From 12849b1535fb520386a6687870cdc44ad2a40a84 Mon Sep 17 00:00:00 2001 From: Julian Kiedaisch Date: Wed, 30 Sep 2026 10:03:16 +0000 Subject: [PATCH] feat(core): TCP in the simulation core MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit engine.ts ports Swift's "Java-compatible TCP sockets" in one piece, since half a state machine could not be checked: server and client sockets (a free port from Java's random numbers on their own seed), the three-way handshake with its result (connected, invalid socket, unreachable, timed out), segments of 1460 bytes, messages up to the push, a timeout of 3 × 2.5 s with at most three attempts, closing through every Java state including TIME_WAIT (2.5 s), sequence numbers modulo 2^32. Three scenarios match the Swift engine trace for trace: a LAN with data over three segments, closing from both ends, a closed port and an unreachable host; two networks through a router with a firewall rule, data lost until the connection closes, and an accepted socket that does not hold the port of its closed listener; CLOSING, reached by a lost FIN. The engine delivers a FIN within the same close, so both ends close at once only with packet loss; an empty message does not arrive in Swift (it does not advance the sequence number), nor here. Swift's four TCP engine tests are ported, with tests for stopping, a foreign SYN+ACK at a listener and the flag names. 17 mutation probes, 16 caught; the other (delivered, not waited, not connected gives unreachable) cannot be reached through Swift's engine, which never sends a reset and always acknowledges correctly. Co-Authored-By: Claude Opus 5.5 --- CHANGES.md | 4 +- packages/core/src/runtime/engine.ts | 746 +- packages/core/test/engine.test.ts | 131 +- packages/core/test/oracle.test.ts | 47 + .../test/scenarios/tcp-closing.scenario.json | 154 + .../test/scenarios/tcp-closing.swift.json | 4255 +++++++ .../core/test/scenarios/tcp-lan.scenario.json | 215 + .../core/test/scenarios/tcp-lan.swift.json | 10424 ++++++++++++++++ .../scenarios/tcp-routed-loss.scenario.json | 166 + .../test/scenarios/tcp-routed-loss.swift.json | 4777 +++++++ .../core/test/scenarios/udp-lan.swift.json | 15 +- .../core/test/scenarios/udp-routed.swift.json | 20 +- tools/swift-oracle/README.md | 8 +- tools/swift-oracle/Sources/Oracle/main.swift | 33 + 14 files changed, 20973 insertions(+), 22 deletions(-) create mode 100644 packages/core/test/scenarios/tcp-closing.scenario.json create mode 100644 packages/core/test/scenarios/tcp-closing.swift.json create mode 100644 packages/core/test/scenarios/tcp-lan.scenario.json create mode 100644 packages/core/test/scenarios/tcp-lan.swift.json create mode 100644 packages/core/test/scenarios/tcp-routed-loss.scenario.json create mode 100644 packages/core/test/scenarios/tcp-routed-loss.swift.json diff --git a/CHANGES.md b/CHANGES.md index f489661..4dde40e 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -13,7 +13,7 @@ Swift-Pfade relativ zu `filius-ipad/ios/FiliusPad/TopologyEditor/` (Stand | `src/model/link.ts`, `src/model/graph.ts` | `Model/TopologyLink.swift`, `Model/TopologyGraph.swift` | übertragen, bisher nur die Daten (Abfragen folgen mit dem Editor) | | `src/model/documentation.ts` | `Model/TopologyDocumentation.swift` | übertragen; FNV-Kennung mit BigInt, gegen die IDs aus dem Swift-Import geprüft | | `src/runtime/config.ts` | `State/TopologyEditorState.swift` (Laufzeit-Konfigurationen, WLAN eines Rechners, DHCP, Portweiterleitung, Remote Link ohne LAN-Transport, Programme und ihre Konfiguration, Firewall, DNS-Einträge aus `State/TopologyDNSResolver.swift`, E-Mail-Konten und -Nachrichten aus `State/TopologyEmail.swift`); dazu Echo-Server- und Client-Konfiguration, die Swift nicht speichert | übertragen; Java-Beschriftungen der Oberfläche weggelassen | -| `src/runtime/engine.ts` | `State/TopologyNetworkRuntimeEngine.swift` Z. ~313–3585, ~4472–5187 (UDP), ~4753–4850 | übertragen: Warteschlange, Uhr, Ethernet, Switch, ARP, IPv4, ICMP, Routing, Firewall, UDP-Sockets (binden, freie Ports nach Javas Zufall, senden samt Broadcast, zustellen, empfangen mit Wartezeit, schließen). Klasse statt Werttyp. Noch nicht übertragen (wirft `NotPortedError`): Gateway-NAT, TCP, DHCP, DNS, RIP, Remote Link, WLAN | +| `src/runtime/engine.ts` | `State/TopologyNetworkRuntimeEngine.swift` Z. ~313–3585, ~4472–5187 (UDP), ~4753–4850 | übertragen: Warteschlange, Uhr, Ethernet, Switch, ARP, IPv4, ICMP, Routing, Firewall, UDP-Sockets (binden, freie Ports nach Javas Zufall, senden samt Broadcast, zustellen, empfangen mit Wartezeit, schließen), TCP (Z. ~5187–5913: Server- und Client-Sockets, Handschlag mit Ergebnis, Segmente zu 1460 Byte bis zum PSH, Zeitgrenze 3 × 2,5 s mit höchstens drei Versuchen, Abbau über alle Java-Zustände samt `TIME_WAIT`). Klasse statt Werttyp. Noch nicht übertragen (wirft `NotPortedError`): Gateway-NAT, DHCP, DNS, RIP, Remote Link, WLAN | | `src/runtime/ipv4.ts` | Engine `parseIPv4`/`sameSubnet` | übertragen | | `src/runtime/packets.ts` | Engine, Paketmodelle | übertragen; `Data` → `Uint8Array` | | `src/runtime/random.ts` | Engine, `TopologyJavaCompatibleRandom` | übertragen; BigInt für die 48-Bit-Arithmetik | @@ -27,7 +27,7 @@ Swift-Pfade relativ zu `filius-ipad/ios/FiliusPad/TopologyEditor/` (Stand | `test/virtualFileSystem.test.ts`, `test/vfs.*.json` | `TopologyProjectPersistenceTests.swift`, `TopologyEditorReducerTests.swift` (drei Dateisystem-Tests, als Fälle) | übertragen und erweitert: 11 Fälle, Ergebnis aus dem Swift-Kern | | `test/strings.test.ts`, `test/strings.*.json` | — | neu: Fälle und ganze Zeichenmengen, Ergebnis aus dem Swift-Kern | | `test/engine.test.ts` | `TopologyNetworkRuntimeEngineTests.swift` (21 von 72 Tests) | übertragen; `nextInt`-Referenzwerte an OpenJDK 21 gemessen | -| `test/oracle.test.ts`, `test/scenarios/` | — | neu: 7 Szenarien (davon 2 UDP), Ergebnis mit dem Swift-Kern abgeglichen (`tools/swift-oracle`); Schritte `bindUdp`, `sendUdp`, `receiveUdp`, `closeSocket` | +| `test/oracle.test.ts`, `test/scenarios/` | — | neu: 10 Szenarien (davon 2 UDP, 3 TCP), Ergebnis mit dem Swift-Kern abgeglichen (`tools/swift-oracle`); Schritte für UDP und TCP | | `test/routeTable.test.ts` | `TopologyJavaRouteTableTests.swift` (8 von 12 Tests) | übertragen; Geometrie- und Reducer-Tests folgen mit Editor und Dokument | ## packages/fls diff --git a/packages/core/src/runtime/engine.ts b/packages/core/src/runtime/engine.ts index 31f70a3..9e5a183 100644 --- a/packages/core/src/runtime/engine.ts +++ b/packages/core/src/runtime/engine.ts @@ -16,9 +16,10 @@ // // "UDP sockets and Router RIP" (lines ~4472–5187, the // UDP sockets; RIP not yet) +// "Java-compatible TCP sockets" (lines ~5187–5913) // // Not ported yet — each place throws NotPortedError instead of guessing: -// gateway NAT, TCP delivery, RIP routing, remote links. DHCP is not in the +// gateway NAT, RIP routing, remote links. DHCP is not in the // snapshot yet, so Swift's DHCP handling of a datagram has nothing to do. import { compareIds, type Id } from '../ids.js'; @@ -51,6 +52,8 @@ import { type IcmpMessage, type IcmpMessageKind, type IPv4Packet, + type TcpSegment, + type TcpSocketState, type UdpDatagram, } from './packets.js'; import { JavaCompatibleRandom } from './random.js'; @@ -232,7 +235,7 @@ export type RuntimePhase = 'stopped' | 'running'; export type SocketProtocol = 'udp' | 'tcp'; -/** Swift's TopologyRuntimeSocketRecord (UDP so far). */ +/** Swift's TopologyRuntimeSocketRecord. */ export interface SocketRecord { readonly id: Id; readonly nodeId: Id; @@ -242,6 +245,39 @@ export interface SocketRecord { readonly localPort: number; remoteIPAddress: string | undefined; remotePort: number | undefined; + /** TCP only. */ + tcpState: TcpSocketState | undefined; + /** A socket a TCP listener accepted: that listener. */ + readonly parentListenerSocketId: Id | undefined; +} + +/** Swift's TopologyRuntimeTCPSessionRecord; sequence numbers are unsigned 32-bit. */ +export interface TcpSession { + readonly id: Id; + readonly socketId: Id; + state: TcpSocketState; + sendAttempts: number; + nextSendSequenceNumber: number; + lastSentSequenceNumber: number; + remoteSequenceNumber: number; + lastAcknowledgedSequenceNumber: number | undefined; + lastSentSegment: TcpSegment | undefined; + receiveAssembly: Uint8Array; + receivedMessages: Uint8Array[]; +} + +export type TcpConnectionResult = 'connected' | 'invalidSocket' | 'unreachable' | 'timedOut'; + +export const TCP_MAXIMUM_SEGMENT_SIZE = 1_460; +export const TCP_MAXIMUM_SEND_ATTEMPTS = 3; +export const TCP_ROUND_TRIP_TIME_MILLISECONDS = 2_500; +export const TCP_DEFAULT_TIMEOUT_MILLISECONDS = TCP_MAXIMUM_SEND_ATTEMPTS * TCP_ROUND_TRIP_TIME_MILLISECONDS; +export const TCP_EPHEMERAL_PORT_LOWER_BOUND = 49_152; +export const TCP_EPHEMERAL_PORT_UPPER_BOUND_EXCLUSIVE = 65_535; + +/** Addition modulo 2^32, as Swift's `&+` on UInt32. */ +function uint32Add(value: number, addend: number): number { + return (value + addend) >>> 0; } /** A datagram waiting in a UDP socket's queue. */ @@ -281,7 +317,10 @@ export interface RuntimeState { firewallDecisions: FirewallDecision[]; socketsById: Map; udpReceiveQueuesBySocketId: Map; + tcpSessionsById: Map; + tcpAcceptedSocketIdsByListenerId: Map; nextSocketSequenceNumber: number; + nextTcpInitialSequenceValue: number; nextEventSequenceNumber: number; nextFrameIdentity: number; nextPacketIdentity: number; @@ -308,7 +347,10 @@ function initialState(seed: bigint): RuntimeState { firewallDecisions: [], socketsById: new Map(), udpReceiveQueuesBySocketId: new Map(), + tcpSessionsById: new Map(), + tcpAcceptedSocketIdsByListenerId: new Map(), nextSocketSequenceNumber: 1, + nextTcpInitialSequenceValue: 1, nextEventSequenceNumber: 0, nextFrameIdentity: 1, nextPacketIdentity: 1, @@ -443,6 +485,8 @@ export class NetworkRuntimeEngine { state.icmpObservationsByNodeId.clear(); state.socketsById.clear(); state.udpReceiveQueuesBySocketId.clear(); + state.tcpSessionsById.clear(); + state.tcpAcceptedSocketIdsByListenerId.clear(); state.firewallDecisions = []; return [this.output({ type: 'stopped' })]; } @@ -617,7 +661,8 @@ export class NetworkRuntimeEngine { case 'dhcpTimeout': throw new NotPortedError('DHCP client'); case 'tcpTimeout': - throw new NotPortedError('TCP timeouts'); + this.handleTcpTimeout(kind.sessionId); + return; case 'remoteLinkDelivery': case 'lanRemoteLinkTransmission': throw new NotPortedError('remote links'); @@ -676,8 +721,7 @@ export class NetworkRuntimeEngine { ) { return undefined; } - const id = deterministicSocketId(state.nextSocketSequenceNumber); - state.nextSocketSequenceNumber += 1; + const id = this.allocateSocketId(); state.socketsById.set(id, { id, nodeId, @@ -686,6 +730,8 @@ export class NetworkRuntimeEngine { localPort: reservedPort, remoteIPAddress: options.remoteIPAddress, remotePort: options.remotePort, + tcpState: undefined, + parentListenerSocketId: undefined, }); state.udpReceiveQueuesBySocketId.set(id, []); return id; @@ -709,15 +755,38 @@ export class NetworkRuntimeEngine { } closeSocket(socketId: Id): void { - if (this.stateValue.socketsById.get(socketId)?.protocol === 'tcp') throw new NotPortedError('TCP sockets'); + if (this.stateValue.socketsById.get(socketId)?.protocol === 'tcp') { + this.closeTcpSocket(socketId); + return; + } this.stateValue.socketsById.delete(socketId); this.stateValue.udpReceiveQueuesBySocketId.delete(socketId); } - /** Forgets a socket without closing it (Swift's discardSocket; TCP children once TCP is ported). */ + /** Forgets a socket without closing it, with the sockets a TCP listener accepted. */ discardSocket(socketId: Id): void { - this.stateValue.socketsById.delete(socketId); - this.stateValue.udpReceiveQueuesBySocketId.delete(socketId); + const state = this.stateValue; + const children = state.tcpAcceptedSocketIdsByListenerId.get(socketId) ?? []; + state.tcpAcceptedSocketIdsByListenerId.delete(socketId); + for (const child of children) { + state.socketsById.delete(child); + state.tcpSessionsById.delete(child); + } + state.socketsById.delete(socketId); + state.tcpSessionsById.delete(socketId); + state.udpReceiveQueuesBySocketId.delete(socketId); + for (const [listener, accepted] of state.tcpAcceptedSocketIdsByListenerId) { + state.tcpAcceptedSocketIdsByListenerId.set( + listener, + accepted.filter((id) => id !== socketId), + ); + } + } + + private allocateSocketId(): Id { + const id = deterministicSocketId(this.stateValue.nextSocketSequenceNumber); + this.stateValue.nextSocketSequenceNumber += 1; + return id; } /** @@ -851,6 +920,621 @@ export class NetworkRuntimeEngine { }); } + // ── TCP sockets ────────────────────────────────────────────────────────── + + /** A listening TCP socket; undefined while stopped, when the port is taken or the address is not the node's. */ + openTcpServerSocket(nodeId: Id, localPort: number, localIPAddress?: string): Id | undefined { + const state = this.stateValue; + if ( + state.phase !== 'running' || + this.isTcpPortReserved(nodeId, localPort) || + (localIPAddress !== undefined && !this.networkInterfaces(nodeId).some((each) => each.ipAddress === localIPAddress)) + ) { + return undefined; + } + const id = this.allocateSocketId(); + state.socketsById.set(id, { + id, + nodeId, + protocol: 'tcp', + localIPAddress, + localPort, + remoteIPAddress: undefined, + remotePort: undefined, + tcpState: 'LISTEN', + parentListenerSocketId: undefined, + }); + state.tcpSessionsById.set(id, this.makeTcpSession(id, 'LISTEN')); + state.tcpAcceptedSocketIdsByListenerId.set(id, []); + this.recordTcpStateTransition(id, 'CLOSED', 'LISTEN'); + return id; + } + + /** A closed TCP client socket towards the remote end, on the given or a free port. */ + openTcpClientSocket( + nodeId: Id, + remoteIPAddress: string, + remotePort: number, + options: { localIPAddress?: string; localPort?: number } = {}, + ): Id | undefined { + const state = this.stateValue; + if (state.phase !== 'running') return undefined; + let localIPAddress: string | undefined; + if (options.localIPAddress !== undefined) { + if (!this.networkInterfaces(nodeId).some((each) => each.ipAddress === options.localIPAddress)) return undefined; + localIPAddress = options.localIPAddress; + } else { + const route = this.routeForPacket(nodeId, remoteIPAddress); + localIPAddress = route.type === 'egress' ? route.interface.ipAddress : this.networkInterfaces(nodeId)[0]?.ipAddress; + } + if (localIPAddress === undefined) return undefined; + let localPort: number; + if (options.localPort !== undefined) { + if (this.isTcpPortReserved(nodeId, options.localPort)) return undefined; + localPort = options.localPort; + } else { + const port = this.reserveFreeTcpPort(nodeId); + if (port === undefined) return undefined; + localPort = port; + } + const id = this.allocateSocketId(); + state.socketsById.set(id, { + id, + nodeId, + protocol: 'tcp', + localIPAddress, + localPort, + remoteIPAddress, + remotePort, + tcpState: 'CLOSED', + parentListenerSocketId: undefined, + }); + state.tcpSessionsById.set(id, this.makeTcpSession(id, 'CLOSED')); + return id; + } + + /** A port held by an open (not closed) TCP socket that is no listener's child. */ + isTcpPortReserved(nodeId: Id, port: number): boolean { + for (const socket of this.stateValue.socketsById.values()) { + if ( + socket.nodeId === nodeId && + socket.protocol === 'tcp' && + socket.localPort === port && + socket.parentListenerSocketId === undefined && + socket.tcpState !== 'CLOSED' + ) { + return true; + } + } + return false; + } + + connectTcp(socketId: Id): boolean { + return this.connectTcpWithResult(socketId) === 'connected'; + } + + /** The three-way handshake from a closed client socket, waiting on the virtual clock as Java blocks. */ + connectTcpWithResult(socketId: Id): TcpConnectionResult { + const state = this.stateValue; + const socket = state.socketsById.get(socketId); + if ( + socket === undefined || + socket.protocol !== 'tcp' || + socket.parentListenerSocketId !== undefined || + socket.remoteIPAddress === undefined || + socket.remotePort === undefined || + socket.tcpState !== 'CLOSED' || + [...state.socketsById.values()].some( + (other) => + other.id !== socketId && + other.nodeId === socket.nodeId && + other.protocol === 'tcp' && + other.localPort === socket.localPort && + other.parentListenerSocketId === undefined && + other.tcpState !== 'CLOSED', + ) + ) { + return 'invalidSocket'; + } + this.updateTcpState(socketId, 'SYN_SENT'); + this.resetTcpSendAttempts(socketId); + const initialDelivery = this.transmitTcpSegment(socketId, TCP_FLAG.synchronize, new Uint8Array(), 0, 'TCP SYN'); + const waitedForTimeout = this.advanceTcpUntilSettled(socketId, { waitingStates: ['SYN_SENT'] }); + if (state.socketsById.get(socketId)?.tcpState === 'ESTABLISHED') return 'connected'; + if (initialDelivery === undefined || initialDelivery.type !== 'delivered') return 'unreachable'; + return waitedForTimeout ? 'timedOut' : 'unreachable'; + } + + /** Sends in segments of at most TCP_MAXIMUM_SEGMENT_SIZE bytes, each acknowledged before the next. */ + sendTcp(socketId: Id, payload: Uint8Array): boolean { + const state = this.stateValue; + if (state.socketsById.get(socketId)?.tcpState !== 'ESTABLISHED') return false; + const chunks: Uint8Array[] = []; + if (payload.length === 0) { + chunks.push(new Uint8Array()); + } else { + for (let offset = 0; offset < payload.length; offset += TCP_MAXIMUM_SEGMENT_SIZE) { + chunks.push(payload.subarray(offset, Math.min(offset + TCP_MAXIMUM_SEGMENT_SIZE, payload.length))); + } + } + for (const [index, chunk] of chunks.entries()) { + if (state.socketsById.get(socketId)?.tcpState !== 'ESTABLISHED') return false; + this.resetTcpSendAttempts(socketId); + const flags = index === chunks.length - 1 ? TCP_FLAG.push : 0; + this.transmitTcpSegment(socketId, flags, chunk, 0, `TCP data segment ${index + 1}/${chunks.length}`); + this.advanceTcpUntilSettled(socketId, { waitingForAcknowledgement: true }); + const session = state.tcpSessionsById.get(socketId); + if (session === undefined || session.state !== 'ESTABLISHED' || session.lastSentSegment !== undefined) return false; + } + return true; + } + + /** The oldest whole message (up to a PSH) received on the socket. */ + receiveTcp(socketId: Id): Uint8Array | undefined { + const session = this.stateValue.tcpSessionsById.get(socketId); + if (session === undefined || session.receivedMessages.length === 0) return undefined; + return session.receivedMessages.shift(); + } + + closeTcpSocket(socketId: Id): void { + const socket = this.stateValue.socketsById.get(socketId); + if (socket === undefined || socket.protocol !== 'tcp' || socket.tcpState === undefined) return; + switch (socket.tcpState) { + case 'LISTEN': + case 'SYN_SENT': + this.updateTcpState(socketId, 'CLOSED'); + this.clearTcpPendingTransmission(socketId); + return; + case 'ESTABLISHED': + case 'SYN_RCVD': + this.updateTcpState(socketId, 'FIN_WAIT_1'); + this.resetTcpSendAttempts(socketId); + this.transmitTcpSegment(socketId, TCP_FLAG.finish, new Uint8Array(), 0, 'TCP FIN'); + return; + case 'CLOSE_WAIT': + this.updateTcpState(socketId, 'LAST_ACK'); + this.resetTcpSendAttempts(socketId); + this.transmitTcpSegment(socketId, TCP_FLAG.finish, new Uint8Array(), 0, 'TCP FIN after CLOSE_WAIT'); + return; + default: + return; + } + } + + /** The socket at the other end of a connection, the first by id. */ + peerTcpSocketId(socketId: Id): Id | undefined { + const socket = this.stateValue.socketsById.get(socketId); + if ( + socket === undefined || + socket.protocol !== 'tcp' || + socket.localIPAddress === undefined || + socket.remoteIPAddress === undefined || + socket.remotePort === undefined + ) { + return undefined; + } + return [...this.stateValue.socketsById.values()] + .filter( + (candidate) => + candidate.id !== socketId && + candidate.protocol === 'tcp' && + candidate.tcpState !== 'LISTEN' && + candidate.localIPAddress === socket.remoteIPAddress && + candidate.localPort === socket.remotePort && + candidate.remoteIPAddress === socket.localIPAddress && + candidate.remotePort === socket.localPort, + ) + .sort((lhs, rhs) => compareIds(lhs.id, rhs.id))[0]?.id; + } + + /** Removes a closed TCP socket; false when it is not one. */ + cleanClosedTcpSocket(socketId: Id): boolean { + const state = this.stateValue; + const socket = state.socketsById.get(socketId); + if (socket?.protocol !== 'tcp' || socket.tcpState !== 'CLOSED') return false; + this.cancelTcpTimeouts(socketId); + state.socketsById.delete(socketId); + state.tcpSessionsById.delete(socketId); + state.tcpAcceptedSocketIdsByListenerId.delete(socketId); + for (const [listener, accepted] of state.tcpAcceptedSocketIdsByListenerId) { + state.tcpAcceptedSocketIdsByListenerId.set( + listener, + accepted.filter((id) => id !== socketId), + ); + } + return true; + } + + private deliverTcp(packet: IPv4Packet, segment: TcpSegment, nodeId: Id, networkInterface: NetworkInterface): void { + const state = this.stateValue; + this.recordTrace({ + packetIdentity: packet.identity, + nodeId, + interfaceId: networkInterface.portId, + direction: 'local', + layer: 'transport', + operation: 'accepted', + beforeHeaders: tcpHeaders(segment), + detail: 'TCP segment received', + }); + const byId = (lhs: SocketRecord, rhs: SocketRecord) => compareIds(lhs.id, rhs.id); + const sockets = [...state.socketsById.values()]; + const exact = sockets + .filter( + (socket) => + socket.nodeId === nodeId && + socket.protocol === 'tcp' && + socket.tcpState !== 'LISTEN' && + socket.tcpState !== 'CLOSED' && + socket.localPort === segment.destinationPort && + (socket.localIPAddress === undefined || socket.localIPAddress === packet.receiverIPAddress) && + socket.remoteIPAddress === packet.senderIPAddress && + socket.remotePort === segment.sourcePort, + ) + .sort(byId)[0]; + if (exact !== undefined) { + this.processIncomingTcpSegment(exact.id, segment); + return; + } + const listener = sockets + .filter( + (socket) => + socket.nodeId === nodeId && + socket.protocol === 'tcp' && + socket.tcpState === 'LISTEN' && + socket.localPort === segment.destinationPort && + (socket.localIPAddress === undefined || socket.localIPAddress === packet.receiverIPAddress), + ) + .sort(byId)[0]; + if (listener === undefined || (segment.flags & TCP_FLAG.synchronize) === 0 || (segment.flags & TCP_FLAG.acknowledgement) !== 0) { + this.recordTrace({ + packetIdentity: packet.identity, + nodeId, + interfaceId: networkInterface.portId, + direction: 'local', + layer: 'transport', + operation: 'dropped', + beforeHeaders: tcpHeaders(segment), + detail: 'TCP destination port closed', + }); + return; + } + const acceptedId = this.allocateSocketId(); + state.socketsById.set(acceptedId, { + id: acceptedId, + nodeId, + protocol: 'tcp', + localIPAddress: packet.receiverIPAddress, + localPort: segment.destinationPort, + remoteIPAddress: packet.senderIPAddress, + remotePort: segment.sourcePort, + tcpState: 'SYN_RCVD', + parentListenerSocketId: listener.id, + }); + const session = this.makeTcpSession(acceptedId, 'SYN_RCVD'); + session.remoteSequenceNumber = nextTcpSequenceNumber(segment); + state.tcpSessionsById.set(acceptedId, session); + getOrCreate(state.tcpAcceptedSocketIdsByListenerId, listener.id, () => []).push(acceptedId); + this.recordTcpStateTransition(acceptedId, 'LISTEN', 'SYN_RCVD'); + this.resetTcpSendAttempts(acceptedId); + this.transmitTcpSegment( + acceptedId, + TCP_FLAG.synchronize | TCP_FLAG.acknowledgement, + new Uint8Array(), + session.remoteSequenceNumber, + 'TCP SYN+ACK', + ); + } + + private processIncomingTcpSegment(socketId: Id, segment: TcpSegment): void { + const socket = this.stateValue.socketsById.get(socketId); + if (socket === undefined || socket.tcpState === undefined) return; + const has = (flag: number) => (segment.flags & flag) !== 0; + if (has(TCP_FLAG.reset)) { + this.clearTcpPendingTransmission(socketId); + this.updateTcpState(socketId, 'CLOSED'); + return; + } + switch (socket.tcpState) { + case 'SYN_SENT': { + if ( + !has(TCP_FLAG.synchronize) || + !has(TCP_FLAG.acknowledgement) || + !this.acknowledgeTcpIfExpected(socketId, segment.acknowledgementNumber) + ) { + this.updateTcpState(socketId, 'CLOSED'); + return; + } + const session = this.stateValue.tcpSessionsById.get(socketId); + if (session !== undefined) session.remoteSequenceNumber = nextTcpSequenceNumber(segment); + this.updateTcpState(socketId, 'ESTABLISHED'); + this.sendTcpAcknowledgement(socketId, segment); + return; + } + case 'SYN_RCVD': + if (!has(TCP_FLAG.acknowledgement) || !this.acknowledgeTcpIfExpected(socketId, segment.acknowledgementNumber)) return; + this.updateTcpState(socketId, 'ESTABLISHED'); + return; + case 'ESTABLISHED': + if (has(TCP_FLAG.finish)) { + this.sendTcpAcknowledgement(socketId, segment); + this.updateTcpState(socketId, 'CLOSE_WAIT'); + } else if (segment.payload.length > 0 || has(TCP_FLAG.push)) { + this.receiveTcpPayload(socketId, segment); + } else if (has(TCP_FLAG.acknowledgement)) { + this.acknowledgeTcpIfExpected(socketId, segment.acknowledgementNumber); + } + return; + case 'FIN_WAIT_1': { + const hasAck = has(TCP_FLAG.acknowledgement); + const hasFin = has(TCP_FLAG.finish); + if (hasAck) this.acknowledgeTcpIfExpected(socketId, segment.acknowledgementNumber); + if (hasAck && hasFin) { + this.sendTcpAcknowledgement(socketId, segment); + this.enterTcpTimeWait(socketId); + } else if (hasAck) { + this.updateTcpState(socketId, 'FIN_WAIT_2'); + } else if (hasFin) { + this.sendTcpAcknowledgement(socketId, segment); + this.updateTcpState(socketId, 'CLOSING'); + } + return; + } + case 'FIN_WAIT_2': + if (has(TCP_FLAG.finish)) { + this.sendTcpAcknowledgement(socketId, segment); + this.enterTcpTimeWait(socketId); + } + return; + case 'CLOSING': + if (has(TCP_FLAG.acknowledgement) && this.acknowledgeTcpIfExpected(socketId, segment.acknowledgementNumber)) { + this.enterTcpTimeWait(socketId); + } + return; + case 'LAST_ACK': + if (has(TCP_FLAG.acknowledgement) && this.acknowledgeTcpIfExpected(socketId, segment.acknowledgementNumber)) { + this.updateTcpState(socketId, 'CLOSED'); + } + return; + default: + return; + } + } + + private receiveTcpPayload(socketId: Id, segment: TcpSegment): void { + const session = this.stateValue.tcpSessionsById.get(socketId); + if (session === undefined) return; + const nextRemoteSequence = nextTcpSequenceNumber(segment); + if (nextRemoteSequence > session.remoteSequenceNumber) { + session.remoteSequenceNumber = nextRemoteSequence; + session.receiveAssembly = concatBytes(session.receiveAssembly, segment.payload); + if ((segment.flags & TCP_FLAG.push) !== 0) { + session.receivedMessages.push(session.receiveAssembly); + session.receiveAssembly = new Uint8Array(); + } + } + this.sendTcpAcknowledgement(socketId, segment); + } + + private sendTcpAcknowledgement(socketId: Id, segment: TcpSegment): void { + this.transmitTcpSegment(socketId, TCP_FLAG.acknowledgement, new Uint8Array(), nextTcpSequenceNumber(segment), 'TCP ACK'); + } + + private transmitTcpSegment( + socketId: Id, + flags: number, + payload: Uint8Array, + acknowledgementNumber: number, + detail: string, + retransmission = false, + ): IPv4DeliveryResult | undefined { + const state = this.stateValue; + const socket = state.socketsById.get(socketId); + const session = state.tcpSessionsById.get(socketId); + if (socket === undefined || socket.remoteIPAddress === undefined || socket.remotePort === undefined || session === undefined) { + return undefined; + } + let segment: TcpSegment; + if (retransmission && session.lastSentSegment !== undefined) { + segment = session.lastSentSegment; + session.sendAttempts += 1; + } else { + segment = { + sourcePort: socket.localPort, + destinationPort: socket.remotePort, + sequenceNumber: session.nextSendSequenceNumber, + acknowledgementNumber, + flags, + payload, + }; + session.lastSentSequenceNumber = segment.sequenceNumber; + session.nextSendSequenceNumber = nextTcpSequenceNumber(segment); + if (tcpSegmentRequiresAcknowledgement(segment)) { + session.lastSentSegment = segment; + session.sendAttempts = 1; + } + } + const interfaces = this.networkInterfaces(socket.nodeId); + let networkInterface = + socket.localIPAddress === undefined ? undefined : interfaces.find((each) => each.ipAddress === socket.localIPAddress); + if (networkInterface === undefined) { + const route = this.routeForPacket(socket.nodeId, socket.remoteIPAddress); + networkInterface = route.type === 'egress' ? route.interface : interfaces[0]; + } + if (networkInterface === undefined) return undefined; + const packet: IPv4Packet = { + identity: this.allocatePacketIdentity(), + senderIPAddress: networkInterface.ipAddress, + receiverIPAddress: socket.remoteIPAddress, + timeToLive: 64, + protocol: 'tcp', + payload: { kind: 'tcp', segment }, + }; + this.recordTrace({ + packetIdentity: packet.identity, + nodeId: socket.nodeId, + interfaceId: networkInterface.portId, + direction: 'outbound', + layer: 'transport', + operation: retransmission ? 'retransmitted' : 'sent', + afterHeaders: tcpHeaders(segment), + detail: retransmission ? `${detail} retransmission attempt ${session.sendAttempts}` : detail, + }); + const delivery = this.sendIPv4Packet(socket.nodeId, packet, networkInterface.portId); + if (state.tcpSessionsById.get(socketId)?.lastSentSegment !== undefined) this.scheduleTcpTimeoutIfNeeded(socketId); + return delivery; + } + + private scheduleTcpTimeoutIfNeeded(socketId: Id): void { + const pending = this.stateValue.pendingEvents.some((event) => event.kind.kind === 'tcpTimeout' && event.kind.sessionId === socketId); + if (pending) return; + this.schedule(this.stateValue.currentTimeMilliseconds + TCP_DEFAULT_TIMEOUT_MILLISECONDS, { kind: 'tcpTimeout', sessionId: socketId }); + } + + private handleTcpTimeout(socketId: Id): void { + const socket = this.stateValue.socketsById.get(socketId); + if (socket === undefined || socket.tcpState === undefined) return; + if (socket.tcpState === 'TIME_WAIT') { + this.updateTcpState(socketId, 'CLOSED'); + this.clearTcpPendingTransmission(socketId); + return; + } + const session = this.stateValue.tcpSessionsById.get(socketId); + const last = session?.lastSentSegment; + if (session === undefined || last === undefined) return; + if (session.sendAttempts >= TCP_MAXIMUM_SEND_ATTEMPTS) { + this.clearTcpPendingTransmission(socketId); + this.updateTcpState(socketId, 'CLOSED'); + return; + } + const synchronize = (last.flags & TCP_FLAG.synchronize) !== 0; + const baseDetail = synchronize + ? (last.flags & TCP_FLAG.acknowledgement) === 0 + ? 'TCP SYN' + : 'TCP SYN+ACK' + : (last.flags & TCP_FLAG.finish) !== 0 + ? 'TCP FIN' + : 'TCP data'; + this.transmitTcpSegment(socketId, last.flags, last.payload, last.acknowledgementNumber, baseDetail, true); + } + + private acknowledgeTcpIfExpected(socketId: Id, acknowledgementNumber: number): boolean { + const session = this.stateValue.tcpSessionsById.get(socketId); + if (session === undefined || session.lastSentSegment === undefined || acknowledgementNumber !== session.nextSendSequenceNumber) { + return false; + } + session.lastAcknowledgedSequenceNumber = acknowledgementNumber; + session.lastSentSegment = undefined; + this.cancelTcpTimeouts(socketId); + return true; + } + + private clearTcpPendingTransmission(socketId: Id): void { + const session = this.stateValue.tcpSessionsById.get(socketId); + if (session !== undefined) session.lastSentSegment = undefined; + this.cancelTcpTimeouts(socketId); + } + + private cancelTcpTimeouts(socketId: Id): void { + this.stateValue.pendingEvents = this.stateValue.pendingEvents.filter( + (event) => !(event.kind.kind === 'tcpTimeout' && event.kind.sessionId === socketId), + ); + } + + private enterTcpTimeWait(socketId: Id): void { + this.clearTcpPendingTransmission(socketId); + this.updateTcpState(socketId, 'TIME_WAIT'); + this.schedule(this.stateValue.currentTimeMilliseconds + TCP_ROUND_TRIP_TIME_MILLISECONDS, { kind: 'tcpTimeout', sessionId: socketId }); + } + + /** + * Advances the clock to the socket's timeouts while it waits in one of + * the states or for an acknowledgement; whether it advanced at all. + */ + private advanceTcpUntilSettled( + socketId: Id, + options: { waitingStates?: readonly TcpSocketState[]; waitingForAcknowledgement?: boolean }, + ): boolean { + let advancedToTimeout = false; + while (this.stateValue.phase === 'running') { + const socket = this.stateValue.socketsById.get(socketId); + if (socket === undefined || socket.tcpState === undefined) return advancedToTimeout; + const waitingOnState = options.waitingStates?.includes(socket.tcpState) === true; + const waitingOnAck = + options.waitingForAcknowledgement === true && this.stateValue.tcpSessionsById.get(socketId)?.lastSentSegment !== undefined; + if (!waitingOnState && !waitingOnAck) return advancedToTimeout; + const deadlines = this.stateValue.pendingEvents + .filter((event) => event.kind.kind === 'tcpTimeout' && event.kind.sessionId === socketId) + .map((event) => event.deadlineMilliseconds); + if (deadlines.length === 0) return advancedToTimeout; + advancedToTimeout = true; + this.advance(Math.min(...deadlines)); + } + return advancedToTimeout; + } + + private updateTcpState(socketId: Id, newState: TcpSocketState): void { + const socket = this.stateValue.socketsById.get(socketId); + const oldState = socket?.tcpState; + if (socket === undefined || oldState === undefined || oldState === newState) return; + socket.tcpState = newState; + const session = this.stateValue.tcpSessionsById.get(socketId); + if (session !== undefined) session.state = newState; + this.recordTcpStateTransition(socketId, oldState, newState); + } + + private recordTcpStateTransition(socketId: Id, oldState: TcpSocketState, newState: TcpSocketState): void { + const socket = this.stateValue.socketsById.get(socketId); + if (socket === undefined) return; + this.recordTrace({ + nodeId: socket.nodeId, + direction: 'local', + layer: 'transport', + operation: 'accepted', + beforeHeaders: [{ name: 'state', value: oldState }], + afterHeaders: [{ name: 'state', value: newState }], + detail: `TCP ${oldState} -> ${newState}`, + }); + } + + private resetTcpSendAttempts(socketId: Id): void { + const session = this.stateValue.tcpSessionsById.get(socketId); + if (session !== undefined) session.sendAttempts = 0; + } + + private reserveFreeTcpPort(nodeId: Id): number | undefined { + const span = TCP_EPHEMERAL_PORT_UPPER_BOUND_EXCLUSIVE - TCP_EPHEMERAL_PORT_LOWER_BOUND; + for (let attempt = 0; attempt < span; attempt++) { + const port = TCP_EPHEMERAL_PORT_LOWER_BOUND + this.tcpPortRandom.nextInt(span); + if (!this.isTcpPortReserved(nodeId, port)) return port; + } + return undefined; + } + + /** Swift: (value mod 2^32) · 1,000,000, truncated to 32 bits. */ + private allocateTcpInitialSequenceNumber(): number { + const value = BigInt(this.stateValue.nextTcpInitialSequenceValue); + this.stateValue.nextTcpInitialSequenceValue += 1; + return Number(BigInt.asUintN(32, (value % 4_294_967_296n) * 1_000_000n)); + } + + private makeTcpSession(socketId: Id, socketState: TcpSocketState): TcpSession { + const initialSequence = this.allocateTcpInitialSequenceNumber(); + return { + id: socketId, + socketId, + state: socketState, + sendAttempts: 0, + nextSendSequenceNumber: initialSequence, + lastSentSequenceNumber: initialSequence, + remoteSequenceNumber: 0, + lastAcknowledgedSequenceNumber: undefined, + lastSentSegment: undefined, + receiveAssembly: new Uint8Array(), + receivedMessages: [], + }; + } + // ── Later slices hook in here ──────────────────────────────────────────── private initializeRipState(): void { @@ -1783,7 +2467,8 @@ export class NetworkRuntimeEngine { interfaceId: networkInterface.portId, packet, }); - throw new NotPortedError('TCP delivery'); + this.deliverTcp(packet, payload.segment, nodeId, networkInterface); + return; } } @@ -2179,6 +2864,47 @@ export function ipv4Headers(packet: IPv4Packet): HeaderField[] { ]; } +function tcpSegmentRequiresAcknowledgement(segment: TcpSegment): boolean { + return ( + (segment.flags & (TCP_FLAG.synchronize | TCP_FLAG.finish | TCP_FLAG.push)) !== 0 || segment.payload.length > 0 + ); +} + +/** The sequence number after the segment: SYN and FIN count one, and each payload byte. */ +export function nextTcpSequenceNumber(segment: TcpSegment): number { + let next = segment.sequenceNumber; + if ((segment.flags & (TCP_FLAG.synchronize | TCP_FLAG.finish)) !== 0) next = uint32Add(next, 1); + return uint32Add(next, segment.payload.length); +} + +function concatBytes(first: Uint8Array, second: Uint8Array): Uint8Array { + const result = new Uint8Array(first.length + second.length); + result.set(first); + result.set(second, first.length); + return result; +} + +export function tcpFlagDescription(flags: number): string { + const names: string[] = []; + if ((flags & TCP_FLAG.finish) !== 0) names.push('FIN'); + if ((flags & TCP_FLAG.synchronize) !== 0) names.push('SYN'); + if ((flags & TCP_FLAG.reset) !== 0) names.push('RST'); + if ((flags & TCP_FLAG.push) !== 0) names.push('PSH'); + if ((flags & TCP_FLAG.acknowledgement) !== 0) names.push('ACK'); + return names.join('+'); +} + +export function tcpHeaders(segment: TcpSegment): HeaderField[] { + return [ + { name: 'sourcePort', value: String(segment.sourcePort) }, + { name: 'destinationPort', value: String(segment.destinationPort) }, + { name: 'sequenceNumber', value: String(segment.sequenceNumber) }, + { name: 'acknowledgementNumber', value: String(segment.acknowledgementNumber) }, + { name: 'flags', value: tcpFlagDescription(segment.flags) }, + { name: 'payloadLength', value: String(segment.payload.length) }, + ]; +} + export function udpHeaders(datagram: UdpDatagram): HeaderField[] { return [ { name: 'sourcePort', value: String(datagram.sourcePort) }, diff --git a/packages/core/test/engine.test.ts b/packages/core/test/engine.test.ts index 0d36202..ec8070b 100644 --- a/packages/core/test/engine.test.ts +++ b/packages/core/test/engine.test.ts @@ -1,7 +1,7 @@ // Ported from filius-ipad ios/FiliusPadTests/TopologyNetworkRuntimeEngineTests.swift: // the event queue, the virtual clock, Java-compatible randomness, restart, // Ethernet/switch/ARP/IPv4/ICMP, routing errors, the firewall, packet loss -// and trace retention, UDP sockets. The remaining Swift tests (TCP, DHCP, +// and trace retention, UDP and TCP sockets. The remaining Swift tests (DHCP, // DNS, RIP, NAT, remote link, packet viewer) follow with their protocol // slices. @@ -21,6 +21,8 @@ import { stableMacAddress, switchConfiguration, TCP_FLAG, + TCP_ROUND_TRIP_TIME_MILLISECONDS, + tcpFlagDescription, topologySnapshot, traceRetentionPolicy, UNSPECIFIED_MAC_ADDRESS, @@ -209,6 +211,25 @@ describe('event queue and virtual clock', () => { engine.handle({ type: 'start', snapshot: topologySnapshot(input), seed: 14, initialTimeMilliseconds: 0 }); expect(engine.bindUdpSocket(nodeId, { localPort: 7 })).toBe(uuid(1)); }); + + it('forgets TCP sessions and accepted sockets on stop', () => { + const [clientId, clientPortId, serverId, serverPortId] = [0x21, 0x22, 0x23, 0x24].map(uuid) as [string, string, string, string]; + const engine = startedEngine({ + nodes: [pc(clientId, clientPortId), pc(serverId, serverPortId)], + links: [link(clientId, clientPortId, serverId, serverPortId)], + deviceConfigurations: new Map([ + [clientId, device('10.3.0.1')], + [serverId, device('10.3.0.2')], + ]), + }); + engine.openTcpServerSocket(serverId, 80); + expect(engine.connectTcp(engine.openTcpClientSocket(clientId, '10.3.0.2', 80)!)).toBe(true); + expect(engine.state.tcpSessionsById.size).toBe(3); + + engine.handle({ type: 'stop' }); + expect(engine.state.tcpSessionsById.size).toBe(0); + expect(engine.state.tcpAcceptedSocketIdsByListenerId.size).toBe(0); + }); }); describe('UDP sockets', () => { @@ -738,3 +759,111 @@ describe('packet loss and trace retention', () => { expect(engine.state.nextTraceIdentity).toBe(7); }); }); + +describe('TCP sockets', () => { + /** Two PCs on one cable, started. */ + const pair = (first: number, second: number, prefix: string) => { + const [clientId, clientPortId, serverId, serverPortId] = [first, first + 0x10, second, second + 0x10].map(uuid) as [ + string, + string, + string, + string, + ]; + const engine = startedEngine({ + nodes: [pc(clientId, clientPortId), pc(serverId, serverPortId)], + links: [link(clientId, clientPortId, serverId, serverPortId)], + deviceConfigurations: new Map([ + [clientId, device(`${prefix}.1`)], + [serverId, device(`${prefix}.2`)], + ]), + }); + return { engine, clientId, serverId }; + }; + + it('makes an established client and an accepted server socket with the three-way handshake', () => { + const { engine, clientId, serverId } = pair(0x1701, 0x1702, '10.17.0'); + const listenerId = engine.openTcpServerSocket(serverId, 8080)!; + const clientSocketId = engine.openTcpClientSocket(clientId, '10.17.0.2', 8080)!; + + expect(engine.connectTcp(clientSocketId)).toBe(true); + const acceptedSocketId = engine.state.tcpAcceptedSocketIdsByListenerId.get(listenerId)![0]!; + expect(engine.state.socketsById.get(clientSocketId)?.tcpState).toBe('ESTABLISHED'); + expect(engine.state.socketsById.get(acceptedSocketId)?.tcpState).toBe('ESTABLISHED'); + expect(engine.state.packetTraces.some((trace) => trace.detail === 'TCP SYN_SENT -> ESTABLISHED')).toBe(true); + expect(engine.state.packetTraces.some((trace) => trace.detail === 'TCP SYN_RCVD -> ESTABLISHED')).toBe(true); + }); + + it("sends segments of Java's MSS and reassembles one message up to the push", () => { + const { engine, clientId, serverId } = pair(0x1721, 0x1722, '10.18.0'); + const listenerId = engine.openTcpServerSocket(serverId, 8081)!; + const clientSocketId = engine.openTcpClientSocket(clientId, '10.18.0.2', 8081)!; + expect(engine.connectTcp(clientSocketId)).toBe(true); + const acceptedSocketId = engine.state.tcpAcceptedSocketIdsByListenerId.get(listenerId)![0]!; + const payload = Uint8Array.from({ length: 3_001 }, (_, index) => index % 251); + + expect(engine.sendTcp(clientSocketId, payload)).toBe(true); + expect(engine.receiveTcp(acceptedSocketId)).toEqual(payload); + const payloadLengths = engine.state.packetTraces + .filter((trace) => trace.detail?.startsWith('TCP data') === true) + .map((trace) => Number(trace.afterHeaders.find((header) => header.name === 'payloadLength')?.value)); + expect(payloadLengths).toEqual([1_460, 1_460, 81]); + }); + + it('retransmits a connection attempt at most three times and releases the port', () => { + const clientId = uuid(0x1741); + const engine = startedEngine({ nodes: [pc(clientId, uuid(0x1751))], links: [], deviceConfigurations: new Map([[clientId, device('10.19.0.1')]]) }); + const socketId = engine.openTcpClientSocket(clientId, '10.19.0.99', 80)!; + const localPort = engine.state.socketsById.get(socketId)!.localPort; + + expect(engine.connectTcp(socketId)).toBe(false); + expect(engine.state.tcpSessionsById.get(socketId)?.sendAttempts).toBe(3); + expect(engine.state.socketsById.get(socketId)?.tcpState).toBe('CLOSED'); + expect(engine.isTcpPortReserved(clientId, localPort)).toBe(false); + expect(engine.state.packetTraces.filter((trace) => trace.detail?.includes('TCP SYN retransmission') === true)).toHaveLength(2); + }); + + it('drops a SYN+ACK at a listening port with no connection of its own', () => { + const { engine, clientId, serverId } = pair(0x1781, 0x1782, '10.21.0'); + const listenerId = engine.openTcpServerSocket(serverId, 7000)!; + const segment = { sourcePort: 80, destinationPort: 7000, sequenceNumber: 5, acknowledgementNumber: 9, flags: TCP_FLAG.synchronize | TCP_FLAG.acknowledgement, payload: new Uint8Array() }; + engine.sendIPv4Packet(clientId, { + identity: engine.allocatePacketIdentity(), + senderIPAddress: '10.21.0.1', + receiverIPAddress: '10.21.0.2', + timeToLive: 64, + protocol: 'tcp', + payload: { kind: 'tcp', segment }, + }); + engine.handle({ type: 'advance', toMilliseconds: engine.state.currentTimeMilliseconds + 1_000 }); + + expect(engine.state.tcpAcceptedSocketIdsByListenerId.get(listenerId)).toEqual([]); + expect(engine.state.packetTraces.some((trace) => trace.detail === 'TCP destination port closed')).toBe(true); + }); + + it('names the flags of a segment in Swift\'s order', () => { + expect(tcpFlagDescription(TCP_FLAG.acknowledgement | TCP_FLAG.push | TCP_FLAG.reset | TCP_FLAG.synchronize | TCP_FLAG.finish)).toBe( + 'FIN+SYN+RST+PSH+ACK', + ); + expect(tcpFlagDescription(TCP_FLAG.synchronize | TCP_FLAG.acknowledgement)).toBe('SYN+ACK'); + expect(tcpFlagDescription(0)).toBe(''); + }); + + it("closes with Java's FIN states, and TIME_WAIT releases both ends", () => { + const { engine, clientId, serverId } = pair(0x1761, 0x1762, '10.20.0'); + const listenerId = engine.openTcpServerSocket(serverId, 9090)!; + const clientSocketId = engine.openTcpClientSocket(clientId, '10.20.0.2', 9090)!; + expect(engine.connectTcp(clientSocketId)).toBe(true); + const serverSocketId = engine.state.tcpAcceptedSocketIdsByListenerId.get(listenerId)![0]!; + + engine.closeTcpSocket(clientSocketId); + expect(engine.state.socketsById.get(clientSocketId)?.tcpState).toBe('FIN_WAIT_2'); + expect(engine.state.socketsById.get(serverSocketId)?.tcpState).toBe('CLOSE_WAIT'); + engine.closeTcpSocket(serverSocketId); + expect(engine.state.socketsById.get(clientSocketId)?.tcpState).toBe('TIME_WAIT'); + expect(engine.state.socketsById.get(serverSocketId)?.tcpState).toBe('CLOSED'); + + engine.handle({ type: 'advance', toMilliseconds: engine.state.currentTimeMilliseconds + TCP_ROUND_TRIP_TIME_MILLISECONDS }); + expect(engine.state.socketsById.get(clientSocketId)?.tcpState).toBe('CLOSED'); + expect(engine.state.socketsById.get(listenerId)?.tcpState).toBe('LISTEN'); + }); +}); diff --git a/packages/core/test/oracle.test.ts b/packages/core/test/oracle.test.ts index 16b1f41..f0025e4 100644 --- a/packages/core/test/oracle.test.ts +++ b/packages/core/test/oracle.test.ts @@ -75,6 +75,9 @@ interface Scenario { socket?: string; payload?: string; timeout?: number; + // TCP: the payload repeated this many times, for messages longer than a segment. + repeatCount?: number; + localPort?: number; }[]; } @@ -281,6 +284,37 @@ function run(scenario: Scenario): Record { ); break; } + case 'openTcpServer': + results.push(engine.openTcpServerSocket(step.node!, step.port!, step.localIp) ?? null); + break; + case 'openTcpClient': + results.push( + engine.openTcpClientSocket(step.node!, step.target!, step.port!, { + ...(step.localIp === undefined ? {} : { localIPAddress: step.localIp }), + ...(step.localPort === undefined ? {} : { localPort: step.localPort }), + }) ?? null, + ); + break; + case 'connectTcp': + results.push(engine.connectTcpWithResult(step.socket!)); + break; + case 'sendTcp': + results.push(engine.sendTcp(step.socket!, new TextEncoder().encode((step.payload ?? '').repeat(step.repeatCount ?? 1)))); + break; + case 'receiveTcp': { + const message = engine.receiveTcp(step.socket!); + results.push(message === undefined ? null : new TextDecoder().decode(message)); + break; + } + case 'acceptedTcp': + results.push(engine.state.tcpAcceptedSocketIdsByListenerId.get(step.socket!) ?? []); + break; + case 'peerTcp': + results.push(engine.peerTcpSocketId(step.socket!) ?? null); + break; + case 'cleanTcp': + results.push(engine.cleanClosedTcpSocket(step.socket!)); + break; case 'closeSocket': engine.closeSocket(step.socket!); results.push(!engine.state.socketsById.has(step.socket!)); @@ -316,6 +350,19 @@ function run(scenario: Scenario): Record { remoteIp: socket.remoteIPAddress ?? null, remotePort: socket.remotePort ?? null, queued: state.udpReceiveQueuesBySocketId.get(socket.id)?.length ?? 0, + tcpState: socket.tcpState ?? null, + parent: socket.parentListenerSocketId === undefined ? null : upper(socket.parentListenerSocketId), + session: ((session) => + session === undefined + ? null + : { + attempts: session.sendAttempts, + next: session.nextSendSequenceNumber, + remote: session.remoteSequenceNumber, + pending: session.lastSentSegment !== undefined, + assembly: session.receiveAssembly.length, + messages: session.receivedMessages.length, + })(state.tcpSessionsById.get(socket.id)), })), firewallDecisions: state.firewallDecisions.map((decision) => ({ packet: decision.packetIdentity, diff --git a/packages/core/test/scenarios/tcp-closing.scenario.json b/packages/core/test/scenarios/tcp-closing.scenario.json new file mode 100644 index 0000000..ae61fdb --- /dev/null +++ b/packages/core/test/scenarios/tcp-closing.scenario.json @@ -0,0 +1,154 @@ +{ + "seed": 33, + "nodes": [ + { + "id": "00000000-0000-0000-0000-000000000101", + "kind": "pc", + "ports": [ + { + "id": "00000000-0000-0000-0000-000000000111", + "label": "eth0" + } + ] + }, + { + "id": "00000000-0000-0000-0000-000000000102", + "kind": "pc", + "ports": [ + { + "id": "00000000-0000-0000-0000-000000000112", + "label": "eth0" + } + ] + }, + { + "id": "00000000-0000-0000-0000-000000000103", + "kind": "pc", + "ports": [ + { + "id": "00000000-0000-0000-0000-000000000113", + "label": "eth0" + } + ] + }, + { + "id": "00000000-0000-0000-0000-000000000104", + "kind": "networkSwitch", + "ports": [ + { + "id": "00000000-0000-0000-0000-000000000121", + "label": "sw1" + }, + { + "id": "00000000-0000-0000-0000-000000000122", + "label": "sw2" + }, + { + "id": "00000000-0000-0000-0000-000000000123", + "label": "sw3" + }, + { + "id": "00000000-0000-0000-0000-000000000124", + "label": "sw4" + } + ] + } + ], + "links": [ + { + "id": "00000000-0000-0000-0000-00000000F001", + "sourceNode": "00000000-0000-0000-0000-000000000101", + "sourcePort": "00000000-0000-0000-0000-000000000111", + "targetNode": "00000000-0000-0000-0000-000000000104", + "targetPort": "00000000-0000-0000-0000-000000000121" + }, + { + "id": "00000000-0000-0000-0000-00000000F002", + "sourceNode": "00000000-0000-0000-0000-000000000102", + "sourcePort": "00000000-0000-0000-0000-000000000112", + "targetNode": "00000000-0000-0000-0000-000000000104", + "targetPort": "00000000-0000-0000-0000-000000000122" + }, + { + "id": "00000000-0000-0000-0000-00000000F003", + "sourceNode": "00000000-0000-0000-0000-000000000103", + "sourcePort": "00000000-0000-0000-0000-000000000113", + "targetNode": "00000000-0000-0000-0000-000000000104", + "targetPort": "00000000-0000-0000-0000-000000000123" + } + ], + "devices": { + "00000000-0000-0000-0000-000000000101": { + "ip": "192.168.0.10", + "mask": "255.255.255.0" + }, + "00000000-0000-0000-0000-000000000102": { + "ip": "192.168.0.20", + "mask": "255.255.255.0" + }, + "00000000-0000-0000-0000-000000000103": { + "ip": "192.168.0.30", + "mask": "255.255.255.0" + } + }, + "switches": { + "00000000-0000-0000-0000-000000000104": { + "ssid": "lab", + "retention": 5000 + } + }, + "steps": [ + { + "op": "openTcpServer", + "node": "00000000-0000-0000-0000-000000000101", + "port": 7 + }, + { + "op": "openTcpClient", + "node": "00000000-0000-0000-0000-000000000102", + "target": "192.168.0.10", + "port": 7, + "localIp": "192.168.0.20" + }, + { + "op": "connectTcp", + "socket": "00000000-0000-0000-0000-000000000002" + }, + { + "op": "sendTcp", + "socket": "00000000-0000-0000-0000-000000000002", + "payload": "" + }, + { + "op": "receiveTcp", + "socket": "00000000-0000-0000-0000-000000000003" + }, + { + "op": "packetLoss", + "enabled": true + }, + { + "op": "closeSocket", + "socket": "00000000-0000-0000-0000-000000000002" + }, + { + "op": "packetLoss", + "enabled": false + }, + { + "op": "closeSocket", + "socket": "00000000-0000-0000-0000-000000000003" + }, + { + "op": "advance", + "to": 30000 + }, + { + "op": "openTcpClient", + "node": "00000000-0000-0000-0000-000000000102", + "target": "192.168.0.10", + "port": 7, + "localIp": "10.0.0.1" + } + ] +} diff --git a/packages/core/test/scenarios/tcp-closing.swift.json b/packages/core/test/scenarios/tcp-closing.swift.json new file mode 100644 index 0000000..0bf0b81 --- /dev/null +++ b/packages/core/test/scenarios/tcp-closing.swift.json @@ -0,0 +1,4255 @@ +{ + "arp" : { + "00000000-0000-0000-0000-000000000101" : { + "192.168.0.20" : "02:00:00:00:01:12" + }, + "00000000-0000-0000-0000-000000000102" : { + "192.168.0.10" : "02:00:00:00:01:11" + }, + "00000000-0000-0000-0000-000000000103" : { + "192.168.0.20" : "02:00:00:00:01:12" + } + }, + "firewallDecisions" : [ + + ], + "icmpObservations" : { + + }, + "pendingEvents" : 0, + "results" : [ + "00000000-0000-0000-0000-000000000001", + "00000000-0000-0000-0000-000000000002", + "connected", + true, + null, + true, + false, + false, + false, + 30000, + null + ], + "sockets" : [ + { + "id" : "00000000-0000-0000-0000-000000000001", + "localIp" : null, + "localPort" : 7, + "node" : "00000000-0000-0000-0000-000000000101", + "parent" : null, + "protocol" : "tcp", + "queued" : 0, + "remoteIp" : null, + "remotePort" : null, + "session" : { + "assembly" : 0, + "attempts" : 0, + "messages" : 0, + "next" : 1000000, + "pending" : false, + "remote" : 0 + }, + "tcpState" : "LISTEN" + }, + { + "id" : "00000000-0000-0000-0000-000000000002", + "localIp" : "192.168.0.20", + "localPort" : 54520, + "node" : "00000000-0000-0000-0000-000000000102", + "parent" : null, + "protocol" : "tcp", + "queued" : 0, + "remoteIp" : "192.168.0.10", + "remotePort" : 7, + "session" : { + "assembly" : 0, + "attempts" : 2, + "messages" : 0, + "next" : 2000002, + "pending" : false, + "remote" : 3000001 + }, + "tcpState" : "CLOSED" + }, + { + "id" : "00000000-0000-0000-0000-000000000003", + "localIp" : "192.168.0.10", + "localPort" : 7, + "node" : "00000000-0000-0000-0000-000000000101", + "parent" : "00000000-0000-0000-0000-000000000001", + "protocol" : "tcp", + "queued" : 0, + "remoteIp" : "192.168.0.20", + "remotePort" : 54520, + "session" : { + "assembly" : 0, + "attempts" : 1, + "messages" : 0, + "next" : 3000002, + "pending" : false, + "remote" : 2000001 + }, + "tcpState" : "CLOSED" + } + ], + "switchTables" : { + + }, + "time" : 30000, + "traces" : [ + { + "after" : [ + [ + "state", + "LISTEN" + ] + ], + "before" : [ + [ + "state", + "CLOSED" + ] + ], + "detail" : "TCP CLOSED -> LISTEN", + "direction" : "local", + "id" : 1, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "time" : 0 + }, + { + "after" : [ + [ + "state", + "SYN_SENT" + ] + ], + "before" : [ + [ + "state", + "CLOSED" + ] + ], + "detail" : "TCP CLOSED -> SYN_SENT", + "direction" : "local", + "id" : 2, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "time" : 0 + }, + { + "after" : [ + [ + "sourcePort", + "54520" + ], + [ + "destinationPort", + "7" + ], + [ + "sequenceNumber", + "2000000" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "SYN" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP SYN", + "direction" : "outbound", + "id" : 3, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 1, + "time" : 0 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "ARP request for 192.168.0.10", + "direction" : "outbound", + "frame" : 1, + "id" : 4, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "created", + "time" : 0 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 1, + "id" : 5, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "time" : 0 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 1, + "id" : 6, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "time" : 55 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 1, + "id" : 7, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "time" : 55 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "switch broadcast flooding", + "direction" : "outbound", + "frame" : 1, + "id" : 8, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "time" : 55 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 1, + "id" : 9, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "time" : 55 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "switch broadcast flooding", + "direction" : "outbound", + "frame" : 1, + "id" : 10, + "interface" : "00000000-0000-0000-0000-000000000123", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "time" : 55 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 1, + "id" : 11, + "interface" : "00000000-0000-0000-0000-000000000123", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "time" : 55 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 1, + "id" : 12, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "time" : 110 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 1, + "id" : 13, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "time" : 110 + }, + { + "after" : [ + + ], + "before" : [ + [ + "operation", + "request" + ], + [ + "senderMAC", + "02:00:00:00:01:12" + ], + [ + "senderIP", + "192.168.0.20" + ], + [ + "targetMAC", + "00:00:00:00:00:00" + ], + [ + "targetIP", + "192.168.0.10" + ] + ], + "direction" : "inbound", + "frame" : 1, + "id" : 14, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "time" : 110 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "detail" : "ARP reply for 192.168.0.10", + "direction" : "outbound", + "frame" : 2, + "id" : 15, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "created", + "time" : 110 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 2, + "id" : 16, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "time" : 110 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 1, + "id" : 17, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "received", + "time" : 110 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 1, + "id" : 18, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "received", + "time" : 110 + }, + { + "after" : [ + + ], + "before" : [ + [ + "operation", + "request" + ], + [ + "senderMAC", + "02:00:00:00:01:12" + ], + [ + "senderIP", + "192.168.0.20" + ], + [ + "targetMAC", + "00:00:00:00:00:00" + ], + [ + "targetIP", + "192.168.0.10" + ] + ], + "direction" : "inbound", + "frame" : 1, + "id" : 19, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "accepted", + "time" : 110 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 2, + "id" : 20, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "time" : 165 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 2, + "id" : 21, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "time" : 165 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "detail" : "switch learned unicast forwarding", + "direction" : "outbound", + "frame" : 2, + "id" : 22, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "time" : 165 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 2, + "id" : 23, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "time" : 165 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 2, + "id" : 24, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "time" : 220 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 2, + "id" : 25, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "time" : 220 + }, + { + "after" : [ + + ], + "before" : [ + [ + "operation", + "reply" + ], + [ + "senderMAC", + "02:00:00:00:01:11" + ], + [ + "senderIP", + "192.168.0.10" + ], + [ + "targetMAC", + "02:00:00:00:01:12" + ], + [ + "targetIP", + "192.168.0.20" + ] + ], + "direction" : "inbound", + "frame" : 2, + "id" : 26, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "time" : 220 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.20" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 3, + "id" : 27, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 1, + "time" : 220 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 3, + "id" : 28, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "created", + "packet" : 1, + "time" : 220 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 3, + "id" : 29, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 1, + "time" : 220 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 3, + "id" : 30, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "packet" : 1, + "time" : 275 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 3, + "id" : 31, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "packet" : 1, + "time" : 275 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "detail" : "switch learned unicast forwarding", + "direction" : "outbound", + "frame" : 3, + "id" : 32, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 1, + "time" : 275 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 3, + "id" : 33, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 1, + "time" : 275 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 3, + "id" : 34, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 1, + "time" : 330 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 3, + "id" : 35, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 1, + "time" : 330 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "192.168.0.20" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 3, + "id" : 36, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 1, + "time" : 330 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "54520" + ], + [ + "destinationPort", + "7" + ], + [ + "sequenceNumber", + "2000000" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "SYN" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 37, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "packet" : 1, + "time" : 330 + }, + { + "after" : [ + [ + "state", + "SYN_RCVD" + ] + ], + "before" : [ + [ + "state", + "LISTEN" + ] + ], + "detail" : "TCP LISTEN -> SYN_RCVD", + "direction" : "local", + "id" : 38, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "time" : 330 + }, + { + "after" : [ + [ + "sourcePort", + "7" + ], + [ + "destinationPort", + "54520" + ], + [ + "sequenceNumber", + "3000000" + ], + [ + "acknowledgementNumber", + "2000001" + ], + [ + "flags", + "SYN+ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP SYN+ACK", + "direction" : "outbound", + "id" : 39, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 2, + "time" : 330 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.10" + ], + [ + "receiverIP", + "192.168.0.20" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 4, + "id" : 40, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 2, + "time" : 330 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 4, + "id" : 41, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "created", + "packet" : 2, + "time" : 330 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 4, + "id" : 42, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 2, + "time" : 330 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 4, + "id" : 43, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "packet" : 2, + "time" : 385 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 4, + "id" : 44, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "packet" : 2, + "time" : 385 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "detail" : "switch learned unicast forwarding", + "direction" : "outbound", + "frame" : 4, + "id" : 45, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 2, + "time" : 385 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 4, + "id" : 46, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 2, + "time" : 385 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 4, + "id" : 47, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 2, + "time" : 440 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 4, + "id" : 48, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 2, + "time" : 440 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "192.168.0.10" + ], + [ + "receiverIP", + "192.168.0.20" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 4, + "id" : 49, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 2, + "time" : 440 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "7" + ], + [ + "destinationPort", + "54520" + ], + [ + "sequenceNumber", + "3000000" + ], + [ + "acknowledgementNumber", + "2000001" + ], + [ + "flags", + "SYN+ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 50, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "packet" : 2, + "time" : 440 + }, + { + "after" : [ + [ + "state", + "ESTABLISHED" + ] + ], + "before" : [ + [ + "state", + "SYN_SENT" + ] + ], + "detail" : "TCP SYN_SENT -> ESTABLISHED", + "direction" : "local", + "id" : 51, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "time" : 440 + }, + { + "after" : [ + [ + "sourcePort", + "54520" + ], + [ + "destinationPort", + "7" + ], + [ + "sequenceNumber", + "2000001" + ], + [ + "acknowledgementNumber", + "3000001" + ], + [ + "flags", + "ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP ACK", + "direction" : "outbound", + "id" : 52, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 3, + "time" : 440 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.20" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 5, + "id" : 53, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 3, + "time" : 440 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 5, + "id" : 54, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "created", + "packet" : 3, + "time" : 440 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 5, + "id" : 55, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 3, + "time" : 440 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 5, + "id" : 56, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "packet" : 3, + "time" : 495 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 5, + "id" : 57, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "packet" : 3, + "time" : 495 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "detail" : "switch learned unicast forwarding", + "direction" : "outbound", + "frame" : 5, + "id" : 58, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 3, + "time" : 495 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 5, + "id" : 59, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 3, + "time" : 495 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 5, + "id" : 60, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 3, + "time" : 550 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 5, + "id" : 61, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 3, + "time" : 550 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "192.168.0.20" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 5, + "id" : 62, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 3, + "time" : 550 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "54520" + ], + [ + "destinationPort", + "7" + ], + [ + "sequenceNumber", + "2000001" + ], + [ + "acknowledgementNumber", + "3000001" + ], + [ + "flags", + "ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 63, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "packet" : 3, + "time" : 550 + }, + { + "after" : [ + [ + "state", + "ESTABLISHED" + ] + ], + "before" : [ + [ + "state", + "SYN_RCVD" + ] + ], + "detail" : "TCP SYN_RCVD -> ESTABLISHED", + "direction" : "local", + "id" : 64, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "time" : 550 + }, + { + "after" : [ + [ + "sourcePort", + "54520" + ], + [ + "destinationPort", + "7" + ], + [ + "sequenceNumber", + "2000001" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "PSH" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP data segment 1\/1", + "direction" : "outbound", + "id" : 65, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 4, + "time" : 550 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.20" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 6, + "id" : 66, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 4, + "time" : 550 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 6, + "id" : 67, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "created", + "packet" : 4, + "time" : 550 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 6, + "id" : 68, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 4, + "time" : 550 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 6, + "id" : 69, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "packet" : 4, + "time" : 605 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 6, + "id" : 70, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "packet" : 4, + "time" : 605 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "detail" : "switch learned unicast forwarding", + "direction" : "outbound", + "frame" : 6, + "id" : 71, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 4, + "time" : 605 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 6, + "id" : 72, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 4, + "time" : 605 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 6, + "id" : 73, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 4, + "time" : 660 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 6, + "id" : 74, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 4, + "time" : 660 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "192.168.0.20" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 6, + "id" : 75, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 4, + "time" : 660 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "54520" + ], + [ + "destinationPort", + "7" + ], + [ + "sequenceNumber", + "2000001" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "PSH" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 76, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "packet" : 4, + "time" : 660 + }, + { + "after" : [ + [ + "sourcePort", + "7" + ], + [ + "destinationPort", + "54520" + ], + [ + "sequenceNumber", + "3000001" + ], + [ + "acknowledgementNumber", + "2000001" + ], + [ + "flags", + "ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP ACK", + "direction" : "outbound", + "id" : 77, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 5, + "time" : 660 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.10" + ], + [ + "receiverIP", + "192.168.0.20" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 7, + "id" : 78, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 5, + "time" : 660 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 7, + "id" : 79, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "created", + "packet" : 5, + "time" : 660 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 7, + "id" : 80, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 5, + "time" : 660 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 7, + "id" : 81, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "packet" : 5, + "time" : 715 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 7, + "id" : 82, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "packet" : 5, + "time" : 715 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "detail" : "switch learned unicast forwarding", + "direction" : "outbound", + "frame" : 7, + "id" : 83, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 5, + "time" : 715 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 7, + "id" : 84, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 5, + "time" : 715 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 7, + "id" : 85, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 5, + "time" : 770 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 7, + "id" : 86, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 5, + "time" : 770 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "192.168.0.10" + ], + [ + "receiverIP", + "192.168.0.20" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 7, + "id" : 87, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 5, + "time" : 770 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "7" + ], + [ + "destinationPort", + "54520" + ], + [ + "sequenceNumber", + "3000001" + ], + [ + "acknowledgementNumber", + "2000001" + ], + [ + "flags", + "ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 88, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "packet" : 5, + "time" : 770 + }, + { + "after" : [ + [ + "state", + "FIN_WAIT_1" + ] + ], + "before" : [ + [ + "state", + "ESTABLISHED" + ] + ], + "detail" : "TCP ESTABLISHED -> FIN_WAIT_1", + "direction" : "local", + "id" : 89, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "time" : 770 + }, + { + "after" : [ + [ + "sourcePort", + "54520" + ], + [ + "destinationPort", + "7" + ], + [ + "sequenceNumber", + "2000001" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "FIN" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP FIN", + "direction" : "outbound", + "id" : 90, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 6, + "time" : 770 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.20" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 8, + "id" : 91, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 6, + "time" : 770 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 8, + "id" : 92, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "created", + "packet" : 6, + "time" : 770 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 8, + "id" : 93, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 6, + "time" : 770 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "detail" : "global packet-loss simulation", + "direction" : "inbound", + "frame" : 8, + "id" : 94, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "dropped", + "packet" : 6, + "time" : 825 + }, + { + "after" : [ + [ + "state", + "FIN_WAIT_1" + ] + ], + "before" : [ + [ + "state", + "ESTABLISHED" + ] + ], + "detail" : "TCP ESTABLISHED -> FIN_WAIT_1", + "direction" : "local", + "id" : 95, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "time" : 825 + }, + { + "after" : [ + [ + "sourcePort", + "7" + ], + [ + "destinationPort", + "54520" + ], + [ + "sequenceNumber", + "3000001" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "FIN" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP FIN", + "direction" : "outbound", + "id" : 96, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 7, + "time" : 825 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.10" + ], + [ + "receiverIP", + "192.168.0.20" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 9, + "id" : 97, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 7, + "time" : 825 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 9, + "id" : 98, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "created", + "packet" : 7, + "time" : 825 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 9, + "id" : 99, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 7, + "time" : 825 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 9, + "id" : 100, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "packet" : 7, + "time" : 880 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 9, + "id" : 101, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "packet" : 7, + "time" : 880 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "detail" : "switch learned unicast forwarding", + "direction" : "outbound", + "frame" : 9, + "id" : 102, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 7, + "time" : 880 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 9, + "id" : 103, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 7, + "time" : 880 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 9, + "id" : 104, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 7, + "time" : 935 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 9, + "id" : 105, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 7, + "time" : 935 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "192.168.0.10" + ], + [ + "receiverIP", + "192.168.0.20" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 9, + "id" : 106, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 7, + "time" : 935 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "7" + ], + [ + "destinationPort", + "54520" + ], + [ + "sequenceNumber", + "3000001" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "FIN" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 107, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "packet" : 7, + "time" : 935 + }, + { + "after" : [ + [ + "sourcePort", + "54520" + ], + [ + "destinationPort", + "7" + ], + [ + "sequenceNumber", + "2000002" + ], + [ + "acknowledgementNumber", + "3000002" + ], + [ + "flags", + "ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP ACK", + "direction" : "outbound", + "id" : 108, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 8, + "time" : 935 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.20" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 10, + "id" : 109, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 8, + "time" : 935 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 10, + "id" : 110, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "created", + "packet" : 8, + "time" : 935 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 10, + "id" : 111, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 8, + "time" : 935 + }, + { + "after" : [ + [ + "state", + "CLOSING" + ] + ], + "before" : [ + [ + "state", + "FIN_WAIT_1" + ] + ], + "detail" : "TCP FIN_WAIT_1 -> CLOSING", + "direction" : "local", + "id" : 112, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "time" : 935 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 10, + "id" : 113, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "packet" : 8, + "time" : 990 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 10, + "id" : 114, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "packet" : 8, + "time" : 990 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "detail" : "switch learned unicast forwarding", + "direction" : "outbound", + "frame" : 10, + "id" : 115, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 8, + "time" : 990 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 10, + "id" : 116, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 8, + "time" : 990 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 10, + "id" : 117, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 8, + "time" : 1045 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 10, + "id" : 118, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 8, + "time" : 1045 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "192.168.0.20" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 10, + "id" : 119, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 8, + "time" : 1045 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "54520" + ], + [ + "destinationPort", + "7" + ], + [ + "sequenceNumber", + "2000002" + ], + [ + "acknowledgementNumber", + "3000002" + ], + [ + "flags", + "ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 120, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "packet" : 8, + "time" : 1045 + }, + { + "after" : [ + [ + "state", + "FIN_WAIT_2" + ] + ], + "before" : [ + [ + "state", + "FIN_WAIT_1" + ] + ], + "detail" : "TCP FIN_WAIT_1 -> FIN_WAIT_2", + "direction" : "local", + "id" : 121, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "time" : 1045 + }, + { + "after" : [ + [ + "sourcePort", + "54520" + ], + [ + "destinationPort", + "7" + ], + [ + "sequenceNumber", + "2000001" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "FIN" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP FIN retransmission attempt 2", + "direction" : "outbound", + "id" : 122, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "retransmitted", + "packet" : 9, + "time" : 8325 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.20" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 11, + "id" : 123, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 9, + "time" : 8325 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 11, + "id" : 124, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "created", + "packet" : 9, + "time" : 8325 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 11, + "id" : 125, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 9, + "time" : 8325 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 11, + "id" : 126, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "packet" : 9, + "time" : 8380 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 11, + "id" : 127, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "packet" : 9, + "time" : 8380 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "detail" : "switch unknown unicast flooding", + "direction" : "outbound", + "frame" : 11, + "id" : 128, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 9, + "time" : 8380 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 11, + "id" : 129, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 9, + "time" : 8380 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "detail" : "switch unknown unicast flooding", + "direction" : "outbound", + "frame" : 11, + "id" : 130, + "interface" : "00000000-0000-0000-0000-000000000123", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 9, + "time" : 8380 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 11, + "id" : 131, + "interface" : "00000000-0000-0000-0000-000000000123", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 9, + "time" : 8380 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 11, + "id" : 132, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 9, + "time" : 8435 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 11, + "id" : 133, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 9, + "time" : 8435 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "192.168.0.20" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 11, + "id" : 134, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 9, + "time" : 8435 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "54520" + ], + [ + "destinationPort", + "7" + ], + [ + "sequenceNumber", + "2000001" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "FIN" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 135, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "packet" : 9, + "time" : 8435 + }, + { + "after" : [ + [ + "sourcePort", + "7" + ], + [ + "destinationPort", + "54520" + ], + [ + "sequenceNumber", + "3000002" + ], + [ + "acknowledgementNumber", + "2000002" + ], + [ + "flags", + "ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP ACK", + "direction" : "outbound", + "id" : 136, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 10, + "time" : 8435 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.10" + ], + [ + "receiverIP", + "192.168.0.20" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 12, + "id" : 137, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 10, + "time" : 8435 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 12, + "id" : 138, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "created", + "packet" : 10, + "time" : 8435 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 12, + "id" : 139, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 10, + "time" : 8435 + }, + { + "after" : [ + [ + "state", + "TIME_WAIT" + ] + ], + "before" : [ + [ + "state", + "FIN_WAIT_2" + ] + ], + "detail" : "TCP FIN_WAIT_2 -> TIME_WAIT", + "direction" : "local", + "id" : 140, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "time" : 8435 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 11, + "id" : 141, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "received", + "packet" : 9, + "time" : 8435 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 11, + "id" : 142, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "received", + "packet" : 9, + "time" : 8435 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "detail" : "destination MAC does not match interface", + "direction" : "inbound", + "frame" : 11, + "id" : 143, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "dropped", + "packet" : 9, + "time" : 8435 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 12, + "id" : 144, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "packet" : 10, + "time" : 8490 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 12, + "id" : 145, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "packet" : 10, + "time" : 8490 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "detail" : "switch learned unicast forwarding", + "direction" : "outbound", + "frame" : 12, + "id" : 146, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 10, + "time" : 8490 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 12, + "id" : 147, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 10, + "time" : 8490 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 12, + "id" : 148, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 10, + "time" : 8545 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 12, + "id" : 149, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 10, + "time" : 8545 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "192.168.0.10" + ], + [ + "receiverIP", + "192.168.0.20" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 12, + "id" : 150, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 10, + "time" : 8545 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "7" + ], + [ + "destinationPort", + "54520" + ], + [ + "sequenceNumber", + "3000002" + ], + [ + "acknowledgementNumber", + "2000002" + ], + [ + "flags", + "ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 151, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "packet" : 10, + "time" : 8545 + }, + { + "after" : [ + [ + "state", + "TIME_WAIT" + ] + ], + "before" : [ + [ + "state", + "CLOSING" + ] + ], + "detail" : "TCP CLOSING -> TIME_WAIT", + "direction" : "local", + "id" : 152, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "time" : 8545 + }, + { + "after" : [ + [ + "state", + "CLOSED" + ] + ], + "before" : [ + [ + "state", + "TIME_WAIT" + ] + ], + "detail" : "TCP TIME_WAIT -> CLOSED", + "direction" : "local", + "id" : 153, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "time" : 10935 + }, + { + "after" : [ + [ + "state", + "CLOSED" + ] + ], + "before" : [ + [ + "state", + "TIME_WAIT" + ] + ], + "detail" : "TCP TIME_WAIT -> CLOSED", + "direction" : "local", + "id" : 154, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "time" : 11045 + } + ] +} diff --git a/packages/core/test/scenarios/tcp-lan.scenario.json b/packages/core/test/scenarios/tcp-lan.scenario.json new file mode 100644 index 0000000..b25bebb --- /dev/null +++ b/packages/core/test/scenarios/tcp-lan.scenario.json @@ -0,0 +1,215 @@ +{ + "seed": 31, + "nodes": [ + { + "id": "00000000-0000-0000-0000-000000000101", + "kind": "pc", + "ports": [ + { + "id": "00000000-0000-0000-0000-000000000111", + "label": "eth0" + } + ] + }, + { + "id": "00000000-0000-0000-0000-000000000102", + "kind": "pc", + "ports": [ + { + "id": "00000000-0000-0000-0000-000000000112", + "label": "eth0" + } + ] + }, + { + "id": "00000000-0000-0000-0000-000000000103", + "kind": "pc", + "ports": [ + { + "id": "00000000-0000-0000-0000-000000000113", + "label": "eth0" + } + ] + }, + { + "id": "00000000-0000-0000-0000-000000000104", + "kind": "networkSwitch", + "ports": [ + { + "id": "00000000-0000-0000-0000-000000000121", + "label": "sw1" + }, + { + "id": "00000000-0000-0000-0000-000000000122", + "label": "sw2" + }, + { + "id": "00000000-0000-0000-0000-000000000123", + "label": "sw3" + }, + { + "id": "00000000-0000-0000-0000-000000000124", + "label": "sw4" + } + ] + } + ], + "links": [ + { + "id": "00000000-0000-0000-0000-00000000F001", + "sourceNode": "00000000-0000-0000-0000-000000000101", + "sourcePort": "00000000-0000-0000-0000-000000000111", + "targetNode": "00000000-0000-0000-0000-000000000104", + "targetPort": "00000000-0000-0000-0000-000000000121" + }, + { + "id": "00000000-0000-0000-0000-00000000F002", + "sourceNode": "00000000-0000-0000-0000-000000000102", + "sourcePort": "00000000-0000-0000-0000-000000000112", + "targetNode": "00000000-0000-0000-0000-000000000104", + "targetPort": "00000000-0000-0000-0000-000000000122" + }, + { + "id": "00000000-0000-0000-0000-00000000F003", + "sourceNode": "00000000-0000-0000-0000-000000000103", + "sourcePort": "00000000-0000-0000-0000-000000000113", + "targetNode": "00000000-0000-0000-0000-000000000104", + "targetPort": "00000000-0000-0000-0000-000000000123" + } + ], + "devices": { + "00000000-0000-0000-0000-000000000101": { + "ip": "192.168.0.10", + "mask": "255.255.255.0" + }, + "00000000-0000-0000-0000-000000000102": { + "ip": "192.168.0.20", + "mask": "255.255.255.0" + }, + "00000000-0000-0000-0000-000000000103": { + "ip": "192.168.0.30", + "mask": "255.255.255.0" + } + }, + "switches": { + "00000000-0000-0000-0000-000000000104": { + "ssid": "lab", + "retention": 5000 + } + }, + "steps": [ + { + "op": "openTcpServer", + "node": "00000000-0000-0000-0000-000000000101", + "port": 80 + }, + { + "op": "openTcpServer", + "node": "00000000-0000-0000-0000-000000000101", + "port": 80 + }, + { + "op": "openTcpClient", + "node": "00000000-0000-0000-0000-000000000102", + "target": "192.168.0.10", + "port": 80 + }, + { + "op": "connectTcp", + "socket": "00000000-0000-0000-0000-000000000002" + }, + { + "op": "acceptedTcp", + "socket": "00000000-0000-0000-0000-000000000001" + }, + { + "op": "peerTcp", + "socket": "00000000-0000-0000-0000-000000000002" + }, + { + "op": "sendTcp", + "socket": "00000000-0000-0000-0000-000000000002", + "payload": "GET /" + }, + { + "op": "receiveTcp", + "socket": "00000000-0000-0000-0000-000000000003" + }, + { + "op": "sendTcp", + "socket": "00000000-0000-0000-0000-000000000003", + "payload": "x", + "repeatCount": 3000 + }, + { + "op": "receiveTcp", + "socket": "00000000-0000-0000-0000-000000000002" + }, + { + "op": "receiveTcp", + "socket": "00000000-0000-0000-0000-000000000002" + }, + { + "op": "closeSocket", + "socket": "00000000-0000-0000-0000-000000000002" + }, + { + "op": "advance", + "to": 3000 + }, + { + "op": "closeSocket", + "socket": "00000000-0000-0000-0000-000000000003" + }, + { + "op": "advance", + "to": 4000 + }, + { + "op": "advance", + "to": 8000 + }, + { + "op": "cleanTcp", + "socket": "00000000-0000-0000-0000-000000000002" + }, + { + "op": "cleanTcp", + "socket": "00000000-0000-0000-0000-000000000001" + }, + { + "op": "connectTcp", + "socket": "00000000-0000-0000-0000-000000000001" + }, + { + "op": "openTcpClient", + "node": "00000000-0000-0000-0000-000000000103", + "target": "192.168.0.10", + "port": 81 + }, + { + "op": "sendTcp", + "socket": "00000000-0000-0000-0000-000000000004", + "payload": "ohne Verbindung" + }, + { + "op": "connectTcp", + "socket": "00000000-0000-0000-0000-000000000004" + }, + { + "op": "openTcpClient", + "node": "00000000-0000-0000-0000-000000000103", + "target": "192.168.0.99", + "port": 80, + "localPort": 5000 + }, + { + "op": "connectTcp", + "socket": "00000000-0000-0000-0000-000000000005" + }, + { + "op": "closeSocket", + "socket": "00000000-0000-0000-0000-000000000001" + } + ] +} diff --git a/packages/core/test/scenarios/tcp-lan.swift.json b/packages/core/test/scenarios/tcp-lan.swift.json new file mode 100644 index 0000000..c5ae8d0 --- /dev/null +++ b/packages/core/test/scenarios/tcp-lan.swift.json @@ -0,0 +1,10424 @@ +{ + "arp" : { + "00000000-0000-0000-0000-000000000101" : { + "192.168.0.20" : "02:00:00:00:01:12", + "192.168.0.30" : "02:00:00:00:01:13" + }, + "00000000-0000-0000-0000-000000000102" : { + "192.168.0.10" : "02:00:00:00:01:11", + "192.168.0.30" : "02:00:00:00:01:13" + }, + "00000000-0000-0000-0000-000000000103" : { + "192.168.0.10" : "02:00:00:00:01:11", + "192.168.0.20" : "02:00:00:00:01:12" + } + }, + "firewallDecisions" : [ + + ], + "icmpObservations" : { + "00000000-0000-0000-0000-000000000103" : [ + { + "identifier" : 0, + "kind" : "destinationHostUnreachable", + "sender" : "192.168.0.30", + "sequence" : 0 + }, + { + "identifier" : 0, + "kind" : "destinationHostUnreachable", + "sender" : "192.168.0.30", + "sequence" : 0 + }, + { + "identifier" : 0, + "kind" : "destinationHostUnreachable", + "sender" : "192.168.0.30", + "sequence" : 0 + } + ] + }, + "pendingEvents" : 0, + "results" : [ + "00000000-0000-0000-0000-000000000001", + null, + "00000000-0000-0000-0000-000000000002", + "connected", + [ + "00000000-0000-0000-0000-000000000003" + ], + "00000000-0000-0000-0000-000000000003", + true, + "GET \/", + true, + "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", + null, + false, + 3000, + false, + 4000, + 8000, + true, + false, + "invalidSocket", + "00000000-0000-0000-0000-000000000004", + false, + "timedOut", + "00000000-0000-0000-0000-000000000005", + "unreachable", + false + ], + "sockets" : [ + { + "id" : "00000000-0000-0000-0000-000000000001", + "localIp" : null, + "localPort" : 80, + "node" : "00000000-0000-0000-0000-000000000101", + "parent" : null, + "protocol" : "tcp", + "queued" : 0, + "remoteIp" : null, + "remotePort" : null, + "session" : { + "assembly" : 0, + "attempts" : 0, + "messages" : 0, + "next" : 1000000, + "pending" : false, + "remote" : 0 + }, + "tcpState" : "CLOSED" + }, + { + "id" : "00000000-0000-0000-0000-000000000003", + "localIp" : "192.168.0.10", + "localPort" : 80, + "node" : "00000000-0000-0000-0000-000000000101", + "parent" : "00000000-0000-0000-0000-000000000001", + "protocol" : "tcp", + "queued" : 0, + "remoteIp" : "192.168.0.20", + "remotePort" : 61957, + "session" : { + "assembly" : 0, + "attempts" : 1, + "messages" : 0, + "next" : 3003002, + "pending" : false, + "remote" : 2000006 + }, + "tcpState" : "CLOSED" + }, + { + "id" : "00000000-0000-0000-0000-000000000004", + "localIp" : "192.168.0.30", + "localPort" : 51292, + "node" : "00000000-0000-0000-0000-000000000103", + "parent" : null, + "protocol" : "tcp", + "queued" : 0, + "remoteIp" : "192.168.0.10", + "remotePort" : 81, + "session" : { + "assembly" : 0, + "attempts" : 3, + "messages" : 0, + "next" : 4000001, + "pending" : false, + "remote" : 0 + }, + "tcpState" : "CLOSED" + }, + { + "id" : "00000000-0000-0000-0000-000000000005", + "localIp" : "192.168.0.30", + "localPort" : 5000, + "node" : "00000000-0000-0000-0000-000000000103", + "parent" : null, + "protocol" : "tcp", + "queued" : 0, + "remoteIp" : "192.168.0.99", + "remotePort" : 80, + "session" : { + "assembly" : 0, + "attempts" : 3, + "messages" : 0, + "next" : 5000001, + "pending" : false, + "remote" : 0 + }, + "tcpState" : "CLOSED" + } + ], + "switchTables" : { + + }, + "time" : 53550, + "traces" : [ + { + "after" : [ + [ + "state", + "LISTEN" + ] + ], + "before" : [ + [ + "state", + "CLOSED" + ] + ], + "detail" : "TCP CLOSED -> LISTEN", + "direction" : "local", + "id" : 1, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "time" : 0 + }, + { + "after" : [ + [ + "state", + "SYN_SENT" + ] + ], + "before" : [ + [ + "state", + "CLOSED" + ] + ], + "detail" : "TCP CLOSED -> SYN_SENT", + "direction" : "local", + "id" : 2, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "time" : 0 + }, + { + "after" : [ + [ + "sourcePort", + "61957" + ], + [ + "destinationPort", + "80" + ], + [ + "sequenceNumber", + "2000000" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "SYN" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP SYN", + "direction" : "outbound", + "id" : 3, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 1, + "time" : 0 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "ARP request for 192.168.0.10", + "direction" : "outbound", + "frame" : 1, + "id" : 4, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "created", + "time" : 0 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 1, + "id" : 5, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "time" : 0 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 1, + "id" : 6, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "time" : 55 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 1, + "id" : 7, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "time" : 55 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "switch broadcast flooding", + "direction" : "outbound", + "frame" : 1, + "id" : 8, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "time" : 55 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 1, + "id" : 9, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "time" : 55 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "switch broadcast flooding", + "direction" : "outbound", + "frame" : 1, + "id" : 10, + "interface" : "00000000-0000-0000-0000-000000000123", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "time" : 55 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 1, + "id" : 11, + "interface" : "00000000-0000-0000-0000-000000000123", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "time" : 55 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 1, + "id" : 12, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "time" : 110 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 1, + "id" : 13, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "time" : 110 + }, + { + "after" : [ + + ], + "before" : [ + [ + "operation", + "request" + ], + [ + "senderMAC", + "02:00:00:00:01:12" + ], + [ + "senderIP", + "192.168.0.20" + ], + [ + "targetMAC", + "00:00:00:00:00:00" + ], + [ + "targetIP", + "192.168.0.10" + ] + ], + "direction" : "inbound", + "frame" : 1, + "id" : 14, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "time" : 110 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "detail" : "ARP reply for 192.168.0.10", + "direction" : "outbound", + "frame" : 2, + "id" : 15, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "created", + "time" : 110 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 2, + "id" : 16, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "time" : 110 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 1, + "id" : 17, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "received", + "time" : 110 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 1, + "id" : 18, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "received", + "time" : 110 + }, + { + "after" : [ + + ], + "before" : [ + [ + "operation", + "request" + ], + [ + "senderMAC", + "02:00:00:00:01:12" + ], + [ + "senderIP", + "192.168.0.20" + ], + [ + "targetMAC", + "00:00:00:00:00:00" + ], + [ + "targetIP", + "192.168.0.10" + ] + ], + "direction" : "inbound", + "frame" : 1, + "id" : 19, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "accepted", + "time" : 110 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 2, + "id" : 20, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "time" : 165 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 2, + "id" : 21, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "time" : 165 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "detail" : "switch learned unicast forwarding", + "direction" : "outbound", + "frame" : 2, + "id" : 22, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "time" : 165 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 2, + "id" : 23, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "time" : 165 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 2, + "id" : 24, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "time" : 220 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 2, + "id" : 25, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "time" : 220 + }, + { + "after" : [ + + ], + "before" : [ + [ + "operation", + "reply" + ], + [ + "senderMAC", + "02:00:00:00:01:11" + ], + [ + "senderIP", + "192.168.0.10" + ], + [ + "targetMAC", + "02:00:00:00:01:12" + ], + [ + "targetIP", + "192.168.0.20" + ] + ], + "direction" : "inbound", + "frame" : 2, + "id" : 26, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "time" : 220 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.20" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 3, + "id" : 27, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 1, + "time" : 220 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 3, + "id" : 28, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "created", + "packet" : 1, + "time" : 220 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 3, + "id" : 29, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 1, + "time" : 220 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 3, + "id" : 30, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "packet" : 1, + "time" : 275 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 3, + "id" : 31, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "packet" : 1, + "time" : 275 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "detail" : "switch learned unicast forwarding", + "direction" : "outbound", + "frame" : 3, + "id" : 32, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 1, + "time" : 275 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 3, + "id" : 33, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 1, + "time" : 275 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 3, + "id" : 34, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 1, + "time" : 330 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 3, + "id" : 35, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 1, + "time" : 330 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "192.168.0.20" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 3, + "id" : 36, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 1, + "time" : 330 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "61957" + ], + [ + "destinationPort", + "80" + ], + [ + "sequenceNumber", + "2000000" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "SYN" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 37, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "packet" : 1, + "time" : 330 + }, + { + "after" : [ + [ + "state", + "SYN_RCVD" + ] + ], + "before" : [ + [ + "state", + "LISTEN" + ] + ], + "detail" : "TCP LISTEN -> SYN_RCVD", + "direction" : "local", + "id" : 38, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "time" : 330 + }, + { + "after" : [ + [ + "sourcePort", + "80" + ], + [ + "destinationPort", + "61957" + ], + [ + "sequenceNumber", + "3000000" + ], + [ + "acknowledgementNumber", + "2000001" + ], + [ + "flags", + "SYN+ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP SYN+ACK", + "direction" : "outbound", + "id" : 39, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 2, + "time" : 330 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.10" + ], + [ + "receiverIP", + "192.168.0.20" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 4, + "id" : 40, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 2, + "time" : 330 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 4, + "id" : 41, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "created", + "packet" : 2, + "time" : 330 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 4, + "id" : 42, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 2, + "time" : 330 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 4, + "id" : 43, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "packet" : 2, + "time" : 385 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 4, + "id" : 44, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "packet" : 2, + "time" : 385 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "detail" : "switch learned unicast forwarding", + "direction" : "outbound", + "frame" : 4, + "id" : 45, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 2, + "time" : 385 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 4, + "id" : 46, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 2, + "time" : 385 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 4, + "id" : 47, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 2, + "time" : 440 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 4, + "id" : 48, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 2, + "time" : 440 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "192.168.0.10" + ], + [ + "receiverIP", + "192.168.0.20" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 4, + "id" : 49, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 2, + "time" : 440 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "80" + ], + [ + "destinationPort", + "61957" + ], + [ + "sequenceNumber", + "3000000" + ], + [ + "acknowledgementNumber", + "2000001" + ], + [ + "flags", + "SYN+ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 50, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "packet" : 2, + "time" : 440 + }, + { + "after" : [ + [ + "state", + "ESTABLISHED" + ] + ], + "before" : [ + [ + "state", + "SYN_SENT" + ] + ], + "detail" : "TCP SYN_SENT -> ESTABLISHED", + "direction" : "local", + "id" : 51, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "time" : 440 + }, + { + "after" : [ + [ + "sourcePort", + "61957" + ], + [ + "destinationPort", + "80" + ], + [ + "sequenceNumber", + "2000001" + ], + [ + "acknowledgementNumber", + "3000001" + ], + [ + "flags", + "ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP ACK", + "direction" : "outbound", + "id" : 52, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 3, + "time" : 440 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.20" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 5, + "id" : 53, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 3, + "time" : 440 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 5, + "id" : 54, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "created", + "packet" : 3, + "time" : 440 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 5, + "id" : 55, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 3, + "time" : 440 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 5, + "id" : 56, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "packet" : 3, + "time" : 495 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 5, + "id" : 57, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "packet" : 3, + "time" : 495 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "detail" : "switch learned unicast forwarding", + "direction" : "outbound", + "frame" : 5, + "id" : 58, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 3, + "time" : 495 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 5, + "id" : 59, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 3, + "time" : 495 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 5, + "id" : 60, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 3, + "time" : 550 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 5, + "id" : 61, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 3, + "time" : 550 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "192.168.0.20" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 5, + "id" : 62, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 3, + "time" : 550 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "61957" + ], + [ + "destinationPort", + "80" + ], + [ + "sequenceNumber", + "2000001" + ], + [ + "acknowledgementNumber", + "3000001" + ], + [ + "flags", + "ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 63, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "packet" : 3, + "time" : 550 + }, + { + "after" : [ + [ + "state", + "ESTABLISHED" + ] + ], + "before" : [ + [ + "state", + "SYN_RCVD" + ] + ], + "detail" : "TCP SYN_RCVD -> ESTABLISHED", + "direction" : "local", + "id" : 64, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "time" : 550 + }, + { + "after" : [ + [ + "sourcePort", + "61957" + ], + [ + "destinationPort", + "80" + ], + [ + "sequenceNumber", + "2000001" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "PSH" + ], + [ + "payloadLength", + "5" + ] + ], + "before" : [ + + ], + "detail" : "TCP data segment 1\/1", + "direction" : "outbound", + "id" : 65, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 4, + "time" : 550 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.20" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 6, + "id" : 66, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 4, + "time" : 550 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 6, + "id" : 67, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "created", + "packet" : 4, + "time" : 550 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 6, + "id" : 68, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 4, + "time" : 550 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 6, + "id" : 69, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "packet" : 4, + "time" : 605 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 6, + "id" : 70, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "packet" : 4, + "time" : 605 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "detail" : "switch learned unicast forwarding", + "direction" : "outbound", + "frame" : 6, + "id" : 71, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 4, + "time" : 605 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 6, + "id" : 72, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 4, + "time" : 605 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 6, + "id" : 73, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 4, + "time" : 660 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 6, + "id" : 74, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 4, + "time" : 660 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "192.168.0.20" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 6, + "id" : 75, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 4, + "time" : 660 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "61957" + ], + [ + "destinationPort", + "80" + ], + [ + "sequenceNumber", + "2000001" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "PSH" + ], + [ + "payloadLength", + "5" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 76, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "packet" : 4, + "time" : 660 + }, + { + "after" : [ + [ + "sourcePort", + "80" + ], + [ + "destinationPort", + "61957" + ], + [ + "sequenceNumber", + "3000001" + ], + [ + "acknowledgementNumber", + "2000006" + ], + [ + "flags", + "ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP ACK", + "direction" : "outbound", + "id" : 77, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 5, + "time" : 660 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.10" + ], + [ + "receiverIP", + "192.168.0.20" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 7, + "id" : 78, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 5, + "time" : 660 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 7, + "id" : 79, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "created", + "packet" : 5, + "time" : 660 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 7, + "id" : 80, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 5, + "time" : 660 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 7, + "id" : 81, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "packet" : 5, + "time" : 715 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 7, + "id" : 82, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "packet" : 5, + "time" : 715 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "detail" : "switch learned unicast forwarding", + "direction" : "outbound", + "frame" : 7, + "id" : 83, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 5, + "time" : 715 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 7, + "id" : 84, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 5, + "time" : 715 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 7, + "id" : 85, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 5, + "time" : 770 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 7, + "id" : 86, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 5, + "time" : 770 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "192.168.0.10" + ], + [ + "receiverIP", + "192.168.0.20" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 7, + "id" : 87, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 5, + "time" : 770 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "80" + ], + [ + "destinationPort", + "61957" + ], + [ + "sequenceNumber", + "3000001" + ], + [ + "acknowledgementNumber", + "2000006" + ], + [ + "flags", + "ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 88, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "packet" : 5, + "time" : 770 + }, + { + "after" : [ + [ + "sourcePort", + "80" + ], + [ + "destinationPort", + "61957" + ], + [ + "sequenceNumber", + "3000001" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "" + ], + [ + "payloadLength", + "1460" + ] + ], + "before" : [ + + ], + "detail" : "TCP data segment 1\/3", + "direction" : "outbound", + "id" : 89, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 6, + "time" : 770 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.10" + ], + [ + "receiverIP", + "192.168.0.20" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 8, + "id" : 90, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 6, + "time" : 770 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 8, + "id" : 91, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "created", + "packet" : 6, + "time" : 770 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 8, + "id" : 92, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 6, + "time" : 770 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 8, + "id" : 93, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "packet" : 6, + "time" : 825 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 8, + "id" : 94, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "packet" : 6, + "time" : 825 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "detail" : "switch learned unicast forwarding", + "direction" : "outbound", + "frame" : 8, + "id" : 95, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 6, + "time" : 825 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 8, + "id" : 96, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 6, + "time" : 825 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 8, + "id" : 97, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 6, + "time" : 880 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 8, + "id" : 98, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 6, + "time" : 880 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "192.168.0.10" + ], + [ + "receiverIP", + "192.168.0.20" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 8, + "id" : 99, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 6, + "time" : 880 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "80" + ], + [ + "destinationPort", + "61957" + ], + [ + "sequenceNumber", + "3000001" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "" + ], + [ + "payloadLength", + "1460" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 100, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "packet" : 6, + "time" : 880 + }, + { + "after" : [ + [ + "sourcePort", + "61957" + ], + [ + "destinationPort", + "80" + ], + [ + "sequenceNumber", + "2000006" + ], + [ + "acknowledgementNumber", + "3001461" + ], + [ + "flags", + "ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP ACK", + "direction" : "outbound", + "id" : 101, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 7, + "time" : 880 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.20" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 9, + "id" : 102, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 7, + "time" : 880 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 9, + "id" : 103, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "created", + "packet" : 7, + "time" : 880 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 9, + "id" : 104, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 7, + "time" : 880 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 9, + "id" : 105, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "packet" : 7, + "time" : 935 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 9, + "id" : 106, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "packet" : 7, + "time" : 935 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "detail" : "switch learned unicast forwarding", + "direction" : "outbound", + "frame" : 9, + "id" : 107, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 7, + "time" : 935 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 9, + "id" : 108, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 7, + "time" : 935 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 9, + "id" : 109, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 7, + "time" : 990 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 9, + "id" : 110, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 7, + "time" : 990 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "192.168.0.20" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 9, + "id" : 111, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 7, + "time" : 990 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "61957" + ], + [ + "destinationPort", + "80" + ], + [ + "sequenceNumber", + "2000006" + ], + [ + "acknowledgementNumber", + "3001461" + ], + [ + "flags", + "ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 112, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "packet" : 7, + "time" : 990 + }, + { + "after" : [ + [ + "sourcePort", + "80" + ], + [ + "destinationPort", + "61957" + ], + [ + "sequenceNumber", + "3001461" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "" + ], + [ + "payloadLength", + "1460" + ] + ], + "before" : [ + + ], + "detail" : "TCP data segment 2\/3", + "direction" : "outbound", + "id" : 113, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 8, + "time" : 990 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.10" + ], + [ + "receiverIP", + "192.168.0.20" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 10, + "id" : 114, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 8, + "time" : 990 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 10, + "id" : 115, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "created", + "packet" : 8, + "time" : 990 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 10, + "id" : 116, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 8, + "time" : 990 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 10, + "id" : 117, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "packet" : 8, + "time" : 1045 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 10, + "id" : 118, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "packet" : 8, + "time" : 1045 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "detail" : "switch learned unicast forwarding", + "direction" : "outbound", + "frame" : 10, + "id" : 119, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 8, + "time" : 1045 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 10, + "id" : 120, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 8, + "time" : 1045 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 10, + "id" : 121, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 8, + "time" : 1100 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 10, + "id" : 122, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 8, + "time" : 1100 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "192.168.0.10" + ], + [ + "receiverIP", + "192.168.0.20" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 10, + "id" : 123, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 8, + "time" : 1100 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "80" + ], + [ + "destinationPort", + "61957" + ], + [ + "sequenceNumber", + "3001461" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "" + ], + [ + "payloadLength", + "1460" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 124, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "packet" : 8, + "time" : 1100 + }, + { + "after" : [ + [ + "sourcePort", + "61957" + ], + [ + "destinationPort", + "80" + ], + [ + "sequenceNumber", + "2000006" + ], + [ + "acknowledgementNumber", + "3002921" + ], + [ + "flags", + "ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP ACK", + "direction" : "outbound", + "id" : 125, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 9, + "time" : 1100 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.20" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 11, + "id" : 126, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 9, + "time" : 1100 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 11, + "id" : 127, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "created", + "packet" : 9, + "time" : 1100 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 11, + "id" : 128, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 9, + "time" : 1100 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 11, + "id" : 129, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "packet" : 9, + "time" : 1155 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 11, + "id" : 130, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "packet" : 9, + "time" : 1155 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "detail" : "switch learned unicast forwarding", + "direction" : "outbound", + "frame" : 11, + "id" : 131, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 9, + "time" : 1155 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 11, + "id" : 132, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 9, + "time" : 1155 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 11, + "id" : 133, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 9, + "time" : 1210 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 11, + "id" : 134, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 9, + "time" : 1210 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "192.168.0.20" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 11, + "id" : 135, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 9, + "time" : 1210 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "61957" + ], + [ + "destinationPort", + "80" + ], + [ + "sequenceNumber", + "2000006" + ], + [ + "acknowledgementNumber", + "3002921" + ], + [ + "flags", + "ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 136, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "packet" : 9, + "time" : 1210 + }, + { + "after" : [ + [ + "sourcePort", + "80" + ], + [ + "destinationPort", + "61957" + ], + [ + "sequenceNumber", + "3002921" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "PSH" + ], + [ + "payloadLength", + "80" + ] + ], + "before" : [ + + ], + "detail" : "TCP data segment 3\/3", + "direction" : "outbound", + "id" : 137, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 10, + "time" : 1210 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.10" + ], + [ + "receiverIP", + "192.168.0.20" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 12, + "id" : 138, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 10, + "time" : 1210 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 12, + "id" : 139, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "created", + "packet" : 10, + "time" : 1210 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 12, + "id" : 140, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 10, + "time" : 1210 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 12, + "id" : 141, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "packet" : 10, + "time" : 1265 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 12, + "id" : 142, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "packet" : 10, + "time" : 1265 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "detail" : "switch learned unicast forwarding", + "direction" : "outbound", + "frame" : 12, + "id" : 143, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 10, + "time" : 1265 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 12, + "id" : 144, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 10, + "time" : 1265 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 12, + "id" : 145, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 10, + "time" : 1320 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 12, + "id" : 146, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 10, + "time" : 1320 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "192.168.0.10" + ], + [ + "receiverIP", + "192.168.0.20" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 12, + "id" : 147, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 10, + "time" : 1320 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "80" + ], + [ + "destinationPort", + "61957" + ], + [ + "sequenceNumber", + "3002921" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "PSH" + ], + [ + "payloadLength", + "80" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 148, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "packet" : 10, + "time" : 1320 + }, + { + "after" : [ + [ + "sourcePort", + "61957" + ], + [ + "destinationPort", + "80" + ], + [ + "sequenceNumber", + "2000006" + ], + [ + "acknowledgementNumber", + "3003001" + ], + [ + "flags", + "ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP ACK", + "direction" : "outbound", + "id" : 149, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 11, + "time" : 1320 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.20" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 13, + "id" : 150, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 11, + "time" : 1320 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 13, + "id" : 151, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "created", + "packet" : 11, + "time" : 1320 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 13, + "id" : 152, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 11, + "time" : 1320 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 13, + "id" : 153, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "packet" : 11, + "time" : 1375 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 13, + "id" : 154, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "packet" : 11, + "time" : 1375 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "detail" : "switch learned unicast forwarding", + "direction" : "outbound", + "frame" : 13, + "id" : 155, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 11, + "time" : 1375 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 13, + "id" : 156, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 11, + "time" : 1375 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 13, + "id" : 157, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 11, + "time" : 1430 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 13, + "id" : 158, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 11, + "time" : 1430 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "192.168.0.20" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 13, + "id" : 159, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 11, + "time" : 1430 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "61957" + ], + [ + "destinationPort", + "80" + ], + [ + "sequenceNumber", + "2000006" + ], + [ + "acknowledgementNumber", + "3003001" + ], + [ + "flags", + "ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 160, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "packet" : 11, + "time" : 1430 + }, + { + "after" : [ + [ + "state", + "FIN_WAIT_1" + ] + ], + "before" : [ + [ + "state", + "ESTABLISHED" + ] + ], + "detail" : "TCP ESTABLISHED -> FIN_WAIT_1", + "direction" : "local", + "id" : 161, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "time" : 1430 + }, + { + "after" : [ + [ + "sourcePort", + "61957" + ], + [ + "destinationPort", + "80" + ], + [ + "sequenceNumber", + "2000006" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "FIN" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP FIN", + "direction" : "outbound", + "id" : 162, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 12, + "time" : 1430 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.20" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 14, + "id" : 163, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 12, + "time" : 1430 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 14, + "id" : 164, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "created", + "packet" : 12, + "time" : 1430 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 14, + "id" : 165, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 12, + "time" : 1430 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 14, + "id" : 166, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "packet" : 12, + "time" : 1485 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 14, + "id" : 167, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "packet" : 12, + "time" : 1485 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "detail" : "switch learned unicast forwarding", + "direction" : "outbound", + "frame" : 14, + "id" : 168, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 12, + "time" : 1485 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 14, + "id" : 169, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 12, + "time" : 1485 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 14, + "id" : 170, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 12, + "time" : 1540 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 14, + "id" : 171, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 12, + "time" : 1540 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "192.168.0.20" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 14, + "id" : 172, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 12, + "time" : 1540 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "61957" + ], + [ + "destinationPort", + "80" + ], + [ + "sequenceNumber", + "2000006" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "FIN" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 173, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "packet" : 12, + "time" : 1540 + }, + { + "after" : [ + [ + "sourcePort", + "80" + ], + [ + "destinationPort", + "61957" + ], + [ + "sequenceNumber", + "3003001" + ], + [ + "acknowledgementNumber", + "2000007" + ], + [ + "flags", + "ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP ACK", + "direction" : "outbound", + "id" : 174, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 13, + "time" : 1540 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.10" + ], + [ + "receiverIP", + "192.168.0.20" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 15, + "id" : 175, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 13, + "time" : 1540 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 15, + "id" : 176, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "created", + "packet" : 13, + "time" : 1540 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 15, + "id" : 177, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 13, + "time" : 1540 + }, + { + "after" : [ + [ + "state", + "CLOSE_WAIT" + ] + ], + "before" : [ + [ + "state", + "ESTABLISHED" + ] + ], + "detail" : "TCP ESTABLISHED -> CLOSE_WAIT", + "direction" : "local", + "id" : 178, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "time" : 1540 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 15, + "id" : 179, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "packet" : 13, + "time" : 1595 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 15, + "id" : 180, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "packet" : 13, + "time" : 1595 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "detail" : "switch learned unicast forwarding", + "direction" : "outbound", + "frame" : 15, + "id" : 181, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 13, + "time" : 1595 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 15, + "id" : 182, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 13, + "time" : 1595 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 15, + "id" : 183, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 13, + "time" : 1650 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 15, + "id" : 184, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 13, + "time" : 1650 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "192.168.0.10" + ], + [ + "receiverIP", + "192.168.0.20" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 15, + "id" : 185, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 13, + "time" : 1650 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "80" + ], + [ + "destinationPort", + "61957" + ], + [ + "sequenceNumber", + "3003001" + ], + [ + "acknowledgementNumber", + "2000007" + ], + [ + "flags", + "ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 186, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "packet" : 13, + "time" : 1650 + }, + { + "after" : [ + [ + "state", + "FIN_WAIT_2" + ] + ], + "before" : [ + [ + "state", + "FIN_WAIT_1" + ] + ], + "detail" : "TCP FIN_WAIT_1 -> FIN_WAIT_2", + "direction" : "local", + "id" : 187, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "time" : 1650 + }, + { + "after" : [ + [ + "state", + "LAST_ACK" + ] + ], + "before" : [ + [ + "state", + "CLOSE_WAIT" + ] + ], + "detail" : "TCP CLOSE_WAIT -> LAST_ACK", + "direction" : "local", + "id" : 188, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "time" : 3000 + }, + { + "after" : [ + [ + "sourcePort", + "80" + ], + [ + "destinationPort", + "61957" + ], + [ + "sequenceNumber", + "3003001" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "FIN" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP FIN after CLOSE_WAIT", + "direction" : "outbound", + "id" : 189, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 14, + "time" : 3000 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.10" + ], + [ + "receiverIP", + "192.168.0.20" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 16, + "id" : 190, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 14, + "time" : 3000 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 16, + "id" : 191, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "created", + "packet" : 14, + "time" : 3000 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 16, + "id" : 192, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "packet" : 14, + "time" : 3000 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 16, + "id" : 193, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "packet" : 14, + "time" : 3055 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 16, + "id" : 194, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "packet" : 14, + "time" : 3055 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "detail" : "switch learned unicast forwarding", + "direction" : "outbound", + "frame" : 16, + "id" : 195, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 14, + "time" : 3055 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 16, + "id" : 196, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 14, + "time" : 3055 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 16, + "id" : 197, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 14, + "time" : 3110 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:12" + ] + ], + "direction" : "inbound", + "frame" : 16, + "id" : 198, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 14, + "time" : 3110 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "192.168.0.10" + ], + [ + "receiverIP", + "192.168.0.20" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 16, + "id" : 199, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 14, + "time" : 3110 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "80" + ], + [ + "destinationPort", + "61957" + ], + [ + "sequenceNumber", + "3003001" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "FIN" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 200, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "packet" : 14, + "time" : 3110 + }, + { + "after" : [ + [ + "sourcePort", + "61957" + ], + [ + "destinationPort", + "80" + ], + [ + "sequenceNumber", + "2000007" + ], + [ + "acknowledgementNumber", + "3003002" + ], + [ + "flags", + "ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP ACK", + "direction" : "outbound", + "id" : 201, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 15, + "time" : 3110 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.20" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 17, + "id" : 202, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 15, + "time" : 3110 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 17, + "id" : 203, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "created", + "packet" : 15, + "time" : 3110 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 17, + "id" : 204, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "sent", + "packet" : 15, + "time" : 3110 + }, + { + "after" : [ + [ + "state", + "TIME_WAIT" + ] + ], + "before" : [ + [ + "state", + "FIN_WAIT_2" + ] + ], + "detail" : "TCP FIN_WAIT_2 -> TIME_WAIT", + "direction" : "local", + "id" : 205, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "time" : 3110 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 17, + "id" : 206, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "packet" : 15, + "time" : 3165 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 17, + "id" : 207, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "packet" : 15, + "time" : 3165 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "detail" : "switch learned unicast forwarding", + "direction" : "outbound", + "frame" : 17, + "id" : 208, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 15, + "time" : 3165 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 17, + "id" : 209, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 15, + "time" : 3165 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 17, + "id" : 210, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 15, + "time" : 3220 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:12" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 17, + "id" : 211, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 15, + "time" : 3220 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "192.168.0.20" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 17, + "id" : 212, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 15, + "time" : 3220 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "61957" + ], + [ + "destinationPort", + "80" + ], + [ + "sequenceNumber", + "2000007" + ], + [ + "acknowledgementNumber", + "3003002" + ], + [ + "flags", + "ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 213, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "packet" : 15, + "time" : 3220 + }, + { + "after" : [ + [ + "state", + "CLOSED" + ] + ], + "before" : [ + [ + "state", + "LAST_ACK" + ] + ], + "detail" : "TCP LAST_ACK -> CLOSED", + "direction" : "local", + "id" : 214, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "time" : 3220 + }, + { + "after" : [ + [ + "state", + "CLOSED" + ] + ], + "before" : [ + [ + "state", + "TIME_WAIT" + ] + ], + "detail" : "TCP TIME_WAIT -> CLOSED", + "direction" : "local", + "id" : 215, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "time" : 5610 + }, + { + "after" : [ + [ + "state", + "SYN_SENT" + ] + ], + "before" : [ + [ + "state", + "CLOSED" + ] + ], + "detail" : "TCP CLOSED -> SYN_SENT", + "direction" : "local", + "id" : 216, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "accepted", + "time" : 8000 + }, + { + "after" : [ + [ + "sourcePort", + "51292" + ], + [ + "destinationPort", + "81" + ], + [ + "sequenceNumber", + "4000000" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "SYN" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP SYN", + "direction" : "outbound", + "id" : 217, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "sent", + "packet" : 16, + "time" : 8000 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "ARP request for 192.168.0.10", + "direction" : "outbound", + "frame" : 18, + "id" : 218, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "created", + "time" : 8000 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 18, + "id" : 219, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "sent", + "time" : 8000 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 18, + "id" : 220, + "interface" : "00000000-0000-0000-0000-000000000123", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "time" : 8055 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 18, + "id" : 221, + "interface" : "00000000-0000-0000-0000-000000000123", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "time" : 8055 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "switch broadcast flooding", + "direction" : "outbound", + "frame" : 18, + "id" : 222, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "time" : 8055 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 18, + "id" : 223, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "time" : 8055 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "switch broadcast flooding", + "direction" : "outbound", + "frame" : 18, + "id" : 224, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "time" : 8055 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 18, + "id" : 225, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "time" : 8055 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 18, + "id" : 226, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "time" : 8110 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 18, + "id" : 227, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "time" : 8110 + }, + { + "after" : [ + + ], + "before" : [ + [ + "operation", + "request" + ], + [ + "senderMAC", + "02:00:00:00:01:13" + ], + [ + "senderIP", + "192.168.0.30" + ], + [ + "targetMAC", + "00:00:00:00:00:00" + ], + [ + "targetIP", + "192.168.0.10" + ] + ], + "direction" : "inbound", + "frame" : 18, + "id" : 228, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "time" : 8110 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:13" + ] + ], + "before" : [ + + ], + "detail" : "ARP reply for 192.168.0.10", + "direction" : "outbound", + "frame" : 19, + "id" : 229, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "created", + "time" : 8110 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:13" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 19, + "id" : 230, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "sent", + "time" : 8110 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 18, + "id" : 231, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "time" : 8110 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 18, + "id" : 232, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "time" : 8110 + }, + { + "after" : [ + + ], + "before" : [ + [ + "operation", + "request" + ], + [ + "senderMAC", + "02:00:00:00:01:13" + ], + [ + "senderIP", + "192.168.0.30" + ], + [ + "targetMAC", + "00:00:00:00:00:00" + ], + [ + "targetIP", + "192.168.0.10" + ] + ], + "direction" : "inbound", + "frame" : 18, + "id" : 233, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "time" : 8110 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:13" + ] + ], + "direction" : "inbound", + "frame" : 19, + "id" : 234, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "time" : 8165 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:13" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 19, + "id" : 235, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "time" : 8165 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:13" + ] + ], + "before" : [ + + ], + "detail" : "switch learned unicast forwarding", + "direction" : "outbound", + "frame" : 19, + "id" : 236, + "interface" : "00000000-0000-0000-0000-000000000123", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "time" : 8165 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:13" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 19, + "id" : 237, + "interface" : "00000000-0000-0000-0000-000000000123", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "time" : 8165 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:13" + ] + ], + "direction" : "inbound", + "frame" : 19, + "id" : 238, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "received", + "time" : 8220 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:11" + ], + [ + "destinationMAC", + "02:00:00:00:01:13" + ] + ], + "direction" : "inbound", + "frame" : 19, + "id" : 239, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "received", + "time" : 8220 + }, + { + "after" : [ + + ], + "before" : [ + [ + "operation", + "reply" + ], + [ + "senderMAC", + "02:00:00:00:01:11" + ], + [ + "senderIP", + "192.168.0.10" + ], + [ + "targetMAC", + "02:00:00:00:01:13" + ], + [ + "targetIP", + "192.168.0.30" + ] + ], + "direction" : "inbound", + "frame" : 19, + "id" : 240, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "accepted", + "time" : 8220 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.30" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 20, + "id" : 241, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "sent", + "packet" : 16, + "time" : 8220 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 20, + "id" : 242, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "created", + "packet" : 16, + "time" : 8220 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 20, + "id" : 243, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "sent", + "packet" : 16, + "time" : 8220 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 20, + "id" : 244, + "interface" : "00000000-0000-0000-0000-000000000123", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "packet" : 16, + "time" : 8275 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 20, + "id" : 245, + "interface" : "00000000-0000-0000-0000-000000000123", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "packet" : 16, + "time" : 8275 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "detail" : "switch learned unicast forwarding", + "direction" : "outbound", + "frame" : 20, + "id" : 246, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 16, + "time" : 8275 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 20, + "id" : 247, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 16, + "time" : 8275 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 20, + "id" : 248, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 16, + "time" : 8330 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 20, + "id" : 249, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 16, + "time" : 8330 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "192.168.0.30" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 20, + "id" : 250, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 16, + "time" : 8330 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "51292" + ], + [ + "destinationPort", + "81" + ], + [ + "sequenceNumber", + "4000000" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "SYN" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 251, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "packet" : 16, + "time" : 8330 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "51292" + ], + [ + "destinationPort", + "81" + ], + [ + "sequenceNumber", + "4000000" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "SYN" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP destination port closed", + "direction" : "local", + "id" : 252, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "dropped", + "packet" : 16, + "time" : 8330 + }, + { + "after" : [ + [ + "sourcePort", + "51292" + ], + [ + "destinationPort", + "81" + ], + [ + "sequenceNumber", + "4000000" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "SYN" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP SYN retransmission attempt 2", + "direction" : "outbound", + "id" : 253, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "retransmitted", + "packet" : 17, + "time" : 15830 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.30" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 21, + "id" : 254, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "sent", + "packet" : 17, + "time" : 15830 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 21, + "id" : 255, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "created", + "packet" : 17, + "time" : 15830 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 21, + "id" : 256, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "sent", + "packet" : 17, + "time" : 15830 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 21, + "id" : 257, + "interface" : "00000000-0000-0000-0000-000000000123", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "packet" : 17, + "time" : 15885 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 21, + "id" : 258, + "interface" : "00000000-0000-0000-0000-000000000123", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "packet" : 17, + "time" : 15885 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "detail" : "switch unknown unicast flooding", + "direction" : "outbound", + "frame" : 21, + "id" : 259, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 17, + "time" : 15885 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 21, + "id" : 260, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 17, + "time" : 15885 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "detail" : "switch unknown unicast flooding", + "direction" : "outbound", + "frame" : 21, + "id" : 261, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 17, + "time" : 15885 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 21, + "id" : 262, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 17, + "time" : 15885 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 21, + "id" : 263, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 17, + "time" : 15940 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 21, + "id" : 264, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 17, + "time" : 15940 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "192.168.0.30" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 21, + "id" : 265, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 17, + "time" : 15940 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "51292" + ], + [ + "destinationPort", + "81" + ], + [ + "sequenceNumber", + "4000000" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "SYN" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 266, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "packet" : 17, + "time" : 15940 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "51292" + ], + [ + "destinationPort", + "81" + ], + [ + "sequenceNumber", + "4000000" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "SYN" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP destination port closed", + "direction" : "local", + "id" : 267, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "dropped", + "packet" : 17, + "time" : 15940 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 21, + "id" : 268, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 17, + "time" : 15940 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 21, + "id" : 269, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 17, + "time" : 15940 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "detail" : "destination MAC does not match interface", + "direction" : "inbound", + "frame" : 21, + "id" : 270, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "dropped", + "packet" : 17, + "time" : 15940 + }, + { + "after" : [ + [ + "sourcePort", + "51292" + ], + [ + "destinationPort", + "81" + ], + [ + "sequenceNumber", + "4000000" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "SYN" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP SYN retransmission attempt 3", + "direction" : "outbound", + "id" : 271, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "retransmitted", + "packet" : 18, + "time" : 23330 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.30" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 22, + "id" : 272, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "sent", + "packet" : 18, + "time" : 23330 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 22, + "id" : 273, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "created", + "packet" : 18, + "time" : 23330 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 22, + "id" : 274, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "sent", + "packet" : 18, + "time" : 23330 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 22, + "id" : 275, + "interface" : "00000000-0000-0000-0000-000000000123", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "packet" : 18, + "time" : 23385 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 22, + "id" : 276, + "interface" : "00000000-0000-0000-0000-000000000123", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "packet" : 18, + "time" : 23385 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "detail" : "switch unknown unicast flooding", + "direction" : "outbound", + "frame" : 22, + "id" : 277, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 18, + "time" : 23385 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 22, + "id" : 278, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 18, + "time" : 23385 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "detail" : "switch unknown unicast flooding", + "direction" : "outbound", + "frame" : 22, + "id" : 279, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "packet" : 18, + "time" : 23385 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 22, + "id" : 280, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "packet" : 18, + "time" : 23385 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 22, + "id" : 281, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 18, + "time" : 23440 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 22, + "id" : 282, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 18, + "time" : 23440 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "192.168.0.30" + ], + [ + "receiverIP", + "192.168.0.10" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 22, + "id" : 283, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "packet" : 18, + "time" : 23440 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "51292" + ], + [ + "destinationPort", + "81" + ], + [ + "sequenceNumber", + "4000000" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "SYN" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 284, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "packet" : 18, + "time" : 23440 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "51292" + ], + [ + "destinationPort", + "81" + ], + [ + "sequenceNumber", + "4000000" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "SYN" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP destination port closed", + "direction" : "local", + "id" : 285, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "dropped", + "packet" : 18, + "time" : 23440 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 22, + "id" : 286, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 18, + "time" : 23440 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "direction" : "inbound", + "frame" : 22, + "id" : 287, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "packet" : 18, + "time" : 23440 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "02:00:00:00:01:11" + ] + ], + "detail" : "destination MAC does not match interface", + "direction" : "inbound", + "frame" : 22, + "id" : 288, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "dropped", + "packet" : 18, + "time" : 23440 + }, + { + "after" : [ + [ + "state", + "CLOSED" + ] + ], + "before" : [ + [ + "state", + "SYN_SENT" + ] + ], + "detail" : "TCP SYN_SENT -> CLOSED", + "direction" : "local", + "id" : 289, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "accepted", + "time" : 30830 + }, + { + "after" : [ + [ + "state", + "SYN_SENT" + ] + ], + "before" : [ + [ + "state", + "CLOSED" + ] + ], + "detail" : "TCP CLOSED -> SYN_SENT", + "direction" : "local", + "id" : 290, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "accepted", + "time" : 30830 + }, + { + "after" : [ + [ + "sourcePort", + "5000" + ], + [ + "destinationPort", + "80" + ], + [ + "sequenceNumber", + "5000000" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "SYN" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP SYN", + "direction" : "outbound", + "id" : 291, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "sent", + "packet" : 19, + "time" : 30830 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "ARP request for 192.168.0.99", + "direction" : "outbound", + "frame" : 23, + "id" : 292, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "created", + "time" : 30830 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 23, + "id" : 293, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "sent", + "time" : 30830 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 23, + "id" : 294, + "interface" : "00000000-0000-0000-0000-000000000123", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "time" : 30885 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 23, + "id" : 295, + "interface" : "00000000-0000-0000-0000-000000000123", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "time" : 30885 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "switch broadcast flooding", + "direction" : "outbound", + "frame" : 23, + "id" : 296, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "time" : 30885 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 23, + "id" : 297, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "time" : 30885 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "switch broadcast flooding", + "direction" : "outbound", + "frame" : 23, + "id" : 298, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "time" : 30885 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 23, + "id" : 299, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "time" : 30885 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 23, + "id" : 300, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "time" : 30940 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 23, + "id" : 301, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "time" : 30940 + }, + { + "after" : [ + + ], + "before" : [ + [ + "operation", + "request" + ], + [ + "senderMAC", + "02:00:00:00:01:13" + ], + [ + "senderIP", + "192.168.0.30" + ], + [ + "targetMAC", + "00:00:00:00:00:00" + ], + [ + "targetIP", + "192.168.0.99" + ] + ], + "direction" : "inbound", + "frame" : 23, + "id" : 302, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "time" : 30940 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 23, + "id" : 303, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "time" : 30940 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 23, + "id" : 304, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "time" : 30940 + }, + { + "after" : [ + + ], + "before" : [ + [ + "operation", + "request" + ], + [ + "senderMAC", + "02:00:00:00:01:13" + ], + [ + "senderIP", + "192.168.0.30" + ], + [ + "targetMAC", + "00:00:00:00:00:00" + ], + [ + "targetIP", + "192.168.0.99" + ] + ], + "direction" : "inbound", + "frame" : 23, + "id" : 305, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "time" : 30940 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "ARP request for 192.168.0.99", + "direction" : "outbound", + "frame" : 24, + "id" : 306, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "created", + "time" : 30940 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 24, + "id" : 307, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "sent", + "time" : 30940 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 24, + "id" : 308, + "interface" : "00000000-0000-0000-0000-000000000123", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "time" : 30995 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 24, + "id" : 309, + "interface" : "00000000-0000-0000-0000-000000000123", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "time" : 30995 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "switch broadcast flooding", + "direction" : "outbound", + "frame" : 24, + "id" : 310, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "time" : 30995 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 24, + "id" : 311, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "time" : 30995 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "switch broadcast flooding", + "direction" : "outbound", + "frame" : 24, + "id" : 312, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "time" : 30995 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 24, + "id" : 313, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "time" : 30995 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 24, + "id" : 314, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "time" : 31050 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 24, + "id" : 315, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "time" : 31050 + }, + { + "after" : [ + + ], + "before" : [ + [ + "operation", + "request" + ], + [ + "senderMAC", + "02:00:00:00:01:13" + ], + [ + "senderIP", + "192.168.0.30" + ], + [ + "targetMAC", + "00:00:00:00:00:00" + ], + [ + "targetIP", + "192.168.0.99" + ] + ], + "direction" : "inbound", + "frame" : 24, + "id" : 316, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "time" : 31050 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 24, + "id" : 317, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "time" : 31050 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 24, + "id" : 318, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "time" : 31050 + }, + { + "after" : [ + + ], + "before" : [ + [ + "operation", + "request" + ], + [ + "senderMAC", + "02:00:00:00:01:13" + ], + [ + "senderIP", + "192.168.0.30" + ], + [ + "targetMAC", + "00:00:00:00:00:00" + ], + [ + "targetIP", + "192.168.0.99" + ] + ], + "direction" : "inbound", + "frame" : 24, + "id" : 319, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "time" : 31050 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.30" + ], + [ + "receiverIP", + "192.168.0.30" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "1" + ] + ], + "before" : [ + + ], + "detail" : "ICMP destinationHostUnreachable", + "direction" : "local", + "id" : 320, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "created", + "packet" : 20, + "time" : 31050 + }, + { + "after" : [ + [ + "sourcePort", + "5000" + ], + [ + "destinationPort", + "80" + ], + [ + "sequenceNumber", + "5000000" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "SYN" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP SYN retransmission attempt 2", + "direction" : "outbound", + "id" : 321, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "retransmitted", + "packet" : 21, + "time" : 38550 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "ARP request for 192.168.0.99", + "direction" : "outbound", + "frame" : 25, + "id" : 322, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "created", + "time" : 38550 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 25, + "id" : 323, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "sent", + "time" : 38550 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "ARP request for 192.168.0.99", + "direction" : "outbound", + "frame" : 26, + "id" : 324, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "created", + "time" : 38550 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 26, + "id" : 325, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "sent", + "time" : 38550 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.30" + ], + [ + "receiverIP", + "192.168.0.30" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "1" + ] + ], + "before" : [ + + ], + "detail" : "ICMP destinationHostUnreachable", + "direction" : "local", + "id" : 326, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "created", + "packet" : 22, + "time" : 38550 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 25, + "id" : 327, + "interface" : "00000000-0000-0000-0000-000000000123", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "time" : 38605 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 25, + "id" : 328, + "interface" : "00000000-0000-0000-0000-000000000123", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "time" : 38605 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "switch broadcast flooding", + "direction" : "outbound", + "frame" : 25, + "id" : 329, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "time" : 38605 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 25, + "id" : 330, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "time" : 38605 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "switch broadcast flooding", + "direction" : "outbound", + "frame" : 25, + "id" : 331, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "time" : 38605 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 25, + "id" : 332, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "time" : 38605 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 26, + "id" : 333, + "interface" : "00000000-0000-0000-0000-000000000123", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "time" : 38605 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 26, + "id" : 334, + "interface" : "00000000-0000-0000-0000-000000000123", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "time" : 38605 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "switch broadcast flooding", + "direction" : "outbound", + "frame" : 26, + "id" : 335, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "time" : 38605 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 26, + "id" : 336, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "time" : 38605 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "switch broadcast flooding", + "direction" : "outbound", + "frame" : 26, + "id" : 337, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "time" : 38605 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 26, + "id" : 338, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "time" : 38605 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 25, + "id" : 339, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "time" : 38660 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 25, + "id" : 340, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "time" : 38660 + }, + { + "after" : [ + + ], + "before" : [ + [ + "operation", + "request" + ], + [ + "senderMAC", + "02:00:00:00:01:13" + ], + [ + "senderIP", + "192.168.0.30" + ], + [ + "targetMAC", + "00:00:00:00:00:00" + ], + [ + "targetIP", + "192.168.0.99" + ] + ], + "direction" : "inbound", + "frame" : 25, + "id" : 341, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "time" : 38660 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 25, + "id" : 342, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "time" : 38660 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 25, + "id" : 343, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "time" : 38660 + }, + { + "after" : [ + + ], + "before" : [ + [ + "operation", + "request" + ], + [ + "senderMAC", + "02:00:00:00:01:13" + ], + [ + "senderIP", + "192.168.0.30" + ], + [ + "targetMAC", + "00:00:00:00:00:00" + ], + [ + "targetIP", + "192.168.0.99" + ] + ], + "direction" : "inbound", + "frame" : 25, + "id" : 344, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "time" : 38660 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 26, + "id" : 345, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "time" : 38660 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 26, + "id" : 346, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "time" : 38660 + }, + { + "after" : [ + + ], + "before" : [ + [ + "operation", + "request" + ], + [ + "senderMAC", + "02:00:00:00:01:13" + ], + [ + "senderIP", + "192.168.0.30" + ], + [ + "targetMAC", + "00:00:00:00:00:00" + ], + [ + "targetIP", + "192.168.0.99" + ] + ], + "direction" : "inbound", + "frame" : 26, + "id" : 347, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "time" : 38660 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 26, + "id" : 348, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "time" : 38660 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 26, + "id" : 349, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "time" : 38660 + }, + { + "after" : [ + + ], + "before" : [ + [ + "operation", + "request" + ], + [ + "senderMAC", + "02:00:00:00:01:13" + ], + [ + "senderIP", + "192.168.0.30" + ], + [ + "targetMAC", + "00:00:00:00:00:00" + ], + [ + "targetIP", + "192.168.0.99" + ] + ], + "direction" : "inbound", + "frame" : 26, + "id" : 350, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "time" : 38660 + }, + { + "after" : [ + [ + "sourcePort", + "5000" + ], + [ + "destinationPort", + "80" + ], + [ + "sequenceNumber", + "5000000" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "SYN" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP SYN retransmission attempt 3", + "direction" : "outbound", + "id" : 351, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "retransmitted", + "packet" : 23, + "time" : 46050 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "ARP request for 192.168.0.99", + "direction" : "outbound", + "frame" : 27, + "id" : 352, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "created", + "time" : 46050 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 27, + "id" : 353, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "sent", + "time" : 46050 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "ARP request for 192.168.0.99", + "direction" : "outbound", + "frame" : 28, + "id" : 354, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "created", + "time" : 46050 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 28, + "id" : 355, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "sent", + "time" : 46050 + }, + { + "after" : [ + [ + "senderIP", + "192.168.0.30" + ], + [ + "receiverIP", + "192.168.0.30" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "1" + ] + ], + "before" : [ + + ], + "detail" : "ICMP destinationHostUnreachable", + "direction" : "local", + "id" : 356, + "interface" : "00000000-0000-0000-0000-000000000113", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "created", + "packet" : 24, + "time" : 46050 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 27, + "id" : 357, + "interface" : "00000000-0000-0000-0000-000000000123", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "time" : 46105 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 27, + "id" : 358, + "interface" : "00000000-0000-0000-0000-000000000123", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "time" : 46105 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "switch broadcast flooding", + "direction" : "outbound", + "frame" : 27, + "id" : 359, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "time" : 46105 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 27, + "id" : 360, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "time" : 46105 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "switch broadcast flooding", + "direction" : "outbound", + "frame" : 27, + "id" : 361, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "time" : 46105 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 27, + "id" : 362, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "time" : 46105 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 28, + "id" : 363, + "interface" : "00000000-0000-0000-0000-000000000123", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "received", + "time" : 46105 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "detail" : "switch learned source MAC", + "direction" : "inbound", + "frame" : 28, + "id" : 364, + "interface" : "00000000-0000-0000-0000-000000000123", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "accepted", + "time" : 46105 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "switch broadcast flooding", + "direction" : "outbound", + "frame" : 28, + "id" : 365, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "time" : 46105 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 28, + "id" : 366, + "interface" : "00000000-0000-0000-0000-000000000121", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "time" : 46105 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "switch broadcast flooding", + "direction" : "outbound", + "frame" : 28, + "id" : 367, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "forwarded", + "time" : 46105 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 28, + "id" : 368, + "interface" : "00000000-0000-0000-0000-000000000122", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000104", + "operation" : "sent", + "time" : 46105 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 27, + "id" : 369, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "time" : 46160 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 27, + "id" : 370, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "time" : 46160 + }, + { + "after" : [ + + ], + "before" : [ + [ + "operation", + "request" + ], + [ + "senderMAC", + "02:00:00:00:01:13" + ], + [ + "senderIP", + "192.168.0.30" + ], + [ + "targetMAC", + "00:00:00:00:00:00" + ], + [ + "targetIP", + "192.168.0.99" + ] + ], + "direction" : "inbound", + "frame" : 27, + "id" : 371, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "time" : 46160 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 27, + "id" : 372, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "time" : 46160 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 27, + "id" : 373, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "time" : 46160 + }, + { + "after" : [ + + ], + "before" : [ + [ + "operation", + "request" + ], + [ + "senderMAC", + "02:00:00:00:01:13" + ], + [ + "senderIP", + "192.168.0.30" + ], + [ + "targetMAC", + "00:00:00:00:00:00" + ], + [ + "targetIP", + "192.168.0.99" + ] + ], + "direction" : "inbound", + "frame" : 27, + "id" : 374, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "time" : 46160 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 28, + "id" : 375, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "time" : 46160 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 28, + "id" : 376, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "received", + "time" : 46160 + }, + { + "after" : [ + + ], + "before" : [ + [ + "operation", + "request" + ], + [ + "senderMAC", + "02:00:00:00:01:13" + ], + [ + "senderIP", + "192.168.0.30" + ], + [ + "targetMAC", + "00:00:00:00:00:00" + ], + [ + "targetIP", + "192.168.0.99" + ] + ], + "direction" : "inbound", + "frame" : 28, + "id" : 377, + "interface" : "00000000-0000-0000-0000-000000000111", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "time" : 46160 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 28, + "id" : 378, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "time" : 46160 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:01:13" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 28, + "id" : 379, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "received", + "time" : 46160 + }, + { + "after" : [ + + ], + "before" : [ + [ + "operation", + "request" + ], + [ + "senderMAC", + "02:00:00:00:01:13" + ], + [ + "senderIP", + "192.168.0.30" + ], + [ + "targetMAC", + "00:00:00:00:00:00" + ], + [ + "targetIP", + "192.168.0.99" + ] + ], + "direction" : "inbound", + "frame" : 28, + "id" : 380, + "interface" : "00000000-0000-0000-0000-000000000112", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000102", + "operation" : "accepted", + "time" : 46160 + }, + { + "after" : [ + [ + "state", + "CLOSED" + ] + ], + "before" : [ + [ + "state", + "SYN_SENT" + ] + ], + "detail" : "TCP SYN_SENT -> CLOSED", + "direction" : "local", + "id" : 381, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000103", + "operation" : "accepted", + "time" : 53550 + }, + { + "after" : [ + [ + "state", + "CLOSED" + ] + ], + "before" : [ + [ + "state", + "LISTEN" + ] + ], + "detail" : "TCP LISTEN -> CLOSED", + "direction" : "local", + "id" : 382, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000101", + "operation" : "accepted", + "time" : 53550 + } + ] +} diff --git a/packages/core/test/scenarios/tcp-routed-loss.scenario.json b/packages/core/test/scenarios/tcp-routed-loss.scenario.json new file mode 100644 index 0000000..e91068e --- /dev/null +++ b/packages/core/test/scenarios/tcp-routed-loss.scenario.json @@ -0,0 +1,166 @@ +{ + "seed": 32, + "nodes": [ + { + "id": "00000000-0000-0000-0000-000000000201", + "kind": "pc", + "ports": [ + { + "id": "00000000-0000-0000-0000-000000000211", + "label": "eth0" + } + ] + }, + { + "id": "00000000-0000-0000-0000-000000000202", + "kind": "router", + "ports": [ + { + "id": "00000000-0000-0000-0000-000000000221", + "label": "rt1" + }, + { + "id": "00000000-0000-0000-0000-000000000222", + "label": "rt2" + } + ] + }, + { + "id": "00000000-0000-0000-0000-000000000203", + "kind": "pc", + "ports": [ + { + "id": "00000000-0000-0000-0000-000000000213", + "label": "eth0" + } + ] + } + ], + "links": [ + { + "id": "00000000-0000-0000-0000-00000000F004", + "sourceNode": "00000000-0000-0000-0000-000000000201", + "sourcePort": "00000000-0000-0000-0000-000000000211", + "targetNode": "00000000-0000-0000-0000-000000000202", + "targetPort": "00000000-0000-0000-0000-000000000221" + }, + { + "id": "00000000-0000-0000-0000-00000000F005", + "sourceNode": "00000000-0000-0000-0000-000000000202", + "sourcePort": "00000000-0000-0000-0000-000000000222", + "targetNode": "00000000-0000-0000-0000-000000000203", + "targetPort": "00000000-0000-0000-0000-000000000213" + } + ], + "devices": { + "00000000-0000-0000-0000-000000000201": { + "ip": "10.0.0.2", + "mask": "255.255.255.0", + "gateway": "10.0.0.1" + }, + "00000000-0000-0000-0000-000000000202": { + "ip": "10.0.0.1", + "mask": "255.255.255.0" + }, + "00000000-0000-0000-0000-000000000203": { + "ip": "20.0.0.2", + "mask": "255.255.255.0", + "gateway": "20.0.0.1" + } + }, + "interfaces": [ + { + "node": "00000000-0000-0000-0000-000000000202", + "port": "00000000-0000-0000-0000-000000000221", + "ip": "10.0.0.1", + "mask": "255.255.255.0" + }, + { + "node": "00000000-0000-0000-0000-000000000202", + "port": "00000000-0000-0000-0000-000000000222", + "ip": "20.0.0.1", + "mask": "255.255.255.0" + } + ], + "steps": [ + { + "op": "openTcpServer", + "node": "00000000-0000-0000-0000-000000000203", + "port": 80 + }, + { + "op": "openTcpServer", + "node": "00000000-0000-0000-0000-000000000203", + "port": 81 + }, + { + "op": "openTcpClient", + "node": "00000000-0000-0000-0000-000000000201", + "target": "20.0.0.2", + "port": 80 + }, + { + "op": "connectTcp", + "socket": "00000000-0000-0000-0000-000000000003" + }, + { + "op": "sendTcp", + "socket": "00000000-0000-0000-0000-000000000003", + "payload": "durch den Router" + }, + { + "op": "receiveTcp", + "socket": "00000000-0000-0000-0000-000000000004" + }, + { + "op": "openTcpClient", + "node": "00000000-0000-0000-0000-000000000201", + "target": "20.0.0.2", + "port": 81 + }, + { + "op": "connectTcp", + "socket": "00000000-0000-0000-0000-000000000005" + }, + { + "op": "packetLoss", + "enabled": true + }, + { + "op": "sendTcp", + "socket": "00000000-0000-0000-0000-000000000003", + "payload": "verloren" + }, + { + "op": "packetLoss", + "enabled": false + }, + { + "op": "sendTcp", + "socket": "00000000-0000-0000-0000-000000000003", + "payload": "zu spaet" + }, + { + "op": "closeSocket", + "socket": "00000000-0000-0000-0000-000000000001" + }, + { + "op": "openTcpServer", + "node": "00000000-0000-0000-0000-000000000203", + "port": 80 + } + ], + "firewalls": { + "00000000-0000-0000-0000-000000000202": { + "active": true, + "defaultPolicy": "accept", + "rules": [ + { + "protocol": "tcp", + "port": 81, + "action": "drop" + } + ] + } + } +} diff --git a/packages/core/test/scenarios/tcp-routed-loss.swift.json b/packages/core/test/scenarios/tcp-routed-loss.swift.json new file mode 100644 index 0000000..1f300a9 --- /dev/null +++ b/packages/core/test/scenarios/tcp-routed-loss.swift.json @@ -0,0 +1,4777 @@ +{ + "arp" : { + "00000000-0000-0000-0000-000000000201" : { + "10.0.0.1" : "02:00:00:00:02:21" + }, + "00000000-0000-0000-0000-000000000202" : { + "10.0.0.2" : "02:00:00:00:02:11", + "20.0.0.2" : "02:00:00:00:02:13" + }, + "00000000-0000-0000-0000-000000000203" : { + "20.0.0.1" : "02:00:00:00:02:22" + } + }, + "firewallDecisions" : [ + { + "accepted" : true, + "node" : "00000000-0000-0000-0000-000000000202", + "packet" : 1 + }, + { + "accepted" : true, + "node" : "00000000-0000-0000-0000-000000000202", + "packet" : 2 + }, + { + "accepted" : true, + "node" : "00000000-0000-0000-0000-000000000202", + "packet" : 3 + }, + { + "accepted" : true, + "node" : "00000000-0000-0000-0000-000000000202", + "packet" : 4 + }, + { + "accepted" : true, + "node" : "00000000-0000-0000-0000-000000000202", + "packet" : 5 + }, + { + "accepted" : false, + "node" : "00000000-0000-0000-0000-000000000202", + "packet" : 6, + "rule" : 0 + }, + { + "accepted" : false, + "node" : "00000000-0000-0000-0000-000000000202", + "packet" : 7, + "rule" : 0 + }, + { + "accepted" : false, + "node" : "00000000-0000-0000-0000-000000000202", + "packet" : 8, + "rule" : 0 + } + ], + "icmpObservations" : { + + }, + "pendingEvents" : 0, + "results" : [ + "00000000-0000-0000-0000-000000000001", + "00000000-0000-0000-0000-000000000002", + "00000000-0000-0000-0000-000000000003", + "connected", + true, + "durch den Router", + "00000000-0000-0000-0000-000000000005", + "timedOut", + true, + false, + false, + false, + false, + "00000000-0000-0000-0000-000000000006" + ], + "sockets" : [ + { + "id" : "00000000-0000-0000-0000-000000000001", + "localIp" : null, + "localPort" : 80, + "node" : "00000000-0000-0000-0000-000000000203", + "parent" : null, + "protocol" : "tcp", + "queued" : 0, + "remoteIp" : null, + "remotePort" : null, + "session" : { + "assembly" : 0, + "attempts" : 0, + "messages" : 0, + "next" : 1000000, + "pending" : false, + "remote" : 0 + }, + "tcpState" : "CLOSED" + }, + { + "id" : "00000000-0000-0000-0000-000000000002", + "localIp" : null, + "localPort" : 81, + "node" : "00000000-0000-0000-0000-000000000203", + "parent" : null, + "protocol" : "tcp", + "queued" : 0, + "remoteIp" : null, + "remotePort" : null, + "session" : { + "assembly" : 0, + "attempts" : 0, + "messages" : 0, + "next" : 2000000, + "pending" : false, + "remote" : 0 + }, + "tcpState" : "LISTEN" + }, + { + "id" : "00000000-0000-0000-0000-000000000003", + "localIp" : "10.0.0.2", + "localPort" : 50299, + "node" : "00000000-0000-0000-0000-000000000201", + "parent" : null, + "protocol" : "tcp", + "queued" : 0, + "remoteIp" : "20.0.0.2", + "remotePort" : 80, + "session" : { + "assembly" : 0, + "attempts" : 3, + "messages" : 0, + "next" : 3000025, + "pending" : false, + "remote" : 4000001 + }, + "tcpState" : "CLOSED" + }, + { + "id" : "00000000-0000-0000-0000-000000000004", + "localIp" : "20.0.0.2", + "localPort" : 80, + "node" : "00000000-0000-0000-0000-000000000203", + "parent" : "00000000-0000-0000-0000-000000000001", + "protocol" : "tcp", + "queued" : 0, + "remoteIp" : "10.0.0.2", + "remotePort" : 50299, + "session" : { + "assembly" : 0, + "attempts" : 1, + "messages" : 0, + "next" : 4000001, + "pending" : false, + "remote" : 3000017 + }, + "tcpState" : "ESTABLISHED" + }, + { + "id" : "00000000-0000-0000-0000-000000000005", + "localIp" : "10.0.0.2", + "localPort" : 63015, + "node" : "00000000-0000-0000-0000-000000000201", + "parent" : null, + "protocol" : "tcp", + "queued" : 0, + "remoteIp" : "20.0.0.2", + "remotePort" : 81, + "session" : { + "assembly" : 0, + "attempts" : 3, + "messages" : 0, + "next" : 5000001, + "pending" : false, + "remote" : 0 + }, + "tcpState" : "CLOSED" + }, + { + "id" : "00000000-0000-0000-0000-000000000006", + "localIp" : null, + "localPort" : 80, + "node" : "00000000-0000-0000-0000-000000000203", + "parent" : null, + "protocol" : "tcp", + "queued" : 0, + "remoteIp" : null, + "remotePort" : null, + "session" : { + "assembly" : 0, + "attempts" : 0, + "messages" : 0, + "next" : 6000000, + "pending" : false, + "remote" : 0 + }, + "tcpState" : "LISTEN" + } + ], + "switchTables" : { + + }, + "time" : 45880, + "traces" : [ + { + "after" : [ + [ + "state", + "LISTEN" + ] + ], + "before" : [ + [ + "state", + "CLOSED" + ] + ], + "detail" : "TCP CLOSED -> LISTEN", + "direction" : "local", + "id" : 1, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "accepted", + "time" : 0 + }, + { + "after" : [ + [ + "state", + "LISTEN" + ] + ], + "before" : [ + [ + "state", + "CLOSED" + ] + ], + "detail" : "TCP CLOSED -> LISTEN", + "direction" : "local", + "id" : 2, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "accepted", + "time" : 0 + }, + { + "after" : [ + [ + "state", + "SYN_SENT" + ] + ], + "before" : [ + [ + "state", + "CLOSED" + ] + ], + "detail" : "TCP CLOSED -> SYN_SENT", + "direction" : "local", + "id" : 3, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "accepted", + "time" : 0 + }, + { + "after" : [ + [ + "sourcePort", + "50299" + ], + [ + "destinationPort", + "80" + ], + [ + "sequenceNumber", + "3000000" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "SYN" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP SYN", + "direction" : "outbound", + "id" : 4, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "sent", + "packet" : 1, + "time" : 0 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "ARP request for 10.0.0.1", + "direction" : "outbound", + "frame" : 1, + "id" : 5, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "created", + "time" : 0 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 1, + "id" : 6, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "sent", + "time" : 0 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 1, + "id" : 7, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "time" : 55 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 1, + "id" : 8, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "time" : 55 + }, + { + "after" : [ + + ], + "before" : [ + [ + "operation", + "request" + ], + [ + "senderMAC", + "02:00:00:00:02:11" + ], + [ + "senderIP", + "10.0.0.2" + ], + [ + "targetMAC", + "00:00:00:00:00:00" + ], + [ + "targetIP", + "10.0.0.1" + ] + ], + "direction" : "inbound", + "frame" : 1, + "id" : 9, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "accepted", + "time" : 55 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:21" + ], + [ + "destinationMAC", + "02:00:00:00:02:11" + ] + ], + "before" : [ + + ], + "detail" : "ARP reply for 10.0.0.1", + "direction" : "outbound", + "frame" : 2, + "id" : 10, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "created", + "time" : 55 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:21" + ], + [ + "destinationMAC", + "02:00:00:00:02:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 2, + "id" : 11, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "sent", + "time" : 55 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:21" + ], + [ + "destinationMAC", + "02:00:00:00:02:11" + ] + ], + "direction" : "inbound", + "frame" : 2, + "id" : 12, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "received", + "time" : 110 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:21" + ], + [ + "destinationMAC", + "02:00:00:00:02:11" + ] + ], + "direction" : "inbound", + "frame" : 2, + "id" : 13, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "received", + "time" : 110 + }, + { + "after" : [ + + ], + "before" : [ + [ + "operation", + "reply" + ], + [ + "senderMAC", + "02:00:00:00:02:21" + ], + [ + "senderIP", + "10.0.0.1" + ], + [ + "targetMAC", + "02:00:00:00:02:11" + ], + [ + "targetIP", + "10.0.0.2" + ] + ], + "direction" : "inbound", + "frame" : 2, + "id" : 14, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "accepted", + "time" : 110 + }, + { + "after" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 3, + "id" : 15, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "sent", + "packet" : 1, + "time" : 110 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 3, + "id" : 16, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "created", + "packet" : 1, + "time" : 110 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 3, + "id" : 17, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "sent", + "packet" : 1, + "time" : 110 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "direction" : "inbound", + "frame" : 3, + "id" : 18, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "packet" : 1, + "time" : 165 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "direction" : "inbound", + "frame" : 3, + "id" : 19, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "packet" : 1, + "time" : 165 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 3, + "id" : 20, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "packet" : 1, + "time" : 165 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "detail" : "firewall default policy", + "direction" : "inbound", + "frame" : 3, + "id" : 21, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "accepted", + "packet" : 1, + "time" : 165 + }, + { + "after" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "63" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "detail" : "TTL decremented", + "direction" : "outbound", + "frame" : 3, + "id" : 22, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "forwarded", + "packet" : 1, + "time" : 165 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:22" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "ARP request for 20.0.0.2", + "direction" : "outbound", + "frame" : 4, + "id" : 23, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "created", + "time" : 165 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:22" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 4, + "id" : 24, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "sent", + "time" : 165 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:22" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "detail" : "ARP request for 20.0.0.2", + "direction" : "outbound", + "frame" : 5, + "id" : 25, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "created", + "time" : 165 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:22" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 5, + "id" : 26, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "sent", + "time" : 165 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "63" + ], + [ + "protocol", + "6" + ] + ], + "detail" : "waiting for ARP resolution of 20.0.0.2", + "direction" : "outbound", + "id" : 27, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "created", + "packet" : 1, + "time" : 165 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:22" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 4, + "id" : 28, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "received", + "time" : 220 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:22" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 4, + "id" : 29, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "received", + "time" : 220 + }, + { + "after" : [ + + ], + "before" : [ + [ + "operation", + "request" + ], + [ + "senderMAC", + "02:00:00:00:02:22" + ], + [ + "senderIP", + "20.0.0.1" + ], + [ + "targetMAC", + "00:00:00:00:00:00" + ], + [ + "targetIP", + "20.0.0.2" + ] + ], + "direction" : "inbound", + "frame" : 4, + "id" : 30, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "accepted", + "time" : 220 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:13" + ], + [ + "destinationMAC", + "02:00:00:00:02:22" + ] + ], + "before" : [ + + ], + "detail" : "ARP reply for 20.0.0.2", + "direction" : "outbound", + "frame" : 6, + "id" : 31, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "created", + "time" : 220 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:13" + ], + [ + "destinationMAC", + "02:00:00:00:02:22" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 6, + "id" : 32, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "sent", + "time" : 220 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:22" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 5, + "id" : 33, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "received", + "time" : 220 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:22" + ], + [ + "destinationMAC", + "FF:FF:FF:FF:FF:FF" + ] + ], + "direction" : "inbound", + "frame" : 5, + "id" : 34, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "received", + "time" : 220 + }, + { + "after" : [ + + ], + "before" : [ + [ + "operation", + "request" + ], + [ + "senderMAC", + "02:00:00:00:02:22" + ], + [ + "senderIP", + "20.0.0.1" + ], + [ + "targetMAC", + "00:00:00:00:00:00" + ], + [ + "targetIP", + "20.0.0.2" + ] + ], + "direction" : "inbound", + "frame" : 5, + "id" : 35, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "accepted", + "time" : 220 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:13" + ], + [ + "destinationMAC", + "02:00:00:00:02:22" + ] + ], + "before" : [ + + ], + "detail" : "ARP reply for 20.0.0.2", + "direction" : "outbound", + "frame" : 7, + "id" : 36, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "created", + "time" : 220 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:13" + ], + [ + "destinationMAC", + "02:00:00:00:02:22" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 7, + "id" : 37, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "sent", + "time" : 220 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:13" + ], + [ + "destinationMAC", + "02:00:00:00:02:22" + ] + ], + "direction" : "inbound", + "frame" : 6, + "id" : 38, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "time" : 275 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:13" + ], + [ + "destinationMAC", + "02:00:00:00:02:22" + ] + ], + "direction" : "inbound", + "frame" : 6, + "id" : 39, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "time" : 275 + }, + { + "after" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "63" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 8, + "id" : 40, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "forwarded", + "packet" : 1, + "time" : 275 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:22" + ], + [ + "destinationMAC", + "02:00:00:00:02:13" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 8, + "id" : 41, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "created", + "packet" : 1, + "time" : 275 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:22" + ], + [ + "destinationMAC", + "02:00:00:00:02:13" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 8, + "id" : 42, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "sent", + "packet" : 1, + "time" : 275 + }, + { + "after" : [ + + ], + "before" : [ + [ + "operation", + "reply" + ], + [ + "senderMAC", + "02:00:00:00:02:13" + ], + [ + "senderIP", + "20.0.0.2" + ], + [ + "targetMAC", + "02:00:00:00:02:22" + ], + [ + "targetIP", + "20.0.0.1" + ] + ], + "direction" : "inbound", + "frame" : 6, + "id" : 43, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "accepted", + "time" : 275 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:13" + ], + [ + "destinationMAC", + "02:00:00:00:02:22" + ] + ], + "direction" : "inbound", + "frame" : 7, + "id" : 44, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "time" : 275 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:13" + ], + [ + "destinationMAC", + "02:00:00:00:02:22" + ] + ], + "direction" : "inbound", + "frame" : 7, + "id" : 45, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "time" : 275 + }, + { + "after" : [ + + ], + "before" : [ + [ + "operation", + "reply" + ], + [ + "senderMAC", + "02:00:00:00:02:13" + ], + [ + "senderIP", + "20.0.0.2" + ], + [ + "targetMAC", + "02:00:00:00:02:22" + ], + [ + "targetIP", + "20.0.0.1" + ] + ], + "direction" : "inbound", + "frame" : 7, + "id" : 46, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "accepted", + "time" : 275 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:22" + ], + [ + "destinationMAC", + "02:00:00:00:02:13" + ] + ], + "direction" : "inbound", + "frame" : 8, + "id" : 47, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "received", + "packet" : 1, + "time" : 330 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:22" + ], + [ + "destinationMAC", + "02:00:00:00:02:13" + ] + ], + "direction" : "inbound", + "frame" : 8, + "id" : 48, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "received", + "packet" : 1, + "time" : 330 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "63" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 8, + "id" : 49, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "received", + "packet" : 1, + "time" : 330 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "50299" + ], + [ + "destinationPort", + "80" + ], + [ + "sequenceNumber", + "3000000" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "SYN" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 50, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "accepted", + "packet" : 1, + "time" : 330 + }, + { + "after" : [ + [ + "state", + "SYN_RCVD" + ] + ], + "before" : [ + [ + "state", + "LISTEN" + ] + ], + "detail" : "TCP LISTEN -> SYN_RCVD", + "direction" : "local", + "id" : 51, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "accepted", + "time" : 330 + }, + { + "after" : [ + [ + "sourcePort", + "80" + ], + [ + "destinationPort", + "50299" + ], + [ + "sequenceNumber", + "4000000" + ], + [ + "acknowledgementNumber", + "3000001" + ], + [ + "flags", + "SYN+ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP SYN+ACK", + "direction" : "outbound", + "id" : 52, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "sent", + "packet" : 2, + "time" : 330 + }, + { + "after" : [ + [ + "senderIP", + "20.0.0.2" + ], + [ + "receiverIP", + "10.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 9, + "id" : 53, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "sent", + "packet" : 2, + "time" : 330 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:13" + ], + [ + "destinationMAC", + "02:00:00:00:02:22" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 9, + "id" : 54, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "created", + "packet" : 2, + "time" : 330 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:13" + ], + [ + "destinationMAC", + "02:00:00:00:02:22" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 9, + "id" : 55, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "sent", + "packet" : 2, + "time" : 330 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:13" + ], + [ + "destinationMAC", + "02:00:00:00:02:22" + ] + ], + "direction" : "inbound", + "frame" : 9, + "id" : 56, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "packet" : 2, + "time" : 385 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:13" + ], + [ + "destinationMAC", + "02:00:00:00:02:22" + ] + ], + "direction" : "inbound", + "frame" : 9, + "id" : 57, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "packet" : 2, + "time" : 385 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "20.0.0.2" + ], + [ + "receiverIP", + "10.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 9, + "id" : 58, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "packet" : 2, + "time" : 385 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "20.0.0.2" + ], + [ + "receiverIP", + "10.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "detail" : "established TCP traffic bypasses SYN-only filtering", + "direction" : "inbound", + "frame" : 9, + "id" : 59, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "accepted", + "packet" : 2, + "time" : 385 + }, + { + "after" : [ + [ + "senderIP", + "20.0.0.2" + ], + [ + "receiverIP", + "10.0.0.2" + ], + [ + "ttl", + "63" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + [ + "senderIP", + "20.0.0.2" + ], + [ + "receiverIP", + "10.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "detail" : "TTL decremented", + "direction" : "outbound", + "frame" : 9, + "id" : 60, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "forwarded", + "packet" : 2, + "time" : 385 + }, + { + "after" : [ + [ + "senderIP", + "20.0.0.2" + ], + [ + "receiverIP", + "10.0.0.2" + ], + [ + "ttl", + "63" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 10, + "id" : 61, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "forwarded", + "packet" : 2, + "time" : 385 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:21" + ], + [ + "destinationMAC", + "02:00:00:00:02:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 10, + "id" : 62, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "created", + "packet" : 2, + "time" : 385 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:21" + ], + [ + "destinationMAC", + "02:00:00:00:02:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 10, + "id" : 63, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "sent", + "packet" : 2, + "time" : 385 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:21" + ], + [ + "destinationMAC", + "02:00:00:00:02:11" + ] + ], + "direction" : "inbound", + "frame" : 10, + "id" : 64, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "received", + "packet" : 2, + "time" : 440 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:21" + ], + [ + "destinationMAC", + "02:00:00:00:02:11" + ] + ], + "direction" : "inbound", + "frame" : 10, + "id" : 65, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "received", + "packet" : 2, + "time" : 440 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "20.0.0.2" + ], + [ + "receiverIP", + "10.0.0.2" + ], + [ + "ttl", + "63" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 10, + "id" : 66, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "received", + "packet" : 2, + "time" : 440 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "80" + ], + [ + "destinationPort", + "50299" + ], + [ + "sequenceNumber", + "4000000" + ], + [ + "acknowledgementNumber", + "3000001" + ], + [ + "flags", + "SYN+ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 67, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "accepted", + "packet" : 2, + "time" : 440 + }, + { + "after" : [ + [ + "state", + "ESTABLISHED" + ] + ], + "before" : [ + [ + "state", + "SYN_SENT" + ] + ], + "detail" : "TCP SYN_SENT -> ESTABLISHED", + "direction" : "local", + "id" : 68, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "accepted", + "time" : 440 + }, + { + "after" : [ + [ + "sourcePort", + "50299" + ], + [ + "destinationPort", + "80" + ], + [ + "sequenceNumber", + "3000001" + ], + [ + "acknowledgementNumber", + "4000001" + ], + [ + "flags", + "ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP ACK", + "direction" : "outbound", + "id" : 69, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "sent", + "packet" : 3, + "time" : 440 + }, + { + "after" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 11, + "id" : 70, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "sent", + "packet" : 3, + "time" : 440 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 11, + "id" : 71, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "created", + "packet" : 3, + "time" : 440 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 11, + "id" : 72, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "sent", + "packet" : 3, + "time" : 440 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "direction" : "inbound", + "frame" : 11, + "id" : 73, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "packet" : 3, + "time" : 495 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "direction" : "inbound", + "frame" : 11, + "id" : 74, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "packet" : 3, + "time" : 495 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 11, + "id" : 75, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "packet" : 3, + "time" : 495 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "detail" : "established TCP traffic bypasses SYN-only filtering", + "direction" : "inbound", + "frame" : 11, + "id" : 76, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "accepted", + "packet" : 3, + "time" : 495 + }, + { + "after" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "63" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "detail" : "TTL decremented", + "direction" : "outbound", + "frame" : 11, + "id" : 77, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "forwarded", + "packet" : 3, + "time" : 495 + }, + { + "after" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "63" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 12, + "id" : 78, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "forwarded", + "packet" : 3, + "time" : 495 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:22" + ], + [ + "destinationMAC", + "02:00:00:00:02:13" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 12, + "id" : 79, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "created", + "packet" : 3, + "time" : 495 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:22" + ], + [ + "destinationMAC", + "02:00:00:00:02:13" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 12, + "id" : 80, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "sent", + "packet" : 3, + "time" : 495 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:22" + ], + [ + "destinationMAC", + "02:00:00:00:02:13" + ] + ], + "direction" : "inbound", + "frame" : 12, + "id" : 81, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "received", + "packet" : 3, + "time" : 550 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:22" + ], + [ + "destinationMAC", + "02:00:00:00:02:13" + ] + ], + "direction" : "inbound", + "frame" : 12, + "id" : 82, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "received", + "packet" : 3, + "time" : 550 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "63" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 12, + "id" : 83, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "received", + "packet" : 3, + "time" : 550 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "50299" + ], + [ + "destinationPort", + "80" + ], + [ + "sequenceNumber", + "3000001" + ], + [ + "acknowledgementNumber", + "4000001" + ], + [ + "flags", + "ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 84, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "accepted", + "packet" : 3, + "time" : 550 + }, + { + "after" : [ + [ + "state", + "ESTABLISHED" + ] + ], + "before" : [ + [ + "state", + "SYN_RCVD" + ] + ], + "detail" : "TCP SYN_RCVD -> ESTABLISHED", + "direction" : "local", + "id" : 85, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "accepted", + "time" : 550 + }, + { + "after" : [ + [ + "sourcePort", + "50299" + ], + [ + "destinationPort", + "80" + ], + [ + "sequenceNumber", + "3000001" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "PSH" + ], + [ + "payloadLength", + "16" + ] + ], + "before" : [ + + ], + "detail" : "TCP data segment 1\/1", + "direction" : "outbound", + "id" : 86, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "sent", + "packet" : 4, + "time" : 550 + }, + { + "after" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 13, + "id" : 87, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "sent", + "packet" : 4, + "time" : 550 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 13, + "id" : 88, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "created", + "packet" : 4, + "time" : 550 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 13, + "id" : 89, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "sent", + "packet" : 4, + "time" : 550 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "direction" : "inbound", + "frame" : 13, + "id" : 90, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "packet" : 4, + "time" : 605 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "direction" : "inbound", + "frame" : 13, + "id" : 91, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "packet" : 4, + "time" : 605 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 13, + "id" : 92, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "packet" : 4, + "time" : 605 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "detail" : "established TCP traffic bypasses SYN-only filtering", + "direction" : "inbound", + "frame" : 13, + "id" : 93, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "accepted", + "packet" : 4, + "time" : 605 + }, + { + "after" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "63" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "detail" : "TTL decremented", + "direction" : "outbound", + "frame" : 13, + "id" : 94, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "forwarded", + "packet" : 4, + "time" : 605 + }, + { + "after" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "63" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 14, + "id" : 95, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "forwarded", + "packet" : 4, + "time" : 605 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:22" + ], + [ + "destinationMAC", + "02:00:00:00:02:13" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 14, + "id" : 96, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "created", + "packet" : 4, + "time" : 605 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:22" + ], + [ + "destinationMAC", + "02:00:00:00:02:13" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 14, + "id" : 97, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "sent", + "packet" : 4, + "time" : 605 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:22" + ], + [ + "destinationMAC", + "02:00:00:00:02:13" + ] + ], + "direction" : "inbound", + "frame" : 14, + "id" : 98, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "received", + "packet" : 4, + "time" : 660 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:22" + ], + [ + "destinationMAC", + "02:00:00:00:02:13" + ] + ], + "direction" : "inbound", + "frame" : 14, + "id" : 99, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "received", + "packet" : 4, + "time" : 660 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "63" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 14, + "id" : 100, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "received", + "packet" : 4, + "time" : 660 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "50299" + ], + [ + "destinationPort", + "80" + ], + [ + "sequenceNumber", + "3000001" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "PSH" + ], + [ + "payloadLength", + "16" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 101, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "accepted", + "packet" : 4, + "time" : 660 + }, + { + "after" : [ + [ + "sourcePort", + "80" + ], + [ + "destinationPort", + "50299" + ], + [ + "sequenceNumber", + "4000001" + ], + [ + "acknowledgementNumber", + "3000017" + ], + [ + "flags", + "ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP ACK", + "direction" : "outbound", + "id" : 102, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "sent", + "packet" : 5, + "time" : 660 + }, + { + "after" : [ + [ + "senderIP", + "20.0.0.2" + ], + [ + "receiverIP", + "10.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 15, + "id" : 103, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "sent", + "packet" : 5, + "time" : 660 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:13" + ], + [ + "destinationMAC", + "02:00:00:00:02:22" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 15, + "id" : 104, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "created", + "packet" : 5, + "time" : 660 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:13" + ], + [ + "destinationMAC", + "02:00:00:00:02:22" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 15, + "id" : 105, + "interface" : "00000000-0000-0000-0000-000000000213", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "sent", + "packet" : 5, + "time" : 660 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:13" + ], + [ + "destinationMAC", + "02:00:00:00:02:22" + ] + ], + "direction" : "inbound", + "frame" : 15, + "id" : 106, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "packet" : 5, + "time" : 715 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:13" + ], + [ + "destinationMAC", + "02:00:00:00:02:22" + ] + ], + "direction" : "inbound", + "frame" : 15, + "id" : 107, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "packet" : 5, + "time" : 715 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "20.0.0.2" + ], + [ + "receiverIP", + "10.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 15, + "id" : 108, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "packet" : 5, + "time" : 715 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "20.0.0.2" + ], + [ + "receiverIP", + "10.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "detail" : "established TCP traffic bypasses SYN-only filtering", + "direction" : "inbound", + "frame" : 15, + "id" : 109, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "accepted", + "packet" : 5, + "time" : 715 + }, + { + "after" : [ + [ + "senderIP", + "20.0.0.2" + ], + [ + "receiverIP", + "10.0.0.2" + ], + [ + "ttl", + "63" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + [ + "senderIP", + "20.0.0.2" + ], + [ + "receiverIP", + "10.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "detail" : "TTL decremented", + "direction" : "outbound", + "frame" : 15, + "id" : 110, + "interface" : "00000000-0000-0000-0000-000000000222", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "forwarded", + "packet" : 5, + "time" : 715 + }, + { + "after" : [ + [ + "senderIP", + "20.0.0.2" + ], + [ + "receiverIP", + "10.0.0.2" + ], + [ + "ttl", + "63" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 16, + "id" : 111, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "forwarded", + "packet" : 5, + "time" : 715 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:21" + ], + [ + "destinationMAC", + "02:00:00:00:02:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 16, + "id" : 112, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "created", + "packet" : 5, + "time" : 715 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:21" + ], + [ + "destinationMAC", + "02:00:00:00:02:11" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 16, + "id" : 113, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "sent", + "packet" : 5, + "time" : 715 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:21" + ], + [ + "destinationMAC", + "02:00:00:00:02:11" + ] + ], + "direction" : "inbound", + "frame" : 16, + "id" : 114, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "received", + "packet" : 5, + "time" : 770 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:21" + ], + [ + "destinationMAC", + "02:00:00:00:02:11" + ] + ], + "direction" : "inbound", + "frame" : 16, + "id" : 115, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "received", + "packet" : 5, + "time" : 770 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "20.0.0.2" + ], + [ + "receiverIP", + "10.0.0.2" + ], + [ + "ttl", + "63" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 16, + "id" : 116, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "received", + "packet" : 5, + "time" : 770 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourcePort", + "80" + ], + [ + "destinationPort", + "50299" + ], + [ + "sequenceNumber", + "4000001" + ], + [ + "acknowledgementNumber", + "3000017" + ], + [ + "flags", + "ACK" + ], + [ + "payloadLength", + "0" + ] + ], + "detail" : "TCP segment received", + "direction" : "local", + "id" : 117, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "accepted", + "packet" : 5, + "time" : 770 + }, + { + "after" : [ + [ + "state", + "SYN_SENT" + ] + ], + "before" : [ + [ + "state", + "CLOSED" + ] + ], + "detail" : "TCP CLOSED -> SYN_SENT", + "direction" : "local", + "id" : 118, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "accepted", + "time" : 770 + }, + { + "after" : [ + [ + "sourcePort", + "63015" + ], + [ + "destinationPort", + "81" + ], + [ + "sequenceNumber", + "5000000" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "SYN" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP SYN", + "direction" : "outbound", + "id" : 119, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "sent", + "packet" : 6, + "time" : 770 + }, + { + "after" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 17, + "id" : 120, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "sent", + "packet" : 6, + "time" : 770 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 17, + "id" : 121, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "created", + "packet" : 6, + "time" : 770 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 17, + "id" : 122, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "sent", + "packet" : 6, + "time" : 770 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "direction" : "inbound", + "frame" : 17, + "id" : 123, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "packet" : 6, + "time" : 825 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "direction" : "inbound", + "frame" : 17, + "id" : 124, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "packet" : 6, + "time" : 825 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 17, + "id" : 125, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "packet" : 6, + "time" : 825 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "detail" : "TCP matched rule #1", + "direction" : "inbound", + "frame" : 17, + "id" : 126, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "dropped", + "packet" : 6, + "time" : 825 + }, + { + "after" : [ + [ + "sourcePort", + "63015" + ], + [ + "destinationPort", + "81" + ], + [ + "sequenceNumber", + "5000000" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "SYN" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP SYN retransmission attempt 2", + "direction" : "outbound", + "id" : 127, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "retransmitted", + "packet" : 7, + "time" : 8325 + }, + { + "after" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 18, + "id" : 128, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "sent", + "packet" : 7, + "time" : 8325 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 18, + "id" : 129, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "created", + "packet" : 7, + "time" : 8325 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 18, + "id" : 130, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "sent", + "packet" : 7, + "time" : 8325 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "direction" : "inbound", + "frame" : 18, + "id" : 131, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "packet" : 7, + "time" : 8380 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "direction" : "inbound", + "frame" : 18, + "id" : 132, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "packet" : 7, + "time" : 8380 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 18, + "id" : 133, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "packet" : 7, + "time" : 8380 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "detail" : "TCP matched rule #1", + "direction" : "inbound", + "frame" : 18, + "id" : 134, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "dropped", + "packet" : 7, + "time" : 8380 + }, + { + "after" : [ + [ + "sourcePort", + "63015" + ], + [ + "destinationPort", + "81" + ], + [ + "sequenceNumber", + "5000000" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "SYN" + ], + [ + "payloadLength", + "0" + ] + ], + "before" : [ + + ], + "detail" : "TCP SYN retransmission attempt 3", + "direction" : "outbound", + "id" : 135, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "retransmitted", + "packet" : 8, + "time" : 15825 + }, + { + "after" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 19, + "id" : 136, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "sent", + "packet" : 8, + "time" : 15825 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 19, + "id" : 137, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "created", + "packet" : 8, + "time" : 15825 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 19, + "id" : 138, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "sent", + "packet" : 8, + "time" : 15825 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "direction" : "inbound", + "frame" : 19, + "id" : 139, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "packet" : 8, + "time" : 15880 + }, + { + "after" : [ + + ], + "before" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "direction" : "inbound", + "frame" : 19, + "id" : 140, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "packet" : 8, + "time" : 15880 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "direction" : "inbound", + "frame" : 19, + "id" : 141, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "received", + "packet" : 8, + "time" : 15880 + }, + { + "after" : [ + + ], + "before" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "detail" : "TCP matched rule #1", + "direction" : "inbound", + "frame" : 19, + "id" : 142, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "dropped", + "packet" : 8, + "time" : 15880 + }, + { + "after" : [ + [ + "state", + "CLOSED" + ] + ], + "before" : [ + [ + "state", + "SYN_SENT" + ] + ], + "detail" : "TCP SYN_SENT -> CLOSED", + "direction" : "local", + "id" : 143, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "accepted", + "time" : 23325 + }, + { + "after" : [ + [ + "sourcePort", + "50299" + ], + [ + "destinationPort", + "80" + ], + [ + "sequenceNumber", + "3000017" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "PSH" + ], + [ + "payloadLength", + "8" + ] + ], + "before" : [ + + ], + "detail" : "TCP data segment 1\/1", + "direction" : "outbound", + "id" : 144, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "sent", + "packet" : 9, + "time" : 23325 + }, + { + "after" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 20, + "id" : 145, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "sent", + "packet" : 9, + "time" : 23325 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 20, + "id" : 146, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "created", + "packet" : 9, + "time" : 23325 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 20, + "id" : 147, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "sent", + "packet" : 9, + "time" : 23325 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "before" : [ + + ], + "detail" : "global packet-loss simulation", + "direction" : "inbound", + "frame" : 20, + "id" : 148, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "dropped", + "packet" : 9, + "time" : 23380 + }, + { + "after" : [ + [ + "sourcePort", + "50299" + ], + [ + "destinationPort", + "80" + ], + [ + "sequenceNumber", + "3000017" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "PSH" + ], + [ + "payloadLength", + "8" + ] + ], + "before" : [ + + ], + "detail" : "TCP data retransmission attempt 2", + "direction" : "outbound", + "id" : 149, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "retransmitted", + "packet" : 10, + "time" : 30880 + }, + { + "after" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 21, + "id" : 150, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "sent", + "packet" : 10, + "time" : 30880 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 21, + "id" : 151, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "created", + "packet" : 10, + "time" : 30880 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 21, + "id" : 152, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "sent", + "packet" : 10, + "time" : 30880 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "before" : [ + + ], + "detail" : "global packet-loss simulation", + "direction" : "inbound", + "frame" : 21, + "id" : 153, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "dropped", + "packet" : 10, + "time" : 30935 + }, + { + "after" : [ + [ + "sourcePort", + "50299" + ], + [ + "destinationPort", + "80" + ], + [ + "sequenceNumber", + "3000017" + ], + [ + "acknowledgementNumber", + "0" + ], + [ + "flags", + "PSH" + ], + [ + "payloadLength", + "8" + ] + ], + "before" : [ + + ], + "detail" : "TCP data retransmission attempt 3", + "direction" : "outbound", + "id" : 154, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "retransmitted", + "packet" : 11, + "time" : 38380 + }, + { + "after" : [ + [ + "senderIP", + "10.0.0.2" + ], + [ + "receiverIP", + "20.0.0.2" + ], + [ + "ttl", + "64" + ], + [ + "protocol", + "6" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 22, + "id" : 155, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "network", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "sent", + "packet" : 11, + "time" : 38380 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 22, + "id" : 156, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "dataLink", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "created", + "packet" : 11, + "time" : 38380 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "before" : [ + + ], + "direction" : "outbound", + "frame" : 22, + "id" : 157, + "interface" : "00000000-0000-0000-0000-000000000211", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "sent", + "packet" : 11, + "time" : 38380 + }, + { + "after" : [ + [ + "sourceMAC", + "02:00:00:00:02:11" + ], + [ + "destinationMAC", + "02:00:00:00:02:21" + ] + ], + "before" : [ + + ], + "detail" : "global packet-loss simulation", + "direction" : "inbound", + "frame" : 22, + "id" : 158, + "interface" : "00000000-0000-0000-0000-000000000221", + "layer" : "physical", + "node" : "00000000-0000-0000-0000-000000000202", + "operation" : "dropped", + "packet" : 11, + "time" : 38435 + }, + { + "after" : [ + [ + "state", + "CLOSED" + ] + ], + "before" : [ + [ + "state", + "ESTABLISHED" + ] + ], + "detail" : "TCP ESTABLISHED -> CLOSED", + "direction" : "local", + "id" : 159, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000201", + "operation" : "accepted", + "time" : 45880 + }, + { + "after" : [ + [ + "state", + "CLOSED" + ] + ], + "before" : [ + [ + "state", + "LISTEN" + ] + ], + "detail" : "TCP LISTEN -> CLOSED", + "direction" : "local", + "id" : 160, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "accepted", + "time" : 45880 + }, + { + "after" : [ + [ + "state", + "LISTEN" + ] + ], + "before" : [ + [ + "state", + "CLOSED" + ] + ], + "detail" : "TCP CLOSED -> LISTEN", + "direction" : "local", + "id" : 161, + "layer" : "transport", + "node" : "00000000-0000-0000-0000-000000000203", + "operation" : "accepted", + "time" : 45880 + } + ] +} diff --git a/packages/core/test/scenarios/udp-lan.swift.json b/packages/core/test/scenarios/udp-lan.swift.json index 03c7b43..386396a 100644 --- a/packages/core/test/scenarios/udp-lan.swift.json +++ b/packages/core/test/scenarios/udp-lan.swift.json @@ -84,30 +84,39 @@ "localIp" : null, "localPort" : 51180, "node" : "00000000-0000-0000-0000-000000000102", + "parent" : null, "protocol" : "udp", "queued" : 0, "remoteIp" : "192.168.0.10", - "remotePort" : 5000 + "remotePort" : 5000, + "session" : null, + "tcpState" : null }, { "id" : "00000000-0000-0000-0000-000000000003", "localIp" : "192.168.0.30", "localPort" : 7000, "node" : "00000000-0000-0000-0000-000000000103", + "parent" : null, "protocol" : "udp", "queued" : 0, "remoteIp" : null, - "remotePort" : null + "remotePort" : null, + "session" : null, + "tcpState" : null }, { "id" : "00000000-0000-0000-0000-000000000004", "localIp" : null, "localPort" : 5000, "node" : "00000000-0000-0000-0000-000000000101", + "parent" : null, "protocol" : "udp", "queued" : 0, "remoteIp" : null, - "remotePort" : null + "remotePort" : null, + "session" : null, + "tcpState" : null } ], "switchTables" : { diff --git a/packages/core/test/scenarios/udp-routed.swift.json b/packages/core/test/scenarios/udp-routed.swift.json index 370c37f..902de24 100644 --- a/packages/core/test/scenarios/udp-routed.swift.json +++ b/packages/core/test/scenarios/udp-routed.swift.json @@ -96,40 +96,52 @@ "localIp" : null, "localPort" : 5000, "node" : "00000000-0000-0000-0000-000000000203", + "parent" : null, "protocol" : "udp", "queued" : 0, "remoteIp" : "10.0.0.2", - "remotePort" : 54899 + "remotePort" : 54899, + "session" : null, + "tcpState" : null }, { "id" : "00000000-0000-0000-0000-000000000002", "localIp" : null, "localPort" : 5001, "node" : "00000000-0000-0000-0000-000000000203", + "parent" : null, "protocol" : "udp", "queued" : 0, "remoteIp" : null, - "remotePort" : null + "remotePort" : null, + "session" : null, + "tcpState" : null }, { "id" : "00000000-0000-0000-0000-000000000003", "localIp" : null, "localPort" : 54899, "node" : "00000000-0000-0000-0000-000000000201", + "parent" : null, "protocol" : "udp", "queued" : 0, "remoteIp" : "20.0.0.2", - "remotePort" : 5000 + "remotePort" : 5000, + "session" : null, + "tcpState" : null }, { "id" : "00000000-0000-0000-0000-000000000004", "localIp" : null, "localPort" : 5000, "node" : "00000000-0000-0000-0000-000000000202", + "parent" : null, "protocol" : "udp", "queued" : 0, "remoteIp" : "10.0.0.2", - "remotePort" : 54899 + "remotePort" : 54899, + "session" : null, + "tcpState" : null } ], "switchTables" : { diff --git a/tools/swift-oracle/README.md b/tools/swift-oracle/README.md index f62c014..cecd8ff 100644 --- a/tools/swift-oracle/README.md +++ b/tools/swift-oracle/README.md @@ -21,8 +21,12 @@ npm test # vergleicht mit den geschriebenen *.swift.json `sat`, `speed`; UDP (seit F2): `bindUdp` (Knoten, optional Port, lokale Adresse, Gegenstelle; Ergebnis die Socket-ID), `sendUdp` (Socket, Text, optional Ziel und Port), `receiveUdp` (Socket, optional Wartezeit), - `closeSocket`. Das Ergebnis enthält die Sockets mit der Länge ihrer - Warteschlange. + `closeSocket`; TCP: `openTcpServer`, `openTcpClient`, `connectTcp` + (Ergebnis `connected`, `invalidSocket`, `unreachable`, `timedOut`), + `sendTcp` (mit `repeatCount` für lange Nachrichten), `receiveTcp`, + `acceptedTcp`, `peerTcp`, `cleanTcp`; `closeSocket` schließt auch TCP. + Das Ergebnis enthält die Sockets mit der Länge ihrer Warteschlange, dem + TCP-Zustand, dem annehmenden Socket und den Sitzungswerten. ## Korpus diff --git a/tools/swift-oracle/Sources/Oracle/main.swift b/tools/swift-oracle/Sources/Oracle/main.swift index 1094df6..1c2aafc 100644 --- a/tools/swift-oracle/Sources/Oracle/main.swift +++ b/tools/swift-oracle/Sources/Oracle/main.swift @@ -39,6 +39,8 @@ struct ScenarioStep: Decodable { // UDP: a socket is named by the id bindUdp returned. let port: UInt16?; let localIp: String?; let remoteIp: String?; let remotePort: UInt16? let socket: String?; let payload: String?; let timeout: UInt64? + // TCP: the payload repeated this many times, for messages longer than a segment. + let repeatCount: Int?; let localPort: UInt16? } struct Scenario: Decodable { let seed: UInt64 @@ -245,6 +247,28 @@ func run(_ scenario: Scenario) -> JSON { "payload": String(decoding: item.datagram.payload, as: UTF8.self), "at": item.receivedAtMilliseconds, ] } ?? NSNull()) + case "openTcpServer": + results.append(engine.openTCPServerSocket( + nodeID: uuid(step.node!), localPort: step.port!, localIPAddress: step.localIp + )?.uuidString ?? NSNull()) + case "openTcpClient": + results.append(engine.openTCPClientSocket( + nodeID: uuid(step.node!), remoteIPAddress: step.target!, remotePort: step.port!, + localIPAddress: step.localIp, localPort: step.localPort + )?.uuidString ?? NSNull()) + case "connectTcp": + results.append(String(describing: engine.connectTCPWithResult(socketID: uuid(step.socket!)))) + case "sendTcp": + let text = String(repeating: step.payload ?? "", count: step.repeatCount ?? 1) + results.append(engine.sendTCP(socketID: uuid(step.socket!), payload: Data(text.utf8))) + case "receiveTcp": + results.append(engine.receiveTCP(socketID: uuid(step.socket!)).map { String(decoding: $0, as: UTF8.self) } ?? NSNull()) + case "acceptedTcp": + results.append((engine.state.tcpAcceptedSocketIDsByListenerID[uuid(step.socket!)] ?? []).map(\.uuidString)) + case "peerTcp": + results.append(engine.peerTCPSocketID(socketID: uuid(step.socket!))?.uuidString ?? NSNull()) + case "cleanTcp": + results.append(engine.cleanClosedTCPSocket(socketID: uuid(step.socket!))) case "closeSocket": engine.closeSocket(socketID: uuid(step.socket!)) results.append(engine.state.socketsByID[uuid(step.socket!)] == nil) @@ -280,6 +304,15 @@ func run(_ scenario: Scenario) -> JSON { "localIp": socket.localIPAddress ?? NSNull(), "localPort": socket.localPort, "remoteIp": socket.remoteIPAddress ?? NSNull(), "remotePort": socket.remotePort.map { $0 as Any } ?? NSNull(), "queued": state.udpReceiveQueuesBySocketID[socket.id]?.count ?? 0, + "tcpState": socket.tcpState?.rawValue ?? NSNull(), + "parent": socket.parentListenerSocketID?.uuidString ?? NSNull(), + "session": state.tcpSessionsByID[socket.id].map { session -> JSON in + [ + "attempts": session.sendAttempts, "next": session.nextSendSequenceNumber, + "remote": session.remoteSequenceNumber, "pending": session.lastSentSegment != nil, + "assembly": session.receiveAssembly.count, "messages": session.receivedMessages.count, + ] + } ?? NSNull(), ] }, "firewallDecisions": state.firewallDecisions.map { decision -> JSON in