port: ssh (22), Seq: 1, Ack: 165, Len: 0", + "size": "32", + "hide": null, + "fields": [ + { + "name": "tcp.srcport", + "pos": "34", + "showname": "Source port: 52834 (52834)", + "size": "2", + "value": "ce62", + "show": "52834", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.dstport", + "pos": "36", + "showname": "Destination port: ssh (22)", + "size": "2", + "value": "0016", + "show": "22", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.port", + "pos": "34", + "showname": "Source or Destination Port: 52834", + "size": "2", + "value": "ce62", + "show": "52834", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "tcp.port", + "pos": "36", + "showname": "Source or Destination Port: 22", + "size": "2", + "value": "0016", + "show": "22", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "tcp.stream", + "pos": "34", + "showname": "Stream index: 0", + "size": "0", + "value": null, + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.len", + "pos": "46", + "showname": "TCP Segment Len: 0", + "size": "1", + "value": "80", + "show": "0", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "tcp.seq", + "pos": "38", + "showname": "Sequence number: 1 (relative sequence number)", + "size": "4", + "value": "3e7a345c", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.ack", + "pos": "42", + "showname": "Acknowledgment number: 165 (relative ack number)", + "size": "4", + "value": "342f6fd2", + "show": "165", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.hdr_len", + "pos": "46", + "showname": "Header length: 32 bytes", + "size": "1", + "value": "80", + "show": "32", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags", + "pos": "46", + "showname": "Flags: 0x010 (ACK)", + "size": "2", + "value": "10", + "show": "0x0010", + "unmaskedvalue": "8010", + "hide": null, + "fields": [ + { + "name": "tcp.flags.res", + "pos": "46", + "showname": "000. .... .... = Reserved: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "80", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.ns", + "pos": "46", + "showname": "...0 .... .... = Nonce: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "80", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.cwr", + "pos": "47", + "showname": ".... 0... .... = Congestion Window Reduced (CWR): Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.ecn", + "pos": "47", + "showname": ".... .0.. .... = ECN-Echo: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.urg", + "pos": "47", + "showname": ".... ..0. .... = Urgent: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.ack", + "pos": "47", + "showname": ".... ...1 .... = Acknowledgment: Set", + "size": "1", + "value": "1", + "show": "1", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.push", + "pos": "47", + "showname": ".... .... 0... = Push: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.reset", + "pos": "47", + "showname": ".... .... .0.. = Reset: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.syn", + "pos": "47", + "showname": ".... .... ..0. = Syn: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.fin", + "pos": "47", + "showname": ".... .... ...0 = Fin: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "tcp.window_size_value", + "pos": "48", + "showname": "Window size value: 4090", + "size": "2", + "value": "0ffa", + "show": "4090", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.window_size", + "pos": "48", + "showname": "Calculated window size: 4090", + "size": "2", + "value": "0ffa", + "show": "4090", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.window_size_scalefactor", + "pos": "48", + "showname": "Window size scaling factor: -1 (unknown)", + "size": "2", + "value": "0ffa", + "show": "-1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.checksum", + "pos": "50", + "showname": "Checksum: 0xf127 [validation disabled]", + "size": "2", + "value": "f127", + "show": "0xf127", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "tcp.checksum_good", + "pos": "50", + "showname": "Good Checksum: False", + "size": "2", + "value": "f127", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.checksum_bad", + "pos": "50", + "showname": "Bad Checksum: False", + "size": "2", + "value": "f127", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "tcp.options", + "pos": "54", + "showname": "Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps", + "size": "12", + "value": "0101080a1ec844090475900b", + "show": "01:01:08:0a:1e:c8:44:09:04:75:90:0b", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "", + "pos": "54", + "showname": null, + "size": "1", + "value": "01", + "show": "No-Operation (NOP)", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.opt.type", + "pos": "54", + "showname": "Type: 1", + "size": "1", + "value": "01", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.opt.type.copy", + "pos": "54", + "showname": "0... .... = Copy on fragmentation: No", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.opt.type.class", + "pos": "54", + "showname": ".00. .... = Class: Control (0)", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.opt.type.number", + "pos": "54", + "showname": "...0 0001 = Number: No-Operation (NOP) (1)", + "size": "1", + "value": "1", + "show": "1", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + } + ], + "protos": null + }, + { + "name": "", + "pos": "55", + "showname": null, + "size": "1", + "value": "01", + "show": "No-Operation (NOP)", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.opt.type", + "pos": "55", + "showname": "Type: 1", + "size": "1", + "value": "01", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.opt.type.copy", + "pos": "55", + "showname": "0... .... = Copy on fragmentation: No", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.opt.type.class", + "pos": "55", + "showname": ".00. .... = Class: Control (0)", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.opt.type.number", + "pos": "55", + "showname": "...0 0001 = Number: No-Operation (NOP) (1)", + "size": "1", + "value": "1", + "show": "1", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + } + ], + "protos": null + }, + { + "name": "", + "pos": "56", + "showname": null, + "size": "10", + "value": "080a1ec844090475900b", + "show": "Timestamps: TSval 516441097, TSecr 74813451", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "tcp.option_kind", + "pos": "56", + "showname": "Kind: Timestamp (8)", + "size": "1", + "value": "08", + "show": "8", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.option_len", + "pos": "57", + "showname": "Length: 10", + "size": "1", + "value": "0a", + "show": "10", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.options.timestamp.tsval", + "pos": "58", + "showname": "Timestamp value: 516441097", + "size": "4", + "value": "1ec84409", + "show": "516441097", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.options.timestamp.tsecr", + "pos": "62", + "showname": "Timestamp echo reply: 74813451", + "size": "4", + "value": "0475900b", + "show": "74813451", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + } + ], + "protos": null + } + ] + } + ] + }, + { + "protos": [ + { + "name": "geninfo", + "pos": "0", + "showname": "General information", + "size": "66", + "hide": null, + "fields": [ + { + "name": "num", + "pos": "0", + "showname": "Number", + "size": "66", + "value": "3", + "show": "3", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "len", + "pos": "0", + "showname": "Frame Length", + "size": "66", + "value": "42", + "show": "66", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "caplen", + "pos": "0", + "showname": "Captured Length", + "size": "66", + "value": "42", + "show": "66", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "timestamp", + "pos": "0", + "showname": "Captured Time", + "size": "66", + "value": "1522244608.165282000", + "show": "Mar 28, 2018 13:43:28.165282000 UTC", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ] + }, + { + "name": "frame", + "pos": "0", + "showname": "Frame 3: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)", + "size": "66", + "hide": null, + "fields": [ + { + "name": "frame.dlt", + "pos": "0", + "showname": "WTAP_ENCAP: 1", + "size": "0", + "value": null, + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time", + "pos": "0", + "showname": "Arrival Time: Mar 28, 2018 13:43:28.165282000 UTC", + "size": "0", + "value": null, + "show": "Mar 28, 2018 13:43:28.165282000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.offset_shift", + "pos": "0", + "showname": "Time shift for this packet: 0.000000000 seconds", + "size": "0", + "value": null, + "show": "0.000000000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time_epoch", + "pos": "0", + "showname": "Epoch Time: 1522244608.165282000 seconds", + "size": "0", + "value": null, + "show": "1522244608.165282000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time_delta", + "pos": "0", + "showname": "Time delta from previous captured frame: 0.000070000 seconds", + "size": "0", + "value": null, + "show": "0.000070000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time_delta_displayed", + "pos": "0", + "showname": "Time delta from previous displayed frame: 0.000070000 seconds", + "size": "0", + "value": null, + "show": "0.000070000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time_relative", + "pos": "0", + "showname": "Time since reference or first frame: 0.051284000 seconds", + "size": "0", + "value": null, + "show": "0.051284000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.number", + "pos": "0", + "showname": "Frame Number: 3", + "size": "0", + "value": null, + "show": "3", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.len", + "pos": "0", + "showname": "Frame Length: 66 bytes (528 bits)", + "size": "0", + "value": null, + "show": "66", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.cap_len", + "pos": "0", + "showname": "Capture Length: 66 bytes (528 bits)", + "size": "0", + "value": null, + "show": "66", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.marked", + "pos": "0", + "showname": "Frame is marked: False", + "size": "0", + "value": null, + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.ignored", + "pos": "0", + "showname": "Frame is ignored: False", + "size": "0", + "value": null, + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.protocols", + "pos": "0", + "showname": "Protocols in frame: eth:ip:tcp", + "size": "0", + "value": null, + "show": "eth:ip:tcp", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ] + }, + { + "name": "eth", + "pos": "0", + "showname": "Ethernet II, Src: Cisco_5b:e8:c1 (84:78:ac:5b:e8:c1), Dst: fa:16:3e:04:cd:37 (fa:16:3e:04:cd:37)", + "size": "14", + "hide": null, + "fields": [ + { + "name": "eth.dst", + "pos": "0", + "showname": "Destination: fa:16:3e:04:cd:37 (fa:16:3e:04:cd:37)", + "size": "6", + "value": "fa163e04cd37", + "show": "fa:16:3e:04:cd:37", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "eth.addr", + "pos": "0", + "showname": "Address: fa:16:3e:04:cd:37 (fa:16:3e:04:cd:37)", + "size": "6", + "value": "fa163e04cd37", + "show": "fa:16:3e:04:cd:37", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "eth.lg", + "pos": "0", + "showname": ".... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)", + "size": "3", + "value": "1", + "show": "1", + "unmaskedvalue": "fa163e", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "eth.ig", + "pos": "0", + "showname": ".... ...0 .... .... .... .... = IG bit: Individual address (unicast)", + "size": "3", + "value": "0", + "show": "0", + "unmaskedvalue": "fa163e", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "eth.src", + "pos": "6", + "showname": "Source: Cisco_5b:e8:c1 (84:78:ac:5b:e8:c1)", + "size": "6", + "value": "8478ac5be8c1", + "show": "84:78:ac:5b:e8:c1", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "eth.addr", + "pos": "6", + "showname": "Address: Cisco_5b:e8:c1 (84:78:ac:5b:e8:c1)", + "size": "6", + "value": "8478ac5be8c1", + "show": "84:78:ac:5b:e8:c1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "eth.lg", + "pos": "6", + "showname": ".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)", + "size": "3", + "value": "0", + "show": "0", + "unmaskedvalue": "8478ac", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "eth.ig", + "pos": "6", + "showname": ".... ...0 .... .... .... .... = IG bit: Individual address (unicast)", + "size": "3", + "value": "0", + "show": "0", + "unmaskedvalue": "8478ac", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "eth.type", + "pos": "12", + "showname": "Type: IP (0x0800)", + "size": "2", + "value": "0800", + "show": "0x0800", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ] + }, + { + "name": "ip", + "pos": "14", + "showname": "Internet Protocol Version 4, Src: 10.200.10.172 (10.200.10.172), Dst: 172.26.215.106 (172.26.215.106)", + "size": "20", + "hide": null, + "fields": [ + { + "name": "ip.version", + "pos": "14", + "showname": "Version: 4", + "size": "1", + "value": "45", + "show": "4", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.hdr_len", + "pos": "14", + "showname": "Header length: 20 bytes", + "size": "1", + "value": "45", + "show": "20", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.dsfield", + "pos": "15", + "showname": "Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))", + "size": "1", + "value": "00", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.dsfield.dscp", + "pos": "15", + "showname": "0000 00.. = Differentiated Services Codepoint: Default (0x00)", + "size": "1", + "value": "0", + "show": "0x00", + "unmaskedvalue": "00", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.dsfield.ecn", + "pos": "15", + "showname": ".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)", + "size": "1", + "value": "0", + "show": "0x00", + "unmaskedvalue": "00", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "ip.len", + "pos": "16", + "showname": "Total Length: 52", + "size": "2", + "value": "0034", + "show": "52", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.id", + "pos": "18", + "showname": "Identification: 0x0000 (0)", + "size": "2", + "value": "0000", + "show": "0x0000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.flags", + "pos": "20", + "showname": "Flags: 0x02 (Don't Fragment)", + "size": "1", + "value": "40", + "show": "0x02", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.flags.rb", + "pos": "20", + "showname": "0... .... = Reserved bit: Not set", + "size": "1", + "value": "40", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.flags.df", + "pos": "20", + "showname": ".1.. .... = Don't fragment: Set", + "size": "1", + "value": "40", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.flags.mf", + "pos": "20", + "showname": "..0. .... = More fragments: Not set", + "size": "1", + "value": "40", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "ip.frag_offset", + "pos": "20", + "showname": "Fragment offset: 0", + "size": "2", + "value": "4000", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.ttl", + "pos": "22", + "showname": "Time to live: 62", + "size": "1", + "value": "3e", + "show": "62", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.proto", + "pos": "23", + "showname": "Protocol: TCP (6)", + "size": "1", + "value": "06", + "show": "6", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.checksum", + "pos": "24", + "showname": "Header checksum: 0xa3cb [correct]", + "size": "2", + "value": "a3cb", + "show": "0xa3cb", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.checksum_good", + "pos": "24", + "showname": "Good: True", + "size": "2", + "value": "a3cb", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.checksum_bad", + "pos": "24", + "showname": "Bad: False", + "size": "2", + "value": "a3cb", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "ip.src", + "pos": "26", + "showname": "Source: 10.200.10.172 (10.200.10.172)", + "size": "4", + "value": "0ac80aac", + "show": "10.200.10.172", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.addr", + "pos": "26", + "showname": "Source or Destination Address: 10.200.10.172 (10.200.10.172)", + "size": "4", + "value": "0ac80aac", + "show": "10.200.10.172", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.src_host", + "pos": "26", + "showname": "Source Host: 10.200.10.172", + "size": "4", + "value": "0ac80aac", + "show": "10.200.10.172", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.host", + "pos": "26", + "showname": "Source or Destination Host: 10.200.10.172", + "size": "4", + "value": "0ac80aac", + "show": "10.200.10.172", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.dst", + "pos": "30", + "showname": "Destination: 172.26.215.106 (172.26.215.106)", + "size": "4", + "value": "ac1ad76a", + "show": "172.26.215.106", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.addr", + "pos": "30", + "showname": "Source or Destination Address: 172.26.215.106 (172.26.215.106)", + "size": "4", + "value": "ac1ad76a", + "show": "172.26.215.106", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.dst_host", + "pos": "30", + "showname": "Destination Host: 172.26.215.106", + "size": "4", + "value": "ac1ad76a", + "show": "172.26.215.106", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.host", + "pos": "30", + "showname": "Source or Destination Host: 172.26.215.106", + "size": "4", + "value": "ac1ad76a", + "show": "172.26.215.106", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + } + ] + }, + { + "name": "tcp", + "pos": "34", + "showname": "Transmission Control Protocol, Src Port: 52834 (52834), Dst Port: ssh (22), Seq: 1, Ack: 241, Len: 0", + "size": "32", + "hide": null, + "fields": [ + { + "name": "tcp.srcport", + "pos": "34", + "showname": "Source port: 52834 (52834)", + "size": "2", + "value": "ce62", + "show": "52834", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.dstport", + "pos": "36", + "showname": "Destination port: ssh (22)", + "size": "2", + "value": "0016", + "show": "22", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.port", + "pos": "34", + "showname": "Source or Destination Port: 52834", + "size": "2", + "value": "ce62", + "show": "52834", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "tcp.port", + "pos": "36", + "showname": "Source or Destination Port: 22", + "size": "2", + "value": "0016", + "show": "22", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "tcp.stream", + "pos": "34", + "showname": "Stream index: 0", + "size": "0", + "value": null, + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.len", + "pos": "46", + "showname": "TCP Segment Len: 0", + "size": "1", + "value": "80", + "show": "0", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "tcp.seq", + "pos": "38", + "showname": "Sequence number: 1 (relative sequence number)", + "size": "4", + "value": "3e7a345c", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.ack", + "pos": "42", + "showname": "Acknowledgment number: 241 (relative ack number)", + "size": "4", + "value": "342f701e", + "show": "241", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.hdr_len", + "pos": "46", + "showname": "Header length: 32 bytes", + "size": "1", + "value": "80", + "show": "32", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags", + "pos": "46", + "showname": "Flags: 0x010 (ACK)", + "size": "2", + "value": "10", + "show": "0x0010", + "unmaskedvalue": "8010", + "hide": null, + "fields": [ + { + "name": "tcp.flags.res", + "pos": "46", + "showname": "000. .... .... = Reserved: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "80", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.ns", + "pos": "46", + "showname": "...0 .... .... = Nonce: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "80", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.cwr", + "pos": "47", + "showname": ".... 0... .... = Congestion Window Reduced (CWR): Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.ecn", + "pos": "47", + "showname": ".... .0.. .... = ECN-Echo: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.urg", + "pos": "47", + "showname": ".... ..0. .... = Urgent: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.ack", + "pos": "47", + "showname": ".... ...1 .... = Acknowledgment: Set", + "size": "1", + "value": "1", + "show": "1", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.push", + "pos": "47", + "showname": ".... .... 0... = Push: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.reset", + "pos": "47", + "showname": ".... .... .0.. = Reset: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.syn", + "pos": "47", + "showname": ".... .... ..0. = Syn: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.fin", + "pos": "47", + "showname": ".... .... ...0 = Fin: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "tcp.window_size_value", + "pos": "48", + "showname": "Window size value: 4093", + "size": "2", + "value": "0ffd", + "show": "4093", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.window_size", + "pos": "48", + "showname": "Calculated window size: 4093", + "size": "2", + "value": "0ffd", + "show": "4093", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.window_size_scalefactor", + "pos": "48", + "showname": "Window size scaling factor: -1 (unknown)", + "size": "2", + "value": "0ffd", + "show": "-1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.checksum", + "pos": "50", + "showname": "Checksum: 0xf0d7 [validation disabled]", + "size": "2", + "value": "f0d7", + "show": "0xf0d7", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "tcp.checksum_good", + "pos": "50", + "showname": "Good Checksum: False", + "size": "2", + "value": "f0d7", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.checksum_bad", + "pos": "50", + "showname": "Bad Checksum: False", + "size": "2", + "value": "f0d7", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "tcp.options", + "pos": "54", + "showname": "Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps", + "size": "12", + "value": "0101080a1ec844090475900c", + "show": "01:01:08:0a:1e:c8:44:09:04:75:90:0c", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "", + "pos": "54", + "showname": null, + "size": "1", + "value": "01", + "show": "No-Operation (NOP)", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.opt.type", + "pos": "54", + "showname": "Type: 1", + "size": "1", + "value": "01", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.opt.type.copy", + "pos": "54", + "showname": "0... .... = Copy on fragmentation: No", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.opt.type.class", + "pos": "54", + "showname": ".00. .... = Class: Control (0)", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.opt.type.number", + "pos": "54", + "showname": "...0 0001 = Number: No-Operation (NOP) (1)", + "size": "1", + "value": "1", + "show": "1", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + } + ], + "protos": null + }, + { + "name": "", + "pos": "55", + "showname": null, + "size": "1", + "value": "01", + "show": "No-Operation (NOP)", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.opt.type", + "pos": "55", + "showname": "Type: 1", + "size": "1", + "value": "01", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.opt.type.copy", + "pos": "55", + "showname": "0... .... = Copy on fragmentation: No", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.opt.type.class", + "pos": "55", + "showname": ".00. .... = Class: Control (0)", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.opt.type.number", + "pos": "55", + "showname": "...0 0001 = Number: No-Operation (NOP) (1)", + "size": "1", + "value": "1", + "show": "1", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + } + ], + "protos": null + }, + { + "name": "", + "pos": "56", + "showname": null, + "size": "10", + "value": "080a1ec844090475900c", + "show": "Timestamps: TSval 516441097, TSecr 74813452", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "tcp.option_kind", + "pos": "56", + "showname": "Kind: Timestamp (8)", + "size": "1", + "value": "08", + "show": "8", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.option_len", + "pos": "57", + "showname": "Length: 10", + "size": "1", + "value": "0a", + "show": "10", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.options.timestamp.tsval", + "pos": "58", + "showname": "Timestamp value: 516441097", + "size": "4", + "value": "1ec84409", + "show": "516441097", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.options.timestamp.tsecr", + "pos": "62", + "showname": "Timestamp echo reply: 74813452", + "size": "4", + "value": "0475900c", + "show": "74813452", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + } + ], + "protos": null + } + ] + } + ] + }, + { + "protos": [ + { + "name": "geninfo", + "pos": "0", + "showname": "General information", + "size": "66", + "hide": null, + "fields": [ + { + "name": "num", + "pos": "0", + "showname": "Number", + "size": "66", + "value": "4", + "show": "4", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "len", + "pos": "0", + "showname": "Frame Length", + "size": "66", + "value": "42", + "show": "66", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "caplen", + "pos": "0", + "showname": "Captured Length", + "size": "66", + "value": "42", + "show": "66", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "timestamp", + "pos": "0", + "showname": "Captured Time", + "size": "66", + "value": "1522244690.657009000", + "show": "Mar 28, 2018 13:44:50.657009000 UTC", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ] + }, + { + "name": "frame", + "pos": "0", + "showname": "Frame 4: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)", + "size": "66", + "hide": null, + "fields": [ + { + "name": "frame.dlt", + "pos": "0", + "showname": "WTAP_ENCAP: 1", + "size": "0", + "value": null, + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time", + "pos": "0", + "showname": "Arrival Time: Mar 28, 2018 13:44:50.657009000 UTC", + "size": "0", + "value": null, + "show": "Mar 28, 2018 13:44:50.657009000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.offset_shift", + "pos": "0", + "showname": "Time shift for this packet: 0.000000000 seconds", + "size": "0", + "value": null, + "show": "0.000000000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time_epoch", + "pos": "0", + "showname": "Epoch Time: 1522244690.657009000 seconds", + "size": "0", + "value": null, + "show": "1522244690.657009000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time_delta", + "pos": "0", + "showname": "Time delta from previous captured frame: 82.491727000 seconds", + "size": "0", + "value": null, + "show": "82.491727000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time_delta_displayed", + "pos": "0", + "showname": "Time delta from previous displayed frame: 82.491727000 seconds", + "size": "0", + "value": null, + "show": "82.491727000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time_relative", + "pos": "0", + "showname": "Time since reference or first frame: 82.543011000 seconds", + "size": "0", + "value": null, + "show": "82.543011000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.number", + "pos": "0", + "showname": "Frame Number: 4", + "size": "0", + "value": null, + "show": "4", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.len", + "pos": "0", + "showname": "Frame Length: 66 bytes (528 bits)", + "size": "0", + "value": null, + "show": "66", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.cap_len", + "pos": "0", + "showname": "Capture Length: 66 bytes (528 bits)", + "size": "0", + "value": null, + "show": "66", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.marked", + "pos": "0", + "showname": "Frame is marked: False", + "size": "0", + "value": null, + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.ignored", + "pos": "0", + "showname": "Frame is ignored: False", + "size": "0", + "value": null, + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.protocols", + "pos": "0", + "showname": "Protocols in frame: eth:ip:tcp", + "size": "0", + "value": null, + "show": "eth:ip:tcp", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ] + }, + { + "name": "eth", + "pos": "0", + "showname": "Ethernet II, Src: Cisco_5b:e8:c1 (84:78:ac:5b:e8:c1), Dst: fa:16:3e:04:cd:37 (fa:16:3e:04:cd:37)", + "size": "14", + "hide": null, + "fields": [ + { + "name": "eth.dst", + "pos": "0", + "showname": "Destination: fa:16:3e:04:cd:37 (fa:16:3e:04:cd:37)", + "size": "6", + "value": "fa163e04cd37", + "show": "fa:16:3e:04:cd:37", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "eth.addr", + "pos": "0", + "showname": "Address: fa:16:3e:04:cd:37 (fa:16:3e:04:cd:37)", + "size": "6", + "value": "fa163e04cd37", + "show": "fa:16:3e:04:cd:37", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "eth.lg", + "pos": "0", + "showname": ".... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)", + "size": "3", + "value": "1", + "show": "1", + "unmaskedvalue": "fa163e", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "eth.ig", + "pos": "0", + "showname": ".... ...0 .... .... .... .... = IG bit: Individual address (unicast)", + "size": "3", + "value": "0", + "show": "0", + "unmaskedvalue": "fa163e", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "eth.src", + "pos": "6", + "showname": "Source: Cisco_5b:e8:c1 (84:78:ac:5b:e8:c1)", + "size": "6", + "value": "8478ac5be8c1", + "show": "84:78:ac:5b:e8:c1", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "eth.addr", + "pos": "6", + "showname": "Address: Cisco_5b:e8:c1 (84:78:ac:5b:e8:c1)", + "size": "6", + "value": "8478ac5be8c1", + "show": "84:78:ac:5b:e8:c1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "eth.lg", + "pos": "6", + "showname": ".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)", + "size": "3", + "value": "0", + "show": "0", + "unmaskedvalue": "8478ac", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "eth.ig", + "pos": "6", + "showname": ".... ...0 .... .... .... .... = IG bit: Individual address (unicast)", + "size": "3", + "value": "0", + "show": "0", + "unmaskedvalue": "8478ac", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "eth.type", + "pos": "12", + "showname": "Type: IP (0x0800)", + "size": "2", + "value": "0800", + "show": "0x0800", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ] + }, + { + "name": "ip", + "pos": "14", + "showname": "Internet Protocol Version 4, Src: 10.200.10.172 (10.200.10.172), Dst: 172.26.215.106 (172.26.215.106)", + "size": "20", + "hide": null, + "fields": [ + { + "name": "ip.version", + "pos": "14", + "showname": "Version: 4", + "size": "1", + "value": "45", + "show": "4", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.hdr_len", + "pos": "14", + "showname": "Header length: 20 bytes", + "size": "1", + "value": "45", + "show": "20", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.dsfield", + "pos": "15", + "showname": "Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))", + "size": "1", + "value": "00", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.dsfield.dscp", + "pos": "15", + "showname": "0000 00.. = Differentiated Services Codepoint: Default (0x00)", + "size": "1", + "value": "0", + "show": "0x00", + "unmaskedvalue": "00", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.dsfield.ecn", + "pos": "15", + "showname": ".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)", + "size": "1", + "value": "0", + "show": "0x00", + "unmaskedvalue": "00", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "ip.len", + "pos": "16", + "showname": "Total Length: 52", + "size": "2", + "value": "0034", + "show": "52", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.id", + "pos": "18", + "showname": "Identification: 0x0000 (0)", + "size": "2", + "value": "0000", + "show": "0x0000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.flags", + "pos": "20", + "showname": "Flags: 0x02 (Don't Fragment)", + "size": "1", + "value": "40", + "show": "0x02", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.flags.rb", + "pos": "20", + "showname": "0... .... = Reserved bit: Not set", + "size": "1", + "value": "40", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.flags.df", + "pos": "20", + "showname": ".1.. .... = Don't fragment: Set", + "size": "1", + "value": "40", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.flags.mf", + "pos": "20", + "showname": "..0. .... = More fragments: Not set", + "size": "1", + "value": "40", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "ip.frag_offset", + "pos": "20", + "showname": "Fragment offset: 0", + "size": "2", + "value": "4000", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.ttl", + "pos": "22", + "showname": "Time to live: 62", + "size": "1", + "value": "3e", + "show": "62", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.proto", + "pos": "23", + "showname": "Protocol: TCP (6)", + "size": "1", + "value": "06", + "show": "6", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.checksum", + "pos": "24", + "showname": "Header checksum: 0xa3cb [correct]", + "size": "2", + "value": "a3cb", + "show": "0xa3cb", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.checksum_good", + "pos": "24", + "showname": "Good: True", + "size": "2", + "value": "a3cb", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.checksum_bad", + "pos": "24", + "showname": "Bad: False", + "size": "2", + "value": "a3cb", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "ip.src", + "pos": "26", + "showname": "Source: 10.200.10.172 (10.200.10.172)", + "size": "4", + "value": "0ac80aac", + "show": "10.200.10.172", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.addr", + "pos": "26", + "showname": "Source or Destination Address: 10.200.10.172 (10.200.10.172)", + "size": "4", + "value": "0ac80aac", + "show": "10.200.10.172", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.src_host", + "pos": "26", + "showname": "Source Host: 10.200.10.172", + "size": "4", + "value": "0ac80aac", + "show": "10.200.10.172", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.host", + "pos": "26", + "showname": "Source or Destination Host: 10.200.10.172", + "size": "4", + "value": "0ac80aac", + "show": "10.200.10.172", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.dst", + "pos": "30", + "showname": "Destination: 172.26.215.106 (172.26.215.106)", + "size": "4", + "value": "ac1ad76a", + "show": "172.26.215.106", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.addr", + "pos": "30", + "showname": "Source or Destination Address: 172.26.215.106 (172.26.215.106)", + "size": "4", + "value": "ac1ad76a", + "show": "172.26.215.106", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.dst_host", + "pos": "30", + "showname": "Destination Host: 172.26.215.106", + "size": "4", + "value": "ac1ad76a", + "show": "172.26.215.106", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.host", + "pos": "30", + "showname": "Source or Destination Host: 172.26.215.106", + "size": "4", + "value": "ac1ad76a", + "show": "172.26.215.106", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + } + ] + }, + { + "name": "tcp", + "pos": "34", + "showname": "Transmission Control Protocol, Src Port: 52834 (52834), Dst Port: ssh (22), Seq: 1193, Ack: 24217, Len: 0", + "size": "32", + "hide": null, + "fields": [ + { + "name": "tcp.srcport", + "pos": "34", + "showname": "Source port: 52834 (52834)", + "size": "2", + "value": "ce62", + "show": "52834", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.dstport", + "pos": "36", + "showname": "Destination port: ssh (22)", + "size": "2", + "value": "0016", + "show": "22", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.port", + "pos": "34", + "showname": "Source or Destination Port: 52834", + "size": "2", + "value": "ce62", + "show": "52834", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "tcp.port", + "pos": "36", + "showname": "Source or Destination Port: 22", + "size": "2", + "value": "0016", + "show": "22", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "tcp.stream", + "pos": "34", + "showname": "Stream index: 0", + "size": "0", + "value": null, + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.len", + "pos": "46", + "showname": "TCP Segment Len: 0", + "size": "1", + "value": "80", + "show": "0", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "tcp.seq", + "pos": "38", + "showname": "Sequence number: 1193 (relative sequence number)", + "size": "4", + "value": "3e7a3904", + "show": "1193", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.ack", + "pos": "42", + "showname": "Acknowledgment number: 24217 (relative ack number)", + "size": "4", + "value": "342fcdc6", + "show": "24217", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.hdr_len", + "pos": "46", + "showname": "Header length: 32 bytes", + "size": "1", + "value": "80", + "show": "32", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags", + "pos": "46", + "showname": "Flags: 0x010 (ACK)", + "size": "2", + "value": "10", + "show": "0x0010", + "unmaskedvalue": "8010", + "hide": null, + "fields": [ + { + "name": "tcp.flags.res", + "pos": "46", + "showname": "000. .... .... = Reserved: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "80", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.ns", + "pos": "46", + "showname": "...0 .... .... = Nonce: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "80", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.cwr", + "pos": "47", + "showname": ".... 0... .... = Congestion Window Reduced (CWR): Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.ecn", + "pos": "47", + "showname": ".... .0.. .... = ECN-Echo: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.urg", + "pos": "47", + "showname": ".... ..0. .... = Urgent: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.ack", + "pos": "47", + "showname": ".... ...1 .... = Acknowledgment: Set", + "size": "1", + "value": "1", + "show": "1", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.push", + "pos": "47", + "showname": ".... .... 0... = Push: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.reset", + "pos": "47", + "showname": ".... .... .0.. = Reset: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.syn", + "pos": "47", + "showname": ".... .... ..0. = Syn: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.fin", + "pos": "47", + "showname": ".... .... ...0 = Fin: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "tcp.window_size_value", + "pos": "48", + "showname": "Window size value: 4094", + "size": "2", + "value": "0ffe", + "show": "4094", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.window_size", + "pos": "48", + "showname": "Calculated window size: 4094", + "size": "2", + "value": "0ffe", + "show": "4094", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.window_size_scalefactor", + "pos": "48", + "showname": "Window size scaling factor: -1 (unknown)", + "size": "2", + "value": "0ffe", + "show": "-1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.checksum", + "pos": "50", + "showname": "Checksum: 0x0c9b [validation disabled]", + "size": "2", + "value": "0c9b", + "show": "0x0c9b", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "tcp.checksum_good", + "pos": "50", + "showname": "Good Checksum: False", + "size": "2", + "value": "0c9b", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.checksum_bad", + "pos": "50", + "showname": "Bad Checksum: False", + "size": "2", + "value": "0c9b", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "tcp.options", + "pos": "54", + "showname": "Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps", + "size": "12", + "value": "0101080a1ec983b60476d248", + "show": "01:01:08:0a:1e:c9:83:b6:04:76:d2:48", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "", + "pos": "54", + "showname": null, + "size": "1", + "value": "01", + "show": "No-Operation (NOP)", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.opt.type", + "pos": "54", + "showname": "Type: 1", + "size": "1", + "value": "01", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.opt.type.copy", + "pos": "54", + "showname": "0... .... = Copy on fragmentation: No", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.opt.type.class", + "pos": "54", + "showname": ".00. .... = Class: Control (0)", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.opt.type.number", + "pos": "54", + "showname": "...0 0001 = Number: No-Operation (NOP) (1)", + "size": "1", + "value": "1", + "show": "1", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + } + ], + "protos": null + }, + { + "name": "", + "pos": "55", + "showname": null, + "size": "1", + "value": "01", + "show": "No-Operation (NOP)", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.opt.type", + "pos": "55", + "showname": "Type: 1", + "size": "1", + "value": "01", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.opt.type.copy", + "pos": "55", + "showname": "0... .... = Copy on fragmentation: No", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.opt.type.class", + "pos": "55", + "showname": ".00. .... = Class: Control (0)", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.opt.type.number", + "pos": "55", + "showname": "...0 0001 = Number: No-Operation (NOP) (1)", + "size": "1", + "value": "1", + "show": "1", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + } + ], + "protos": null + }, + { + "name": "", + "pos": "56", + "showname": null, + "size": "10", + "value": "080a1ec983b60476d248", + "show": "Timestamps: TSval 516522934, TSecr 74895944", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "tcp.option_kind", + "pos": "56", + "showname": "Kind: Timestamp (8)", + "size": "1", + "value": "08", + "show": "8", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.option_len", + "pos": "57", + "showname": "Length: 10", + "size": "1", + "value": "0a", + "show": "10", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.options.timestamp.tsval", + "pos": "58", + "showname": "Timestamp value: 516522934", + "size": "4", + "value": "1ec983b6", + "show": "516522934", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.options.timestamp.tsecr", + "pos": "62", + "showname": "Timestamp echo reply: 74895944", + "size": "4", + "value": "0476d248", + "show": "74895944", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + } + ], + "protos": null + }, + { + "name": "tcp.analysis", + "pos": "34", + "showname": "SEQ/ACK analysis", + "size": "0", + "value": "", + "show": "", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "tcp.analysis.flags", + "pos": "34", + "showname": "TCP Analysis Flags", + "size": "0", + "value": "", + "show": "", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "tcp.analysis.lost_segment", + "pos": "34", + "showname": "A segment before this frame wasn't captured", + "size": "0", + "value": "", + "show": "", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "expert", + "pos": "34", + "showname": "Expert Info (Warn/Sequence): Previous segment not captured (common at capture start)", + "size": "0", + "value": null, + "show": null, + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "expert.message", + "pos": "0", + "showname": "Message: Previous segment not captured (common at capture start)", + "size": "0", + "value": null, + "show": "Previous segment not captured (common at capture start)", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "expert.severity", + "pos": "0", + "showname": "Severity level: Warn", + "size": "0", + "value": null, + "show": "0x00600000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "expert.group", + "pos": "0", + "showname": "Group: Sequence", + "size": "0", + "value": null, + "show": "0x02000000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + } + ], + "protos": null + } + ], + "protos": null + } + ], + "protos": null + } + ] + } + ] + }, + { + "protos": [ + { + "name": "geninfo", + "pos": "0", + "showname": "General information", + "size": "66", + "hide": null, + "fields": [ + { + "name": "num", + "pos": "0", + "showname": "Number", + "size": "66", + "value": "5", + "show": "5", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "len", + "pos": "0", + "showname": "Frame Length", + "size": "66", + "value": "42", + "show": "66", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "caplen", + "pos": "0", + "showname": "Captured Length", + "size": "66", + "value": "42", + "show": "66", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "timestamp", + "pos": "0", + "showname": "Captured Time", + "size": "66", + "value": "1522244690.730830000", + "show": "Mar 28, 2018 13:44:50.730830000 UTC", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ] + }, + { + "name": "frame", + "pos": "0", + "showname": "Frame 5: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)", + "size": "66", + "hide": null, + "fields": [ + { + "name": "frame.dlt", + "pos": "0", + "showname": "WTAP_ENCAP: 1", + "size": "0", + "value": null, + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time", + "pos": "0", + "showname": "Arrival Time: Mar 28, 2018 13:44:50.730830000 UTC", + "size": "0", + "value": null, + "show": "Mar 28, 2018 13:44:50.730830000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.offset_shift", + "pos": "0", + "showname": "Time shift for this packet: 0.000000000 seconds", + "size": "0", + "value": null, + "show": "0.000000000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time_epoch", + "pos": "0", + "showname": "Epoch Time: 1522244690.730830000 seconds", + "size": "0", + "value": null, + "show": "1522244690.730830000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time_delta", + "pos": "0", + "showname": "Time delta from previous captured frame: 0.073821000 seconds", + "size": "0", + "value": null, + "show": "0.073821000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time_delta_displayed", + "pos": "0", + "showname": "Time delta from previous displayed frame: 0.073821000 seconds", + "size": "0", + "value": null, + "show": "0.073821000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time_relative", + "pos": "0", + "showname": "Time since reference or first frame: 82.616832000 seconds", + "size": "0", + "value": null, + "show": "82.616832000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.number", + "pos": "0", + "showname": "Frame Number: 5", + "size": "0", + "value": null, + "show": "5", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.len", + "pos": "0", + "showname": "Frame Length: 66 bytes (528 bits)", + "size": "0", + "value": null, + "show": "66", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.cap_len", + "pos": "0", + "showname": "Capture Length: 66 bytes (528 bits)", + "size": "0", + "value": null, + "show": "66", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.marked", + "pos": "0", + "showname": "Frame is marked: False", + "size": "0", + "value": null, + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.ignored", + "pos": "0", + "showname": "Frame is ignored: False", + "size": "0", + "value": null, + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.protocols", + "pos": "0", + "showname": "Protocols in frame: eth:ip:tcp", + "size": "0", + "value": null, + "show": "eth:ip:tcp", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ] + }, + { + "name": "eth", + "pos": "0", + "showname": "Ethernet II, Src: Cisco_5b:e8:c1 (84:78:ac:5b:e8:c1), Dst: fa:16:3e:04:cd:37 (fa:16:3e:04:cd:37)", + "size": "14", + "hide": null, + "fields": [ + { + "name": "eth.dst", + "pos": "0", + "showname": "Destination: fa:16:3e:04:cd:37 (fa:16:3e:04:cd:37)", + "size": "6", + "value": "fa163e04cd37", + "show": "fa:16:3e:04:cd:37", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "eth.addr", + "pos": "0", + "showname": "Address: fa:16:3e:04:cd:37 (fa:16:3e:04:cd:37)", + "size": "6", + "value": "fa163e04cd37", + "show": "fa:16:3e:04:cd:37", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "eth.lg", + "pos": "0", + "showname": ".... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)", + "size": "3", + "value": "1", + "show": "1", + "unmaskedvalue": "fa163e", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "eth.ig", + "pos": "0", + "showname": ".... ...0 .... .... .... .... = IG bit: Individual address (unicast)", + "size": "3", + "value": "0", + "show": "0", + "unmaskedvalue": "fa163e", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "eth.src", + "pos": "6", + "showname": "Source: Cisco_5b:e8:c1 (84:78:ac:5b:e8:c1)", + "size": "6", + "value": "8478ac5be8c1", + "show": "84:78:ac:5b:e8:c1", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "eth.addr", + "pos": "6", + "showname": "Address: Cisco_5b:e8:c1 (84:78:ac:5b:e8:c1)", + "size": "6", + "value": "8478ac5be8c1", + "show": "84:78:ac:5b:e8:c1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "eth.lg", + "pos": "6", + "showname": ".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)", + "size": "3", + "value": "0", + "show": "0", + "unmaskedvalue": "8478ac", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "eth.ig", + "pos": "6", + "showname": ".... ...0 .... .... .... .... = IG bit: Individual address (unicast)", + "size": "3", + "value": "0", + "show": "0", + "unmaskedvalue": "8478ac", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "eth.type", + "pos": "12", + "showname": "Type: IP (0x0800)", + "size": "2", + "value": "0800", + "show": "0x0800", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ] + }, + { + "name": "ip", + "pos": "14", + "showname": "Internet Protocol Version 4, Src: 10.200.10.172 (10.200.10.172), Dst: 172.26.215.106 (172.26.215.106)", + "size": "20", + "hide": null, + "fields": [ + { + "name": "ip.version", + "pos": "14", + "showname": "Version: 4", + "size": "1", + "value": "45", + "show": "4", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.hdr_len", + "pos": "14", + "showname": "Header length: 20 bytes", + "size": "1", + "value": "45", + "show": "20", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.dsfield", + "pos": "15", + "showname": "Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))", + "size": "1", + "value": "00", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.dsfield.dscp", + "pos": "15", + "showname": "0000 00.. = Differentiated Services Codepoint: Default (0x00)", + "size": "1", + "value": "0", + "show": "0x00", + "unmaskedvalue": "00", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.dsfield.ecn", + "pos": "15", + "showname": ".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)", + "size": "1", + "value": "0", + "show": "0x00", + "unmaskedvalue": "00", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "ip.len", + "pos": "16", + "showname": "Total Length: 52", + "size": "2", + "value": "0034", + "show": "52", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.id", + "pos": "18", + "showname": "Identification: 0x0000 (0)", + "size": "2", + "value": "0000", + "show": "0x0000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.flags", + "pos": "20", + "showname": "Flags: 0x02 (Don't Fragment)", + "size": "1", + "value": "40", + "show": "0x02", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.flags.rb", + "pos": "20", + "showname": "0... .... = Reserved bit: Not set", + "size": "1", + "value": "40", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.flags.df", + "pos": "20", + "showname": ".1.. .... = Don't fragment: Set", + "size": "1", + "value": "40", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.flags.mf", + "pos": "20", + "showname": "..0. .... = More fragments: Not set", + "size": "1", + "value": "40", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "ip.frag_offset", + "pos": "20", + "showname": "Fragment offset: 0", + "size": "2", + "value": "4000", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.ttl", + "pos": "22", + "showname": "Time to live: 62", + "size": "1", + "value": "3e", + "show": "62", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.proto", + "pos": "23", + "showname": "Protocol: TCP (6)", + "size": "1", + "value": "06", + "show": "6", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.checksum", + "pos": "24", + "showname": "Header checksum: 0xa3cb [correct]", + "size": "2", + "value": "a3cb", + "show": "0xa3cb", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.checksum_good", + "pos": "24", + "showname": "Good: True", + "size": "2", + "value": "a3cb", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.checksum_bad", + "pos": "24", + "showname": "Bad: False", + "size": "2", + "value": "a3cb", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "ip.src", + "pos": "26", + "showname": "Source: 10.200.10.172 (10.200.10.172)", + "size": "4", + "value": "0ac80aac", + "show": "10.200.10.172", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.addr", + "pos": "26", + "showname": "Source or Destination Address: 10.200.10.172 (10.200.10.172)", + "size": "4", + "value": "0ac80aac", + "show": "10.200.10.172", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.src_host", + "pos": "26", + "showname": "Source Host: 10.200.10.172", + "size": "4", + "value": "0ac80aac", + "show": "10.200.10.172", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.host", + "pos": "26", + "showname": "Source or Destination Host: 10.200.10.172", + "size": "4", + "value": "0ac80aac", + "show": "10.200.10.172", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.dst", + "pos": "30", + "showname": "Destination: 172.26.215.106 (172.26.215.106)", + "size": "4", + "value": "ac1ad76a", + "show": "172.26.215.106", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.addr", + "pos": "30", + "showname": "Source or Destination Address: 172.26.215.106 (172.26.215.106)", + "size": "4", + "value": "ac1ad76a", + "show": "172.26.215.106", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.dst_host", + "pos": "30", + "showname": "Destination Host: 172.26.215.106", + "size": "4", + "value": "ac1ad76a", + "show": "172.26.215.106", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.host", + "pos": "30", + "showname": "Source or Destination Host: 172.26.215.106", + "size": "4", + "value": "ac1ad76a", + "show": "172.26.215.106", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + } + ] + }, + { + "name": "tcp", + "pos": "34", + "showname": "Transmission Control Protocol, Src Port: 52834 (52834), Dst Port: ssh (22), Seq: 1193, Ack: 24381, Len: 0", + "size": "32", + "hide": null, + "fields": [ + { + "name": "tcp.srcport", + "pos": "34", + "showname": "Source port: 52834 (52834)", + "size": "2", + "value": "ce62", + "show": "52834", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.dstport", + "pos": "36", + "showname": "Destination port: ssh (22)", + "size": "2", + "value": "0016", + "show": "22", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.port", + "pos": "34", + "showname": "Source or Destination Port: 52834", + "size": "2", + "value": "ce62", + "show": "52834", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "tcp.port", + "pos": "36", + "showname": "Source or Destination Port: 22", + "size": "2", + "value": "0016", + "show": "22", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "tcp.stream", + "pos": "34", + "showname": "Stream index: 0", + "size": "0", + "value": null, + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.len", + "pos": "46", + "showname": "TCP Segment Len: 0", + "size": "1", + "value": "80", + "show": "0", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "tcp.seq", + "pos": "38", + "showname": "Sequence number: 1193 (relative sequence number)", + "size": "4", + "value": "3e7a3904", + "show": "1193", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.ack", + "pos": "42", + "showname": "Acknowledgment number: 24381 (relative ack number)", + "size": "4", + "value": "342fce6a", + "show": "24381", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.hdr_len", + "pos": "46", + "showname": "Header length: 32 bytes", + "size": "1", + "value": "80", + "show": "32", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags", + "pos": "46", + "showname": "Flags: 0x010 (ACK)", + "size": "2", + "value": "10", + "show": "0x0010", + "unmaskedvalue": "8010", + "hide": null, + "fields": [ + { + "name": "tcp.flags.res", + "pos": "46", + "showname": "000. .... .... = Reserved: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "80", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.ns", + "pos": "46", + "showname": "...0 .... .... = Nonce: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "80", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.cwr", + "pos": "47", + "showname": ".... 0... .... = Congestion Window Reduced (CWR): Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.ecn", + "pos": "47", + "showname": ".... .0.. .... = ECN-Echo: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.urg", + "pos": "47", + "showname": ".... ..0. .... = Urgent: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.ack", + "pos": "47", + "showname": ".... ...1 .... = Acknowledgment: Set", + "size": "1", + "value": "1", + "show": "1", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.push", + "pos": "47", + "showname": ".... .... 0... = Push: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.reset", + "pos": "47", + "showname": ".... .... .0.. = Reset: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.syn", + "pos": "47", + "showname": ".... .... ..0. = Syn: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.fin", + "pos": "47", + "showname": ".... .... ...0 = Fin: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "tcp.window_size_value", + "pos": "48", + "showname": "Window size value: 4090", + "size": "2", + "value": "0ffa", + "show": "4090", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.window_size", + "pos": "48", + "showname": "Calculated window size: 4090", + "size": "2", + "value": "0ffa", + "show": "4090", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.window_size_scalefactor", + "pos": "48", + "showname": "Window size scaling factor: -1 (unknown)", + "size": "2", + "value": "0ffa", + "show": "-1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.checksum", + "pos": "50", + "showname": "Checksum: 0x0b69 [validation disabled]", + "size": "2", + "value": "0b69", + "show": "0x0b69", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "tcp.checksum_good", + "pos": "50", + "showname": "Good Checksum: False", + "size": "2", + "value": "0b69", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.checksum_bad", + "pos": "50", + "showname": "Bad Checksum: False", + "size": "2", + "value": "0b69", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "tcp.options", + "pos": "54", + "showname": "Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps", + "size": "12", + "value": "0101080a1ec983ff0476d291", + "show": "01:01:08:0a:1e:c9:83:ff:04:76:d2:91", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "", + "pos": "54", + "showname": null, + "size": "1", + "value": "01", + "show": "No-Operation (NOP)", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.opt.type", + "pos": "54", + "showname": "Type: 1", + "size": "1", + "value": "01", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.opt.type.copy", + "pos": "54", + "showname": "0... .... = Copy on fragmentation: No", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.opt.type.class", + "pos": "54", + "showname": ".00. .... = Class: Control (0)", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.opt.type.number", + "pos": "54", + "showname": "...0 0001 = Number: No-Operation (NOP) (1)", + "size": "1", + "value": "1", + "show": "1", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + } + ], + "protos": null + }, + { + "name": "", + "pos": "55", + "showname": null, + "size": "1", + "value": "01", + "show": "No-Operation (NOP)", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.opt.type", + "pos": "55", + "showname": "Type: 1", + "size": "1", + "value": "01", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.opt.type.copy", + "pos": "55", + "showname": "0... .... = Copy on fragmentation: No", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.opt.type.class", + "pos": "55", + "showname": ".00. .... = Class: Control (0)", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.opt.type.number", + "pos": "55", + "showname": "...0 0001 = Number: No-Operation (NOP) (1)", + "size": "1", + "value": "1", + "show": "1", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + } + ], + "protos": null + }, + { + "name": "", + "pos": "56", + "showname": null, + "size": "10", + "value": "080a1ec983ff0476d291", + "show": "Timestamps: TSval 516523007, TSecr 74896017", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "tcp.option_kind", + "pos": "56", + "showname": "Kind: Timestamp (8)", + "size": "1", + "value": "08", + "show": "8", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.option_len", + "pos": "57", + "showname": "Length: 10", + "size": "1", + "value": "0a", + "show": "10", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.options.timestamp.tsval", + "pos": "58", + "showname": "Timestamp value: 516523007", + "size": "4", + "value": "1ec983ff", + "show": "516523007", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.options.timestamp.tsecr", + "pos": "62", + "showname": "Timestamp echo reply: 74896017", + "size": "4", + "value": "0476d291", + "show": "74896017", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + } + ], + "protos": null + } + ] + } + ] + }, + { + "protos": [ + { + "name": "geninfo", + "pos": "0", + "showname": "General information", + "size": "66", + "hide": null, + "fields": [ + { + "name": "num", + "pos": "0", + "showname": "Number", + "size": "66", + "value": "6", + "show": "6", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "len", + "pos": "0", + "showname": "Frame Length", + "size": "66", + "value": "42", + "show": "66", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "caplen", + "pos": "0", + "showname": "Captured Length", + "size": "66", + "value": "42", + "show": "66", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "timestamp", + "pos": "0", + "showname": "Captured Time", + "size": "66", + "value": "1522244690.731086000", + "show": "Mar 28, 2018 13:44:50.731086000 UTC", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ] + }, + { + "name": "frame", + "pos": "0", + "showname": "Frame 6: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)", + "size": "66", + "hide": null, + "fields": [ + { + "name": "frame.dlt", + "pos": "0", + "showname": "WTAP_ENCAP: 1", + "size": "0", + "value": null, + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time", + "pos": "0", + "showname": "Arrival Time: Mar 28, 2018 13:44:50.731086000 UTC", + "size": "0", + "value": null, + "show": "Mar 28, 2018 13:44:50.731086000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.offset_shift", + "pos": "0", + "showname": "Time shift for this packet: 0.000000000 seconds", + "size": "0", + "value": null, + "show": "0.000000000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time_epoch", + "pos": "0", + "showname": "Epoch Time: 1522244690.731086000 seconds", + "size": "0", + "value": null, + "show": "1522244690.731086000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time_delta", + "pos": "0", + "showname": "Time delta from previous captured frame: 0.000256000 seconds", + "size": "0", + "value": null, + "show": "0.000256000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time_delta_displayed", + "pos": "0", + "showname": "Time delta from previous displayed frame: 0.000256000 seconds", + "size": "0", + "value": null, + "show": "0.000256000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.time_relative", + "pos": "0", + "showname": "Time since reference or first frame: 82.617088000 seconds", + "size": "0", + "value": null, + "show": "82.617088000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.number", + "pos": "0", + "showname": "Frame Number: 6", + "size": "0", + "value": null, + "show": "6", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.len", + "pos": "0", + "showname": "Frame Length: 66 bytes (528 bits)", + "size": "0", + "value": null, + "show": "66", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.cap_len", + "pos": "0", + "showname": "Capture Length: 66 bytes (528 bits)", + "size": "0", + "value": null, + "show": "66", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.marked", + "pos": "0", + "showname": "Frame is marked: False", + "size": "0", + "value": null, + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.ignored", + "pos": "0", + "showname": "Frame is ignored: False", + "size": "0", + "value": null, + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "frame.protocols", + "pos": "0", + "showname": "Protocols in frame: eth:ip:tcp", + "size": "0", + "value": null, + "show": "eth:ip:tcp", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ] + }, + { + "name": "eth", + "pos": "0", + "showname": "Ethernet II, Src: Cisco_5b:e8:c1 (84:78:ac:5b:e8:c1), Dst: fa:16:3e:04:cd:37 (fa:16:3e:04:cd:37)", + "size": "14", + "hide": null, + "fields": [ + { + "name": "eth.dst", + "pos": "0", + "showname": "Destination: fa:16:3e:04:cd:37 (fa:16:3e:04:cd:37)", + "size": "6", + "value": "fa163e04cd37", + "show": "fa:16:3e:04:cd:37", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "eth.addr", + "pos": "0", + "showname": "Address: fa:16:3e:04:cd:37 (fa:16:3e:04:cd:37)", + "size": "6", + "value": "fa163e04cd37", + "show": "fa:16:3e:04:cd:37", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "eth.lg", + "pos": "0", + "showname": ".... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)", + "size": "3", + "value": "1", + "show": "1", + "unmaskedvalue": "fa163e", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "eth.ig", + "pos": "0", + "showname": ".... ...0 .... .... .... .... = IG bit: Individual address (unicast)", + "size": "3", + "value": "0", + "show": "0", + "unmaskedvalue": "fa163e", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "eth.src", + "pos": "6", + "showname": "Source: Cisco_5b:e8:c1 (84:78:ac:5b:e8:c1)", + "size": "6", + "value": "8478ac5be8c1", + "show": "84:78:ac:5b:e8:c1", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "eth.addr", + "pos": "6", + "showname": "Address: Cisco_5b:e8:c1 (84:78:ac:5b:e8:c1)", + "size": "6", + "value": "8478ac5be8c1", + "show": "84:78:ac:5b:e8:c1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "eth.lg", + "pos": "6", + "showname": ".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)", + "size": "3", + "value": "0", + "show": "0", + "unmaskedvalue": "8478ac", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "eth.ig", + "pos": "6", + "showname": ".... ...0 .... .... .... .... = IG bit: Individual address (unicast)", + "size": "3", + "value": "0", + "show": "0", + "unmaskedvalue": "8478ac", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "eth.type", + "pos": "12", + "showname": "Type: IP (0x0800)", + "size": "2", + "value": "0800", + "show": "0x0800", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ] + }, + { + "name": "ip", + "pos": "14", + "showname": "Internet Protocol Version 4, Src: 10.200.10.172 (10.200.10.172), Dst: 172.26.215.106 (172.26.215.106)", + "size": "20", + "hide": null, + "fields": [ + { + "name": "ip.version", + "pos": "14", + "showname": "Version: 4", + "size": "1", + "value": "45", + "show": "4", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.hdr_len", + "pos": "14", + "showname": "Header length: 20 bytes", + "size": "1", + "value": "45", + "show": "20", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.dsfield", + "pos": "15", + "showname": "Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))", + "size": "1", + "value": "00", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.dsfield.dscp", + "pos": "15", + "showname": "0000 00.. = Differentiated Services Codepoint: Default (0x00)", + "size": "1", + "value": "0", + "show": "0x00", + "unmaskedvalue": "00", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.dsfield.ecn", + "pos": "15", + "showname": ".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)", + "size": "1", + "value": "0", + "show": "0x00", + "unmaskedvalue": "00", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "ip.len", + "pos": "16", + "showname": "Total Length: 52", + "size": "2", + "value": "0034", + "show": "52", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.id", + "pos": "18", + "showname": "Identification: 0x0000 (0)", + "size": "2", + "value": "0000", + "show": "0x0000", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.flags", + "pos": "20", + "showname": "Flags: 0x02 (Don't Fragment)", + "size": "1", + "value": "40", + "show": "0x02", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.flags.rb", + "pos": "20", + "showname": "0... .... = Reserved bit: Not set", + "size": "1", + "value": "40", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.flags.df", + "pos": "20", + "showname": ".1.. .... = Don't fragment: Set", + "size": "1", + "value": "40", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.flags.mf", + "pos": "20", + "showname": "..0. .... = More fragments: Not set", + "size": "1", + "value": "40", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "ip.frag_offset", + "pos": "20", + "showname": "Fragment offset: 0", + "size": "2", + "value": "4000", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.ttl", + "pos": "22", + "showname": "Time to live: 62", + "size": "1", + "value": "3e", + "show": "62", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.proto", + "pos": "23", + "showname": "Protocol: TCP (6)", + "size": "1", + "value": "06", + "show": "6", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.checksum", + "pos": "24", + "showname": "Header checksum: 0xa3cb [correct]", + "size": "2", + "value": "a3cb", + "show": "0xa3cb", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.checksum_good", + "pos": "24", + "showname": "Good: True", + "size": "2", + "value": "a3cb", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.checksum_bad", + "pos": "24", + "showname": "Bad: False", + "size": "2", + "value": "a3cb", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "ip.src", + "pos": "26", + "showname": "Source: 10.200.10.172 (10.200.10.172)", + "size": "4", + "value": "0ac80aac", + "show": "10.200.10.172", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.addr", + "pos": "26", + "showname": "Source or Destination Address: 10.200.10.172 (10.200.10.172)", + "size": "4", + "value": "0ac80aac", + "show": "10.200.10.172", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.src_host", + "pos": "26", + "showname": "Source Host: 10.200.10.172", + "size": "4", + "value": "0ac80aac", + "show": "10.200.10.172", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.host", + "pos": "26", + "showname": "Source or Destination Host: 10.200.10.172", + "size": "4", + "value": "0ac80aac", + "show": "10.200.10.172", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.dst", + "pos": "30", + "showname": "Destination: 172.26.215.106 (172.26.215.106)", + "size": "4", + "value": "ac1ad76a", + "show": "172.26.215.106", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.addr", + "pos": "30", + "showname": "Source or Destination Address: 172.26.215.106 (172.26.215.106)", + "size": "4", + "value": "ac1ad76a", + "show": "172.26.215.106", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.dst_host", + "pos": "30", + "showname": "Destination Host: 172.26.215.106", + "size": "4", + "value": "ac1ad76a", + "show": "172.26.215.106", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "ip.host", + "pos": "30", + "showname": "Source or Destination Host: 172.26.215.106", + "size": "4", + "value": "ac1ad76a", + "show": "172.26.215.106", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + } + ] + }, + { + "name": "tcp", + "pos": "34", + "showname": "Transmission Control Protocol, Src Port: 52834 (52834), Dst Port: ssh (22), Seq: 1193, Ack: 24457, Len: 0", + "size": "32", + "hide": null, + "fields": [ + { + "name": "tcp.srcport", + "pos": "34", + "showname": "Source port: 52834 (52834)", + "size": "2", + "value": "ce62", + "show": "52834", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.dstport", + "pos": "36", + "showname": "Destination port: ssh (22)", + "size": "2", + "value": "0016", + "show": "22", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.port", + "pos": "34", + "showname": "Source or Destination Port: 52834", + "size": "2", + "value": "ce62", + "show": "52834", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "tcp.port", + "pos": "36", + "showname": "Source or Destination Port: 22", + "size": "2", + "value": "0016", + "show": "22", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "tcp.stream", + "pos": "34", + "showname": "Stream index: 0", + "size": "0", + "value": null, + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.len", + "pos": "46", + "showname": "TCP Segment Len: 0", + "size": "1", + "value": "80", + "show": "0", + "unmaskedvalue": null, + "hide": "yes", + "fields": null, + "protos": null + }, + { + "name": "tcp.seq", + "pos": "38", + "showname": "Sequence number: 1193 (relative sequence number)", + "size": "4", + "value": "3e7a3904", + "show": "1193", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.ack", + "pos": "42", + "showname": "Acknowledgment number: 24457 (relative ack number)", + "size": "4", + "value": "342fceb6", + "show": "24457", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.hdr_len", + "pos": "46", + "showname": "Header length: 32 bytes", + "size": "1", + "value": "80", + "show": "32", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags", + "pos": "46", + "showname": "Flags: 0x010 (ACK)", + "size": "2", + "value": "10", + "show": "0x0010", + "unmaskedvalue": "8010", + "hide": null, + "fields": [ + { + "name": "tcp.flags.res", + "pos": "46", + "showname": "000. .... .... = Reserved: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "80", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.ns", + "pos": "46", + "showname": "...0 .... .... = Nonce: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "80", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.cwr", + "pos": "47", + "showname": ".... 0... .... = Congestion Window Reduced (CWR): Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.ecn", + "pos": "47", + "showname": ".... .0.. .... = ECN-Echo: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.urg", + "pos": "47", + "showname": ".... ..0. .... = Urgent: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.ack", + "pos": "47", + "showname": ".... ...1 .... = Acknowledgment: Set", + "size": "1", + "value": "1", + "show": "1", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.push", + "pos": "47", + "showname": ".... .... 0... = Push: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.reset", + "pos": "47", + "showname": ".... .... .0.. = Reset: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.syn", + "pos": "47", + "showname": ".... .... ..0. = Syn: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.flags.fin", + "pos": "47", + "showname": ".... .... ...0 = Fin: Not set", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "10", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "tcp.window_size_value", + "pos": "48", + "showname": "Window size value: 4093", + "size": "2", + "value": "0ffd", + "show": "4093", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.window_size", + "pos": "48", + "showname": "Calculated window size: 4093", + "size": "2", + "value": "0ffd", + "show": "4093", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.window_size_scalefactor", + "pos": "48", + "showname": "Window size scaling factor: -1 (unknown)", + "size": "2", + "value": "0ffd", + "show": "-1", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.checksum", + "pos": "50", + "showname": "Checksum: 0x0b19 [validation disabled]", + "size": "2", + "value": "0b19", + "show": "0x0b19", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "tcp.checksum_good", + "pos": "50", + "showname": "Good Checksum: False", + "size": "2", + "value": "0b19", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.checksum_bad", + "pos": "50", + "showname": "Bad Checksum: False", + "size": "2", + "value": "0b19", + "show": "0", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + }, + { + "name": "tcp.options", + "pos": "54", + "showname": "Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps", + "size": "12", + "value": "0101080a1ec983ff0476d292", + "show": "01:01:08:0a:1e:c9:83:ff:04:76:d2:92", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "", + "pos": "54", + "showname": null, + "size": "1", + "value": "01", + "show": "No-Operation (NOP)", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.opt.type", + "pos": "54", + "showname": "Type: 1", + "size": "1", + "value": "01", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.opt.type.copy", + "pos": "54", + "showname": "0... .... = Copy on fragmentation: No", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.opt.type.class", + "pos": "54", + "showname": ".00. .... = Class: Control (0)", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.opt.type.number", + "pos": "54", + "showname": "...0 0001 = Number: No-Operation (NOP) (1)", + "size": "1", + "value": "1", + "show": "1", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + } + ], + "protos": null + }, + { + "name": "", + "pos": "55", + "showname": null, + "size": "1", + "value": "01", + "show": "No-Operation (NOP)", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.opt.type", + "pos": "55", + "showname": "Type: 1", + "size": "1", + "value": "01", + "show": "1", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "ip.opt.type.copy", + "pos": "55", + "showname": "0... .... = Copy on fragmentation: No", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.opt.type.class", + "pos": "55", + "showname": ".00. .... = Class: Control (0)", + "size": "1", + "value": "0", + "show": "0", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "ip.opt.type.number", + "pos": "55", + "showname": "...0 0001 = Number: No-Operation (NOP) (1)", + "size": "1", + "value": "1", + "show": "1", + "unmaskedvalue": "01", + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + } + ], + "protos": null + }, + { + "name": "", + "pos": "56", + "showname": null, + "size": "10", + "value": "080a1ec983ff0476d292", + "show": "Timestamps: TSval 516523007, TSecr 74896018", + "unmaskedvalue": null, + "hide": null, + "fields": [ + { + "name": "tcp.option_kind", + "pos": "56", + "showname": "Kind: Timestamp (8)", + "size": "1", + "value": "08", + "show": "8", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.option_len", + "pos": "57", + "showname": "Length: 10", + "size": "1", + "value": "0a", + "show": "10", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.options.timestamp.tsval", + "pos": "58", + "showname": "Timestamp value: 516523007", + "size": "4", + "value": "1ec983ff", + "show": "516523007", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + }, + { + "name": "tcp.options.timestamp.tsecr", + "pos": "62", + "showname": "Timestamp echo reply: 74896018", + "size": "4", + "value": "0476d292", + "show": "74896018", + "unmaskedvalue": null, + "hide": null, + "fields": null, + "protos": null + } + ], + "protos": null + } + ], + "protos": null + } + ] + } + ] + } + ] + }` +} function pdml_json() { - return `{ + return `{ "pdml": { "$": { "version": "0", From 55cf2d945a4fcff1e7e2e47a234037ed6f394b2e Mon Sep 17 00:00:00 2001 From: merrimanr Date: Wed, 18 Apr 2018 10:52:56 -0500 Subject: [PATCH 03/14] added license headers --- .../metron-alerts/src/app/pcap/model/pdml.ts | 3 +++ .../pcap-filters/pcap-filters.component.html | 13 +++++++++++++ .../pcap-filters/pcap-filters.component.scss | 17 +++++++++++++++++ .../app/pcap/pcap-list/pcap-list.component.html | 13 +++++++++++++ .../app/pcap/pcap-list/pcap-list.component.scss | 17 +++++++++++++++++ .../pcap-packet-line.component.html | 13 +++++++++++++ .../pcap-packet-line.component.scss | 17 +++++++++++++++++ .../pcap/pcap-packet/pcap-packet.component.html | 13 +++++++++++++ .../pcap/pcap-packet/pcap-packet.component.scss | 17 +++++++++++++++++ .../pcap/pcap-panel/pcap-panel.component.html | 13 +++++++++++++ .../pcap/pcap-panel/pcap-panel.component.scss | 17 +++++++++++++++++ .../app/pcap/pcap-panel/pcap-panel.component.ts | 6 +++--- 12 files changed, 156 insertions(+), 3 deletions(-) diff --git a/metron-interface/metron-alerts/src/app/pcap/model/pdml.ts b/metron-interface/metron-alerts/src/app/pcap/model/pdml.ts index 42da9483ed..97fc34792f 100644 --- a/metron-interface/metron-alerts/src/app/pcap/model/pdml.ts +++ b/metron-interface/metron-alerts/src/app/pcap/model/pdml.ts @@ -20,6 +20,9 @@ //public $: any[] public name: string; public fields?: PdmlField[] + public show: string; + public value: string; + public showname: string; } export class PdmlProto { diff --git a/metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.html b/metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.html index 1c54026278..42661d1068 100644 --- a/metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.html +++ b/metron-interface/metron-alerts/src/app/pcap/pcap-filters/pcap-filters.component.html @@ -1,3 +1,16 @@ +