diff --git a/CHANGES.md b/CHANGES.md index 0621278..8b4c1f6 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -13,7 +13,7 @@ Swift-Pfade relativ zu `filius-ipad/ios/FiliusPad/TopologyEditor/` (Stand | `src/model/link.ts`, `src/model/graph.ts` | `Model/TopologyLink.swift`, `Model/TopologyGraph.swift` | übertragen, bisher nur die Daten (Abfragen folgen mit dem Editor) | | `src/model/documentation.ts` | `Model/TopologyDocumentation.swift` | übertragen; FNV-Kennung mit BigInt, gegen die IDs aus dem Swift-Import geprüft | | `src/runtime/config.ts` | `State/TopologyEditorState.swift` (Laufzeit-Konfigurationen, WLAN eines Rechners, DHCP, Portweiterleitung, Remote Link ohne LAN-Transport, Programme und ihre Konfiguration, Firewall, DNS-Einträge aus `State/TopologyDNSResolver.swift`, E-Mail-Konten und -Nachrichten aus `State/TopologyEmail.swift`); dazu Echo-Server- und Client-Konfiguration, die Swift nicht speichert | übertragen; Java-Beschriftungen der Oberfläche weggelassen | -| `src/runtime/engine.ts` | `State/TopologyNetworkRuntimeEngine.swift` Z. ~313–3585, ~4472–5187 (UDP), ~4753–4850 | übertragen: Warteschlange, Uhr, Ethernet, Switch, ARP, IPv4, ICMP, Routing, Firewall, UDP-Sockets (binden, freie Ports nach Javas Zufall, senden samt Broadcast, zustellen, empfangen mit Wartezeit, schließen), TCP (Z. ~5187–5913: Server- und Client-Sockets, Handschlag mit Ergebnis, Segmente zu 1460 Byte bis zum PSH, höchstens drei Versuche, Abbau über alle Java-Zustände samt `TIME_WAIT`; seit F2.3c nach Javas `TCPSocket` an Java-Filius gemessen: je Versuch und für `TIME_WAIT` 3 RTT nach der Geschwindigkeit (8250 ms bei 90 %, Swift fest 7500 bzw. 2500 ms), der Zeitablauf zählt ab der Übergabe des Segments, vor ARP; ein Segment beendet `TIME_WAIT`; die Gegenseite schließt beim FIN von selbst; nicht bestätigte Daten schließen mit FIN statt sofort; der angenommene Socket hat die Startnummer des Listeners, der Listener eine neue. seit F2.3e wie Java: SYN+ACK und FIN gehen nie ein zweites Mal hinaus; der Server gibt einen Handschlag nach 3 RTT auf und schließt mit FIN; nach dem FIN wartet ein Socket höchstens fünfmal 3 RTT, jedes Segment beendet eine Wartezeit, dann CLOSED (Java lässt den Zustand stehen). Abweichend von Java: drei SYN statt einem, weil Javas Wiederholungsschleife nach dem ersten Zeitablauf abbricht, und ein wiederholtes SYN in `SYN_RCVD` bekommt das SYN+ACK noch einmal, statt den Socket zu schließen), DHCP (Z. ~5913–6694: Server mit festen Zuordnungen, Adressbereich, Angeboten, Leases und Sperrliste; Client seit F2.3b nach Javas `DHCPClient` neu gebaut und an Java-Filius gemessen: je Versuch eine Nachricht, eine Antwort, die nicht passt, wird gelesen und verworfen; die ARP-Prüfung wartet eine RTT, eine Antwort für die Adresse beendet sie sofort, dann DECLINE; nach einem Zeitablauf wiederholt der Zustand seine Nachricht, nach dem fünften nimmt der Client eine Link-Local-Adresse `169.254.1.x/16` (ARP-Probe, ARP-Reply an alle) und gibt keine alte Adresse zurück; Swift sendete doppelt, wartete nicht auf ARP und kehrte nach zehn Versuchen zur alten Adresse zurück. Abweichend von Java: Nach fünf belegten Link-Local-Adressen gibt der Client auf (Java sucht endlos), und ein ARP-Paket für eine andere Adresse beendet die Prüfung nicht. Seit F2.3d befördert ein Kabel einen Frame nach dem anderen wie Javas `SimplexVerbindung` (ein Frame wartet im Ausgangspuffer, bis der vorige angekommen ist, und erscheint im Protokoll, wenn er losgeht); Swift schickt alle zugleich, die Option `swiftCables` behält das für den Swift-Vergleich. Die RTT der DHCP-Zeiten (Warten, Angebote, Sperrliste) folgt wie in Java der Geschwindigkeit (50 Kabel, 2750 ms bei 90 %); Swift rechnet fest mit 2500 ms. ARP seit F2.4b nach Javas `holeARPTabellenEintrag`, an Java-Filius gemessen: eine Auflösung fragt, wartet eine RTT, fragt ein zweites Mal und gibt nach einer weiteren RTT auf; dann „Host unreachable" beim Absender selbst oder vom Router zurück (bei ICMP nur für Echo-Anfragen); ein wartender Absender wacht nach den übrigen Ereignissen desselben Zeitpunkts auf; der Ping wartet danach eine RTT auf die Antwort. Swift schickt in der Ereignisverarbeitung beide Anfragen zugleich und lässt das Paket ohne Ende warten, wenn die Adresse irgendwo im Netz vorkommt (Wissen, das kein Knoten hat), und blockiert direkte Aufrufe ohne Wartezeit; die Option `swiftArp` behält das für den Swift-Vergleich. Seit F2.4b-2 kehrt ein Senden wie in Java sofort zurück, die Frames reisen, während die Uhr läuft (Swift: der Aufruf kehrt erst zurück, wenn alle Frames angekommen sind; die Option `swiftSends` behält das für den Swift-Vergleich), und UDP und TCP senden über Javas Transport-Thread je Knoten und Protokoll: ein Segment nach dem anderen; solange IP auf ARP wartet, blockiert das nächste `senden`. Wartende Absender kommen in der Reihenfolge an die Reihe, in der sie kamen (Javas Sperre überlässt das dem Zufall). Seit F2.4b-3 geht jedes ankommende Paket wie in Java durch den IP-Thread (UDP, TCP) oder den ICMP-Thread (ICMP) seines Knotens: zustellen, Echo-Reply, weiterleiten, eins nach dem anderen; solange ARP wartet, warten die folgenden. Abweichend von Java weckt eine ARP-Antwort alle, die auf die Adresse warten (Javas `notify` weckt einen beliebigen). DNS seit F2.4a nach Javas `DNSServer`/`Resolver`, an Java-Filius gemessen: Server auf Port 53 mit Einträgen aus dem Modell (die Antwort wiederholt die Frage nicht, RCODE immer 0, ein Verweis mit NS und A im Antwortteil), iterativer Resolver mit 5 RTT je Anfrage, der nur die Server behält, an die er verwiesen wurde; seit F2.4c auf den Ereignissen statt blockierend und mit rekursivem Server nach `DNSServer.answerWithRemoteData` (Nameserver der Zone, dann der eigene DNS-Server, sonst Verweis), abweichend von Java fragt er sich nie selbst (Java endlos). Gateway-NAT seit F2.6 (Z. ~3585–3900) nach Javas `filius.software.nat`, an Java-Filius gemessen: die Übersetzung vor dem IP-Thread (wie Javas NAT-Threads zwischen Karte und Ethernet), ausgehend WAN-Adresse und der Port des Eintrags (ICMP behält die Kennung), eingehend nach Gegenstelle, Port und Protokoll, sonst nach der Portweiterleitung (legt einen dynamischen Eintrag an), ein Ping an die WAN-Adresse beantwortet der Heimrouter, Pakete von außen an das LAN verschwinden, beide Seiten durch die Firewall des Heimrouters, ausgehend TTL 1 bekommt „Zeit überschritten“; dynamische Einträge verfallen nach 300 s mal Javas Verzögerungsfaktor (Swift fest 300 s), aufgefrischt nur eingehend, seit 01.10.2026 genau in diesem Alter (Java findet sie erst bei seiner sekündlichen Prüfung, bis zu 1 s später; so auch der Switch: Javas `checkSAT` prüft jede Sekunde, der Kern verfällt genau zur Lernzeit); der Heimrouter leitet weiter wie ein Router. Abweichend von Java: ein LAN-Endpunkt bekommt für jede neue Gegenstelle einen Eintrag auf demselben WAN-Port (Java behält nur den für die erste, die Antworten weiterer bleiben am Heimrouter hängen). RIP seit F2.5a (Z. ~4700–5090) nach Javas `filius.software.rip`, seit F2.5b an Java-Filius gemessen (die Pause in Javas `float`-Rechnung): eine Route mit 0 Hops je eigenem Netz, die nie verfällt; der erste Beacon nach einer Sekunde, dann alle 25,2–35,2 s aus einem Zufall je Router (Java: ein ungesetzter `Random` je Router; der Kern setzt ihn aus Szenario und Router-ID, `ripSeed`; Swift: ein Zufall für alle); eine Nachricht je Schnittstelle ohne die Routen über sie (Split Horizon); eine neue Route oder mehr Hops vom selben Router senden sofort; eine gelernte Route wird genau nach ihren 75 s auf 16 gesetzt und sofort gemeldet (Java erst beim nächsten eigenen Beacon, bis zu gut 30 s später; Swift bei jedem Ereignis; seit 01.10.2026, vorher wie Java); Nachrichten von jedem Quellport (Swift: nur 521); ein RIP-Router leitet nur nach seiner Tabelle weiter, wenige Hops vor langer Maske. `receiveUdp` kehrt wie Javas `empfangen` zurück, sobald ein Datagramm da ist. Den Mitschnitt je Karte (`capture.ts`) schreibt sie seit F2.8a dort, wo Java ihn schreibt: beim Abgang auf das Kabel und bei der Ankunft an der Karte. WLAN seit F2.7 an Java-Filius gemessen: zur Laufzeit ist ein Funkkabel ein Kabel wie jedes andere, und eine SSID verbindet nichts (nach ihr legt nur Javas Editor das Funkkabel, `JHostKonfiguration.updateWifiConnection`); Swifts Verbindung über die SSID zur Laufzeit, auch ohne Kabel (`wirelessAssociations`), nicht übernommen. Klasse statt Werttyp. Noch nicht übertragen (wirft `NotPortedError`): Remote Link | +| `src/runtime/engine.ts` | `State/TopologyNetworkRuntimeEngine.swift` Z. ~313–3585, ~4472–5187 (UDP), ~4753–4850 | übertragen: Warteschlange, Uhr, Ethernet, Switch, ARP, IPv4, ICMP, Routing, Firewall, UDP-Sockets (binden, freie Ports nach Javas Zufall, senden samt Broadcast, zustellen, empfangen mit Wartezeit, schließen), TCP (Z. ~5187–5913: Server- und Client-Sockets, Handschlag mit Ergebnis, Segmente zu 1460 Byte bis zum PSH, höchstens drei Versuche, Abbau über alle Java-Zustände samt `TIME_WAIT`; seit F2.3c nach Javas `TCPSocket` an Java-Filius gemessen: je Versuch und für `TIME_WAIT` 3 RTT nach der Geschwindigkeit (8250 ms bei 90 %, Swift fest 7500 bzw. 2500 ms), der Zeitablauf zählt ab der Übergabe des Segments, vor ARP; ein Segment beendet `TIME_WAIT`; die Gegenseite schließt beim FIN von selbst; nicht bestätigte Daten schließen mit FIN statt sofort; der angenommene Socket hat die Startnummer des Listeners, der Listener eine neue. seit F2.3e wie Java: SYN+ACK und FIN gehen nie ein zweites Mal hinaus; der Server gibt einen Handschlag nach 3 RTT auf und schließt mit FIN; nach dem FIN wartet ein Socket höchstens fünfmal 3 RTT, jedes Segment beendet eine Wartezeit, dann CLOSED (Java lässt den Zustand stehen). Abweichend von Java: drei SYN statt einem, weil Javas Wiederholungsschleife nach dem ersten Zeitablauf abbricht, und ein wiederholtes SYN in `SYN_RCVD` bekommt das SYN+ACK noch einmal, statt den Socket zu schließen), DHCP (Z. ~5913–6694: Server mit festen Zuordnungen, Adressbereich, Angeboten, Leases und Sperrliste; Client seit F2.3b nach Javas `DHCPClient` neu gebaut und an Java-Filius gemessen: je Versuch eine Nachricht, eine Antwort, die nicht passt, wird gelesen und verworfen; die ARP-Prüfung wartet eine RTT, eine Antwort für die Adresse beendet sie sofort, dann DECLINE; nach einem Zeitablauf wiederholt der Zustand seine Nachricht, nach dem fünften nimmt der Client eine Link-Local-Adresse `169.254.1.x/16` (ARP-Probe, ARP-Reply an alle) und gibt keine alte Adresse zurück; Swift sendete doppelt, wartete nicht auf ARP und kehrte nach zehn Versuchen zur alten Adresse zurück. Abweichend von Java: Nach fünf belegten Link-Local-Adressen gibt der Client auf (Java sucht endlos), und ein ARP-Paket für eine andere Adresse beendet die Prüfung nicht. Seit F2.3d befördert ein Kabel einen Frame nach dem anderen wie Javas `SimplexVerbindung` (ein Frame wartet im Ausgangspuffer, bis der vorige angekommen ist, und erscheint im Protokoll, wenn er losgeht); Swift schickt alle zugleich, die Option `swiftCables` behält das für den Swift-Vergleich. Die RTT der DHCP-Zeiten (Warten, Angebote, Sperrliste) folgt wie in Java der Geschwindigkeit (50 Kabel, 2750 ms bei 90 %); Swift rechnet fest mit 2500 ms. ARP seit F2.4b nach Javas `holeARPTabellenEintrag`, an Java-Filius gemessen: eine Auflösung fragt, wartet eine RTT, fragt ein zweites Mal und gibt nach einer weiteren RTT auf; dann „Host unreachable" beim Absender selbst oder vom Router zurück (bei ICMP nur für Echo-Anfragen); ein wartender Absender wacht nach den übrigen Ereignissen desselben Zeitpunkts auf; der Ping wartet danach eine RTT auf die Antwort. Swift schickt in der Ereignisverarbeitung beide Anfragen zugleich und lässt das Paket ohne Ende warten, wenn die Adresse irgendwo im Netz vorkommt (Wissen, das kein Knoten hat), und blockiert direkte Aufrufe ohne Wartezeit; die Option `swiftArp` behält das für den Swift-Vergleich. Seit F2.4b-2 kehrt ein Senden wie in Java sofort zurück, die Frames reisen, während die Uhr läuft (Swift: der Aufruf kehrt erst zurück, wenn alle Frames angekommen sind; die Option `swiftSends` behält das für den Swift-Vergleich), und UDP und TCP senden über Javas Transport-Thread je Knoten und Protokoll: ein Segment nach dem anderen; solange IP auf ARP wartet, blockiert das nächste `senden`. Wartende Absender kommen in der Reihenfolge an die Reihe, in der sie kamen (Javas Sperre überlässt das dem Zufall). Seit F2.4b-3 geht jedes ankommende Paket wie in Java durch den IP-Thread (UDP, TCP) oder den ICMP-Thread (ICMP) seines Knotens: zustellen, Echo-Reply, weiterleiten, eins nach dem anderen; solange ARP wartet, warten die folgenden. Abweichend von Java weckt eine ARP-Antwort alle, die auf die Adresse warten (Javas `notify` weckt einen beliebigen). DNS seit F2.4a nach Javas `DNSServer`/`Resolver`, an Java-Filius gemessen: Server auf Port 53 mit Einträgen aus dem Modell (die Antwort wiederholt die Frage nicht, RCODE immer 0, ein Verweis mit NS und A im Antwortteil), iterativer Resolver mit 5 RTT je Anfrage, der nur die Server behält, an die er verwiesen wurde; seit F2.4c auf den Ereignissen statt blockierend und mit rekursivem Server nach `DNSServer.answerWithRemoteData` (Nameserver der Zone, dann der eigene DNS-Server, sonst Verweis), abweichend von Java fragt er sich nie selbst (Java endlos). Gateway-NAT seit F2.6 (Z. ~3585–3900) nach Javas `filius.software.nat`, an Java-Filius gemessen: die Übersetzung vor dem IP-Thread (wie Javas NAT-Threads zwischen Karte und Ethernet), ausgehend WAN-Adresse und der Port des Eintrags (ICMP behält die Kennung), eingehend nach Gegenstelle, Port und Protokoll, sonst nach der Portweiterleitung (legt einen dynamischen Eintrag an), ein Ping an die WAN-Adresse beantwortet der Heimrouter, Pakete von außen an das LAN verschwinden, beide Seiten durch die Firewall des Heimrouters, ausgehend TTL 1 bekommt „Zeit überschritten“; dynamische Einträge verfallen nach 300 s mal Javas Verzögerungsfaktor (Swift fest 300 s), aufgefrischt nur eingehend, seit 01.10.2026 genau in diesem Alter (Java findet sie erst bei seiner sekündlichen Prüfung, bis zu 1 s später; so auch der Switch: Javas `checkSAT` prüft jede Sekunde, der Kern verfällt genau zur Lernzeit); der Heimrouter leitet weiter wie ein Router. Abweichend von Java: ein LAN-Endpunkt bekommt für jede neue Gegenstelle einen Eintrag auf demselben WAN-Port (Java behält nur den für die erste, die Antworten weiterer bleiben am Heimrouter hängen). RIP seit F2.5a (Z. ~4700–5090) nach Javas `filius.software.rip`, seit F2.5b an Java-Filius gemessen (die Pause in Javas `float`-Rechnung): eine Route mit 0 Hops je eigenem Netz, die nie verfällt; der erste Beacon nach einer Sekunde, dann alle 25,2–35,2 s aus einem Zufall je Router (Java: ein ungesetzter `Random` je Router; der Kern setzt ihn aus Szenario und Router-ID, `ripSeed`; Swift: ein Zufall für alle); eine Nachricht je Schnittstelle ohne die Routen über sie (Split Horizon); eine neue Route oder mehr Hops vom selben Router senden sofort; eine gelernte Route wird genau nach ihren 75 s auf 16 gesetzt und sofort gemeldet (Java erst beim nächsten eigenen Beacon, bis zu gut 30 s später; Swift bei jedem Ereignis; seit 01.10.2026, vorher wie Java); Nachrichten von jedem Quellport (Swift: nur 521); ein RIP-Router leitet nur nach seiner Tabelle weiter, wenige Hops vor langer Maske. `receiveUdp` kehrt wie Javas `empfangen` zurück, sobald ein Datagramm da ist. Seit F2.8b nach Javas Tabellen gemessen: eine ARP-Anfrage trägt als Ziel-MAC die Broadcast-Adresse (Swift: Nullen; `swiftArp` behält sie), eine ICMP-Fehlermeldung Identifier und Sequenznummer 0 (RFC 792, Java; Swift kopiert die des Echos, ein Ping erkennt die Meldung am eingebetteten Echo), und „Host nicht erreichbar“ vom Router trägt das Paket, wie er es weitergeleitet hat (TTL gesenkt). Die Broadcast-Adresse schreibt sie immer groß (Java in der Antwort an 0.0.0.0 klein). Den Mitschnitt je Karte (`capture.ts`) schreibt sie seit F2.8a dort, wo Java ihn schreibt: beim Abgang auf das Kabel und bei der Ankunft an der Karte. WLAN seit F2.7 an Java-Filius gemessen: zur Laufzeit ist ein Funkkabel ein Kabel wie jedes andere, und eine SSID verbindet nichts (nach ihr legt nur Javas Editor das Funkkabel, `JHostKonfiguration.updateWifiConnection`); Swifts Verbindung über die SSID zur Laufzeit, auch ohne Kabel (`wirelessAssociations`), nicht übernommen. Klasse statt Werttyp. Noch nicht übertragen (wirft `NotPortedError`): Remote Link | | `src/runtime/dns.ts` | Java `filius.software.dns.DNSNachricht`, `Query`, `ResourceRecord` | neu nach Java statt nach Swift (Swift ersetzt Javas Textnachrichten durch `FILIUS-DNS-TYPED/1`): Kopfzeile `ID=… QR=… RCODE=… QDCOUNT=… …`, Frage- und Eintragszeilen, Suche nach Namen ohne Rücksicht auf Groß- und Kleinschreibung, NS der längsten Zone, sonst der Wurzel | | `src/runtime/ipv4.ts` | Engine `parseIPv4`/`sameSubnet` | übertragen | | `src/runtime/packets.ts` | Engine, Paketmodelle | übertragen; `Data` → `Uint8Array` | @@ -22,6 +22,7 @@ Swift-Pfade relativ zu `filius-ipad/ios/FiliusPad/TopologyEditor/` (Stand | `src/runtime/snapshot.ts` | Engine, `TopologyNetworkRuntimeTopologySnapshot` | übertragen, bisher mit den Feldern der übertragenen Schichten, seit F2.3 mit den DHCP-Einstellungen von Clients und Servern, seit F2.4a mit den eingeschalteten DNS-Servern; ohne Swifts WLAN-Einstellungen der Rechner (`hostWirelessConfigurationsByNodeID`), die zur Laufzeit nichts bewirken (F2.7) | | `src/runtime/speed.ts` | Engine, `TopologyNetworkRuntimeSpeed` | übertragen; dazu Javas RTT (`Verbindung.holeRTT`: 50 Kabel), die Swift nicht kennt | | `src/runtime/trace.ts` | Engine, Paketspur-Modell | übertragen | +| `src/runtime/captureRows.ts` | Java `Lauscher.datenVorbereiten`, `classifyApplicationLayerProtocol`, die `toString` von `ArpPaket`, `IpPaket`, `IcmpPaket` | neu nach Java (F2.8b): die Tabelle des Mitschnitts, je Frame eine Zeile je Schicht (Ethernet; ARP, ICMP oder IP; TCP oder UDP; die Daten, wenn Javas `trim` etwas übrig lässt), in beiden Ansichten Javas (Ende als Adresse:Port samt Datenzeile, oder nur Ports und die Datenzeile ohne Enden); die Bemerkung bleibt strukturiert, `captureCommentText` sagt sie mit gegebenen Wörtern und Zahlenformat wie Java. An Javas eigenen Tabellen gemessen. Abweichend von Java: „ICMP Time Exceeded“ (Java: „Exeeded“) | | `src/runtime/capture.ts` | Java `filius.rahmenprogramm.nachrichten.Lauscher` | neu nach Java (Swift hat stattdessen die Paketspur je Schritt): der Mitschnitt je Netzwerkkarte, jeder gesendete und empfangene Frame einmal mit Zeit und Nummer, wie Java auch Frames an andere Karten und solche, die die Firewall verwirft; Switches ohne Liste; verlorene Frames getrennt; bleibt über Stopp und Neustart, geleert nur auf Wunsch. Abweichend von Java: je Port statt je MAC-Adresse (Java legt zwei Karten mit gleicher MAC zusammen) und höchstens 10.000 Frames je Karte, die ältesten 1.000 fallen auf einmal heraus, die Nummern bleiben (Java behält alles) | | `src/util/equal.ts` | — | neu (Ersatz für Swifts `Equatable`) | | `src/util/swiftString.ts` | — | neu: Swift-String-Verhalten, das der übertragene Code stillschweigend voraussetzt (Trimmen, Kleinschreibung je Skalar, kanonische Gleichheit, Sortierung nach Skalarwerten, Base64 wie Foundation); am Swift-Orakel gemessen, Leerraum und Steuerzeichen über ganz Unicode | @@ -33,7 +34,8 @@ Swift-Pfade relativ zu `filius-ipad/ios/FiliusPad/TopologyEditor/` (Stand | `test/dhcpJava.test.ts`, `test/scenarios/*.java.json`, `test/scenario.ts`, `test/javaRun.ts` | — | neu: die DHCP-Szenarien gegen Java-Filius (`tools/java-oracle`, `DhcpRun`): je Client dieselben Frames in derselben Reihenfolge, Abstände auf 200 ms, dieselben Adressen am Ende | | `test/arpJava.test.ts`, `test/scenarios/arp-routed.scenario.json`, `test/scenarios/arp-java-*.java.json` | — | neu: vier ARP-Abläufe gegen Java-Filius (`ArpRun`): Frames, Abstände und wann jeder Aufruf zurückkehrt; die zwei Pings stimmen seit F2.4b-1, die zwei UDP-Abläufe seit F2.4b-2 (Javas Transport-Thread), drei Abläufe durch den Router seit F2.4b-3 (IP- und ICMP-Thread) | | `test/natJava.test.ts`, `test/scenarios/nat-home.scenario.json`, `test/scenarios/nat-java-*.java.json` | — | neu: sechs NAT-Abläufe gegen Java-Filius (`NatRun`): je Absenderkarte dieselben Frames in derselben Folge zur selben Zeit, dieselben Aufrufe, dieselbe NAT-Tabelle; freie Ports und TCP-Startnummern als Platzhalter; ein benannter Java-Fehler (`JAVA_BUGS`: die Antwort der zweiten Gegenstelle) | -| `test/javaRun.ts` (`expectSameCaptures`) | — | seit F2.8a: der Mitschnitt jeder Karte gegen Javas Liste dieser Karte (dieselben Frames, dieselbe Folge, dieselbe Zeit), in den Vergleichen für ARP, WLAN, DNS, TCP, NAT, RIP und DHCP mit einem Client | +| `test/javaRun.ts` (`expectSameCaptures`) | — | seit F2.8a: der Mitschnitt jeder Karte gegen Javas Liste dieser Karte (dieselben Frames, dieselbe Folge, dieselbe Zeit), in den Vergleichen für ARP, WLAN, DNS, TCP, NAT, RIP und DHCP mit einem Client; seit F2.8b für jeden dieser Frames auch Javas Tabellenzeilen in beiden Ansichten (Wörter und Zahlen wie Javas deutsches Gebietsschema) | +| `test/captureRows.test.ts` | — | neu (F2.8b): die Regeln der Tabelle, die kein Java-Lauf zeigt (GNT, POP3, SMTP, HTTP, Javas `trim`, ICMP-Fehler mit eingebettetem ICMP, Ansicht ohne Enden) | | `test/wlanJava.test.ts`, `test/scenarios/wlan-lan.scenario.json`, `test/scenarios/wlan-java-*.java.json` | — | neu: vier Pings gegen Java-Filius (`WlanRun`): über Funkkabel, über ein Kabel und an ein Notebook mit der SSID des Switches, aber ohne Kabel (ARP scheitert in Java wie im Kern); Frames, Abstände, Ergebnis und Dauer | | `test/ripJava.test.ts`, `test/scenarios/rip-chain.scenario.json`, `test/scenarios/rip-java-*.java.json` | — | neu: zwei RIP-Abläufe gegen Java-Filius (`RipRun`, der Zufall jedes Routers auf `ripSeed` gesetzt): je Absenderkarte dieselben Nachrichten zur selben Zeit, jede Tabelle durch dieselben Zustände, derselbe Ping; die ersten 5 s (Javas gestaffelter Start) nur über den erreichten Zustand | | `test/dnsJava.test.ts`, `test/scenarios/dns-lan.scenario.json`, `test/scenarios/dns-java-*.java.json` | — | neu: fünf DNS-Abfragen gegen Java-Filius (`DnsRun`): Frames, Ergebnis und Dauer; seit F2.4b-1 alle wie Java; seit F2.4c dazu fünf mit rekursivem Server (`dns-recursive.scenario.json`, `dns-recursive-java-*.java.json`), einer nur bis zur Anfrage des Clients verglichen (`JAVA_UNTIL`: Javas Server fragt sich selbst ohne Ende) | diff --git a/packages/core/src/index.ts b/packages/core/src/index.ts index cd92e8b..8d37772 100644 --- a/packages/core/src/index.ts +++ b/packages/core/src/index.ts @@ -16,6 +16,7 @@ export * from './runtime/snapshot.js'; export * from './runtime/speed.js'; export * from './runtime/trace.js'; export * from './runtime/capture.js'; +export * from './runtime/captureRows.js'; export * from './util/equal.js'; export * from './util/javaIp.js'; export * from './util/swiftString.js'; diff --git a/packages/core/src/runtime/captureRows.ts b/packages/core/src/runtime/captureRows.ts new file mode 100644 index 0000000..f4caab9 --- /dev/null +++ b/packages/core/src/runtime/captureRows.ts @@ -0,0 +1,214 @@ +// The packet capture's table as Java FILIUS shows it +// (filius.rahmenprogramm.nachrichten.Lauscher.datenVorbereiten): per frame a +// row for each layer it carries — Ethernet; then ARP, ICMP or IP; for IP the +// TCP or UDP segment; and its data, when there are any. Seven columns: number, +// time, source, destination, protocol, layer, comment. +// +// The comment stays structured, so that the editor can say it in the +// viewer's language and format its numbers (Java: the words of its message +// bundle, the numbers with the locale's grouping); captureCommentText says it +// with given words, as Java does. The time is the frame's simulation time; +// Java shows its wall clock. +// +// Departures from Java: "ICMP Time Exceeded (poof)", where Java misspells +// "Exeeded"; an IP packet carries only TCP, UDP or ICMP here, so Java's row +// for an unknown transport protocol (all empty) does not occur. + +import type { CapturedFrame } from './capture.js'; +import { IPV4_PROTOCOL, TCP_FLAG, type ArpPacket, type IcmpMessage, type IPv4Packet } from './packets.js'; + +/** Java's four layers (Lauscher.PROTOKOLL_SCHICHTEN): network access, internet, transport, application. */ +export type CaptureLayer = 'networkAccess' | 'internet' | 'transport' | 'application'; + +export type CaptureComment = + /** The Ethernet frame's type (EthernetFrame.IP, .ARP). */ + | { readonly kind: 'ethernetType'; readonly type: '0x800' | '0x806' } + /** "Protocol: 17, TTL: 64". */ + | { readonly kind: 'ipProtocol'; readonly protocol: number; readonly timeToLive: number } + /** "Search for MAC " or "MAC is ", then the packet. */ + | { readonly kind: 'arp'; readonly operation: 'request' | 'reply'; readonly address: string; readonly packet: string } + /** "SYN" or "FIN", then "SEQ: …" and, with the ACK flag, "ACK: …". */ + | { readonly kind: 'tcp'; readonly flag: 'SYN' | 'FIN' | undefined; readonly sequence: number; readonly acknowledgement: number | undefined } + | { readonly kind: 'udp' } + /** The ICMP message, its TTL, identifier, sequence number and the packet it carries. */ + | { + readonly kind: 'icmp'; + readonly message: string; + readonly timeToLive: number; + readonly identifier: number; + readonly sequenceNumber: number; + readonly payload: string | undefined; + } + /** A segment's data, as text. */ + | { readonly kind: 'data'; readonly text: string }; + +export interface CaptureRow { + readonly number: number; + readonly timeMilliseconds: number; + /** Null where Java leaves the cell empty (the data row without addresses). */ + readonly source: string | null; + readonly destination: string | null; + /** "" for Ethernet (Lauscher.ETHERNET) and data Java does not recognise. */ + readonly protocol: string; + readonly layer: CaptureLayer; + readonly comment: CaptureComment; +} + +/** + * The rows of a card's frames. `withAddresses`: a segment's ends as + * address:port, also on its data row (the data exchange window); else ports + * only, and the data row without ends (the layered view). + */ +export function captureRows(frames: readonly CapturedFrame[], options: { withAddresses: boolean }): CaptureRow[] { + const rows: CaptureRow[] = []; + for (const { number, timeMilliseconds, frame } of frames) { + const row = (source: string | null, destination: string | null, protocol: string, layer: CaptureLayer, comment: CaptureComment) => + rows.push({ number, timeMilliseconds, source, destination, protocol, layer, comment }); + const payload = frame.payload; + row(frame.sourceMacAddress, frame.destinationMacAddress, '', 'networkAccess', { kind: 'ethernetType', type: payload.kind === 'arp' ? '0x806' : '0x800' }); + if (payload.kind === 'arp') { + const arp = payload.packet; + row(arp.senderIPAddress, arp.targetIPAddress, 'ARP', 'internet', { + kind: 'arp', + operation: arp.operation, + address: arp.operation === 'request' ? arp.targetIPAddress : arp.senderMacAddress, + packet: arpText(arp), + }); + continue; + } + const packet = payload.packet; + if (packet.payload.kind === 'icmp') { + const message = packet.payload.message; + row(packet.senderIPAddress, packet.receiverIPAddress, 'ICMP', 'internet', { + kind: 'icmp', + message: ICMP_MESSAGES[message.kind], + timeToLive: packet.timeToLive, + identifier: message.identifier, + sequenceNumber: message.sequenceNumber, + payload: message.embeddedOriginalPacket === undefined ? undefined : packetText(message.embeddedOriginalPacket), + }); + continue; + } + row(packet.senderIPAddress, packet.receiverIPAddress, 'IP', 'internet', { kind: 'ipProtocol', protocol: IPV4_PROTOCOL[packet.protocol], timeToLive: packet.timeToLive }); + const segment = packet.payload.kind === 'tcp' ? packet.payload.segment : packet.payload.datagram; + const end = (address: string, port: number) => (options.withAddresses ? `${address}:${port}` : String(port)); + const source = end(packet.senderIPAddress, segment.sourcePort); + const destination = end(packet.receiverIPAddress, segment.destinationPort); + if (packet.payload.kind === 'tcp') { + const tcp = packet.payload.segment; + const flag = (tcp.flags & TCP_FLAG.synchronize) !== 0 ? 'SYN' : (tcp.flags & TCP_FLAG.finish) !== 0 ? 'FIN' : undefined; + const acknowledgement = (tcp.flags & TCP_FLAG.acknowledgement) !== 0 ? tcp.acknowledgementNumber : undefined; + row(source, destination, 'TCP', 'transport', { kind: 'tcp', flag, sequence: tcp.sequenceNumber, acknowledgement }); + } else { + row(source, destination, 'UDP', 'transport', { kind: 'udp' }); + } + const text = new TextDecoder().decode(segment.payload); + if (javaTrim(text) === '') continue; + const protocol = applicationProtocol(text, segment.sourcePort, segment.destinationPort); + row(options.withAddresses ? source : null, options.withAddresses ? destination : null, protocol, 'application', { kind: 'data', text }); + } + return rows; +} + +/** The words Java's message bundle has for the comments (rp_lauscher_msg12–14). */ +export interface CaptureCommentWords { + /** rp_lauscher_msg12 (English bundle: "Protocol") */ + readonly protocol: string; + /** rp_lauscher_msg13 (English bundle: "Search for MAC") */ + readonly searchForMac: string; + /** rp_lauscher_msg14 (English bundle: "MAC is") */ + readonly macIs: string; +} + +/** The comment as Java writes it, with these words and this number format (Java: the locale's grouping). */ +export function captureCommentText(comment: CaptureComment, words: CaptureCommentWords, formatNumber: (value: number) => string): string { + switch (comment.kind) { + case 'ethernetType': + return comment.type; + case 'ipProtocol': + return `${words.protocol}: ${comment.protocol}, TTL: ${comment.timeToLive}`; + case 'arp': + return `${comment.operation === 'request' ? words.searchForMac : words.macIs} ${comment.address} ${comment.packet}`; + case 'tcp': { + const sequence = `SEQ: ${formatNumber(comment.sequence)}`; + const acknowledgement = comment.acknowledgement === undefined ? '' : `, ACK: ${formatNumber(comment.acknowledgement)}`; + return `${comment.flag === undefined ? '' : `${comment.flag}, `}${sequence}${acknowledgement}`; + } + case 'udp': + return ''; + case 'icmp': + return ( + `${comment.message}, TTL: ${comment.timeToLive}, Identifier: ${comment.identifier}, Seq.-No.: ${comment.sequenceNumber}` + + (comment.payload === undefined ? '' : `, Payload: ${comment.payload}`) + ); + case 'data': + return comment.text; + } +} + +const ICMP_MESSAGES: Record = { + echoReply: 'ICMP Echo Reply (pong)', + destinationNetworkUnreachable: 'ICMP Network Unreachable', + destinationHostUnreachable: 'ICMP Host Unreachable', + echoRequest: 'ICMP Echo Request (ping)', + timeExceeded: 'ICMP Time Exceeded (poof)', +}; + +const ICMP_TYPE_CODE: Record = { + echoReply: [0, 0], + destinationNetworkUnreachable: [3, 0], + destinationHostUnreachable: [3, 1], + echoRequest: [8, 0], + timeExceeded: [11, 0], +}; + +/** ArpPaket.toString. */ +function arpText(arp: ArpPacket): string { + return `[op=${arp.operation === 'request' ? 'REQUEST' : 'REPLY'}, sender=${arp.senderMacAddress}|${arp.senderIPAddress}, target=${arp.targetMacAddress}|${arp.targetIPAddress}]`; +} + +/** IpPaket.toString, IcmpPaket.toString for an ICMP packet: the packet an ICMP error carries. */ +function packetText(packet: IPv4Packet): string { + if (packet.payload.kind !== 'icmp') { + return `[id=${packet.identity}, ttl=${packet.timeToLive}, protocol=${IPV4_PROTOCOL[packet.protocol]}, dest=${packet.receiverIPAddress}, src=${packet.senderIPAddress}]`; + } + const message = packet.payload.message; + const [type, code] = ICMP_TYPE_CODE[message.kind]; + const carried = message.embeddedOriginalPacket === undefined ? '' : `, payload:${packetText(message.embeddedOriginalPacket)}`; + return ( + `[id=${packet.identity}; ttl=${packet.timeToLive}; protocol=1; sender=${packet.senderIPAddress}; target=${packet.receiverIPAddress}; ` + + `icmpType=${type}; icmpCode=${code}; identifier=${message.identifier}; seqNr=${message.sequenceNumber}${carried}]` + ); +} + +/** Java's String.trim: cuts characters up to U+0020 at both ends. */ +function javaTrim(text: string): string { + let start = 0; + let end = text.length; + while (start < end && text.charCodeAt(start) <= 0x20) start += 1; + while (end > start && text.charCodeAt(end - 1) <= 0x20) end -= 1; + return text.slice(start, end); +} + +function startsWithIgnoringCase(text: string, prefix: string): boolean { + return text.slice(0, prefix.length).toLowerCase() === prefix.toLowerCase(); +} + +const POP3_COMMANDS = ['USER ', 'PASS ', 'STAT ', 'LIST ', 'RETR ', 'DELE ', 'NOOP', 'RSET', 'QUIT', 'TOP']; + +/** Lauscher.classifyApplicationLayerProtocol: the protocol a segment's data belong to, "" when Java does not know. */ +function applicationProtocol(text: string, sourcePort: number, destinationPort: number): string { + if (['//0x00//', '//0x01//', '//0x80//', '//0x81//', '//0x40//'].some((marker) => text.includes(marker))) return 'GNT'; + if ( + (sourcePort === 110 && (startsWithIgnoringCase(text, '+OK') || startsWithIgnoringCase(text, '-ERR'))) || + (destinationPort === 110 && POP3_COMMANDS.some((command) => startsWithIgnoringCase(text, command))) + ) { + return 'POP3'; + } + if ((sourcePort === 25 && ['1', '2', '3', '4', '5'].some((digit) => text.startsWith(digit))) || destinationPort === 25) return 'SMTP'; + if (text.includes('ID=') && text.includes('QR=') && text.includes('RCODE=')) return 'DNS'; + if (text.includes('DHCP')) return 'DHCP'; + if ((sourcePort === 521 && destinationPort === 520) || (sourcePort === 520 && destinationPort === 521)) return 'RIP'; + if ((destinationPort === 80 && text.toLowerCase().includes('http/')) || sourcePort === 80) return 'HTTP'; + return ''; +} diff --git a/packages/core/src/runtime/engine.ts b/packages/core/src/runtime/engine.ts index f02e425..76dc39a 100644 --- a/packages/core/src/runtime/engine.ts +++ b/packages/core/src/runtime/engine.ts @@ -3716,13 +3716,13 @@ export class NetworkRuntimeEngine { return this.stateValue.arpCachesByNodeId.get(nodeId)?.get(ipAddress)?.macAddress; } - /** One ARP request for `targetIPAddress`, broadcast from the interface. */ + /** One ARP request for `targetIPAddress`, broadcast from the interface; its target MAC the broadcast address, as Java's (ARP.sendeARPBroadcast; Swift, and swiftArp: zeros). */ private sendArpRequest(nodeId: Id, networkInterface: NetworkInterface, targetIPAddress: string): void { const request: ArpPacket = { operation: 'request', senderMacAddress: networkInterface.macAddress, senderIPAddress: networkInterface.ipAddress, - targetMacAddress: UNSPECIFIED_MAC_ADDRESS, + targetMacAddress: this.swiftArp ? UNSPECIFIED_MAC_ADDRESS : ETHERNET_BROADCAST_MAC_ADDRESS, targetIPAddress, }; const frame: EthernetFrame = { @@ -4210,7 +4210,7 @@ export class NetworkRuntimeEngine { const answered = () => (this.stateValue.icmpObservationsByNodeId.get(fromNodeId) ?? []) .slice(observationCount) - .some((observation) => observation.message.identifier === identifier && observation.message.sequenceNumber === sequenceNumber); + .some((observation) => answersEcho(observation.message, identifier, sequenceNumber)); let sent: IPv4DeliveryResult | undefined; let sentAt = this.stateValue.currentTimeMilliseconds; const handedOn = this.sendIPv4PacketWithOptions(fromNodeId, packet, sourceInterface.portId, true, 'sent', { @@ -4229,9 +4229,7 @@ export class NetworkRuntimeEngine { } const result = sent ?? handedOn; const newObservations = (this.stateValue.icmpObservationsByNodeId.get(fromNodeId) ?? []).slice(observationCount); - const observation = newObservations.findLast( - (candidate) => candidate.message.identifier === identifier && candidate.message.sequenceNumber === sequenceNumber, - ); + const observation = newObservations.findLast((candidate) => answersEcho(candidate.message, identifier, sequenceNumber)); if (observation !== undefined) { switch (observation.message.kind) { case 'echoReply': @@ -4533,11 +4531,12 @@ export class NetworkRuntimeEngine { detail: 'TTL decremented', }); // Java: a router whose ARP finds no one answers host unreachable; for - // ICMP only an echo request (ICMP.sendUnicastToNextHop). + // ICMP only an echo request (ICMP.sendUnicastToNextHop). The error carries + // the packet as the router forwarded it, its TTL lowered (measured). const echoOrNotIcmp = packet.payload.kind !== 'icmp' || packet.payload.message.kind === 'echoRequest'; const result = this.sendIPv4PacketWithOptions(nodeId, forwarded, undefined, false, 'forwarded', { onUnresolved: () => { - if (echoOrNotIcmp) this.emitIcmpError(nodeId, networkInterface, 'destinationHostUnreachable', packet); + if (echoOrNotIcmp) this.emitIcmpError(nodeId, networkInterface, 'destinationHostUnreachable', forwarded); }, onFinished: finished, }); @@ -4646,11 +4645,8 @@ export class NetworkRuntimeEngine { protocol: 'icmp', payload: { kind: 'icmp', - message: icmpMessage(kind, { - identifier: icmpIdentifier(originalPacket), - sequenceNumber: icmpSequenceNumber(originalPacket), - embeddedOriginalPacket: embeddedOriginal(originalPacket), - }), + // Identifier and sequence number unused, 0 (RFC 792, Java's sendeICMP for errors). + message: icmpMessage(kind, { embeddedOriginalPacket: embeddedOriginal(originalPacket) }), }, }; this.recordTrace({ @@ -4672,11 +4668,7 @@ export class NetworkRuntimeEngine { kind: IcmpMessageKind, originalPacket: IPv4Packet, ): void { - const message = icmpMessage(kind, { - identifier: icmpIdentifier(originalPacket), - sequenceNumber: icmpSequenceNumber(originalPacket), - embeddedOriginalPacket: embeddedOriginal(originalPacket), - }); + const message = icmpMessage(kind, { embeddedOriginalPacket: embeddedOriginal(originalPacket) }); const packet: IPv4Packet = { identity: this.allocatePacketIdentity(), senderIPAddress: this.networkInterfaces(nodeId)[0]?.ipAddress ?? UNSPECIFIED_IP_ADDRESS, @@ -5010,13 +5002,13 @@ function embeddedOriginal(packet: IPv4Packet): IPv4Packet { return packet; } -function icmpIdentifier(packet: IPv4Packet): number { - return packet.payload.kind === 'icmp' ? packet.payload.message.identifier : 0; +/** The echo reply to an echo request, or an error about it (it carries the request). */ +function answersEcho(message: IcmpMessage, identifier: number, sequenceNumber: number): boolean { + if (message.kind === 'echoReply') return message.identifier === identifier && message.sequenceNumber === sequenceNumber; + const carried = message.embeddedOriginalPacket?.payload; + return carried?.kind === 'icmp' && carried.message.kind === 'echoRequest' && carried.message.identifier === identifier && carried.message.sequenceNumber === sequenceNumber; } -function icmpSequenceNumber(packet: IPv4Packet): number { - return packet.payload.kind === 'icmp' ? packet.payload.message.sequenceNumber : 0; -} export function ethernetHeaders(frame: EthernetFrame): HeaderField[] { return [ diff --git a/packages/core/test/arpJava.test.ts b/packages/core/test/arpJava.test.ts index 519ab10..e1e472b 100644 --- a/packages/core/test/arpJava.test.ts +++ b/packages/core/test/arpJava.test.ts @@ -10,13 +10,13 @@ import { dirname, join } from 'node:path'; import { fileURLToPath } from 'node:url'; import { describe, expect, it } from 'vitest'; import { icmpMessage, type NetworkRuntimeEngine } from '../src/index.js'; -import { expectSameCaptures, withClientPortText, GAP_TOLERANCE_MILLISECONDS, gaps, javaFrames, watchedEngine, type JavaFrame } from './javaRun.js'; +import { expectSameCaptures, withClientPortText, GAP_TOLERANCE_MILLISECONDS, gaps, javaFrames, watchedEngine, type JavaFrame, type JavaTables } from './javaRun.js'; import type { Scenario } from './scenario.js'; const scenarioDirectory = join(dirname(fileURLToPath(import.meta.url)), 'scenarios'); const HOST = '00000000-0000-0000-0000-000000000301'; -interface JavaRun { +interface JavaRun extends JavaTables { frames: Record; events: [number, string][]; } @@ -117,7 +117,7 @@ describe('ARP as Java FILIUS runs it', () => { expect(actual[index]?.text, `frame #${index + 1}`).toBe(expected[index]?.text); expect(Math.abs(actual[index]!.gap - expected[index]!.gap), `gap before frame #${index + 1}`).toBeLessThanOrEqual(GAP_TOLERANCE_MILLISECONDS); } - expectSameCaptures(engine, scenario, java.frames, { text: withClientPortText }); + expectSameCaptures(engine, scenario, java.frames, { text: withClientPortText, tables: java }); }); } }); diff --git a/packages/core/test/captureRows.test.ts b/packages/core/test/captureRows.test.ts new file mode 100644 index 0000000..189ec22 --- /dev/null +++ b/packages/core/test/captureRows.test.ts @@ -0,0 +1,150 @@ +// The capture table's rules that no Java run of the oracle shows +// (Lauscher.datenVorbereiten, classifyApplicationLayerProtocol); the rest is +// compared with Java's own tables in the *Java.test.ts files (javaRun.ts). + +import { describe, expect, it } from 'vitest'; +import { + captureCommentText, + captureRows, + icmpMessage, + TCP_FLAG, + type CapturedFrame, + type CaptureRow, + type EthernetFrame, + type IPv4Packet, +} from '../src/index.js'; + +const WORDS = { protocol: 'Protocol', searchForMac: 'Search for MAC', macIs: 'MAC is' }; +const plain = (value: number) => String(value); + +function captured(packet: IPv4Packet, number = 1): CapturedFrame { + const frame: EthernetFrame = { identity: number, sourceMacAddress: '02:00:00:00:00:01', destinationMacAddress: '02:00:00:00:00:02', payload: { kind: 'ipv4', packet } }; + return { number, timeMilliseconds: 10 * number, frame }; +} + +function udp(text: string, sourcePort: number, destinationPort: number): IPv4Packet { + return { + identity: 7, + senderIPAddress: '10.0.0.1', + receiverIPAddress: '10.0.0.2', + timeToLive: 64, + protocol: 'udp', + payload: { kind: 'udp', datagram: { sourcePort, destinationPort, payload: new TextEncoder().encode(text) } }, + }; +} + +function tcp(text: string, sourcePort: number, destinationPort: number, flags: number = TCP_FLAG.acknowledgement): IPv4Packet { + return { + identity: 8, + senderIPAddress: '10.0.0.1', + receiverIPAddress: '10.0.0.2', + timeToLive: 64, + protocol: 'tcp', + payload: { + kind: 'tcp', + segment: { sourcePort, destinationPort, sequenceNumber: 1000, acknowledgementNumber: 2000, flags, payload: new TextEncoder().encode(text) }, + }, + }; +} + +/** The protocol of the data row, or undefined without one. */ +function applicationProtocol(packet: IPv4Packet): string | undefined { + return captureRows([captured(packet)], { withAddresses: true }).find((row) => row.layer === 'application')?.protocol; +} + +const comments = (rows: CaptureRow[]) => rows.map((row) => captureCommentText(row.comment, WORDS, plain)); + +describe('capture table', () => { + it("names the data's protocol as Java does, by markers, ports and words", () => { + expect(applicationProtocol(tcp('x//0x40//y', 6346, 6346))).toBe('GNT'); + expect(applicationProtocol(tcp('+ok 2 messages', 110, 50000))).toBe('POP3'); + expect(applicationProtocol(tcp('retr 1', 50000, 110))).toBe('POP3'); + expect(applicationProtocol(tcp('noop', 50000, 110))).toBe('POP3'); + expect(applicationProtocol(tcp('hello', 50000, 110))).toBe(''); + expect(applicationProtocol(tcp('250 OK', 25, 50000))).toBe('SMTP'); + expect(applicationProtocol(tcp('anything', 50000, 25))).toBe('SMTP'); + expect(applicationProtocol(udp('ID=1 QR=0 RCODE=0', 50000, 53))).toBe('DNS'); + expect(applicationProtocol(udp('DHCPDISCOVER', 68, 67))).toBe('DHCP'); + expect(applicationProtocol(udp('table', 521, 520))).toBe('RIP'); + expect(applicationProtocol(udp('table', 520, 520))).toBe(''); + expect(applicationProtocol(tcp('GET / HTTP/1.1', 50000, 80))).toBe('HTTP'); + expect(applicationProtocol(tcp('GET /', 50000, 80))).toBe(''); + expect(applicationProtocol(tcp('', 80, 50000))).toBe('HTTP'); + // GNT comes first, then POP3, SMTP, DNS, DHCP, RIP, HTTP. + expect(applicationProtocol(udp('DHCP ID=1 QR=0 RCODE=0', 68, 67))).toBe('DNS'); + }); + + it('shows data only when Java trims them to something, and without ends in the layered view', () => { + expect(applicationProtocol(udp(' \t\n', 9, 9))).toBeUndefined(); + expect(applicationProtocol(tcp('', 50000, 80))).toBeUndefined(); + const withAddresses = captureRows([captured(udp(' x ', 5000, 9))], { withAddresses: true }); + const layered = captureRows([captured(udp(' x ', 5000, 9))], { withAddresses: false }); + expect(withAddresses.map((row) => [row.source, row.destination])).toEqual([ + ['02:00:00:00:00:01', '02:00:00:00:00:02'], + ['10.0.0.1', '10.0.0.2'], + ['10.0.0.1:5000', '10.0.0.2:9'], + ['10.0.0.1:5000', '10.0.0.2:9'], + ]); + expect(layered.map((row) => [row.source, row.destination]).slice(2)).toEqual([ + ['5000', '9'], + [null, null], + ]); + expect(comments(layered)).toEqual(['0x800', 'Protocol: 17, TTL: 64', '', ' x ']); + }); + + it('marks a SYN, else a FIN, and an acknowledgement only with its flag', () => { + const segmentComment = (flags: number) => comments(captureRows([captured(tcp('', 1, 2, flags))], { withAddresses: true }))[2]; + expect(segmentComment(TCP_FLAG.synchronize)).toBe('SYN, SEQ: 1000'); + expect(segmentComment(TCP_FLAG.synchronize | TCP_FLAG.finish | TCP_FLAG.acknowledgement)).toBe('SYN, SEQ: 1000, ACK: 2000'); + expect(segmentComment(TCP_FLAG.finish | TCP_FLAG.acknowledgement)).toBe('FIN, SEQ: 1000, ACK: 2000'); + expect(segmentComment(TCP_FLAG.push | TCP_FLAG.reset)).toBe('SEQ: 1000'); + expect(captureCommentText({ kind: 'tcp', flag: undefined, sequence: 1234567, acknowledgement: 1000 }, WORDS, (value) => value.toLocaleString('de-DE'))).toBe( + 'SEQ: 1.234.567, ACK: 1.000', + ); + }); + + it('writes an ICMP error with the packet it carries, also an ICMP one inside', () => { + const echo: IPv4Packet = { + identity: 3, + senderIPAddress: '10.0.0.1', + receiverIPAddress: '10.0.0.9', + timeToLive: 1, + protocol: 'icmp', + payload: { kind: 'icmp', message: icmpMessage('echoRequest', { identifier: 4, sequenceNumber: 5 }) }, + }; + const error: IPv4Packet = { + identity: 6, + senderIPAddress: '10.0.0.254', + receiverIPAddress: '10.0.0.1', + timeToLive: 64, + protocol: 'icmp', + payload: { kind: 'icmp', message: icmpMessage('timeExceeded', { embeddedOriginalPacket: echo }) }, + }; + const rows = captureRows([captured(error)], { withAddresses: true }); + expect(rows.map((row) => [row.protocol, row.layer])).toEqual([ + ['', 'networkAccess'], + ['ICMP', 'internet'], + ]); + expect(comments(rows)[1]).toBe( + 'ICMP Time Exceeded (poof), TTL: 64, Identifier: 0, Seq.-No.: 0, Payload: ' + + '[id=3; ttl=1; protocol=1; sender=10.0.0.1; target=10.0.0.9; icmpType=8; icmpCode=0; identifier=4; seqNr=5]', + ); + const unreachable = { ...error, payload: { kind: 'icmp' as const, message: icmpMessage('destinationNetworkUnreachable', { embeddedOriginalPacket: udp('x', 1, 2) }) } }; + expect(comments(captureRows([captured(unreachable)], { withAddresses: true }))[1]).toBe( + 'ICMP Network Unreachable, TTL: 64, Identifier: 0, Seq.-No.: 0, Payload: [id=7, ttl=64, protocol=17, dest=10.0.0.2, src=10.0.0.1]', + ); + }); + + it('keeps the frame number and time on each of its rows', () => { + const rows = captureRows([captured(udp('a', 1, 2), 4), captured(udp('', 1, 2), 9)], { withAddresses: true }); + expect(rows.map((row) => [row.number, row.timeMilliseconds])).toEqual([ + [4, 40], + [4, 40], + [4, 40], + [4, 40], + [9, 90], + [9, 90], + [9, 90], + ]); + }); +}); diff --git a/packages/core/test/dhcpJava.test.ts b/packages/core/test/dhcpJava.test.ts index 122d89d..9a2de08 100644 --- a/packages/core/test/dhcpJava.test.ts +++ b/packages/core/test/dhcpJava.test.ts @@ -16,12 +16,12 @@ import { dirname, join } from 'node:path'; import { fileURLToPath } from 'node:url'; import { describe, expect, it } from 'vitest'; import { stableMacAddress } from '../src/index.js'; -import { expectSameCaptures, GAP_TOLERANCE_MILLISECONDS, javaFrames, watchedEngine, type JavaFrame, type SeenFrame } from './javaRun.js'; +import { expectSameCaptures, GAP_TOLERANCE_MILLISECONDS, javaFrames, watchedEngine, type JavaFrame, type SeenFrame, type JavaTables } from './javaRun.js'; import { type Scenario } from './scenario.js'; const scenarioDirectory = join(dirname(fileURLToPath(import.meta.url)), 'scenarios'); -interface JavaRun { +interface JavaRun extends JavaTables { frames: Record; devices: Record; } @@ -89,7 +89,7 @@ describe('DHCP as Java FILIUS runs it', () => { // Each card's capture, with one client: of two that start together, Java's // log loses the DISCOVER of the one that sends second, and which sends // first varies (javaRun.ts). - if (clients.length === 1) expectSameCaptures(engine.engine, scenario, java.frames, { text: (text) => text.replace(LINK_LOCAL, '169.254.1.x') }); + if (clients.length === 1) expectSameCaptures(engine.engine, scenario, java.frames, { text: (text) => text.replace(LINK_LOCAL, '169.254.1.x'), tables: java }); const linkLocal = (devices: Record) => Object.fromEntries(Object.entries(devices).map(([node, device]) => [node, device.map((value) => value.replace(LINK_LOCAL, '169.254.1.x'))])); expect(linkLocal(engine.devices)).toEqual(linkLocal(java.devices)); diff --git a/packages/core/test/dnsJava.test.ts b/packages/core/test/dnsJava.test.ts index efe805b..d7b3457 100644 --- a/packages/core/test/dnsJava.test.ts +++ b/packages/core/test/dnsJava.test.ts @@ -16,14 +16,14 @@ import { dirname, join } from 'node:path'; import { fileURLToPath } from 'node:url'; import { describe, expect, it } from 'vitest'; import type { DnsAddressResolution, NetworkRuntimeEngine } from '../src/index.js'; -import { expectSameCaptures, GAP_TOLERANCE_MILLISECONDS, gaps, javaFrames, watchedEngine, type JavaFrame, type SeenFrame } from './javaRun.js'; +import { expectSameCaptures, GAP_TOLERANCE_MILLISECONDS, gaps, javaFrames, watchedEngine, type JavaFrame, type SeenFrame, type JavaTables } from './javaRun.js'; import type { Scenario } from './scenario.js'; const scenarioDirectory = join(dirname(fileURLToPath(import.meta.url)), 'scenarios'); const CLIENT = '00000000-0000-0000-0000-000000000101'; const LOST_CLIENT = '00000000-0000-0000-0000-000000000104'; -interface JavaRun { +interface JavaRun extends JavaTables { frames: Record; events: [number, string][]; } @@ -122,7 +122,7 @@ describe('DNS as Java FILIUS runs it', () => { expect(actual[index]?.text, `frame #${index + 1}`).toBe(expected[index]?.text); expect(Math.abs(actual[index]!.gap - expected[index]!.gap), `gap before frame #${index + 1}`).toBeLessThanOrEqual(GAP_TOLERANCE_MILLISECONDS); } - expectSameCaptures(engine, scenario, java.frames, { text: (text) => normalized([{ time: 0, text }])[0]!.text, until }); + expectSameCaptures(engine, scenario, java.frames, { text: (text) => normalized([{ time: 0, text }])[0]!.text, until, tables: java }); }); } } diff --git a/packages/core/test/javaRun.ts b/packages/core/test/javaRun.ts index 5fc626c..9f1c528 100644 --- a/packages/core/test/javaRun.ts +++ b/packages/core/test/javaRun.ts @@ -22,7 +22,15 @@ // (engine.test.ts checks that: one cable's delay is below this tolerance). import { expect } from 'vitest'; -import { NetworkRuntimeEngine, TCP_FLAG, type EthernetFrame } from '../src/index.js'; +import { + captureCommentText, + captureRows, + NetworkRuntimeEngine, + TCP_FLAG, + type CapturedFrame, + type CaptureLayer, + type EthernetFrame, +} from '../src/index.js'; import { snapshotOf, type Scenario } from './scenario.js'; export const GAP_TOLERANCE_MILLISECONDS = 120; @@ -177,15 +185,21 @@ export function expectSameCaptures( until?: number | undefined; tolerance?: number; starts?: { java: number; engine: number }; + /** Java's tables of the cards (ScenarioNetwork.writeRows), compared for the frames compared. */ + tables?: JavaTables; + /** Placeholders in a table cell, beyond those of tableCell. */ + cell?: (text: string) => string; } = {}, ): void { const text = options.text ?? ((each: string) => each); const engineByCard = new Map(); + const capturedByCard = new Map(); for (const node of scenario.nodes) { if (node.kind === 'networkSwitch') continue; node.ports.forEach((port, index) => { - const frames = engine.capture.frames(port.id).map((each) => ({ time: each.timeMilliseconds, text: text(engineText(each.frame)) })); - engineByCard.set(index === 0 ? node.id : `${node.id}#${index}`, frames); + const card = index === 0 ? node.id : `${node.id}#${index}`; + capturedByCard.set(card, engine.capture.frames(port.id)); + engineByCard.set(card, capturedByCard.get(card)!.map((each) => ({ time: each.timeMilliseconds, text: text(engineText(each.frame)) }))); }); } const javaByCard = new Map(Object.entries(java).map(([card, frames]) => [card, frames.map((frame) => ({ time: frame.time, text: text(javaText(frame)) }))])); @@ -198,7 +212,29 @@ export function expectSameCaptures( const normalized = options.normalized ?? ((frames: SeenFrame[]) => frames); const window = (frames: SeenFrame[], start: number) => frames.filter((frame) => frame.time - start >= from && frame.time - start < until).map((frame) => ({ time: frame.time - start, text: frame.text })); + const inWindow = (time: number, start: number) => time - start >= from && time - start < until; for (const [card, javaList] of javaByCard) { + if (options.tables !== undefined) { + // The rows of the frames in the window, frame by frame. + const javaNumbers = javaList.flatMap((frame, index) => (inWindow(frame.time, javaStart) ? [index + 1] : [])); + const engineFrames = capturedByCard.get(card)!.filter((each) => inWindow(each.timeMilliseconds, engineStart)); + for (const [view, withAddresses] of [['rows', true], ['layeredRows', false]] as const) { + const javaRows = options.tables[view]?.[card]; + if (javaRows === undefined) continue; + const engineRows = captureRows(engineFrames, { withAddresses }); + const cell = (value: string | null) => (value === null ? null : (options.cell ?? ((each: string) => each))(tableCell(value))); + for (const [index, number] of javaNumbers.entries()) { + const frame = engineFrames[index]; + const expectedRows = javaRows.filter((row) => row[0] === String(number)).map((row) => row.slice(1).map(cell)); + // A frame a test added where Java errs (JAVA_BUGS) has no table of Java's. + if (expectedRows.length === 0 && number > Math.max(0, ...javaRows.map((row) => Number(row[0])))) continue; + const actualRows = engineRows + .filter((row) => row.number === frame?.number) + .map((row) => [row.source, row.destination, row.protocol, JAVA_LAYERS[row.layer], captureCommentText(row.comment, JAVA_WORDS, javaNumber)].map(cell)); + expect(actualRows, `${card} ${view} of frame #${index + 1}`).toEqual(expectedRows); + } + } + } const expected = normalized(window(javaList, javaStart)); const actual = normalized(window(engineByCard.get(card)!, engineStart)); for (let index = 0; index < Math.max(expected.length, actual.length); index += 1) { @@ -214,3 +250,36 @@ export function expectSameCaptures( export function withClientPortText(text: string): string { return text.replace(/:(\d{5})\b/g, (whole, port: string) => (Number(port) >= 49_152 ? ':client' : whole)); } + +/** Java's capture tables per card: number, source, destination, protocol, layer, comment (ScenarioNetwork.writeRows). */ +export interface JavaTables { + rows?: Record; + layeredRows?: Record; +} + +/** Java's layer names and comment words: its German message bundle, the locale it runs in (Locale.GERMANY). */ +const JAVA_LAYERS: Record = { networkAccess: 'Netzzugang', internet: 'Vermittlung', transport: 'Transport', application: 'Anwendung' }; +const JAVA_WORDS = { protocol: 'Protokoll', searchForMac: 'Suche nach MAC f\u00fcr', macIs: 'MAC ist' }; + +/** NumberFormat for Locale.GERMANY: groups of three digits with dots. */ +function javaNumber(value: number): string { + return String(value).replace(/\B(?=(\d{3})+(?!\d))/g, '.'); +} + +/** + * Placeholders every test needs in a table cell: free ports, DNS message IDs, + * IP packet IDs, link-local addresses. And two departures from Java: its ARP + * reply to 0.0.0.0 writes the broadcast address in lower case + * (ARP.sendArpReply), everything else in upper case — the engine always in + * upper case (better than Java where nothing depends on it); and Java + * misspells "ICMP Time Exeeded" (a typo, not taken). + */ +function tableCell(text: string): string { + return withClientPortText(text) + .replaceAll('ff:ff:ff:ff:ff:ff', 'FF:FF:FF:FF:FF:FF') + .replace('ICMP Time Exeeded (poof)', 'ICMP Time Exceeded (poof)') + .replace(/^(\d{5})$/, (whole, port: string) => (Number(port) >= 49_152 ? 'client' : whole)) + .replace(/ID=\d+/g, 'ID=x') + .replace(/\[id=\d+/g, '[id=x') + .replace(/169\.254\.1\.\d+/g, '169.254.1.x'); +} diff --git a/packages/core/test/natJava.test.ts b/packages/core/test/natJava.test.ts index 137f3bc..50346e2 100644 --- a/packages/core/test/natJava.test.ts +++ b/packages/core/test/natJava.test.ts @@ -22,7 +22,7 @@ import { dirname, join } from 'node:path'; import { fileURLToPath } from 'node:url'; import { describe, expect, it } from 'vitest'; import type { Id, IPv4DeliveryResult, NetworkRuntimeEngine } from '../src/index.js'; -import { expectSameCaptures, GAP_TOLERANCE_MILLISECONDS, javaFrames, watchedEngine, type JavaFrame, type SeenFrame } from './javaRun.js'; +import { expectSameCaptures, GAP_TOLERANCE_MILLISECONDS, javaFrames, watchedEngine, type JavaFrame, type SeenFrame, type JavaTables } from './javaRun.js'; import type { Scenario } from './scenario.js'; const scenarioDirectory = join(dirname(fileURLToPath(import.meta.url)), 'scenarios'); @@ -49,7 +49,7 @@ function bySender(frames: readonly SeenFrame[]): Map { return result; } -interface JavaRun { +interface JavaRun extends JavaTables { frames: Record; events: [number, string][]; nat: string[]; @@ -60,13 +60,17 @@ type Call = (label: string, run: () => string) => void; const text = (value: string) => new TextEncoder().encode(value); const decode = (value: Uint8Array | undefined) => (value === undefined ? 'null' : new TextDecoder().decode(value)); +const ICMP_CODES: Record = { timeExceeded: '11/0', destinationNetworkUnreachable: '3/0', destinationHostUnreachable: '3/1' }; + /** A ping in Java's words: the answer's type and code and its sender, or null. */ -function ping(engine: NetworkRuntimeEngine, from: Id, target: string, sequenceNumber: number): string { - const result: IPv4DeliveryResult = engine.sendIcmpEcho(from, target, { sequenceNumber }); - if (result.type === 'icmpError') return `ICMP ${result.kind}`; - const reply = (engine.state.icmpObservationsByNodeId.get(from) ?? []).find( - (observation) => observation.message.kind === 'echoReply' && observation.message.sequenceNumber === sequenceNumber, - ); +function ping(engine: NetworkRuntimeEngine, from: Id, target: string, sequenceNumber: number, timeToLive = 64): string { + const result: IPv4DeliveryResult = engine.sendIcmpEcho(from, target, { sequenceNumber, timeToLive }); + const observations = engine.state.icmpObservationsByNodeId.get(from) ?? []; + if (result.type === 'icmpError') { + const error = observations.findLast((observation) => observation.message.kind === result.kind); + return error === undefined ? `ICMP ${result.kind}` : `ICMP ${ICMP_CODES[result.kind]} from ${error.packet.senderIPAddress}`; + } + const reply = observations.find((observation) => observation.message.kind === 'echoReply' && observation.message.sequenceNumber === sequenceNumber); return reply === undefined ? 'null' : `ICMP 0/0 from ${reply.packet.senderIPAddress}`; } @@ -131,6 +135,7 @@ const STORIES: Record void }, tcpOut: (engine, call) => tcpExchange(engine, call, SERVER, LAN_PC, '42.0.0.20', 80), forward: (engine, call) => tcpExchange(engine, call, LAN_PC, SERVER, '42.0.0.10', 8080), + ttlOut: (engine, call) => call('sendProbe 42.0.0.20', () => ping(engine, LAN_PC, '42.0.0.20', 1, 1)), pingWan: (engine, call) => { call('sendProbe 42.0.0.10', () => ping(engine, SERVER, '42.0.0.10', 1)); call('sendProbe 192.168.0.10', () => ping(engine, SERVER, '192.168.0.10', 2)); @@ -259,6 +264,7 @@ describe('NAT as Java FILIUS runs it', () => { // A card's own list keeps its order. expectSameCaptures(engine, scenario, java.frames, { normalized: withPlaceholders, + tables: measured, tolerance: TCP_STORIES.has(name) ? TCP_TOLERANCE_MILLISECONDS : GAP_TOLERANCE_MILLISECONDS, }); diff --git a/packages/core/test/oracle.test.ts b/packages/core/test/oracle.test.ts index 23b90a8..4b5e550 100644 --- a/packages/core/test/oracle.test.ts +++ b/packages/core/test/oracle.test.ts @@ -285,6 +285,31 @@ const scenarioNames = readdirSync(scenarioDirectory) */ const SWIFT_ERRORS: Record) => Record> = {}; +const ECHO_KINDS = new Set(['echoRequest', 'echoReply']); + +/** + * Java instead of Swift in every scenario: an ICMP error's identifier and + * sequence number are 0 (RFC 792: unused; Java's sendeICMP), where Swift + * copies them from the echo request it is about. Measured with Java FILIUS + * (the capture tables of arpJava and natJava). + */ +function withJavaIcmpErrors(expected: Record): Record { + type Header = [string, string]; + const headers = (fields: Header[]): Header[] => { + const kind = fields.find(([name]) => name === 'kind')?.[1]; + if (kind === undefined || ECHO_KINDS.has(kind)) return fields; + return fields.map(([name, value]) => [name, name === 'identifier' || name === 'sequence' ? '0' : value]); + }; + const traces = (expected.traces as { before: Header[]; after: Header[] }[]).map((trace) => ({ ...trace, before: headers(trace.before), after: headers(trace.after) })); + const observation = (item: { kind?: string }) => (item.kind === undefined || ECHO_KINDS.has(item.kind) ? item : { ...item, identifier: 0, sequence: 0 }); + const observations = Object.fromEntries( + Object.entries(expected.icmpObservations as Record).map(([node, items]) => [node, items.map(observation)]), + ); + // A traceroute's result is its observations (other results are lists too: a switch's table). + const results = (expected.results as unknown[]).map((result) => (Array.isArray(result) ? (result as { kind?: string }[]).map(observation) : result)); + return { ...expected, traces, icmpObservations: observations, results }; +} + /** * Scenarios where the engine follows Java instead of Swift; the Java * comparisons check that behaviour (dhcpJava.test.ts, tcpJava.test.ts, @@ -319,6 +344,14 @@ describe('same result as the Swift engine', () => { } }); + it('corrects ICMP errors where Swift has them', () => { + const corrected = scenarioNames.filter((name) => { + const expected = JSON.parse(readFileSync(join(scenarioDirectory, `${name}.swift.json`), 'utf8')) as Record; + return JSON.stringify(withJavaIcmpErrors(expected)) !== JSON.stringify(expected); + }); + expect(corrected.length).toBeGreaterThan(0); + }); + it('has scenarios with Swift results', () => { expect(scenarioNames.length).toBeGreaterThan(0); }); @@ -334,7 +367,7 @@ describe('same result as the Swift engine', () => { for (const [name, { trace, reason }] of Object.entries(SWIFT_UNTIL_TRACE)) { it(`${name} matches Swift until trace #${trace}, then follows Java: ${reason}`, () => { const scenario = JSON.parse(readFileSync(join(scenarioDirectory, `${name}.scenario.json`), 'utf8')) as Scenario; - const swift = JSON.parse(readFileSync(join(scenarioDirectory, `${name}.swift.json`), 'utf8')) as Record; + const swift = withJavaIcmpErrors(JSON.parse(readFileSync(join(scenarioDirectory, `${name}.swift.json`), 'utf8')) as Record); const actual = run(scenario); const expectedTraces = swift.traces as unknown[]; const actualTraces = actual.traces as unknown[]; @@ -349,7 +382,7 @@ describe('same result as the Swift engine', () => { it(name, () => { const scenario = JSON.parse(readFileSync(join(scenarioDirectory, `${name}.scenario.json`), 'utf8')) as Scenario; const swift = JSON.parse(readFileSync(join(scenarioDirectory, `${name}.swift.json`), 'utf8')) as Record; - const expected = SWIFT_ERRORS[name]?.(swift) ?? swift; + const expected = withJavaIcmpErrors(SWIFT_ERRORS[name]?.(swift) ?? swift); const actual = run(scenario); // Traces first and one by one: the first difference is the one that matters. diff --git a/packages/core/test/ripJava.test.ts b/packages/core/test/ripJava.test.ts index b021ec0..fe72f3b 100644 --- a/packages/core/test/ripJava.test.ts +++ b/packages/core/test/ripJava.test.ts @@ -32,7 +32,7 @@ import { dirname, join } from 'node:path'; import { fileURLToPath } from 'node:url'; import { describe, expect, it } from 'vitest'; import { RIP_FIRST_BEACON_DELAY_MILLISECONDS, RIP_INFINITY, RIP_TIMEOUT_MILLISECONDS, stableMacAddress, type Id, type IPv4DeliveryResult, type NetworkRuntimeEngine } from '../src/index.js'; -import { expectSameCaptures, GAP_TOLERANCE_MILLISECONDS, javaFrames, watchedEngine, type JavaFrame, type SeenFrame } from './javaRun.js'; +import { expectSameCaptures, GAP_TOLERANCE_MILLISECONDS, javaFrames, watchedEngine, type JavaFrame, type SeenFrame, type JavaTables } from './javaRun.js'; import type { Scenario } from './scenario.js'; const scenarioDirectory = join(dirname(fileURLToPath(import.meta.url)), 'scenarios'); @@ -56,7 +56,7 @@ function bySender(frames: readonly SeenFrame[], shift: number): Map; events: [number, string][]; tables: [number, Id, string][]; @@ -170,7 +170,7 @@ describe('RIP as Java FILIUS runs it', () => { } // Each card's capture, after the startup. - expectSameCaptures(engine, scenario, java.frames, { from: STARTUP_MILLISECONDS, until: better, starts: { java: offset, engine: 0 } }); + expectSameCaptures(engine, scenario, java.frames, { from: STARTUP_MILLISECONDS, until: better, starts: { java: offset, engine: 0 }, tables: java }); // Each router's table: the same state when the startup is over, then the same changes at about the same times. for (const router of routers) { diff --git a/packages/core/test/scenarios/arp-java-pingLan.java.json b/packages/core/test/scenarios/arp-java-pingLan.java.json index d464078..24bda7b 100644 --- a/packages/core/test/scenarios/arp-java-pingLan.java.json +++ b/packages/core/test/scenarios/arp-java-pingLan.java.json @@ -2,7 +2,7 @@ "frames": { "00000000-0000-0000-0000-000000000301": [ { - "time": 747, + "time": 717, "source": "02:00:00:00:03:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -10,7 +10,7 @@ "targetIp": "10.0.0.9" }, { - "time": 3497, + "time": 3467, "source": "02:00:00:00:03:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -20,7 +20,7 @@ ], "00000000-0000-0000-0000-000000000302": [ { - "time": 869, + "time": 837, "source": "02:00:00:00:03:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -28,7 +28,7 @@ "targetIp": "10.0.0.9" }, { - "time": 3609, + "time": 3578, "source": "02:00:00:00:03:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -39,13 +39,157 @@ "00000000-0000-0000-0000-000000000302#1": [], "00000000-0000-0000-0000-000000000303": [] }, + "rows": { + "00000000-0000-0000-0000-000000000301": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ], + [ + "2", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ] + ], + "00000000-0000-0000-0000-000000000302": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ], + [ + "2", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ] + ], + "00000000-0000-0000-0000-000000000302#1": [], + "00000000-0000-0000-0000-000000000303": [] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000301": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ], + [ + "2", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ] + ], + "00000000-0000-0000-0000-000000000302": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ], + [ + "2", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ] + ], + "00000000-0000-0000-0000-000000000302#1": [], + "00000000-0000-0000-0000-000000000303": [] + }, "events": [ [ - 743, + 712, "sendProbe 10.0.0.9 called" ], [ - 6253, + 6222, "sendProbe 10.0.0.9 returned ICMP 3/1 from 127.0.0.1" ] ] diff --git a/packages/core/test/scenarios/arp-java-pingRouted.java.json b/packages/core/test/scenarios/arp-java-pingRouted.java.json index d05ed82..31dd287 100644 --- a/packages/core/test/scenarios/arp-java-pingRouted.java.json +++ b/packages/core/test/scenarios/arp-java-pingRouted.java.json @@ -2,7 +2,7 @@ "frames": { "00000000-0000-0000-0000-000000000301": [ { - "time": 716, + "time": 717, "source": "02:00:00:00:03:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -10,7 +10,7 @@ "targetIp": "10.0.0.1" }, { - "time": 953, + "time": 951, "source": "02:00:00:00:03:21", "destination": "02:00:00:00:03:11", "arp": 2, @@ -18,7 +18,7 @@ "targetIp": "10.0.0.2" }, { - "time": 957, + "time": 954, "source": "02:00:00:00:03:11", "destination": "02:00:00:00:03:21", "icmp": 8, @@ -28,7 +28,7 @@ "sequence": 1 }, { - "time": 6682, + "time": 6681, "source": "02:00:00:00:03:21", "destination": "02:00:00:00:03:11", "icmp": 3, @@ -40,7 +40,7 @@ ], "00000000-0000-0000-0000-000000000302": [ { - "time": 839, + "time": 838, "source": "02:00:00:00:03:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -48,7 +48,7 @@ "targetIp": "10.0.0.1" }, { - "time": 841, + "time": 839, "source": "02:00:00:00:03:21", "destination": "02:00:00:00:03:11", "arp": 2, @@ -56,7 +56,7 @@ "targetIp": "10.0.0.2" }, { - "time": 1069, + "time": 1068, "source": "02:00:00:00:03:11", "destination": "02:00:00:00:03:21", "icmp": 8, @@ -66,7 +66,7 @@ "sequence": 1 }, { - "time": 6571, + "time": 6569, "source": "02:00:00:00:03:21", "destination": "02:00:00:00:03:11", "icmp": 3, @@ -78,7 +78,7 @@ ], "00000000-0000-0000-0000-000000000302#1": [ { - "time": 1070, + "time": 1068, "source": "02:00:00:00:03:22", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -86,7 +86,7 @@ "targetIp": "20.0.0.9" }, { - "time": 3820, + "time": 3818, "source": "02:00:00:00:03:22", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -96,7 +96,7 @@ ], "00000000-0000-0000-0000-000000000303": [ { - "time": 1125, + "time": 1124, "source": "02:00:00:00:03:22", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -104,7 +104,7 @@ "targetIp": "20.0.0.9" }, { - "time": 3876, + "time": 3874, "source": "02:00:00:00:03:22", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -113,13 +113,417 @@ } ] }, + "rows": { + "00000000-0000-0000-0000-000000000301": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.1 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.1]" + ], + [ + "2", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.1", + "10.0.0.2", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:21 [op=REPLY, sender=02:00:00:00:03:21|10.0.0.1, target=02:00:00:00:03:11|10.0.0.2]" + ], + [ + "3", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.9", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "10.0.0.1", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Host Unreachable, TTL: 64, Identifier: 0, Seq.-No.: 0, Payload: [id=1; ttl=63; protocol=1; sender=10.0.0.2; target=20.0.0.9; icmpType=8; icmpCode=0; identifier=1; seqNr=1]" + ] + ], + "00000000-0000-0000-0000-000000000302": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.1 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.1]" + ], + [ + "2", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.1", + "10.0.0.2", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:21 [op=REPLY, sender=02:00:00:00:03:21|10.0.0.1, target=02:00:00:00:03:11|10.0.0.2]" + ], + [ + "3", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.9", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "10.0.0.1", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Host Unreachable, TTL: 64, Identifier: 0, Seq.-No.: 0, Payload: [id=1; ttl=63; protocol=1; sender=10.0.0.2; target=20.0.0.9; icmpType=8; icmpCode=0; identifier=1; seqNr=1]" + ] + ], + "00000000-0000-0000-0000-000000000302#1": [ + [ + "1", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ], + [ + "2", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ] + ], + "00000000-0000-0000-0000-000000000303": [ + [ + "1", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ], + [ + "2", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000301": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.1 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.1]" + ], + [ + "2", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.1", + "10.0.0.2", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:21 [op=REPLY, sender=02:00:00:00:03:21|10.0.0.1, target=02:00:00:00:03:11|10.0.0.2]" + ], + [ + "3", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.9", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "10.0.0.1", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Host Unreachable, TTL: 64, Identifier: 0, Seq.-No.: 0, Payload: [id=1; ttl=63; protocol=1; sender=10.0.0.2; target=20.0.0.9; icmpType=8; icmpCode=0; identifier=1; seqNr=1]" + ] + ], + "00000000-0000-0000-0000-000000000302": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.1 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.1]" + ], + [ + "2", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.1", + "10.0.0.2", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:21 [op=REPLY, sender=02:00:00:00:03:21|10.0.0.1, target=02:00:00:00:03:11|10.0.0.2]" + ], + [ + "3", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.9", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "10.0.0.1", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Host Unreachable, TTL: 64, Identifier: 0, Seq.-No.: 0, Payload: [id=1; ttl=63; protocol=1; sender=10.0.0.2; target=20.0.0.9; icmpType=8; icmpCode=0; identifier=1; seqNr=1]" + ] + ], + "00000000-0000-0000-0000-000000000302#1": [ + [ + "1", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ], + [ + "2", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ] + ], + "00000000-0000-0000-0000-000000000303": [ + [ + "1", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ], + [ + "2", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ] + ] + }, "events": [ [ - 711, + 712, "sendProbe 20.0.0.9 called" ], [ - 3707, + 3705, "sendProbe 20.0.0.9 returned null" ] ] diff --git a/packages/core/test/scenarios/arp-java-routedPingBehindPing.java.json b/packages/core/test/scenarios/arp-java-routedPingBehindPing.java.json index 1beabf4..5eeb0e7 100644 --- a/packages/core/test/scenarios/arp-java-routedPingBehindPing.java.json +++ b/packages/core/test/scenarios/arp-java-routedPingBehindPing.java.json @@ -10,7 +10,7 @@ "targetIp": "10.0.0.1" }, { - "time": 950, + "time": 952, "source": "02:00:00:00:03:21", "destination": "02:00:00:00:03:11", "arp": 2, @@ -28,7 +28,7 @@ "sequence": 2 }, { - "time": 1012, + "time": 1013, "source": "02:00:00:00:03:11", "destination": "02:00:00:00:03:21", "icmp": 8, @@ -48,7 +48,7 @@ "sequence": 0 }, { - "time": 6904, + "time": 6905, "source": "02:00:00:00:03:21", "destination": "02:00:00:00:03:11", "icmp": 0, @@ -60,7 +60,7 @@ ], "00000000-0000-0000-0000-000000000302": [ { - "time": 837, + "time": 838, "source": "02:00:00:00:03:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -68,7 +68,7 @@ "targetIp": "10.0.0.1" }, { - "time": 839, + "time": 840, "source": "02:00:00:00:03:21", "destination": "02:00:00:00:03:11", "arp": 2, @@ -86,7 +86,7 @@ "sequence": 2 }, { - "time": 1123, + "time": 1124, "source": "02:00:00:00:03:11", "destination": "02:00:00:00:03:21", "icmp": 8, @@ -96,7 +96,7 @@ "sequence": 1 }, { - "time": 6569, + "time": 6570, "source": "02:00:00:00:03:21", "destination": "02:00:00:00:03:11", "icmp": 3, @@ -118,7 +118,7 @@ ], "00000000-0000-0000-0000-000000000302#1": [ { - "time": 1068, + "time": 1069, "source": "02:00:00:00:03:22", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -126,7 +126,7 @@ "targetIp": "20.0.0.9" }, { - "time": 3818, + "time": 3819, "source": "02:00:00:00:03:22", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -160,7 +160,7 @@ "sequence": 1 }, { - "time": 6792, + "time": 6793, "source": "02:00:00:00:03:13", "destination": "02:00:00:00:03:22", "icmp": 0, @@ -180,7 +180,7 @@ "targetIp": "20.0.0.9" }, { - "time": 3874, + "time": 3875, "source": "02:00:00:00:03:22", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -188,7 +188,7 @@ "targetIp": "20.0.0.9" }, { - "time": 6625, + "time": 6626, "source": "02:00:00:00:03:22", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -196,7 +196,7 @@ "targetIp": "20.0.0.2" }, { - "time": 6625, + "time": 6626, "source": "02:00:00:00:03:13", "destination": "02:00:00:00:03:22", "arp": 2, @@ -225,6 +225,794 @@ } ] }, + "rows": { + "00000000-0000-0000-0000-000000000301": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.1 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.1]" + ], + [ + "2", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.1", + "10.0.0.2", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:21 [op=REPLY, sender=02:00:00:00:03:21|10.0.0.1, target=02:00:00:00:03:11|10.0.0.2]" + ], + [ + "3", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.9", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 2, Seq.-No.: 2" + ], + [ + "4", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "5", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.1", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Host Unreachable, TTL: 64, Identifier: 0, Seq.-No.: 0, Payload: [id=1; ttl=63; protocol=1; sender=10.0.0.2; target=20.0.0.9; icmpType=8; icmpCode=0; identifier=2; seqNr=2]" + ], + [ + "6", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 63, Identifier: 1, Seq.-No.: 1" + ] + ], + "00000000-0000-0000-0000-000000000302": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.1 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.1]" + ], + [ + "2", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.1", + "10.0.0.2", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:21 [op=REPLY, sender=02:00:00:00:03:21|10.0.0.1, target=02:00:00:00:03:11|10.0.0.2]" + ], + [ + "3", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.9", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 2, Seq.-No.: 2" + ], + [ + "4", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "5", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.1", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Host Unreachable, TTL: 64, Identifier: 0, Seq.-No.: 0, Payload: [id=1; ttl=63; protocol=1; sender=10.0.0.2; target=20.0.0.9; icmpType=8; icmpCode=0; identifier=2; seqNr=2]" + ], + [ + "6", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 63, Identifier: 1, Seq.-No.: 1" + ] + ], + "00000000-0000-0000-0000-000000000302#1": [ + [ + "1", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ], + [ + "2", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ], + [ + "3", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "20.0.0.1", + "20.0.0.2", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.2 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.2]" + ], + [ + "4", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "20.0.0.2", + "20.0.0.1", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:13 [op=REPLY, sender=02:00:00:00:03:13|20.0.0.2, target=02:00:00:00:03:22|20.0.0.1]" + ], + [ + "5", + "02:00:00:00:03:22", + "02:00:00:00:03:13", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 63, Identifier: 1, Seq.-No.: 1" + ], + [ + "6", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 1" + ] + ], + "00000000-0000-0000-0000-000000000303": [ + [ + "1", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ], + [ + "2", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ], + [ + "3", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "20.0.0.1", + "20.0.0.2", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.2 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.2]" + ], + [ + "4", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "20.0.0.2", + "20.0.0.1", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:13 [op=REPLY, sender=02:00:00:00:03:13|20.0.0.2, target=02:00:00:00:03:22|20.0.0.1]" + ], + [ + "5", + "02:00:00:00:03:22", + "02:00:00:00:03:13", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 63, Identifier: 1, Seq.-No.: 1" + ], + [ + "6", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 1" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000301": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.1 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.1]" + ], + [ + "2", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.1", + "10.0.0.2", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:21 [op=REPLY, sender=02:00:00:00:03:21|10.0.0.1, target=02:00:00:00:03:11|10.0.0.2]" + ], + [ + "3", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.9", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 2, Seq.-No.: 2" + ], + [ + "4", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "5", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.1", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Host Unreachable, TTL: 64, Identifier: 0, Seq.-No.: 0, Payload: [id=1; ttl=63; protocol=1; sender=10.0.0.2; target=20.0.0.9; icmpType=8; icmpCode=0; identifier=2; seqNr=2]" + ], + [ + "6", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 63, Identifier: 1, Seq.-No.: 1" + ] + ], + "00000000-0000-0000-0000-000000000302": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.1 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.1]" + ], + [ + "2", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.1", + "10.0.0.2", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:21 [op=REPLY, sender=02:00:00:00:03:21|10.0.0.1, target=02:00:00:00:03:11|10.0.0.2]" + ], + [ + "3", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.9", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 2, Seq.-No.: 2" + ], + [ + "4", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "5", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.1", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Host Unreachable, TTL: 64, Identifier: 0, Seq.-No.: 0, Payload: [id=1; ttl=63; protocol=1; sender=10.0.0.2; target=20.0.0.9; icmpType=8; icmpCode=0; identifier=2; seqNr=2]" + ], + [ + "6", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 63, Identifier: 1, Seq.-No.: 1" + ] + ], + "00000000-0000-0000-0000-000000000302#1": [ + [ + "1", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ], + [ + "2", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ], + [ + "3", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "20.0.0.1", + "20.0.0.2", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.2 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.2]" + ], + [ + "4", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "20.0.0.2", + "20.0.0.1", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:13 [op=REPLY, sender=02:00:00:00:03:13|20.0.0.2, target=02:00:00:00:03:22|20.0.0.1]" + ], + [ + "5", + "02:00:00:00:03:22", + "02:00:00:00:03:13", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 63, Identifier: 1, Seq.-No.: 1" + ], + [ + "6", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 1" + ] + ], + "00000000-0000-0000-0000-000000000303": [ + [ + "1", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ], + [ + "2", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ], + [ + "3", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "20.0.0.1", + "20.0.0.2", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.2 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.2]" + ], + [ + "4", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "20.0.0.2", + "20.0.0.1", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:13 [op=REPLY, sender=02:00:00:00:03:13|20.0.0.2, target=02:00:00:00:03:22|20.0.0.1]" + ], + [ + "5", + "02:00:00:00:03:22", + "02:00:00:00:03:13", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 63, Identifier: 1, Seq.-No.: 1" + ], + [ + "6", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 1" + ] + ] + }, "events": [ [ 713, @@ -235,11 +1023,11 @@ "sendeICMP 20.0.0.9 returned " ], [ - 955, + 956, "sendProbe 20.0.0.2 called" ], [ - 3762, + 3763, "sendProbe 20.0.0.2 returned null" ] ] diff --git a/packages/core/test/scenarios/arp-java-routedPingBesideUdp.java.json b/packages/core/test/scenarios/arp-java-routedPingBesideUdp.java.json index 4f58b09..8f78eac 100644 --- a/packages/core/test/scenarios/arp-java-routedPingBesideUdp.java.json +++ b/packages/core/test/scenarios/arp-java-routedPingBesideUdp.java.json @@ -10,7 +10,7 @@ "targetIp": "10.0.0.1" }, { - "time": 954, + "time": 955, "source": "02:00:00:00:03:21", "destination": "02:00:00:00:03:11", "arp": 2, @@ -18,7 +18,7 @@ "targetIp": "10.0.0.2" }, { - "time": 958, + "time": 959, "source": "02:00:00:00:03:11", "destination": "02:00:00:00:03:21", "icmp": 8, @@ -28,7 +28,7 @@ "sequence": 1 }, { - "time": 1406, + "time": 1407, "source": "02:00:00:00:03:21", "destination": "02:00:00:00:03:11", "icmp": 0, @@ -44,12 +44,12 @@ "sourceIp": "10.0.0.2", "destinationIp": "20.0.0.9", "protocol": 17, - "sourcePort": 55220, + "sourcePort": 56083, "destinationPort": 9, "payload": "verloren" }, { - "time": 1511, + "time": 1512, "source": "02:00:00:00:03:11", "destination": "02:00:00:00:03:21", "icmp": 8, @@ -59,7 +59,7 @@ "sequence": 2 }, { - "time": 1846, + "time": 1845, "source": "02:00:00:00:03:21", "destination": "02:00:00:00:03:11", "icmp": 0, @@ -69,7 +69,7 @@ "sequence": 2 }, { - "time": 7137, + "time": 7138, "source": "02:00:00:00:03:21", "destination": "02:00:00:00:03:11", "icmp": 3, @@ -81,7 +81,7 @@ ], "00000000-0000-0000-0000-000000000302": [ { - "time": 840, + "time": 841, "source": "02:00:00:00:03:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -89,7 +89,7 @@ "targetIp": "10.0.0.1" }, { - "time": 842, + "time": 843, "source": "02:00:00:00:03:21", "destination": "02:00:00:00:03:11", "arp": 2, @@ -97,7 +97,7 @@ "targetIp": "10.0.0.2" }, { - "time": 1071, + "time": 1072, "source": "02:00:00:00:03:11", "destination": "02:00:00:00:03:21", "icmp": 8, @@ -123,7 +123,7 @@ "sourceIp": "10.0.0.2", "destinationIp": "20.0.0.9", "protocol": 17, - "sourcePort": 55220, + "sourcePort": 56083, "destinationPort": 9, "payload": "verloren" }, @@ -138,7 +138,7 @@ "sequence": 2 }, { - "time": 1735, + "time": 1734, "source": "02:00:00:00:03:21", "destination": "02:00:00:00:03:11", "icmp": 0, @@ -160,7 +160,7 @@ ], "00000000-0000-0000-0000-000000000302#1": [ { - "time": 1071, + "time": 1072, "source": "02:00:00:00:03:22", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -176,7 +176,7 @@ "targetIp": "20.0.0.1" }, { - "time": 1183, + "time": 1184, "source": "02:00:00:00:03:22", "destination": "02:00:00:00:03:13", "icmp": 8, @@ -214,7 +214,7 @@ "sequence": 2 }, { - "time": 1735, + "time": 1734, "source": "02:00:00:00:03:13", "destination": "02:00:00:00:03:22", "icmp": 0, @@ -234,7 +234,7 @@ ], "00000000-0000-0000-0000-000000000303": [ { - "time": 1127, + "time": 1128, "source": "02:00:00:00:03:22", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -242,7 +242,7 @@ "targetIp": "20.0.0.2" }, { - "time": 1127, + "time": 1128, "source": "02:00:00:00:03:13", "destination": "02:00:00:00:03:22", "arp": 2, @@ -307,6 +307,1114 @@ } ] }, + "rows": { + "00000000-0000-0000-0000-000000000301": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.1 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.1]" + ], + [ + "2", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.1", + "10.0.0.2", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:21 [op=REPLY, sender=02:00:00:00:03:21|10.0.0.1, target=02:00:00:00:03:11|10.0.0.2]" + ], + [ + "3", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 63, Identifier: 1, Seq.-No.: 1" + ], + [ + "5", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.2", + "20.0.0.9", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "10.0.0.2:56083", + "20.0.0.9:9", + "UDP", + "Transport", + "" + ], + [ + "5", + "10.0.0.2:56083", + "20.0.0.9:9", + "", + "Anwendung", + "verloren" + ], + [ + "6", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 2" + ], + [ + "7", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 63, Identifier: 1, Seq.-No.: 2" + ], + [ + "8", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "10.0.0.1", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Host Unreachable, TTL: 64, Identifier: 0, Seq.-No.: 0, Payload: [id=3, ttl=63, protocol=17, dest=20.0.0.9, src=10.0.0.2]" + ] + ], + "00000000-0000-0000-0000-000000000302": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.1 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.1]" + ], + [ + "2", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.1", + "10.0.0.2", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:21 [op=REPLY, sender=02:00:00:00:03:21|10.0.0.1, target=02:00:00:00:03:11|10.0.0.2]" + ], + [ + "3", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 63, Identifier: 1, Seq.-No.: 1" + ], + [ + "5", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.2", + "20.0.0.9", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "10.0.0.2:56083", + "20.0.0.9:9", + "UDP", + "Transport", + "" + ], + [ + "5", + "10.0.0.2:56083", + "20.0.0.9:9", + "", + "Anwendung", + "verloren" + ], + [ + "6", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 2" + ], + [ + "7", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 63, Identifier: 1, Seq.-No.: 2" + ], + [ + "8", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "10.0.0.1", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Host Unreachable, TTL: 64, Identifier: 0, Seq.-No.: 0, Payload: [id=3, ttl=63, protocol=17, dest=20.0.0.9, src=10.0.0.2]" + ] + ], + "00000000-0000-0000-0000-000000000302#1": [ + [ + "1", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "20.0.0.1", + "20.0.0.2", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.2 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.2]" + ], + [ + "2", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "20.0.0.2", + "20.0.0.1", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:13 [op=REPLY, sender=02:00:00:00:03:13|20.0.0.2, target=02:00:00:00:03:22|20.0.0.1]" + ], + [ + "3", + "02:00:00:00:03:22", + "02:00:00:00:03:13", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 63, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "5", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "5", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ], + [ + "6", + "02:00:00:00:03:22", + "02:00:00:00:03:13", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 63, Identifier: 1, Seq.-No.: 2" + ], + [ + "7", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 2" + ], + [ + "8", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "8", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ] + ], + "00000000-0000-0000-0000-000000000303": [ + [ + "1", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "20.0.0.1", + "20.0.0.2", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.2 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.2]" + ], + [ + "2", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "20.0.0.2", + "20.0.0.1", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:13 [op=REPLY, sender=02:00:00:00:03:13|20.0.0.2, target=02:00:00:00:03:22|20.0.0.1]" + ], + [ + "3", + "02:00:00:00:03:22", + "02:00:00:00:03:13", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 63, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "5", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "5", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ], + [ + "6", + "02:00:00:00:03:22", + "02:00:00:00:03:13", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 63, Identifier: 1, Seq.-No.: 2" + ], + [ + "7", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 2" + ], + [ + "8", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "8", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000301": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.1 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.1]" + ], + [ + "2", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.1", + "10.0.0.2", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:21 [op=REPLY, sender=02:00:00:00:03:21|10.0.0.1, target=02:00:00:00:03:11|10.0.0.2]" + ], + [ + "3", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 63, Identifier: 1, Seq.-No.: 1" + ], + [ + "5", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.2", + "20.0.0.9", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "56083", + "9", + "UDP", + "Transport", + "" + ], + [ + "5", + null, + null, + "", + "Anwendung", + "verloren" + ], + [ + "6", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 2" + ], + [ + "7", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 63, Identifier: 1, Seq.-No.: 2" + ], + [ + "8", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "10.0.0.1", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Host Unreachable, TTL: 64, Identifier: 0, Seq.-No.: 0, Payload: [id=3, ttl=63, protocol=17, dest=20.0.0.9, src=10.0.0.2]" + ] + ], + "00000000-0000-0000-0000-000000000302": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.1 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.1]" + ], + [ + "2", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.1", + "10.0.0.2", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:21 [op=REPLY, sender=02:00:00:00:03:21|10.0.0.1, target=02:00:00:00:03:11|10.0.0.2]" + ], + [ + "3", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 63, Identifier: 1, Seq.-No.: 1" + ], + [ + "5", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.2", + "20.0.0.9", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "56083", + "9", + "UDP", + "Transport", + "" + ], + [ + "5", + null, + null, + "", + "Anwendung", + "verloren" + ], + [ + "6", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 2" + ], + [ + "7", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 63, Identifier: 1, Seq.-No.: 2" + ], + [ + "8", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "10.0.0.1", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Host Unreachable, TTL: 64, Identifier: 0, Seq.-No.: 0, Payload: [id=3, ttl=63, protocol=17, dest=20.0.0.9, src=10.0.0.2]" + ] + ], + "00000000-0000-0000-0000-000000000302#1": [ + [ + "1", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "20.0.0.1", + "20.0.0.2", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.2 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.2]" + ], + [ + "2", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "20.0.0.2", + "20.0.0.1", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:13 [op=REPLY, sender=02:00:00:00:03:13|20.0.0.2, target=02:00:00:00:03:22|20.0.0.1]" + ], + [ + "3", + "02:00:00:00:03:22", + "02:00:00:00:03:13", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 63, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "5", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "5", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ], + [ + "6", + "02:00:00:00:03:22", + "02:00:00:00:03:13", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 63, Identifier: 1, Seq.-No.: 2" + ], + [ + "7", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 2" + ], + [ + "8", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "8", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ] + ], + "00000000-0000-0000-0000-000000000303": [ + [ + "1", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "20.0.0.1", + "20.0.0.2", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.2 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.2]" + ], + [ + "2", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "20.0.0.2", + "20.0.0.1", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:13 [op=REPLY, sender=02:00:00:00:03:13|20.0.0.2, target=02:00:00:00:03:22|20.0.0.1]" + ], + [ + "3", + "02:00:00:00:03:22", + "02:00:00:00:03:13", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 63, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "5", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "5", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ], + [ + "6", + "02:00:00:00:03:22", + "02:00:00:00:03:13", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 63, Identifier: 1, Seq.-No.: 2" + ], + [ + "7", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 2" + ], + [ + "8", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "8", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ] + ] + }, "events": [ [ 713, @@ -325,11 +1433,11 @@ "senden verloren returned " ], [ - 1511, + 1512, "sendProbe 20.0.0.2 called" ], [ - 1846, + 1845, "sendProbe 20.0.0.2 returned ICMP 0/0 from 20.0.0.2" ] ] diff --git a/packages/core/test/scenarios/arp-java-routedUdpBehind.java.json b/packages/core/test/scenarios/arp-java-routedUdpBehind.java.json index 60c69e2..4af47e3 100644 --- a/packages/core/test/scenarios/arp-java-routedUdpBehind.java.json +++ b/packages/core/test/scenarios/arp-java-routedUdpBehind.java.json @@ -2,7 +2,7 @@ "frames": { "00000000-0000-0000-0000-000000000301": [ { - "time": 725, + "time": 720, "source": "02:00:00:00:03:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -10,7 +10,7 @@ "targetIp": "10.0.0.1" }, { - "time": 960, + "time": 957, "source": "02:00:00:00:03:21", "destination": "02:00:00:00:03:11", "arp": 2, @@ -18,29 +18,29 @@ "targetIp": "10.0.0.2" }, { - "time": 962, + "time": 959, "source": "02:00:00:00:03:11", "destination": "02:00:00:00:03:21", "sourceIp": "10.0.0.2", "destinationIp": "20.0.0.9", "protocol": 17, - "sourcePort": 62662, + "sourcePort": 55126, "destinationPort": 9, "payload": "verloren" }, { - "time": 1020, + "time": 1017, "source": "02:00:00:00:03:11", "destination": "02:00:00:00:03:21", "sourceIp": "10.0.0.2", "destinationIp": "20.0.0.2", "protocol": 17, - "sourcePort": 57980, + "sourcePort": 58894, "destinationPort": 9, "payload": "dahinter" }, { - "time": 6692, + "time": 6688, "source": "02:00:00:00:03:21", "destination": "02:00:00:00:03:11", "icmp": 3, @@ -52,7 +52,7 @@ ], "00000000-0000-0000-0000-000000000302": [ { - "time": 847, + "time": 844, "source": "02:00:00:00:03:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -60,7 +60,7 @@ "targetIp": "10.0.0.1" }, { - "time": 848, + "time": 845, "source": "02:00:00:00:03:21", "destination": "02:00:00:00:03:11", "arp": 2, @@ -68,29 +68,29 @@ "targetIp": "10.0.0.2" }, { - "time": 1075, + "time": 1072, "source": "02:00:00:00:03:11", "destination": "02:00:00:00:03:21", "sourceIp": "10.0.0.2", "destinationIp": "20.0.0.9", "protocol": 17, - "sourcePort": 62662, + "sourcePort": 55126, "destinationPort": 9, "payload": "verloren" }, { - "time": 1131, + "time": 1128, "source": "02:00:00:00:03:11", "destination": "02:00:00:00:03:21", "sourceIp": "10.0.0.2", "destinationIp": "20.0.0.2", "protocol": 17, - "sourcePort": 57980, + "sourcePort": 58894, "destinationPort": 9, "payload": "dahinter" }, { - "time": 6580, + "time": 6576, "source": "02:00:00:00:03:21", "destination": "02:00:00:00:03:11", "icmp": 3, @@ -102,7 +102,7 @@ ], "00000000-0000-0000-0000-000000000302#1": [ { - "time": 1076, + "time": 1073, "source": "02:00:00:00:03:22", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -110,7 +110,7 @@ "targetIp": "20.0.0.9" }, { - "time": 3826, + "time": 3823, "source": "02:00:00:00:03:22", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -118,7 +118,7 @@ "targetIp": "20.0.0.9" }, { - "time": 6580, + "time": 6576, "source": "02:00:00:00:03:22", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -126,7 +126,7 @@ "targetIp": "20.0.0.2" }, { - "time": 6691, + "time": 6688, "source": "02:00:00:00:03:13", "destination": "02:00:00:00:03:22", "arp": 2, @@ -134,20 +134,20 @@ "targetIp": "20.0.0.1" }, { - "time": 6691, + "time": 6688, "source": "02:00:00:00:03:22", "destination": "02:00:00:00:03:13", "sourceIp": "10.0.0.2", "destinationIp": "20.0.0.2", "protocol": 17, - "sourcePort": 57980, + "sourcePort": 58894, "destinationPort": 9, "payload": "dahinter" } ], "00000000-0000-0000-0000-000000000303": [ { - "time": 1131, + "time": 1128, "source": "02:00:00:00:03:22", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -155,7 +155,7 @@ "targetIp": "20.0.0.9" }, { - "time": 3882, + "time": 3879, "source": "02:00:00:00:03:22", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -163,7 +163,7 @@ "targetIp": "20.0.0.9" }, { - "time": 6635, + "time": 6632, "source": "02:00:00:00:03:22", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -171,7 +171,7 @@ "targetIp": "20.0.0.2" }, { - "time": 6636, + "time": 6632, "source": "02:00:00:00:03:13", "destination": "02:00:00:00:03:22", "arp": 2, @@ -179,33 +179,885 @@ "targetIp": "20.0.0.1" }, { - "time": 6747, + "time": 6744, "source": "02:00:00:00:03:22", "destination": "02:00:00:00:03:13", "sourceIp": "10.0.0.2", "destinationIp": "20.0.0.2", "protocol": 17, - "sourcePort": 57980, + "sourcePort": 58894, "destinationPort": 9, "payload": "dahinter" } ] }, + "rows": { + "00000000-0000-0000-0000-000000000301": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.1 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.1]" + ], + [ + "2", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.1", + "10.0.0.2", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:21 [op=REPLY, sender=02:00:00:00:03:21|10.0.0.1, target=02:00:00:00:03:11|10.0.0.2]" + ], + [ + "3", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.9", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "10.0.0.2:55126", + "20.0.0.9:9", + "UDP", + "Transport", + "" + ], + [ + "3", + "10.0.0.2:55126", + "20.0.0.9:9", + "", + "Anwendung", + "verloren" + ], + [ + "4", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "10.0.0.2", + "20.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "10.0.0.2:58894", + "20.0.0.2:9", + "UDP", + "Transport", + "" + ], + [ + "4", + "10.0.0.2:58894", + "20.0.0.2:9", + "", + "Anwendung", + "dahinter" + ], + [ + "5", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.1", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Host Unreachable, TTL: 64, Identifier: 0, Seq.-No.: 0, Payload: [id=1, ttl=63, protocol=17, dest=20.0.0.9, src=10.0.0.2]" + ] + ], + "00000000-0000-0000-0000-000000000302": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.1 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.1]" + ], + [ + "2", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.1", + "10.0.0.2", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:21 [op=REPLY, sender=02:00:00:00:03:21|10.0.0.1, target=02:00:00:00:03:11|10.0.0.2]" + ], + [ + "3", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.9", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "10.0.0.2:55126", + "20.0.0.9:9", + "UDP", + "Transport", + "" + ], + [ + "3", + "10.0.0.2:55126", + "20.0.0.9:9", + "", + "Anwendung", + "verloren" + ], + [ + "4", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "10.0.0.2", + "20.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "10.0.0.2:58894", + "20.0.0.2:9", + "UDP", + "Transport", + "" + ], + [ + "4", + "10.0.0.2:58894", + "20.0.0.2:9", + "", + "Anwendung", + "dahinter" + ], + [ + "5", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.1", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Host Unreachable, TTL: 64, Identifier: 0, Seq.-No.: 0, Payload: [id=1, ttl=63, protocol=17, dest=20.0.0.9, src=10.0.0.2]" + ] + ], + "00000000-0000-0000-0000-000000000302#1": [ + [ + "1", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ], + [ + "2", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ], + [ + "3", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "20.0.0.1", + "20.0.0.2", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.2 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.2]" + ], + [ + "4", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "20.0.0.2", + "20.0.0.1", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:13 [op=REPLY, sender=02:00:00:00:03:13|20.0.0.2, target=02:00:00:00:03:22|20.0.0.1]" + ], + [ + "5", + "02:00:00:00:03:22", + "02:00:00:00:03:13", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.2", + "20.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 63" + ], + [ + "5", + "10.0.0.2:58894", + "20.0.0.2:9", + "UDP", + "Transport", + "" + ], + [ + "5", + "10.0.0.2:58894", + "20.0.0.2:9", + "", + "Anwendung", + "dahinter" + ] + ], + "00000000-0000-0000-0000-000000000303": [ + [ + "1", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ], + [ + "2", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ], + [ + "3", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "20.0.0.1", + "20.0.0.2", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.2 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.2]" + ], + [ + "4", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "20.0.0.2", + "20.0.0.1", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:13 [op=REPLY, sender=02:00:00:00:03:13|20.0.0.2, target=02:00:00:00:03:22|20.0.0.1]" + ], + [ + "5", + "02:00:00:00:03:22", + "02:00:00:00:03:13", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.2", + "20.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 63" + ], + [ + "5", + "10.0.0.2:58894", + "20.0.0.2:9", + "UDP", + "Transport", + "" + ], + [ + "5", + "10.0.0.2:58894", + "20.0.0.2:9", + "", + "Anwendung", + "dahinter" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000301": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.1 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.1]" + ], + [ + "2", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.1", + "10.0.0.2", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:21 [op=REPLY, sender=02:00:00:00:03:21|10.0.0.1, target=02:00:00:00:03:11|10.0.0.2]" + ], + [ + "3", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.9", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "55126", + "9", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "", + "Anwendung", + "verloren" + ], + [ + "4", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "10.0.0.2", + "20.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "58894", + "9", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "", + "Anwendung", + "dahinter" + ], + [ + "5", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.1", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Host Unreachable, TTL: 64, Identifier: 0, Seq.-No.: 0, Payload: [id=1, ttl=63, protocol=17, dest=20.0.0.9, src=10.0.0.2]" + ] + ], + "00000000-0000-0000-0000-000000000302": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.1 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.1]" + ], + [ + "2", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.1", + "10.0.0.2", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:21 [op=REPLY, sender=02:00:00:00:03:21|10.0.0.1, target=02:00:00:00:03:11|10.0.0.2]" + ], + [ + "3", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.9", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "55126", + "9", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "", + "Anwendung", + "verloren" + ], + [ + "4", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "10.0.0.2", + "20.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "58894", + "9", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "", + "Anwendung", + "dahinter" + ], + [ + "5", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.1", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Host Unreachable, TTL: 64, Identifier: 0, Seq.-No.: 0, Payload: [id=1, ttl=63, protocol=17, dest=20.0.0.9, src=10.0.0.2]" + ] + ], + "00000000-0000-0000-0000-000000000302#1": [ + [ + "1", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ], + [ + "2", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ], + [ + "3", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "20.0.0.1", + "20.0.0.2", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.2 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.2]" + ], + [ + "4", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "20.0.0.2", + "20.0.0.1", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:13 [op=REPLY, sender=02:00:00:00:03:13|20.0.0.2, target=02:00:00:00:03:22|20.0.0.1]" + ], + [ + "5", + "02:00:00:00:03:22", + "02:00:00:00:03:13", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.2", + "20.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 63" + ], + [ + "5", + "58894", + "9", + "UDP", + "Transport", + "" + ], + [ + "5", + null, + null, + "", + "Anwendung", + "dahinter" + ] + ], + "00000000-0000-0000-0000-000000000303": [ + [ + "1", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ], + [ + "2", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "20.0.0.1", + "20.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.9 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.9]" + ], + [ + "3", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "20.0.0.1", + "20.0.0.2", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.2 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.2]" + ], + [ + "4", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "20.0.0.2", + "20.0.0.1", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:13 [op=REPLY, sender=02:00:00:00:03:13|20.0.0.2, target=02:00:00:00:03:22|20.0.0.1]" + ], + [ + "5", + "02:00:00:00:03:22", + "02:00:00:00:03:13", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.2", + "20.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 63" + ], + [ + "5", + "58894", + "9", + "UDP", + "Transport", + "" + ], + [ + "5", + null, + null, + "", + "Anwendung", + "dahinter" + ] + ] + }, "events": [ [ - 717, + 711, "senden verloren called" ], [ - 721, + 715, "senden verloren returned " ], [ - 721, + 716, "senden dahinter called" ], [ - 962, + 959, "senden dahinter returned " ] ] diff --git a/packages/core/test/scenarios/arp-java-udpBehind.java.json b/packages/core/test/scenarios/arp-java-udpBehind.java.json index b741160..f55bbe1 100644 --- a/packages/core/test/scenarios/arp-java-udpBehind.java.json +++ b/packages/core/test/scenarios/arp-java-udpBehind.java.json @@ -2,7 +2,7 @@ "frames": { "00000000-0000-0000-0000-000000000301": [ { - "time": 731, + "time": 720, "source": "02:00:00:00:03:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -10,7 +10,7 @@ "targetIp": "10.0.0.9" }, { - "time": 3481, + "time": 3470, "source": "02:00:00:00:03:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -18,7 +18,7 @@ "targetIp": "10.0.0.9" }, { - "time": 6237, + "time": 6226, "source": "02:00:00:00:03:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -26,7 +26,7 @@ "targetIp": "10.0.0.1" }, { - "time": 6460, + "time": 6449, "source": "02:00:00:00:03:21", "destination": "02:00:00:00:03:11", "arp": 2, @@ -34,20 +34,20 @@ "targetIp": "10.0.0.2" }, { - "time": 6460, + "time": 6450, "source": "02:00:00:00:03:11", "destination": "02:00:00:00:03:21", "sourceIp": "10.0.0.2", "destinationIp": "20.0.0.2", "protocol": 17, - "sourcePort": 55273, + "sourcePort": 59870, "destinationPort": 9, "payload": "dahinter" } ], "00000000-0000-0000-0000-000000000302": [ { - "time": 852, + "time": 843, "source": "02:00:00:00:03:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -55,7 +55,7 @@ "targetIp": "10.0.0.9" }, { - "time": 3593, + "time": 3582, "source": "02:00:00:00:03:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -63,7 +63,7 @@ "targetIp": "10.0.0.9" }, { - "time": 6348, + "time": 6338, "source": "02:00:00:00:03:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -71,7 +71,7 @@ "targetIp": "10.0.0.1" }, { - "time": 6349, + "time": 6338, "source": "02:00:00:00:03:21", "destination": "02:00:00:00:03:11", "arp": 2, @@ -79,20 +79,20 @@ "targetIp": "10.0.0.2" }, { - "time": 6574, + "time": 6563, "source": "02:00:00:00:03:11", "destination": "02:00:00:00:03:21", "sourceIp": "10.0.0.2", "destinationIp": "20.0.0.2", "protocol": 17, - "sourcePort": 55273, + "sourcePort": 59870, "destinationPort": 9, "payload": "dahinter" } ], "00000000-0000-0000-0000-000000000302#1": [ { - "time": 6574, + "time": 6563, "source": "02:00:00:00:03:22", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -100,7 +100,7 @@ "targetIp": "20.0.0.2" }, { - "time": 6685, + "time": 6674, "source": "02:00:00:00:03:13", "destination": "02:00:00:00:03:22", "arp": 2, @@ -108,20 +108,20 @@ "targetIp": "20.0.0.1" }, { - "time": 6685, + "time": 6675, "source": "02:00:00:00:03:22", "destination": "02:00:00:00:03:13", "sourceIp": "10.0.0.2", "destinationIp": "20.0.0.2", "protocol": 17, - "sourcePort": 55273, + "sourcePort": 59870, "destinationPort": 9, "payload": "dahinter" } ], "00000000-0000-0000-0000-000000000303": [ { - "time": 6629, + "time": 6619, "source": "02:00:00:00:03:22", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -129,7 +129,7 @@ "targetIp": "20.0.0.2" }, { - "time": 6629, + "time": 6619, "source": "02:00:00:00:03:13", "destination": "02:00:00:00:03:22", "arp": 2, @@ -137,33 +137,693 @@ "targetIp": "20.0.0.1" }, { - "time": 6741, + "time": 6730, "source": "02:00:00:00:03:22", "destination": "02:00:00:00:03:13", "sourceIp": "10.0.0.2", "destinationIp": "20.0.0.2", "protocol": 17, - "sourcePort": 55273, + "sourcePort": 59870, "destinationPort": 9, "payload": "dahinter" } ] }, + "rows": { + "00000000-0000-0000-0000-000000000301": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ], + [ + "2", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ], + [ + "3", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "10.0.0.2", + "10.0.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.1 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.1]" + ], + [ + "4", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "10.0.0.1", + "10.0.0.2", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:21 [op=REPLY, sender=02:00:00:00:03:21|10.0.0.1, target=02:00:00:00:03:11|10.0.0.2]" + ], + [ + "5", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.2", + "20.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "10.0.0.2:59870", + "20.0.0.2:9", + "UDP", + "Transport", + "" + ], + [ + "5", + "10.0.0.2:59870", + "20.0.0.2:9", + "", + "Anwendung", + "dahinter" + ] + ], + "00000000-0000-0000-0000-000000000302": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ], + [ + "2", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ], + [ + "3", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "10.0.0.2", + "10.0.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.1 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.1]" + ], + [ + "4", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "10.0.0.1", + "10.0.0.2", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:21 [op=REPLY, sender=02:00:00:00:03:21|10.0.0.1, target=02:00:00:00:03:11|10.0.0.2]" + ], + [ + "5", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.2", + "20.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "10.0.0.2:59870", + "20.0.0.2:9", + "UDP", + "Transport", + "" + ], + [ + "5", + "10.0.0.2:59870", + "20.0.0.2:9", + "", + "Anwendung", + "dahinter" + ] + ], + "00000000-0000-0000-0000-000000000302#1": [ + [ + "1", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "20.0.0.1", + "20.0.0.2", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.2 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.2]" + ], + [ + "2", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "20.0.0.2", + "20.0.0.1", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:13 [op=REPLY, sender=02:00:00:00:03:13|20.0.0.2, target=02:00:00:00:03:22|20.0.0.1]" + ], + [ + "3", + "02:00:00:00:03:22", + "02:00:00:00:03:13", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 63" + ], + [ + "3", + "10.0.0.2:59870", + "20.0.0.2:9", + "UDP", + "Transport", + "" + ], + [ + "3", + "10.0.0.2:59870", + "20.0.0.2:9", + "", + "Anwendung", + "dahinter" + ] + ], + "00000000-0000-0000-0000-000000000303": [ + [ + "1", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "20.0.0.1", + "20.0.0.2", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.2 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.2]" + ], + [ + "2", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "20.0.0.2", + "20.0.0.1", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:13 [op=REPLY, sender=02:00:00:00:03:13|20.0.0.2, target=02:00:00:00:03:22|20.0.0.1]" + ], + [ + "3", + "02:00:00:00:03:22", + "02:00:00:00:03:13", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 63" + ], + [ + "3", + "10.0.0.2:59870", + "20.0.0.2:9", + "UDP", + "Transport", + "" + ], + [ + "3", + "10.0.0.2:59870", + "20.0.0.2:9", + "", + "Anwendung", + "dahinter" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000301": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ], + [ + "2", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ], + [ + "3", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "10.0.0.2", + "10.0.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.1 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.1]" + ], + [ + "4", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "10.0.0.1", + "10.0.0.2", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:21 [op=REPLY, sender=02:00:00:00:03:21|10.0.0.1, target=02:00:00:00:03:11|10.0.0.2]" + ], + [ + "5", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.2", + "20.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "59870", + "9", + "UDP", + "Transport", + "" + ], + [ + "5", + null, + null, + "", + "Anwendung", + "dahinter" + ] + ], + "00000000-0000-0000-0000-000000000302": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ], + [ + "2", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ], + [ + "3", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "10.0.0.2", + "10.0.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.1 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.1]" + ], + [ + "4", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "10.0.0.1", + "10.0.0.2", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:21 [op=REPLY, sender=02:00:00:00:03:21|10.0.0.1, target=02:00:00:00:03:11|10.0.0.2]" + ], + [ + "5", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.2", + "20.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "59870", + "9", + "UDP", + "Transport", + "" + ], + [ + "5", + null, + null, + "", + "Anwendung", + "dahinter" + ] + ], + "00000000-0000-0000-0000-000000000302#1": [ + [ + "1", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "20.0.0.1", + "20.0.0.2", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.2 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.2]" + ], + [ + "2", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "20.0.0.2", + "20.0.0.1", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:13 [op=REPLY, sender=02:00:00:00:03:13|20.0.0.2, target=02:00:00:00:03:22|20.0.0.1]" + ], + [ + "3", + "02:00:00:00:03:22", + "02:00:00:00:03:13", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 63" + ], + [ + "3", + "59870", + "9", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "", + "Anwendung", + "dahinter" + ] + ], + "00000000-0000-0000-0000-000000000303": [ + [ + "1", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "20.0.0.1", + "20.0.0.2", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.2 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.2]" + ], + [ + "2", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "20.0.0.2", + "20.0.0.1", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:13 [op=REPLY, sender=02:00:00:00:03:13|20.0.0.2, target=02:00:00:00:03:22|20.0.0.1]" + ], + [ + "3", + "02:00:00:00:03:22", + "02:00:00:00:03:13", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 63" + ], + [ + "3", + "59870", + "9", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "", + "Anwendung", + "dahinter" + ] + ] + }, "events": [ [ - 723, + 711, "senden verloren called" ], [ - 727, + 716, "senden verloren returned " ], [ - 727, + 716, "senden dahinter called" ], [ - 6237, + 6226, "senden dahinter returned " ] ] diff --git a/packages/core/test/scenarios/arp-java-udpTwice.java.json b/packages/core/test/scenarios/arp-java-udpTwice.java.json index 924786a..de47c9b 100644 --- a/packages/core/test/scenarios/arp-java-udpTwice.java.json +++ b/packages/core/test/scenarios/arp-java-udpTwice.java.json @@ -2,7 +2,7 @@ "frames": { "00000000-0000-0000-0000-000000000301": [ { - "time": 723, + "time": 721, "source": "02:00:00:00:03:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -10,7 +10,7 @@ "targetIp": "10.0.0.9" }, { - "time": 3473, + "time": 3471, "source": "02:00:00:00:03:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -18,7 +18,7 @@ "targetIp": "10.0.0.9" }, { - "time": 6229, + "time": 6226, "source": "02:00:00:00:03:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -26,7 +26,7 @@ "targetIp": "10.0.0.9" }, { - "time": 8979, + "time": 8977, "source": "02:00:00:00:03:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -36,7 +36,7 @@ ], "00000000-0000-0000-0000-000000000302": [ { - "time": 843, + "time": 844, "source": "02:00:00:00:03:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -44,7 +44,7 @@ "targetIp": "10.0.0.9" }, { - "time": 3584, + "time": 3583, "source": "02:00:00:00:03:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -52,7 +52,7 @@ "targetIp": "10.0.0.9" }, { - "time": 6340, + "time": 6338, "source": "02:00:00:00:03:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -60,7 +60,7 @@ "targetIp": "10.0.0.9" }, { - "time": 9090, + "time": 9088, "source": "02:00:00:00:03:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -71,21 +71,293 @@ "00000000-0000-0000-0000-000000000302#1": [], "00000000-0000-0000-0000-000000000303": [] }, + "rows": { + "00000000-0000-0000-0000-000000000301": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ], + [ + "2", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ], + [ + "3", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ], + [ + "4", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ] + ], + "00000000-0000-0000-0000-000000000302": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ], + [ + "2", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ], + [ + "3", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ], + [ + "4", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ] + ], + "00000000-0000-0000-0000-000000000302#1": [], + "00000000-0000-0000-0000-000000000303": [] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000301": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ], + [ + "2", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ], + [ + "3", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ], + [ + "4", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ] + ], + "00000000-0000-0000-0000-000000000302": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ], + [ + "2", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ], + [ + "3", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ], + [ + "4", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "10.0.0.2", + "10.0.0.9", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.9 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.9]" + ] + ], + "00000000-0000-0000-0000-000000000302#1": [], + "00000000-0000-0000-0000-000000000303": [] + }, "events": [ [ 713, "senden eins called" ], [ - 718, + 717, "senden eins returned " ], [ - 718, + 717, "senden zwei called" ], [ - 6229, + 6226, "senden zwei returned " ] ] diff --git a/packages/core/test/scenarios/dhcp-conflict.java.json b/packages/core/test/scenarios/dhcp-conflict.java.json index 69fc4de..d55f34b 100644 --- a/packages/core/test/scenarios/dhcp-conflict.java.json +++ b/packages/core/test/scenarios/dhcp-conflict.java.json @@ -2,7 +2,7 @@ "frames": { "00000000-0000-0000-0000-000000000101": [ { - "time": 453, + "time": 457, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -13,7 +13,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 458, + "time": 462, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "192.168.0.10", @@ -24,7 +24,7 @@ "payload": "DHCPOFFER\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nrouter=0.0.0.0\nsubnetmask=255.255.255.0\ndnsserver=0.0.0.0\nserverident=192.168.0.10" }, { - "time": 682, + "time": 686, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -32,7 +32,7 @@ "targetIp": "192.168.0.100" }, { - "time": 794, + "time": 799, "source": "02:00:00:00:01:13", "destination": "ff:ff:ff:ff:ff:ff", "arp": 2, @@ -40,7 +40,7 @@ "targetIp": "255.255.255.255" }, { - "time": 905, + "time": 911, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -51,7 +51,7 @@ "payload": "DHCPDECLINE\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12\nrequested=192.168.0.100\nserverident=192.168.0.10" }, { - "time": 961, + "time": 966, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -62,7 +62,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 3656, + "time": 3661, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -73,7 +73,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 6406, + "time": 6411, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -84,7 +84,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 9157, + "time": 9162, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -95,7 +95,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 11907, + "time": 11912, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -106,7 +106,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 11907, + "time": 11912, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "192.168.0.10", @@ -117,7 +117,7 @@ "payload": "DHCPOFFER\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nrouter=0.0.0.0\nsubnetmask=255.255.255.0\ndnsserver=0.0.0.0\nserverident=192.168.0.10" }, { - "time": 12132, + "time": 12135, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -128,7 +128,7 @@ "payload": "DHCPDECLINE\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12\nrequested=192.168.0.100\nserverident=192.168.0.10" }, { - "time": 12188, + "time": 12191, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -139,25 +139,25 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 14881, + "time": 14886, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, "senderIp": "0.0.0.0", - "targetIp": "169.254.1.107" + "targetIp": "169.254.1.43" }, { - "time": 17632, + "time": 17637, "source": "02:00:00:00:01:12", "destination": "ff:ff:ff:ff:ff:ff", "arp": 2, - "senderIp": "169.254.1.107", + "senderIp": "169.254.1.43", "targetIp": "255.255.255.255" } ], "00000000-0000-0000-0000-000000000102": [ { - "time": 331, + "time": 335, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -168,7 +168,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 569, + "time": 573, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "192.168.0.10", @@ -179,7 +179,7 @@ "payload": "DHCPOFFER\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nrouter=0.0.0.0\nsubnetmask=255.255.255.0\ndnsserver=0.0.0.0\nserverident=192.168.0.10" }, { - "time": 570, + "time": 574, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -187,7 +187,7 @@ "targetIp": "192.168.0.100" }, { - "time": 794, + "time": 799, "source": "02:00:00:00:01:13", "destination": "ff:ff:ff:ff:ff:ff", "arp": 2, @@ -195,7 +195,7 @@ "targetIp": "255.255.255.255" }, { - "time": 794, + "time": 799, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -206,7 +206,7 @@ "payload": "DHCPDECLINE\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12\nrequested=192.168.0.100\nserverident=192.168.0.10" }, { - "time": 850, + "time": 855, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -217,7 +217,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 3545, + "time": 3550, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -228,7 +228,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 6295, + "time": 6300, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -239,7 +239,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 9045, + "time": 9050, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -250,7 +250,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 11795, + "time": 11801, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -261,7 +261,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 12019, + "time": 12024, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "192.168.0.10", @@ -272,7 +272,7 @@ "payload": "DHCPOFFER\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nrouter=0.0.0.0\nsubnetmask=255.255.255.0\ndnsserver=0.0.0.0\nserverident=192.168.0.10" }, { - "time": 12019, + "time": 12024, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -283,7 +283,7 @@ "payload": "DHCPDECLINE\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12\nrequested=192.168.0.100\nserverident=192.168.0.10" }, { - "time": 12076, + "time": 12080, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -294,25 +294,25 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 14770, + "time": 14775, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, "senderIp": "0.0.0.0", - "targetIp": "169.254.1.107" + "targetIp": "169.254.1.43" }, { - "time": 17521, + "time": 17526, "source": "02:00:00:00:01:12", "destination": "ff:ff:ff:ff:ff:ff", "arp": 2, - "senderIp": "169.254.1.107", + "senderIp": "169.254.1.43", "targetIp": "255.255.255.255" } ], "00000000-0000-0000-0000-000000000103": [ { - "time": 453, + "time": 457, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -323,7 +323,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 569, + "time": 574, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "192.168.0.10", @@ -334,7 +334,7 @@ "payload": "DHCPOFFER\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nrouter=0.0.0.0\nsubnetmask=255.255.255.0\ndnsserver=0.0.0.0\nserverident=192.168.0.10" }, { - "time": 682, + "time": 686, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -342,7 +342,7 @@ "targetIp": "192.168.0.100" }, { - "time": 683, + "time": 688, "source": "02:00:00:00:01:13", "destination": "ff:ff:ff:ff:ff:ff", "arp": 2, @@ -350,7 +350,7 @@ "targetIp": "255.255.255.255" }, { - "time": 905, + "time": 911, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -361,7 +361,7 @@ "payload": "DHCPDECLINE\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12\nrequested=192.168.0.100\nserverident=192.168.0.10" }, { - "time": 961, + "time": 966, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -372,7 +372,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 3656, + "time": 3661, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -383,7 +383,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 6406, + "time": 6411, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -394,7 +394,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 9157, + "time": 9162, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -405,7 +405,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 11907, + "time": 11912, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -416,7 +416,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 12019, + "time": 12024, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "192.168.0.10", @@ -427,7 +427,7 @@ "payload": "DHCPOFFER\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nrouter=0.0.0.0\nsubnetmask=255.255.255.0\ndnsserver=0.0.0.0\nserverident=192.168.0.10" }, { - "time": 12132, + "time": 12135, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -438,7 +438,7 @@ "payload": "DHCPDECLINE\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12\nrequested=192.168.0.100\nserverident=192.168.0.10" }, { - "time": 12188, + "time": 12191, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -449,23 +449,2535 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 14881, + "time": 14886, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, "senderIp": "0.0.0.0", - "targetIp": "169.254.1.107" + "targetIp": "169.254.1.43" }, { - "time": 17632, + "time": 17637, "source": "02:00:00:00:01:12", "destination": "ff:ff:ff:ff:ff:ff", "arp": 2, - "senderIp": "169.254.1.107", + "senderIp": "169.254.1.43", "targetIp": "255.255.255.255" } ] }, + "rows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "1", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "1", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "1", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "2", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "2", + "192.168.0.10", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "2", + "192.168.0.10:67", + "255.255.255.255:68", + "UDP", + "Transport", + "" + ], + [ + "2", + "192.168.0.10:67", + "255.255.255.255:68", + "DHCP", + "Anwendung", + "DHCPOFFER\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nrouter=0.0.0.0\nsubnetmask=255.255.255.0\ndnsserver=0.0.0.0\nserverident=192.168.0.10" + ], + [ + "3", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "0.0.0.0", + "192.168.0.100", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.100 [op=REQUEST, sender=02:00:00:00:01:12|0.0.0.0, target=FF:FF:FF:FF:FF:FF|192.168.0.100]" + ], + [ + "4", + "02:00:00:00:01:13", + "ff:ff:ff:ff:ff:ff", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "192.168.0.100", + "255.255.255.255", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.100, target=ff:ff:ff:ff:ff:ff|255.255.255.255]" + ], + [ + "5", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "5", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "5", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDECLINE\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12\nrequested=192.168.0.100\nserverident=192.168.0.10" + ], + [ + "6", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "6", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "6", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "7", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "7", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "7", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "8", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "8", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "8", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "9", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "9", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "9", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "10", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "10", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "10", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "11", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "192.168.0.10", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "11", + "192.168.0.10:67", + "255.255.255.255:68", + "UDP", + "Transport", + "" + ], + [ + "11", + "192.168.0.10:67", + "255.255.255.255:68", + "DHCP", + "Anwendung", + "DHCPOFFER\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nrouter=0.0.0.0\nsubnetmask=255.255.255.0\ndnsserver=0.0.0.0\nserverident=192.168.0.10" + ], + [ + "12", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "12", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "12", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDECLINE\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12\nrequested=192.168.0.100\nserverident=192.168.0.10" + ], + [ + "13", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "13", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "13", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "14", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "14", + "0.0.0.0", + "169.254.1.43", + "ARP", + "Vermittlung", + "Suche nach MAC für 169.254.1.43 [op=REQUEST, sender=02:00:00:00:01:12|0.0.0.0, target=FF:FF:FF:FF:FF:FF|169.254.1.43]" + ], + [ + "15", + "02:00:00:00:01:12", + "ff:ff:ff:ff:ff:ff", + "", + "Netzzugang", + "0x806" + ], + [ + "15", + "169.254.1.43", + "255.255.255.255", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|169.254.1.43, target=ff:ff:ff:ff:ff:ff|255.255.255.255]" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "1", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "1", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "1", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "2", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "2", + "192.168.0.10", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "2", + "192.168.0.10:67", + "255.255.255.255:68", + "UDP", + "Transport", + "" + ], + [ + "2", + "192.168.0.10:67", + "255.255.255.255:68", + "DHCP", + "Anwendung", + "DHCPOFFER\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nrouter=0.0.0.0\nsubnetmask=255.255.255.0\ndnsserver=0.0.0.0\nserverident=192.168.0.10" + ], + [ + "3", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "0.0.0.0", + "192.168.0.100", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.100 [op=REQUEST, sender=02:00:00:00:01:12|0.0.0.0, target=FF:FF:FF:FF:FF:FF|192.168.0.100]" + ], + [ + "4", + "02:00:00:00:01:13", + "ff:ff:ff:ff:ff:ff", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "192.168.0.100", + "255.255.255.255", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.100, target=ff:ff:ff:ff:ff:ff|255.255.255.255]" + ], + [ + "5", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "5", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "5", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDECLINE\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12\nrequested=192.168.0.100\nserverident=192.168.0.10" + ], + [ + "6", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "6", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "6", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "7", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "7", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "7", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "8", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "8", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "8", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "9", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "9", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "9", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "10", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "10", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "10", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "11", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "192.168.0.10", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "11", + "192.168.0.10:67", + "255.255.255.255:68", + "UDP", + "Transport", + "" + ], + [ + "11", + "192.168.0.10:67", + "255.255.255.255:68", + "DHCP", + "Anwendung", + "DHCPOFFER\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nrouter=0.0.0.0\nsubnetmask=255.255.255.0\ndnsserver=0.0.0.0\nserverident=192.168.0.10" + ], + [ + "12", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "12", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "12", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDECLINE\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12\nrequested=192.168.0.100\nserverident=192.168.0.10" + ], + [ + "13", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "13", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "13", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "14", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "14", + "0.0.0.0", + "169.254.1.43", + "ARP", + "Vermittlung", + "Suche nach MAC für 169.254.1.43 [op=REQUEST, sender=02:00:00:00:01:12|0.0.0.0, target=FF:FF:FF:FF:FF:FF|169.254.1.43]" + ], + [ + "15", + "02:00:00:00:01:12", + "ff:ff:ff:ff:ff:ff", + "", + "Netzzugang", + "0x806" + ], + [ + "15", + "169.254.1.43", + "255.255.255.255", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|169.254.1.43, target=ff:ff:ff:ff:ff:ff|255.255.255.255]" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "1", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "1", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "1", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "2", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "2", + "192.168.0.10", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "2", + "192.168.0.10:67", + "255.255.255.255:68", + "UDP", + "Transport", + "" + ], + [ + "2", + "192.168.0.10:67", + "255.255.255.255:68", + "DHCP", + "Anwendung", + "DHCPOFFER\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nrouter=0.0.0.0\nsubnetmask=255.255.255.0\ndnsserver=0.0.0.0\nserverident=192.168.0.10" + ], + [ + "3", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "0.0.0.0", + "192.168.0.100", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.100 [op=REQUEST, sender=02:00:00:00:01:12|0.0.0.0, target=FF:FF:FF:FF:FF:FF|192.168.0.100]" + ], + [ + "4", + "02:00:00:00:01:13", + "ff:ff:ff:ff:ff:ff", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "192.168.0.100", + "255.255.255.255", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.100, target=ff:ff:ff:ff:ff:ff|255.255.255.255]" + ], + [ + "5", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "5", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "5", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDECLINE\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12\nrequested=192.168.0.100\nserverident=192.168.0.10" + ], + [ + "6", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "6", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "6", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "7", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "7", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "7", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "8", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "8", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "8", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "9", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "9", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "9", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "10", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "10", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "10", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "11", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "192.168.0.10", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "11", + "192.168.0.10:67", + "255.255.255.255:68", + "UDP", + "Transport", + "" + ], + [ + "11", + "192.168.0.10:67", + "255.255.255.255:68", + "DHCP", + "Anwendung", + "DHCPOFFER\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nrouter=0.0.0.0\nsubnetmask=255.255.255.0\ndnsserver=0.0.0.0\nserverident=192.168.0.10" + ], + [ + "12", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "12", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "12", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDECLINE\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12\nrequested=192.168.0.100\nserverident=192.168.0.10" + ], + [ + "13", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "13", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "13", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "14", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "14", + "0.0.0.0", + "169.254.1.43", + "ARP", + "Vermittlung", + "Suche nach MAC für 169.254.1.43 [op=REQUEST, sender=02:00:00:00:01:12|0.0.0.0, target=FF:FF:FF:FF:FF:FF|169.254.1.43]" + ], + [ + "15", + "02:00:00:00:01:12", + "ff:ff:ff:ff:ff:ff", + "", + "Netzzugang", + "0x806" + ], + [ + "15", + "169.254.1.43", + "255.255.255.255", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|169.254.1.43, target=ff:ff:ff:ff:ff:ff|255.255.255.255]" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "1", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "1", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "1", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "2", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "2", + "192.168.0.10", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "2", + "67", + "68", + "UDP", + "Transport", + "" + ], + [ + "2", + null, + null, + "DHCP", + "Anwendung", + "DHCPOFFER\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nrouter=0.0.0.0\nsubnetmask=255.255.255.0\ndnsserver=0.0.0.0\nserverident=192.168.0.10" + ], + [ + "3", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "0.0.0.0", + "192.168.0.100", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.100 [op=REQUEST, sender=02:00:00:00:01:12|0.0.0.0, target=FF:FF:FF:FF:FF:FF|192.168.0.100]" + ], + [ + "4", + "02:00:00:00:01:13", + "ff:ff:ff:ff:ff:ff", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "192.168.0.100", + "255.255.255.255", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.100, target=ff:ff:ff:ff:ff:ff|255.255.255.255]" + ], + [ + "5", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "5", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "5", + null, + null, + "DHCP", + "Anwendung", + "DHCPDECLINE\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12\nrequested=192.168.0.100\nserverident=192.168.0.10" + ], + [ + "6", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "6", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "6", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "7", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "7", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "7", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "8", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "8", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "8", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "9", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "9", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "9", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "10", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "10", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "10", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "11", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "192.168.0.10", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "11", + "67", + "68", + "UDP", + "Transport", + "" + ], + [ + "11", + null, + null, + "DHCP", + "Anwendung", + "DHCPOFFER\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nrouter=0.0.0.0\nsubnetmask=255.255.255.0\ndnsserver=0.0.0.0\nserverident=192.168.0.10" + ], + [ + "12", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "12", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "12", + null, + null, + "DHCP", + "Anwendung", + "DHCPDECLINE\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12\nrequested=192.168.0.100\nserverident=192.168.0.10" + ], + [ + "13", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "13", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "13", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "14", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "14", + "0.0.0.0", + "169.254.1.43", + "ARP", + "Vermittlung", + "Suche nach MAC für 169.254.1.43 [op=REQUEST, sender=02:00:00:00:01:12|0.0.0.0, target=FF:FF:FF:FF:FF:FF|169.254.1.43]" + ], + [ + "15", + "02:00:00:00:01:12", + "ff:ff:ff:ff:ff:ff", + "", + "Netzzugang", + "0x806" + ], + [ + "15", + "169.254.1.43", + "255.255.255.255", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|169.254.1.43, target=ff:ff:ff:ff:ff:ff|255.255.255.255]" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "1", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "1", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "1", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "2", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "2", + "192.168.0.10", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "2", + "67", + "68", + "UDP", + "Transport", + "" + ], + [ + "2", + null, + null, + "DHCP", + "Anwendung", + "DHCPOFFER\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nrouter=0.0.0.0\nsubnetmask=255.255.255.0\ndnsserver=0.0.0.0\nserverident=192.168.0.10" + ], + [ + "3", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "0.0.0.0", + "192.168.0.100", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.100 [op=REQUEST, sender=02:00:00:00:01:12|0.0.0.0, target=FF:FF:FF:FF:FF:FF|192.168.0.100]" + ], + [ + "4", + "02:00:00:00:01:13", + "ff:ff:ff:ff:ff:ff", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "192.168.0.100", + "255.255.255.255", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.100, target=ff:ff:ff:ff:ff:ff|255.255.255.255]" + ], + [ + "5", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "5", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "5", + null, + null, + "DHCP", + "Anwendung", + "DHCPDECLINE\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12\nrequested=192.168.0.100\nserverident=192.168.0.10" + ], + [ + "6", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "6", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "6", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "7", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "7", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "7", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "8", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "8", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "8", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "9", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "9", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "9", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "10", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "10", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "10", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "11", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "192.168.0.10", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "11", + "67", + "68", + "UDP", + "Transport", + "" + ], + [ + "11", + null, + null, + "DHCP", + "Anwendung", + "DHCPOFFER\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nrouter=0.0.0.0\nsubnetmask=255.255.255.0\ndnsserver=0.0.0.0\nserverident=192.168.0.10" + ], + [ + "12", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "12", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "12", + null, + null, + "DHCP", + "Anwendung", + "DHCPDECLINE\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12\nrequested=192.168.0.100\nserverident=192.168.0.10" + ], + [ + "13", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "13", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "13", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "14", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "14", + "0.0.0.0", + "169.254.1.43", + "ARP", + "Vermittlung", + "Suche nach MAC für 169.254.1.43 [op=REQUEST, sender=02:00:00:00:01:12|0.0.0.0, target=FF:FF:FF:FF:FF:FF|169.254.1.43]" + ], + [ + "15", + "02:00:00:00:01:12", + "ff:ff:ff:ff:ff:ff", + "", + "Netzzugang", + "0x806" + ], + [ + "15", + "169.254.1.43", + "255.255.255.255", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|169.254.1.43, target=ff:ff:ff:ff:ff:ff|255.255.255.255]" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "1", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "1", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "1", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "2", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "2", + "192.168.0.10", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "2", + "67", + "68", + "UDP", + "Transport", + "" + ], + [ + "2", + null, + null, + "DHCP", + "Anwendung", + "DHCPOFFER\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nrouter=0.0.0.0\nsubnetmask=255.255.255.0\ndnsserver=0.0.0.0\nserverident=192.168.0.10" + ], + [ + "3", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "0.0.0.0", + "192.168.0.100", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.100 [op=REQUEST, sender=02:00:00:00:01:12|0.0.0.0, target=FF:FF:FF:FF:FF:FF|192.168.0.100]" + ], + [ + "4", + "02:00:00:00:01:13", + "ff:ff:ff:ff:ff:ff", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "192.168.0.100", + "255.255.255.255", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.100, target=ff:ff:ff:ff:ff:ff|255.255.255.255]" + ], + [ + "5", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "5", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "5", + null, + null, + "DHCP", + "Anwendung", + "DHCPDECLINE\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12\nrequested=192.168.0.100\nserverident=192.168.0.10" + ], + [ + "6", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "6", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "6", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "7", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "7", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "7", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "8", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "8", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "8", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "9", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "9", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "9", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "10", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "10", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "10", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "11", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "192.168.0.10", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "11", + "67", + "68", + "UDP", + "Transport", + "" + ], + [ + "11", + null, + null, + "DHCP", + "Anwendung", + "DHCPOFFER\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nrouter=0.0.0.0\nsubnetmask=255.255.255.0\ndnsserver=0.0.0.0\nserverident=192.168.0.10" + ], + [ + "12", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "12", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "12", + null, + null, + "DHCP", + "Anwendung", + "DHCPDECLINE\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12\nrequested=192.168.0.100\nserverident=192.168.0.10" + ], + [ + "13", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "13", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "13", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "14", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "14", + "0.0.0.0", + "169.254.1.43", + "ARP", + "Vermittlung", + "Suche nach MAC für 169.254.1.43 [op=REQUEST, sender=02:00:00:00:01:12|0.0.0.0, target=FF:FF:FF:FF:FF:FF|169.254.1.43]" + ], + [ + "15", + "02:00:00:00:01:12", + "ff:ff:ff:ff:ff:ff", + "", + "Netzzugang", + "0x806" + ], + [ + "15", + "169.254.1.43", + "255.255.255.255", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|169.254.1.43, target=ff:ff:ff:ff:ff:ff|255.255.255.255]" + ] + ] + }, "devices": { "00000000-0000-0000-0000-000000000101": [ "192.168.0.10", @@ -474,7 +2986,7 @@ "" ], "00000000-0000-0000-0000-000000000102": [ - "169.254.1.107", + "169.254.1.43", "255.255.0.0", "", "" diff --git a/packages/core/test/scenarios/dhcp-no-server.java.json b/packages/core/test/scenarios/dhcp-no-server.java.json index be4ff93..b12e228 100644 --- a/packages/core/test/scenarios/dhcp-no-server.java.json +++ b/packages/core/test/scenarios/dhcp-no-server.java.json @@ -2,7 +2,7 @@ "frames": { "00000000-0000-0000-0000-000000000101": [ { - "time": 457, + "time": 456, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -24,7 +24,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 5943, + "time": 5939, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -35,7 +35,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 8690, + "time": 8689, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -46,7 +46,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 11440, + "time": 11439, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -57,25 +57,25 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 14191, + "time": 14190, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, "senderIp": "0.0.0.0", - "targetIp": "169.254.1.174" + "targetIp": "169.254.1.142" }, { "time": 16941, "source": "02:00:00:00:01:12", "destination": "ff:ff:ff:ff:ff:ff", "arp": 2, - "senderIp": "169.254.1.174", + "senderIp": "169.254.1.142", "targetIp": "255.255.255.255" } ], "00000000-0000-0000-0000-000000000102": [ { - "time": 333, + "time": 332, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -86,7 +86,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 3078, + "time": 3077, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -97,7 +97,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 5828, + "time": 5827, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -119,7 +119,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 11329, + "time": 11328, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -130,25 +130,25 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 14080, + "time": 14079, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, "senderIp": "0.0.0.0", - "targetIp": "169.254.1.174" + "targetIp": "169.254.1.142" }, { - "time": 16830, + "time": 16829, "source": "02:00:00:00:01:12", "destination": "ff:ff:ff:ff:ff:ff", "arp": 2, - "senderIp": "169.254.1.174", + "senderIp": "169.254.1.142", "targetIp": "255.255.255.255" } ], "00000000-0000-0000-0000-000000000103": [ { - "time": 457, + "time": 456, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -170,7 +170,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 5943, + "time": 5939, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -181,7 +181,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 8690, + "time": 8689, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -192,7 +192,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 11440, + "time": 11439, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -203,23 +203,1191 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 14191, + "time": 14190, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, "senderIp": "0.0.0.0", - "targetIp": "169.254.1.174" + "targetIp": "169.254.1.142" }, { "time": 16941, "source": "02:00:00:00:01:12", "destination": "ff:ff:ff:ff:ff:ff", "arp": 2, - "senderIp": "169.254.1.174", + "senderIp": "169.254.1.142", "targetIp": "255.255.255.255" } ] }, + "rows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "1", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "1", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "1", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "2", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "2", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "2", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "2", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "3", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "3", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "3", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "4", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "4", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "4", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "5", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "5", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "5", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "6", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "6", + "0.0.0.0", + "169.254.1.142", + "ARP", + "Vermittlung", + "Suche nach MAC für 169.254.1.142 [op=REQUEST, sender=02:00:00:00:01:12|0.0.0.0, target=FF:FF:FF:FF:FF:FF|169.254.1.142]" + ], + [ + "7", + "02:00:00:00:01:12", + "ff:ff:ff:ff:ff:ff", + "", + "Netzzugang", + "0x806" + ], + [ + "7", + "169.254.1.142", + "255.255.255.255", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|169.254.1.142, target=ff:ff:ff:ff:ff:ff|255.255.255.255]" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "1", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "1", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "1", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "2", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "2", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "2", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "2", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "3", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "3", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "3", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "4", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "4", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "4", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "5", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "5", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "5", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "6", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "6", + "0.0.0.0", + "169.254.1.142", + "ARP", + "Vermittlung", + "Suche nach MAC für 169.254.1.142 [op=REQUEST, sender=02:00:00:00:01:12|0.0.0.0, target=FF:FF:FF:FF:FF:FF|169.254.1.142]" + ], + [ + "7", + "02:00:00:00:01:12", + "ff:ff:ff:ff:ff:ff", + "", + "Netzzugang", + "0x806" + ], + [ + "7", + "169.254.1.142", + "255.255.255.255", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|169.254.1.142, target=ff:ff:ff:ff:ff:ff|255.255.255.255]" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "1", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "1", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "1", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "2", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "2", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "2", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "2", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "3", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "3", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "3", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "4", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "4", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "4", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "5", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "5", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "5", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "6", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "6", + "0.0.0.0", + "169.254.1.142", + "ARP", + "Vermittlung", + "Suche nach MAC für 169.254.1.142 [op=REQUEST, sender=02:00:00:00:01:12|0.0.0.0, target=FF:FF:FF:FF:FF:FF|169.254.1.142]" + ], + [ + "7", + "02:00:00:00:01:12", + "ff:ff:ff:ff:ff:ff", + "", + "Netzzugang", + "0x806" + ], + [ + "7", + "169.254.1.142", + "255.255.255.255", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|169.254.1.142, target=ff:ff:ff:ff:ff:ff|255.255.255.255]" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "1", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "1", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "1", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "2", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "2", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "2", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "2", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "3", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "3", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "4", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "4", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "5", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "5", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "5", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "6", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "6", + "0.0.0.0", + "169.254.1.142", + "ARP", + "Vermittlung", + "Suche nach MAC für 169.254.1.142 [op=REQUEST, sender=02:00:00:00:01:12|0.0.0.0, target=FF:FF:FF:FF:FF:FF|169.254.1.142]" + ], + [ + "7", + "02:00:00:00:01:12", + "ff:ff:ff:ff:ff:ff", + "", + "Netzzugang", + "0x806" + ], + [ + "7", + "169.254.1.142", + "255.255.255.255", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|169.254.1.142, target=ff:ff:ff:ff:ff:ff|255.255.255.255]" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "1", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "1", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "1", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "2", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "2", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "2", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "2", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "3", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "3", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "4", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "4", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "5", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "5", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "5", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "6", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "6", + "0.0.0.0", + "169.254.1.142", + "ARP", + "Vermittlung", + "Suche nach MAC für 169.254.1.142 [op=REQUEST, sender=02:00:00:00:01:12|0.0.0.0, target=FF:FF:FF:FF:FF:FF|169.254.1.142]" + ], + [ + "7", + "02:00:00:00:01:12", + "ff:ff:ff:ff:ff:ff", + "", + "Netzzugang", + "0x806" + ], + [ + "7", + "169.254.1.142", + "255.255.255.255", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|169.254.1.142, target=ff:ff:ff:ff:ff:ff|255.255.255.255]" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "1", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "1", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "1", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "2", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "2", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "2", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "2", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "3", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "3", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "4", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "4", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "5", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "5", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "5", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "6", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "6", + "0.0.0.0", + "169.254.1.142", + "ARP", + "Vermittlung", + "Suche nach MAC für 169.254.1.142 [op=REQUEST, sender=02:00:00:00:01:12|0.0.0.0, target=FF:FF:FF:FF:FF:FF|169.254.1.142]" + ], + [ + "7", + "02:00:00:00:01:12", + "ff:ff:ff:ff:ff:ff", + "", + "Netzzugang", + "0x806" + ], + [ + "7", + "169.254.1.142", + "255.255.255.255", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|169.254.1.142, target=ff:ff:ff:ff:ff:ff|255.255.255.255]" + ] + ] + }, "devices": { "00000000-0000-0000-0000-000000000101": [ "192.168.0.10", @@ -228,7 +1396,7 @@ "" ], "00000000-0000-0000-0000-000000000102": [ - "169.254.1.174", + "169.254.1.142", "255.255.0.0", "", "" diff --git a/packages/core/test/scenarios/dhcp-two-servers.java.json b/packages/core/test/scenarios/dhcp-two-servers.java.json index 5d1f07c..08112eb 100644 --- a/packages/core/test/scenarios/dhcp-two-servers.java.json +++ b/packages/core/test/scenarios/dhcp-two-servers.java.json @@ -2,7 +2,7 @@ "frames": { "00000000-0000-0000-0000-000000000101": [ { - "time": 454, + "time": 457, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -13,7 +13,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 460, + "time": 462, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "192.168.0.10", @@ -24,7 +24,7 @@ "payload": "DHCPOFFER\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nrouter=192.168.0.254\nsubnetmask=255.255.255.0\ndnsserver=0.0.0.0\nserverident=192.168.0.10" }, { - "time": 572, + "time": 574, "source": "02:00:00:00:01:13", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "192.168.0.30", @@ -35,7 +35,7 @@ "payload": "DHCPOFFER\nyiaddr=192.168.0.200\nchaddr=02:00:00:00:01:12\nrouter=192.168.0.1\nsubnetmask=255.255.255.0\ndnsserver=8.8.8.8\nserverident=192.168.0.30" }, { - "time": 684, + "time": 686, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -43,7 +43,7 @@ "targetIp": "192.168.0.100" }, { - "time": 3435, + "time": 3437, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -54,7 +54,7 @@ "payload": "DHCPREQUEST\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12\nrequested=192.168.0.100\nserverident=192.168.0.10" }, { - "time": 3435, + "time": 3437, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "192.168.0.10", @@ -78,7 +78,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 572, + "time": 574, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "192.168.0.10", @@ -89,7 +89,7 @@ "payload": "DHCPOFFER\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nrouter=192.168.0.254\nsubnetmask=255.255.255.0\ndnsserver=0.0.0.0\nserverident=192.168.0.10" }, { - "time": 572, + "time": 574, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -97,7 +97,7 @@ "targetIp": "192.168.0.100" }, { - "time": 628, + "time": 630, "source": "02:00:00:00:01:13", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "192.168.0.30", @@ -108,7 +108,7 @@ "payload": "DHCPOFFER\nyiaddr=192.168.0.200\nchaddr=02:00:00:00:01:12\nrouter=192.168.0.1\nsubnetmask=255.255.255.0\ndnsserver=8.8.8.8\nserverident=192.168.0.30" }, { - "time": 3323, + "time": 3325, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -119,7 +119,7 @@ "payload": "DHCPREQUEST\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12\nrequested=192.168.0.100\nserverident=192.168.0.10" }, { - "time": 3546, + "time": 3548, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "192.168.0.10", @@ -132,7 +132,7 @@ ], "00000000-0000-0000-0000-000000000103": [ { - "time": 454, + "time": 457, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -143,7 +143,7 @@ "payload": "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" }, { - "time": 460, + "time": 462, "source": "02:00:00:00:01:13", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "192.168.0.30", @@ -154,7 +154,7 @@ "payload": "DHCPOFFER\nyiaddr=192.168.0.200\nchaddr=02:00:00:00:01:12\nrouter=192.168.0.1\nsubnetmask=255.255.255.0\ndnsserver=8.8.8.8\nserverident=192.168.0.30" }, { - "time": 572, + "time": 574, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "192.168.0.10", @@ -165,7 +165,7 @@ "payload": "DHCPOFFER\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nrouter=192.168.0.254\nsubnetmask=255.255.255.0\ndnsserver=0.0.0.0\nserverident=192.168.0.10" }, { - "time": 684, + "time": 686, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -173,7 +173,7 @@ "targetIp": "192.168.0.100" }, { - "time": 3435, + "time": 3437, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "0.0.0.0", @@ -184,7 +184,7 @@ "payload": "DHCPREQUEST\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12\nrequested=192.168.0.100\nserverident=192.168.0.10" }, { - "time": 3546, + "time": 3548, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "sourceIp": "192.168.0.10", @@ -196,6 +196,1078 @@ } ] }, + "rows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "1", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "1", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "1", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "2", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "2", + "192.168.0.10", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "2", + "192.168.0.10:67", + "255.255.255.255:68", + "UDP", + "Transport", + "" + ], + [ + "2", + "192.168.0.10:67", + "255.255.255.255:68", + "DHCP", + "Anwendung", + "DHCPOFFER\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nrouter=192.168.0.254\nsubnetmask=255.255.255.0\ndnsserver=0.0.0.0\nserverident=192.168.0.10" + ], + [ + "3", + "02:00:00:00:01:13", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.30", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "3", + "192.168.0.30:67", + "255.255.255.255:68", + "UDP", + "Transport", + "" + ], + [ + "3", + "192.168.0.30:67", + "255.255.255.255:68", + "DHCP", + "Anwendung", + "DHCPOFFER\nyiaddr=192.168.0.200\nchaddr=02:00:00:00:01:12\nrouter=192.168.0.1\nsubnetmask=255.255.255.0\ndnsserver=8.8.8.8\nserverident=192.168.0.30" + ], + [ + "4", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "0.0.0.0", + "192.168.0.100", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.100 [op=REQUEST, sender=02:00:00:00:01:12|0.0.0.0, target=FF:FF:FF:FF:FF:FF|192.168.0.100]" + ], + [ + "5", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "5", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "5", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPREQUEST\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12\nrequested=192.168.0.100\nserverident=192.168.0.10" + ], + [ + "6", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.10", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "6", + "192.168.0.10:67", + "255.255.255.255:68", + "UDP", + "Transport", + "" + ], + [ + "6", + "192.168.0.10:67", + "255.255.255.255:68", + "DHCP", + "Anwendung", + "DHCPACK\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nserverident=192.168.0.10" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "1", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "1", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "1", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "2", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "2", + "192.168.0.10", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "2", + "192.168.0.10:67", + "255.255.255.255:68", + "UDP", + "Transport", + "" + ], + [ + "2", + "192.168.0.10:67", + "255.255.255.255:68", + "DHCP", + "Anwendung", + "DHCPOFFER\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nrouter=192.168.0.254\nsubnetmask=255.255.255.0\ndnsserver=0.0.0.0\nserverident=192.168.0.10" + ], + [ + "3", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "0.0.0.0", + "192.168.0.100", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.100 [op=REQUEST, sender=02:00:00:00:01:12|0.0.0.0, target=FF:FF:FF:FF:FF:FF|192.168.0.100]" + ], + [ + "4", + "02:00:00:00:01:13", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.30", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "4", + "192.168.0.30:67", + "255.255.255.255:68", + "UDP", + "Transport", + "" + ], + [ + "4", + "192.168.0.30:67", + "255.255.255.255:68", + "DHCP", + "Anwendung", + "DHCPOFFER\nyiaddr=192.168.0.200\nchaddr=02:00:00:00:01:12\nrouter=192.168.0.1\nsubnetmask=255.255.255.0\ndnsserver=8.8.8.8\nserverident=192.168.0.30" + ], + [ + "5", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "5", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "5", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPREQUEST\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12\nrequested=192.168.0.100\nserverident=192.168.0.10" + ], + [ + "6", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.10", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "6", + "192.168.0.10:67", + "255.255.255.255:68", + "UDP", + "Transport", + "" + ], + [ + "6", + "192.168.0.10:67", + "255.255.255.255:68", + "DHCP", + "Anwendung", + "DHCPACK\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nserverident=192.168.0.10" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "1", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "1", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "1", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "2", + "02:00:00:00:01:13", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "2", + "192.168.0.30", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "2", + "192.168.0.30:67", + "255.255.255.255:68", + "UDP", + "Transport", + "" + ], + [ + "2", + "192.168.0.30:67", + "255.255.255.255:68", + "DHCP", + "Anwendung", + "DHCPOFFER\nyiaddr=192.168.0.200\nchaddr=02:00:00:00:01:12\nrouter=192.168.0.1\nsubnetmask=255.255.255.0\ndnsserver=8.8.8.8\nserverident=192.168.0.30" + ], + [ + "3", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.10", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "3", + "192.168.0.10:67", + "255.255.255.255:68", + "UDP", + "Transport", + "" + ], + [ + "3", + "192.168.0.10:67", + "255.255.255.255:68", + "DHCP", + "Anwendung", + "DHCPOFFER\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nrouter=192.168.0.254\nsubnetmask=255.255.255.0\ndnsserver=0.0.0.0\nserverident=192.168.0.10" + ], + [ + "4", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "0.0.0.0", + "192.168.0.100", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.100 [op=REQUEST, sender=02:00:00:00:01:12|0.0.0.0, target=FF:FF:FF:FF:FF:FF|192.168.0.100]" + ], + [ + "5", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "5", + "0.0.0.0:68", + "255.255.255.255:67", + "UDP", + "Transport", + "" + ], + [ + "5", + "0.0.0.0:68", + "255.255.255.255:67", + "DHCP", + "Anwendung", + "DHCPREQUEST\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12\nrequested=192.168.0.100\nserverident=192.168.0.10" + ], + [ + "6", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.10", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "6", + "192.168.0.10:67", + "255.255.255.255:68", + "UDP", + "Transport", + "" + ], + [ + "6", + "192.168.0.10:67", + "255.255.255.255:68", + "DHCP", + "Anwendung", + "DHCPACK\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nserverident=192.168.0.10" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "1", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "1", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "1", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "2", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "2", + "192.168.0.10", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "2", + "67", + "68", + "UDP", + "Transport", + "" + ], + [ + "2", + null, + null, + "DHCP", + "Anwendung", + "DHCPOFFER\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nrouter=192.168.0.254\nsubnetmask=255.255.255.0\ndnsserver=0.0.0.0\nserverident=192.168.0.10" + ], + [ + "3", + "02:00:00:00:01:13", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.30", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "3", + "67", + "68", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "DHCP", + "Anwendung", + "DHCPOFFER\nyiaddr=192.168.0.200\nchaddr=02:00:00:00:01:12\nrouter=192.168.0.1\nsubnetmask=255.255.255.0\ndnsserver=8.8.8.8\nserverident=192.168.0.30" + ], + [ + "4", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "0.0.0.0", + "192.168.0.100", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.100 [op=REQUEST, sender=02:00:00:00:01:12|0.0.0.0, target=FF:FF:FF:FF:FF:FF|192.168.0.100]" + ], + [ + "5", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "5", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "5", + null, + null, + "DHCP", + "Anwendung", + "DHCPREQUEST\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12\nrequested=192.168.0.100\nserverident=192.168.0.10" + ], + [ + "6", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.10", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "6", + "67", + "68", + "UDP", + "Transport", + "" + ], + [ + "6", + null, + null, + "DHCP", + "Anwendung", + "DHCPACK\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nserverident=192.168.0.10" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "1", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "1", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "1", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "2", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "2", + "192.168.0.10", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "2", + "67", + "68", + "UDP", + "Transport", + "" + ], + [ + "2", + null, + null, + "DHCP", + "Anwendung", + "DHCPOFFER\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nrouter=192.168.0.254\nsubnetmask=255.255.255.0\ndnsserver=0.0.0.0\nserverident=192.168.0.10" + ], + [ + "3", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "0.0.0.0", + "192.168.0.100", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.100 [op=REQUEST, sender=02:00:00:00:01:12|0.0.0.0, target=FF:FF:FF:FF:FF:FF|192.168.0.100]" + ], + [ + "4", + "02:00:00:00:01:13", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.30", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "4", + "67", + "68", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "DHCP", + "Anwendung", + "DHCPOFFER\nyiaddr=192.168.0.200\nchaddr=02:00:00:00:01:12\nrouter=192.168.0.1\nsubnetmask=255.255.255.0\ndnsserver=8.8.8.8\nserverident=192.168.0.30" + ], + [ + "5", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "5", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "5", + null, + null, + "DHCP", + "Anwendung", + "DHCPREQUEST\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12\nrequested=192.168.0.100\nserverident=192.168.0.10" + ], + [ + "6", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.10", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "6", + "67", + "68", + "UDP", + "Transport", + "" + ], + [ + "6", + null, + null, + "DHCP", + "Anwendung", + "DHCPACK\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nserverident=192.168.0.10" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "1", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "1", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "1", + null, + null, + "DHCP", + "Anwendung", + "DHCPDISCOVER\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12" + ], + [ + "2", + "02:00:00:00:01:13", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "2", + "192.168.0.30", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "2", + "67", + "68", + "UDP", + "Transport", + "" + ], + [ + "2", + null, + null, + "DHCP", + "Anwendung", + "DHCPOFFER\nyiaddr=192.168.0.200\nchaddr=02:00:00:00:01:12\nrouter=192.168.0.1\nsubnetmask=255.255.255.0\ndnsserver=8.8.8.8\nserverident=192.168.0.30" + ], + [ + "3", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.10", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "3", + "67", + "68", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "DHCP", + "Anwendung", + "DHCPOFFER\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nrouter=192.168.0.254\nsubnetmask=255.255.255.0\ndnsserver=0.0.0.0\nserverident=192.168.0.10" + ], + [ + "4", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "0.0.0.0", + "192.168.0.100", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.100 [op=REQUEST, sender=02:00:00:00:01:12|0.0.0.0, target=FF:FF:FF:FF:FF:FF|192.168.0.100]" + ], + [ + "5", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "0.0.0.0", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "5", + "68", + "67", + "UDP", + "Transport", + "" + ], + [ + "5", + null, + null, + "DHCP", + "Anwendung", + "DHCPREQUEST\nyiaddr=0.0.0.0\nchaddr=02:00:00:00:01:12\nrequested=192.168.0.100\nserverident=192.168.0.10" + ], + [ + "6", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.10", + "255.255.255.255", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 1" + ], + [ + "6", + "67", + "68", + "UDP", + "Transport", + "" + ], + [ + "6", + null, + null, + "DHCP", + "Anwendung", + "DHCPACK\nyiaddr=192.168.0.100\nchaddr=02:00:00:00:01:12\nserverident=192.168.0.10" + ] + ] + }, "devices": { "00000000-0000-0000-0000-000000000101": [ "192.168.0.10", diff --git a/packages/core/test/scenarios/dns-java-address.java.json b/packages/core/test/scenarios/dns-java-address.java.json index ad23a2b..7715c05 100644 --- a/packages/core/test/scenarios/dns-java-address.java.json +++ b/packages/core/test/scenarios/dns-java-address.java.json @@ -2,7 +2,7 @@ "frames": { "00000000-0000-0000-0000-000000000101": [ { - "time": 723, + "time": 726, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -10,7 +10,7 @@ "targetIp": "192.168.0.10" }, { - "time": 956, + "time": 960, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "arp": 2, @@ -18,31 +18,31 @@ "targetIp": "192.168.0.20" }, { - "time": 959, + "time": 962, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 17, - "sourcePort": 57362, + "sourcePort": 57366, "destinationPort": 53, - "payload": "ID=38187 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A IN\n" + "payload": "ID=5913 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A IN\n" }, { - "time": 1188, + "time": 1191, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 17, "sourcePort": 53, - "destinationPort": 57362, - "payload": "ID=38187 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A 3600 192.168.0.30\n" + "destinationPort": 57366, + "payload": "ID=5913 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A 3600 192.168.0.30\n" } ], "00000000-0000-0000-0000-000000000102": [ { - "time": 844, + "time": 848, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -50,7 +50,7 @@ "targetIp": "192.168.0.10" }, { - "time": 845, + "time": 849, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "arp": 2, @@ -58,31 +58,31 @@ "targetIp": "192.168.0.20" }, { - "time": 1072, + "time": 1075, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 17, - "sourcePort": 57362, + "sourcePort": 57366, "destinationPort": 53, - "payload": "ID=38187 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A IN\n" + "payload": "ID=5913 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A IN\n" }, { - "time": 1077, + "time": 1079, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 17, "sourcePort": 53, - "destinationPort": 57362, - "payload": "ID=38187 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A 3600 192.168.0.30\n" + "destinationPort": 57366, + "payload": "ID=5913 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A 3600 192.168.0.30\n" } ], "00000000-0000-0000-0000-000000000103": [ { - "time": 844, + "time": 848, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -92,7 +92,7 @@ ], "00000000-0000-0000-0000-000000000104": [ { - "time": 844, + "time": 848, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -101,13 +101,481 @@ } ] }, + "rows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "192.168.0.20:57366", + "192.168.0.10:53", + "UDP", + "Transport", + "" + ], + [ + "3", + "192.168.0.20:57366", + "192.168.0.10:53", + "DNS", + "Anwendung", + "ID=5913 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "192.168.0.10:53", + "192.168.0.20:57366", + "UDP", + "Transport", + "" + ], + [ + "4", + "192.168.0.10:53", + "192.168.0.20:57366", + "DNS", + "Anwendung", + "ID=5913 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A 3600 192.168.0.30\n" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "192.168.0.20:57366", + "192.168.0.10:53", + "UDP", + "Transport", + "" + ], + [ + "3", + "192.168.0.20:57366", + "192.168.0.10:53", + "DNS", + "Anwendung", + "ID=5913 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "192.168.0.10:53", + "192.168.0.20:57366", + "UDP", + "Transport", + "" + ], + [ + "4", + "192.168.0.10:53", + "192.168.0.20:57366", + "DNS", + "Anwendung", + "ID=5913 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A 3600 192.168.0.30\n" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ] + ], + "00000000-0000-0000-0000-000000000104": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "57366", + "53", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "DNS", + "Anwendung", + "ID=5913 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "53", + "57366", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "DNS", + "Anwendung", + "ID=5913 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A 3600 192.168.0.30\n" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "57366", + "53", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "DNS", + "Anwendung", + "ID=5913 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "53", + "57366", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "DNS", + "Anwendung", + "ID=5913 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A 3600 192.168.0.30\n" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ] + ], + "00000000-0000-0000-0000-000000000104": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ] + ] + }, "events": [ [ - 712, + 716, "holeIPAdresse web.filius.de called" ], [ - 1189, + 1191, "holeIPAdresse web.filius.de returned 192.168.0.30" ] ] diff --git a/packages/core/test/scenarios/dns-java-mail.java.json b/packages/core/test/scenarios/dns-java-mail.java.json index 59a8807..bf13b11 100644 --- a/packages/core/test/scenarios/dns-java-mail.java.json +++ b/packages/core/test/scenarios/dns-java-mail.java.json @@ -2,7 +2,7 @@ "frames": { "00000000-0000-0000-0000-000000000101": [ { - "time": 725, + "time": 726, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -10,7 +10,7 @@ "targetIp": "192.168.0.10" }, { - "time": 958, + "time": 961, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "arp": 2, @@ -18,31 +18,31 @@ "targetIp": "192.168.0.20" }, { - "time": 961, + "time": 964, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 17, - "sourcePort": 55842, + "sourcePort": 62914, "destinationPort": 53, - "payload": "ID=4405 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nfilius.de. MX IN\n" + "payload": "ID=4538 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nfilius.de. MX IN\n" }, { - "time": 1191, + "time": 1193, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 17, "sourcePort": 53, - "destinationPort": 55842, - "payload": "ID=4405 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=2 NSCOUNT=0 ARCOUNT=0 \nfilius.de. MX 3600 mail.filius.de.\nmail.filius.de. A 3600 192.168.0.31\n" + "destinationPort": 62914, + "payload": "ID=4538 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=2 NSCOUNT=0 ARCOUNT=0 \nfilius.de. MX 3600 mail.filius.de.\nmail.filius.de. A 3600 192.168.0.31\n" } ], "00000000-0000-0000-0000-000000000102": [ { - "time": 846, + "time": 849, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -50,7 +50,7 @@ "targetIp": "192.168.0.10" }, { - "time": 847, + "time": 850, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "arp": 2, @@ -58,31 +58,31 @@ "targetIp": "192.168.0.20" }, { - "time": 1074, + "time": 1077, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 17, - "sourcePort": 55842, + "sourcePort": 62914, "destinationPort": 53, - "payload": "ID=4405 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nfilius.de. MX IN\n" + "payload": "ID=4538 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nfilius.de. MX IN\n" }, { - "time": 1079, + "time": 1082, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 17, "sourcePort": 53, - "destinationPort": 55842, - "payload": "ID=4405 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=2 NSCOUNT=0 ARCOUNT=0 \nfilius.de. MX 3600 mail.filius.de.\nmail.filius.de. A 3600 192.168.0.31\n" + "destinationPort": 62914, + "payload": "ID=4538 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=2 NSCOUNT=0 ARCOUNT=0 \nfilius.de. MX 3600 mail.filius.de.\nmail.filius.de. A 3600 192.168.0.31\n" } ], "00000000-0000-0000-0000-000000000103": [ { - "time": 845, + "time": 849, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -92,7 +92,7 @@ ], "00000000-0000-0000-0000-000000000104": [ { - "time": 845, + "time": 849, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -101,13 +101,481 @@ } ] }, + "rows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "192.168.0.20:62914", + "192.168.0.10:53", + "UDP", + "Transport", + "" + ], + [ + "3", + "192.168.0.20:62914", + "192.168.0.10:53", + "DNS", + "Anwendung", + "ID=4538 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nfilius.de. MX IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "192.168.0.10:53", + "192.168.0.20:62914", + "UDP", + "Transport", + "" + ], + [ + "4", + "192.168.0.10:53", + "192.168.0.20:62914", + "DNS", + "Anwendung", + "ID=4538 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=2 NSCOUNT=0 ARCOUNT=0 \nfilius.de. MX 3600 mail.filius.de.\nmail.filius.de. A 3600 192.168.0.31\n" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "192.168.0.20:62914", + "192.168.0.10:53", + "UDP", + "Transport", + "" + ], + [ + "3", + "192.168.0.20:62914", + "192.168.0.10:53", + "DNS", + "Anwendung", + "ID=4538 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nfilius.de. MX IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "192.168.0.10:53", + "192.168.0.20:62914", + "UDP", + "Transport", + "" + ], + [ + "4", + "192.168.0.10:53", + "192.168.0.20:62914", + "DNS", + "Anwendung", + "ID=4538 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=2 NSCOUNT=0 ARCOUNT=0 \nfilius.de. MX 3600 mail.filius.de.\nmail.filius.de. A 3600 192.168.0.31\n" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ] + ], + "00000000-0000-0000-0000-000000000104": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "62914", + "53", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "DNS", + "Anwendung", + "ID=4538 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nfilius.de. MX IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "53", + "62914", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "DNS", + "Anwendung", + "ID=4538 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=2 NSCOUNT=0 ARCOUNT=0 \nfilius.de. MX 3600 mail.filius.de.\nmail.filius.de. A 3600 192.168.0.31\n" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "62914", + "53", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "DNS", + "Anwendung", + "ID=4538 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nfilius.de. MX IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "53", + "62914", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "DNS", + "Anwendung", + "ID=4538 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=2 NSCOUNT=0 ARCOUNT=0 \nfilius.de. MX 3600 mail.filius.de.\nmail.filius.de. A 3600 192.168.0.31\n" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ] + ], + "00000000-0000-0000-0000-000000000104": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ] + ] + }, "events": [ [ - 714, + 715, "holeIPAdresseMailServer filius.de called" ], [ - 1191, + 1194, "holeIPAdresseMailServer filius.de returned 192.168.0.31" ] ] diff --git a/packages/core/test/scenarios/dns-java-noServer.java.json b/packages/core/test/scenarios/dns-java-noServer.java.json index cda42e2..e560ca2 100644 --- a/packages/core/test/scenarios/dns-java-noServer.java.json +++ b/packages/core/test/scenarios/dns-java-noServer.java.json @@ -2,7 +2,7 @@ "frames": { "00000000-0000-0000-0000-000000000101": [ { - "time": 844, + "time": 852, "source": "02:00:00:00:01:14", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -10,7 +10,7 @@ "targetIp": "192.168.0.99" }, { - "time": 3585, + "time": 3592, "source": "02:00:00:00:01:14", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -20,7 +20,7 @@ ], "00000000-0000-0000-0000-000000000102": [ { - "time": 844, + "time": 852, "source": "02:00:00:00:01:14", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -28,7 +28,7 @@ "targetIp": "192.168.0.99" }, { - "time": 3585, + "time": 3592, "source": "02:00:00:00:01:14", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -38,7 +38,7 @@ ], "00000000-0000-0000-0000-000000000103": [ { - "time": 844, + "time": 852, "source": "02:00:00:00:01:14", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -46,7 +46,7 @@ "targetIp": "192.168.0.99" }, { - "time": 3585, + "time": 3592, "source": "02:00:00:00:01:14", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -56,7 +56,7 @@ ], "00000000-0000-0000-0000-000000000104": [ { - "time": 723, + "time": 730, "source": "02:00:00:00:01:14", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -64,7 +64,7 @@ "targetIp": "192.168.0.99" }, { - "time": 3473, + "time": 3480, "source": "02:00:00:00:01:14", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -73,13 +73,289 @@ } ] }, + "rows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:14", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.21", + "192.168.0.99", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.99 [op=REQUEST, sender=02:00:00:00:01:14|192.168.0.21, target=FF:FF:FF:FF:FF:FF|192.168.0.99]" + ], + [ + "2", + "02:00:00:00:01:14", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.21", + "192.168.0.99", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.99 [op=REQUEST, sender=02:00:00:00:01:14|192.168.0.21, target=FF:FF:FF:FF:FF:FF|192.168.0.99]" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:14", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.21", + "192.168.0.99", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.99 [op=REQUEST, sender=02:00:00:00:01:14|192.168.0.21, target=FF:FF:FF:FF:FF:FF|192.168.0.99]" + ], + [ + "2", + "02:00:00:00:01:14", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.21", + "192.168.0.99", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.99 [op=REQUEST, sender=02:00:00:00:01:14|192.168.0.21, target=FF:FF:FF:FF:FF:FF|192.168.0.99]" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:14", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.21", + "192.168.0.99", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.99 [op=REQUEST, sender=02:00:00:00:01:14|192.168.0.21, target=FF:FF:FF:FF:FF:FF|192.168.0.99]" + ], + [ + "2", + "02:00:00:00:01:14", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.21", + "192.168.0.99", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.99 [op=REQUEST, sender=02:00:00:00:01:14|192.168.0.21, target=FF:FF:FF:FF:FF:FF|192.168.0.99]" + ] + ], + "00000000-0000-0000-0000-000000000104": [ + [ + "1", + "02:00:00:00:01:14", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.21", + "192.168.0.99", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.99 [op=REQUEST, sender=02:00:00:00:01:14|192.168.0.21, target=FF:FF:FF:FF:FF:FF|192.168.0.99]" + ], + [ + "2", + "02:00:00:00:01:14", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.21", + "192.168.0.99", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.99 [op=REQUEST, sender=02:00:00:00:01:14|192.168.0.21, target=FF:FF:FF:FF:FF:FF|192.168.0.99]" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:14", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.21", + "192.168.0.99", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.99 [op=REQUEST, sender=02:00:00:00:01:14|192.168.0.21, target=FF:FF:FF:FF:FF:FF|192.168.0.99]" + ], + [ + "2", + "02:00:00:00:01:14", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.21", + "192.168.0.99", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.99 [op=REQUEST, sender=02:00:00:00:01:14|192.168.0.21, target=FF:FF:FF:FF:FF:FF|192.168.0.99]" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:14", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.21", + "192.168.0.99", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.99 [op=REQUEST, sender=02:00:00:00:01:14|192.168.0.21, target=FF:FF:FF:FF:FF:FF|192.168.0.99]" + ], + [ + "2", + "02:00:00:00:01:14", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.21", + "192.168.0.99", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.99 [op=REQUEST, sender=02:00:00:00:01:14|192.168.0.21, target=FF:FF:FF:FF:FF:FF|192.168.0.99]" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:14", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.21", + "192.168.0.99", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.99 [op=REQUEST, sender=02:00:00:00:01:14|192.168.0.21, target=FF:FF:FF:FF:FF:FF|192.168.0.99]" + ], + [ + "2", + "02:00:00:00:01:14", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.21", + "192.168.0.99", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.99 [op=REQUEST, sender=02:00:00:00:01:14|192.168.0.21, target=FF:FF:FF:FF:FF:FF|192.168.0.99]" + ] + ], + "00000000-0000-0000-0000-000000000104": [ + [ + "1", + "02:00:00:00:01:14", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.21", + "192.168.0.99", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.99 [op=REQUEST, sender=02:00:00:00:01:14|192.168.0.21, target=FF:FF:FF:FF:FF:FF|192.168.0.99]" + ], + [ + "2", + "02:00:00:00:01:14", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.21", + "192.168.0.99", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.99 [op=REQUEST, sender=02:00:00:00:01:14|192.168.0.21, target=FF:FF:FF:FF:FF:FF|192.168.0.99]" + ] + ] + }, "events": [ [ - 713, + 718, "holeIPAdresse web.filius.de called" ], [ - 14470, + 14477, "holeIPAdresse web.filius.de failed TimeOutException" ] ] diff --git a/packages/core/test/scenarios/dns-java-referral.java.json b/packages/core/test/scenarios/dns-java-referral.java.json index 204500d..eda724c 100644 --- a/packages/core/test/scenarios/dns-java-referral.java.json +++ b/packages/core/test/scenarios/dns-java-referral.java.json @@ -2,7 +2,7 @@ "frames": { "00000000-0000-0000-0000-000000000101": [ { - "time": 725, + "time": 724, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -10,7 +10,7 @@ "targetIp": "192.168.0.10" }, { - "time": 959, + "time": 957, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "arp": 2, @@ -18,29 +18,29 @@ "targetIp": "192.168.0.20" }, { - "time": 962, + "time": 959, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 17, - "sourcePort": 49846, + "sourcePort": 63577, "destinationPort": 53, - "payload": "ID=27710 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" + "payload": "ID=25033 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" }, { - "time": 1191, + "time": 1188, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 17, "sourcePort": 53, - "destinationPort": 49846, - "payload": "ID=27710 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=2 NSCOUNT=0 ARCOUNT=0 \nschule.de. NS 3600 ns.schule.de.\nns.schule.de. A 3600 192.168.0.11\n" + "destinationPort": 63577, + "payload": "ID=25033 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=2 NSCOUNT=0 ARCOUNT=0 \nschule.de. NS 3600 ns.schule.de.\nns.schule.de. A 3600 192.168.0.11\n" }, { - "time": 1192, + "time": 1189, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -48,7 +48,7 @@ "targetIp": "192.168.0.11" }, { - "time": 1414, + "time": 1411, "source": "02:00:00:00:01:13", "destination": "02:00:00:00:01:11", "arp": 2, @@ -56,31 +56,31 @@ "targetIp": "192.168.0.20" }, { - "time": 1415, + "time": 1411, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:13", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.11", "protocol": 17, - "sourcePort": 61850, + "sourcePort": 60331, "destinationPort": 53, - "payload": "ID=14830 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" + "payload": "ID=21497 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" }, { - "time": 1638, + "time": 1635, "source": "02:00:00:00:01:13", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.11", "destinationIp": "192.168.0.20", "protocol": 17, "sourcePort": 53, - "destinationPort": 61850, - "payload": "ID=14830 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A 3600 192.168.0.40\n" + "destinationPort": 60331, + "payload": "ID=21497 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A 3600 192.168.0.40\n" } ], "00000000-0000-0000-0000-000000000102": [ { - "time": 846, + "time": 845, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -88,7 +88,7 @@ "targetIp": "192.168.0.10" }, { - "time": 848, + "time": 846, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "arp": 2, @@ -96,29 +96,29 @@ "targetIp": "192.168.0.20" }, { - "time": 1075, + "time": 1072, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 17, - "sourcePort": 49846, + "sourcePort": 63577, "destinationPort": 53, - "payload": "ID=27710 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" + "payload": "ID=25033 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" }, { - "time": 1080, + "time": 1077, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 17, "sourcePort": 53, - "destinationPort": 49846, - "payload": "ID=27710 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=2 NSCOUNT=0 ARCOUNT=0 \nschule.de. NS 3600 ns.schule.de.\nns.schule.de. A 3600 192.168.0.11\n" + "destinationPort": 63577, + "payload": "ID=25033 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=2 NSCOUNT=0 ARCOUNT=0 \nschule.de. NS 3600 ns.schule.de.\nns.schule.de. A 3600 192.168.0.11\n" }, { - "time": 1303, + "time": 1300, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -128,7 +128,7 @@ ], "00000000-0000-0000-0000-000000000103": [ { - "time": 846, + "time": 845, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -136,7 +136,7 @@ "targetIp": "192.168.0.10" }, { - "time": 1303, + "time": 1300, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -144,7 +144,7 @@ "targetIp": "192.168.0.11" }, { - "time": 1303, + "time": 1300, "source": "02:00:00:00:01:13", "destination": "02:00:00:00:01:11", "arp": 2, @@ -152,31 +152,31 @@ "targetIp": "192.168.0.20" }, { - "time": 1526, + "time": 1523, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:13", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.11", "protocol": 17, - "sourcePort": 61850, + "sourcePort": 60331, "destinationPort": 53, - "payload": "ID=14830 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" + "payload": "ID=21497 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" }, { - "time": 1527, + "time": 1524, "source": "02:00:00:00:01:13", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.11", "destinationIp": "192.168.0.20", "protocol": 17, "sourcePort": 53, - "destinationPort": 61850, - "payload": "ID=14830 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A 3600 192.168.0.40\n" + "destinationPort": 60331, + "payload": "ID=21497 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A 3600 192.168.0.40\n" } ], "00000000-0000-0000-0000-000000000104": [ { - "time": 846, + "time": 845, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -184,7 +184,7 @@ "targetIp": "192.168.0.10" }, { - "time": 1303, + "time": 1300, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -193,13 +193,929 @@ } ] }, + "rows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "192.168.0.20:63577", + "192.168.0.10:53", + "UDP", + "Transport", + "" + ], + [ + "3", + "192.168.0.20:63577", + "192.168.0.10:53", + "DNS", + "Anwendung", + "ID=25033 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "192.168.0.10:53", + "192.168.0.20:63577", + "UDP", + "Transport", + "" + ], + [ + "4", + "192.168.0.10:53", + "192.168.0.20:63577", + "DNS", + "Anwendung", + "ID=25033 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=2 NSCOUNT=0 ARCOUNT=0 \nschule.de. NS 3600 ns.schule.de.\nns.schule.de. A 3600 192.168.0.11\n" + ], + [ + "5", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "5", + "192.168.0.20", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "6", + "02:00:00:00:01:13", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "6", + "192.168.0.11", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.11, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "7", + "02:00:00:00:01:11", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.20", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "7", + "192.168.0.20:60331", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "7", + "192.168.0.20:60331", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=21497 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" + ], + [ + "8", + "02:00:00:00:01:13", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "192.168.0.11", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "8", + "192.168.0.11:53", + "192.168.0.20:60331", + "UDP", + "Transport", + "" + ], + [ + "8", + "192.168.0.11:53", + "192.168.0.20:60331", + "DNS", + "Anwendung", + "ID=21497 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A 3600 192.168.0.40\n" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "192.168.0.20:63577", + "192.168.0.10:53", + "UDP", + "Transport", + "" + ], + [ + "3", + "192.168.0.20:63577", + "192.168.0.10:53", + "DNS", + "Anwendung", + "ID=25033 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "192.168.0.10:53", + "192.168.0.20:63577", + "UDP", + "Transport", + "" + ], + [ + "4", + "192.168.0.10:53", + "192.168.0.20:63577", + "DNS", + "Anwendung", + "ID=25033 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=2 NSCOUNT=0 ARCOUNT=0 \nschule.de. NS 3600 ns.schule.de.\nns.schule.de. A 3600 192.168.0.11\n" + ], + [ + "5", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "5", + "192.168.0.20", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.20", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "3", + "02:00:00:00:01:13", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "192.168.0.11", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.11, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "4", + "02:00:00:00:01:11", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.20", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "192.168.0.20:60331", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "4", + "192.168.0.20:60331", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=21497 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" + ], + [ + "5", + "02:00:00:00:01:13", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.11", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "192.168.0.11:53", + "192.168.0.20:60331", + "UDP", + "Transport", + "" + ], + [ + "5", + "192.168.0.11:53", + "192.168.0.20:60331", + "DNS", + "Anwendung", + "ID=21497 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A 3600 192.168.0.40\n" + ] + ], + "00000000-0000-0000-0000-000000000104": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.20", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "63577", + "53", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "DNS", + "Anwendung", + "ID=25033 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "53", + "63577", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "DNS", + "Anwendung", + "ID=25033 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=2 NSCOUNT=0 ARCOUNT=0 \nschule.de. NS 3600 ns.schule.de.\nns.schule.de. A 3600 192.168.0.11\n" + ], + [ + "5", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "5", + "192.168.0.20", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "6", + "02:00:00:00:01:13", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "6", + "192.168.0.11", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.11, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "7", + "02:00:00:00:01:11", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.20", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "7", + "60331", + "53", + "UDP", + "Transport", + "" + ], + [ + "7", + null, + null, + "DNS", + "Anwendung", + "ID=21497 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" + ], + [ + "8", + "02:00:00:00:01:13", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "192.168.0.11", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "8", + "53", + "60331", + "UDP", + "Transport", + "" + ], + [ + "8", + null, + null, + "DNS", + "Anwendung", + "ID=21497 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A 3600 192.168.0.40\n" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "63577", + "53", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "DNS", + "Anwendung", + "ID=25033 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "53", + "63577", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "DNS", + "Anwendung", + "ID=25033 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=2 NSCOUNT=0 ARCOUNT=0 \nschule.de. NS 3600 ns.schule.de.\nns.schule.de. A 3600 192.168.0.11\n" + ], + [ + "5", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "5", + "192.168.0.20", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.20", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "3", + "02:00:00:00:01:13", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "192.168.0.11", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.11, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "4", + "02:00:00:00:01:11", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.20", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "60331", + "53", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "DNS", + "Anwendung", + "ID=21497 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" + ], + [ + "5", + "02:00:00:00:01:13", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.11", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "53", + "60331", + "UDP", + "Transport", + "" + ], + [ + "5", + null, + null, + "DNS", + "Anwendung", + "ID=21497 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A 3600 192.168.0.40\n" + ] + ], + "00000000-0000-0000-0000-000000000104": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.20", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ] + ] + }, "events": [ [ - 715, + 714, "holeIPAdresse www.schule.de called" ], [ - 1639, + 1635, "holeIPAdresse www.schule.de returned 192.168.0.40" ] ] diff --git a/packages/core/test/scenarios/dns-java-unknown.java.json b/packages/core/test/scenarios/dns-java-unknown.java.json index bebe8b1..10f8f94 100644 --- a/packages/core/test/scenarios/dns-java-unknown.java.json +++ b/packages/core/test/scenarios/dns-java-unknown.java.json @@ -2,7 +2,7 @@ "frames": { "00000000-0000-0000-0000-000000000101": [ { - "time": 726, + "time": 725, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -10,7 +10,7 @@ "targetIp": "192.168.0.10" }, { - "time": 960, + "time": 958, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "arp": 2, @@ -18,31 +18,31 @@ "targetIp": "192.168.0.20" }, { - "time": 963, + "time": 961, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 17, - "sourcePort": 56964, + "sourcePort": 58719, "destinationPort": 53, - "payload": "ID=54840 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nx.unbekannt.org. A IN\n" + "payload": "ID=44820 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nx.unbekannt.org. A IN\n" }, { - "time": 1192, + "time": 1190, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 17, "sourcePort": 53, - "destinationPort": 56964, - "payload": "ID=54840 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + "destinationPort": 58719, + "payload": "ID=44820 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" } ], "00000000-0000-0000-0000-000000000102": [ { - "time": 848, + "time": 845, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -50,7 +50,7 @@ "targetIp": "192.168.0.10" }, { - "time": 849, + "time": 847, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "arp": 2, @@ -58,31 +58,31 @@ "targetIp": "192.168.0.20" }, { - "time": 1076, + "time": 1074, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 17, - "sourcePort": 56964, + "sourcePort": 58719, "destinationPort": 53, - "payload": "ID=54840 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nx.unbekannt.org. A IN\n" + "payload": "ID=44820 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nx.unbekannt.org. A IN\n" }, { - "time": 1081, + "time": 1079, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 17, "sourcePort": 53, - "destinationPort": 56964, - "payload": "ID=54840 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + "destinationPort": 58719, + "payload": "ID=44820 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" } ], "00000000-0000-0000-0000-000000000103": [ { - "time": 848, + "time": 845, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -92,7 +92,7 @@ ], "00000000-0000-0000-0000-000000000104": [ { - "time": 848, + "time": 846, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -101,13 +101,481 @@ } ] }, + "rows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "192.168.0.20:58719", + "192.168.0.10:53", + "UDP", + "Transport", + "" + ], + [ + "3", + "192.168.0.20:58719", + "192.168.0.10:53", + "DNS", + "Anwendung", + "ID=44820 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nx.unbekannt.org. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "192.168.0.10:53", + "192.168.0.20:58719", + "UDP", + "Transport", + "" + ], + [ + "4", + "192.168.0.10:53", + "192.168.0.20:58719", + "DNS", + "Anwendung", + "ID=44820 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "192.168.0.20:58719", + "192.168.0.10:53", + "UDP", + "Transport", + "" + ], + [ + "3", + "192.168.0.20:58719", + "192.168.0.10:53", + "DNS", + "Anwendung", + "ID=44820 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nx.unbekannt.org. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "192.168.0.10:53", + "192.168.0.20:58719", + "UDP", + "Transport", + "" + ], + [ + "4", + "192.168.0.10:53", + "192.168.0.20:58719", + "DNS", + "Anwendung", + "ID=44820 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ] + ], + "00000000-0000-0000-0000-000000000104": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "58719", + "53", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "DNS", + "Anwendung", + "ID=44820 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nx.unbekannt.org. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "53", + "58719", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "DNS", + "Anwendung", + "ID=44820 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "58719", + "53", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "DNS", + "Anwendung", + "ID=44820 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nx.unbekannt.org. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "53", + "58719", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "DNS", + "Anwendung", + "ID=44820 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ] + ], + "00000000-0000-0000-0000-000000000104": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ] + ] + }, "events": [ [ - 716, + 712, "holeIPAdresse x.unbekannt.org called" ], [ - 1192, + 1191, "holeIPAdresse x.unbekannt.org returned null" ] ] diff --git a/packages/core/test/scenarios/dns-recursive-java-address.java.json b/packages/core/test/scenarios/dns-recursive-java-address.java.json index be81e32..f6e4f5b 100644 --- a/packages/core/test/scenarios/dns-recursive-java-address.java.json +++ b/packages/core/test/scenarios/dns-recursive-java-address.java.json @@ -2,7 +2,7 @@ "frames": { "00000000-0000-0000-0000-000000000101": [ { - "time": 727, + "time": 731, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -10,7 +10,7 @@ "targetIp": "192.168.0.10" }, { - "time": 963, + "time": 967, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "arp": 2, @@ -18,31 +18,31 @@ "targetIp": "192.168.0.20" }, { - "time": 965, + "time": 969, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 17, - "sourcePort": 60119, + "sourcePort": 64893, "destinationPort": 53, - "payload": "ID=56151 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A IN\n" + "payload": "ID=54574 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A IN\n" }, { - "time": 1196, + "time": 1199, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 17, "sourcePort": 53, - "destinationPort": 60119, - "payload": "ID=56151 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A 3600 192.168.0.30\n" + "destinationPort": 64893, + "payload": "ID=54574 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A 3600 192.168.0.30\n" } ], "00000000-0000-0000-0000-000000000102": [ { - "time": 850, + "time": 853, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -50,7 +50,7 @@ "targetIp": "192.168.0.10" }, { - "time": 851, + "time": 855, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "arp": 2, @@ -58,31 +58,31 @@ "targetIp": "192.168.0.20" }, { - "time": 1079, + "time": 1083, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 17, - "sourcePort": 60119, + "sourcePort": 64893, "destinationPort": 53, - "payload": "ID=56151 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A IN\n" + "payload": "ID=54574 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A IN\n" }, { - "time": 1084, + "time": 1088, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 17, "sourcePort": 53, - "destinationPort": 60119, - "payload": "ID=56151 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A 3600 192.168.0.30\n" + "destinationPort": 64893, + "payload": "ID=54574 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A 3600 192.168.0.30\n" } ], "00000000-0000-0000-0000-000000000103": [ { - "time": 850, + "time": 853, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -92,7 +92,7 @@ ], "00000000-0000-0000-0000-000000000104": [ { - "time": 850, + "time": 853, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -101,13 +101,481 @@ } ] }, + "rows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "192.168.0.20:64893", + "192.168.0.10:53", + "UDP", + "Transport", + "" + ], + [ + "3", + "192.168.0.20:64893", + "192.168.0.10:53", + "DNS", + "Anwendung", + "ID=54574 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "192.168.0.10:53", + "192.168.0.20:64893", + "UDP", + "Transport", + "" + ], + [ + "4", + "192.168.0.10:53", + "192.168.0.20:64893", + "DNS", + "Anwendung", + "ID=54574 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A 3600 192.168.0.30\n" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "192.168.0.20:64893", + "192.168.0.10:53", + "UDP", + "Transport", + "" + ], + [ + "3", + "192.168.0.20:64893", + "192.168.0.10:53", + "DNS", + "Anwendung", + "ID=54574 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "192.168.0.10:53", + "192.168.0.20:64893", + "UDP", + "Transport", + "" + ], + [ + "4", + "192.168.0.10:53", + "192.168.0.20:64893", + "DNS", + "Anwendung", + "ID=54574 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A 3600 192.168.0.30\n" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ] + ], + "00000000-0000-0000-0000-000000000104": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "64893", + "53", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "DNS", + "Anwendung", + "ID=54574 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "53", + "64893", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "DNS", + "Anwendung", + "ID=54574 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A 3600 192.168.0.30\n" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "64893", + "53", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "DNS", + "Anwendung", + "ID=54574 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "53", + "64893", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "DNS", + "Anwendung", + "ID=54574 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nweb.filius.de. A 3600 192.168.0.30\n" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ] + ], + "00000000-0000-0000-0000-000000000104": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ] + ] + }, "events": [ [ - 717, + 720, "holeIPAdresse web.filius.de called" ], [ - 1197, + 1200, "holeIPAdresse web.filius.de returned 192.168.0.30" ] ] diff --git a/packages/core/test/scenarios/dns-recursive-java-referral.java.json b/packages/core/test/scenarios/dns-recursive-java-referral.java.json index 5ef1af8..e6114dc 100644 --- a/packages/core/test/scenarios/dns-recursive-java-referral.java.json +++ b/packages/core/test/scenarios/dns-recursive-java-referral.java.json @@ -18,15 +18,15 @@ "targetIp": "192.168.0.20" }, { - "time": 963, + "time": 964, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 17, - "sourcePort": 51710, + "sourcePort": 55721, "destinationPort": 53, - "payload": "ID=39889 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" + "payload": "ID=12837 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" }, { "time": 1196, @@ -37,20 +37,20 @@ "targetIp": "192.168.0.11" }, { - "time": 1645, + "time": 1643, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 17, "sourcePort": 53, - "destinationPort": 51710, - "payload": "ID=39889 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A 3600 192.168.0.40\n" + "destinationPort": 55721, + "payload": "ID=12837 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A 3600 192.168.0.40\n" } ], "00000000-0000-0000-0000-000000000102": [ { - "time": 848, + "time": 849, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -58,7 +58,7 @@ "targetIp": "192.168.0.10" }, { - "time": 849, + "time": 850, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "arp": 2, @@ -66,15 +66,15 @@ "targetIp": "192.168.0.20" }, { - "time": 1076, + "time": 1077, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 17, - "sourcePort": 51710, + "sourcePort": 55721, "destinationPort": 53, - "payload": "ID=39889 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" + "payload": "ID=12837 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" }, { "time": 1085, @@ -99,36 +99,36 @@ "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.11", "protocol": 17, - "sourcePort": 52403, + "sourcePort": 60866, "destinationPort": 53, - "payload": "ID=12187 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" + "payload": "ID=49931 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" }, { - "time": 1533, + "time": 1531, "source": "02:00:00:00:01:13", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.11", "destinationIp": "192.168.0.10", "protocol": 17, "sourcePort": 53, - "destinationPort": 52403, - "payload": "ID=12187 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A 3600 192.168.0.40\n" + "destinationPort": 60866, + "payload": "ID=49931 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A 3600 192.168.0.40\n" }, { - "time": 1534, + "time": 1532, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 17, "sourcePort": 53, - "destinationPort": 51710, - "payload": "ID=39889 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A 3600 192.168.0.40\n" + "destinationPort": 55721, + "payload": "ID=12837 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A 3600 192.168.0.40\n" } ], "00000000-0000-0000-0000-000000000103": [ { - "time": 848, + "time": 849, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -152,31 +152,31 @@ "targetIp": "192.168.0.10" }, { - "time": 1420, + "time": 1419, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:13", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.11", "protocol": 17, - "sourcePort": 52403, + "sourcePort": 60866, "destinationPort": 53, - "payload": "ID=12187 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" + "payload": "ID=49931 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" }, { - "time": 1421, + "time": 1420, "source": "02:00:00:00:01:13", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.11", "destinationIp": "192.168.0.10", "protocol": 17, "sourcePort": 53, - "destinationPort": 52403, - "payload": "ID=12187 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A 3600 192.168.0.40\n" + "destinationPort": 60866, + "payload": "ID=49931 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A 3600 192.168.0.40\n" } ], "00000000-0000-0000-0000-000000000104": [ { - "time": 848, + "time": 849, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -193,13 +193,929 @@ } ] }, + "rows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "192.168.0.20:55721", + "192.168.0.10:53", + "UDP", + "Transport", + "" + ], + [ + "3", + "192.168.0.20:55721", + "192.168.0.10:53", + "DNS", + "Anwendung", + "ID=12837 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "5", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "192.168.0.10:53", + "192.168.0.20:55721", + "UDP", + "Transport", + "" + ], + [ + "5", + "192.168.0.10:53", + "192.168.0.20:55721", + "DNS", + "Anwendung", + "ID=12837 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A 3600 192.168.0.40\n" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "192.168.0.20:55721", + "192.168.0.10:53", + "UDP", + "Transport", + "" + ], + [ + "3", + "192.168.0.20:55721", + "192.168.0.10:53", + "DNS", + "Anwendung", + "ID=12837 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "5", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "5", + "192.168.0.11", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.11, target=02:00:00:00:01:12|192.168.0.10]" + ], + [ + "6", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "6", + "192.168.0.10:60866", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "6", + "192.168.0.10:60866", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=49931 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" + ], + [ + "7", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "7", + "192.168.0.11:53", + "192.168.0.10:60866", + "UDP", + "Transport", + "" + ], + [ + "7", + "192.168.0.11:53", + "192.168.0.10:60866", + "DNS", + "Anwendung", + "ID=49931 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A 3600 192.168.0.40\n" + ], + [ + "8", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "8", + "192.168.0.10:53", + "192.168.0.20:55721", + "UDP", + "Transport", + "" + ], + [ + "8", + "192.168.0.10:53", + "192.168.0.20:55721", + "DNS", + "Anwendung", + "ID=12837 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A 3600 192.168.0.40\n" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "3", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "192.168.0.11", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.11, target=02:00:00:00:01:12|192.168.0.10]" + ], + [ + "4", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "192.168.0.10:60866", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "4", + "192.168.0.10:60866", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=49931 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" + ], + [ + "5", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "192.168.0.11:53", + "192.168.0.10:60866", + "UDP", + "Transport", + "" + ], + [ + "5", + "192.168.0.11:53", + "192.168.0.10:60866", + "DNS", + "Anwendung", + "ID=49931 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A 3600 192.168.0.40\n" + ] + ], + "00000000-0000-0000-0000-000000000104": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "55721", + "53", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "DNS", + "Anwendung", + "ID=12837 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "5", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "53", + "55721", + "UDP", + "Transport", + "" + ], + [ + "5", + null, + null, + "DNS", + "Anwendung", + "ID=12837 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A 3600 192.168.0.40\n" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "55721", + "53", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "DNS", + "Anwendung", + "ID=12837 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "5", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "5", + "192.168.0.11", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.11, target=02:00:00:00:01:12|192.168.0.10]" + ], + [ + "6", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "6", + "60866", + "53", + "UDP", + "Transport", + "" + ], + [ + "6", + null, + null, + "DNS", + "Anwendung", + "ID=49931 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" + ], + [ + "7", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "7", + "53", + "60866", + "UDP", + "Transport", + "" + ], + [ + "7", + null, + null, + "DNS", + "Anwendung", + "ID=49931 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A 3600 192.168.0.40\n" + ], + [ + "8", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "8", + "53", + "55721", + "UDP", + "Transport", + "" + ], + [ + "8", + null, + null, + "DNS", + "Anwendung", + "ID=12837 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A 3600 192.168.0.40\n" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "3", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "192.168.0.11", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.11, target=02:00:00:00:01:12|192.168.0.10]" + ], + [ + "4", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "60866", + "53", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "DNS", + "Anwendung", + "ID=49931 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A IN\n" + ], + [ + "5", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "53", + "60866", + "UDP", + "Transport", + "" + ], + [ + "5", + null, + null, + "DNS", + "Anwendung", + "ID=49931 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=1 NSCOUNT=0 ARCOUNT=0 \nwww.schule.de. A 3600 192.168.0.40\n" + ] + ], + "00000000-0000-0000-0000-000000000104": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ] + ] + }, "events": [ [ - 716, + 717, "holeIPAdresse www.schule.de called" ], [ - 1645, + 1643, "holeIPAdresse www.schule.de returned 192.168.0.40" ] ] diff --git a/packages/core/test/scenarios/dns-recursive-java-unknown.java.json b/packages/core/test/scenarios/dns-recursive-java-unknown.java.json index 3fc418f..692fa40 100644 --- a/packages/core/test/scenarios/dns-recursive-java-unknown.java.json +++ b/packages/core/test/scenarios/dns-recursive-java-unknown.java.json @@ -10,7 +10,7 @@ "targetIp": "192.168.0.10" }, { - "time": 963, + "time": 965, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "arp": 2, @@ -18,18 +18,18 @@ "targetIp": "192.168.0.20" }, { - "time": 965, + "time": 968, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 17, - "sourcePort": 59169, + "sourcePort": 61945, "destinationPort": 53, - "payload": "ID=28614 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nx.unbekannt.org. A IN\n" + "payload": "ID=42077 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nx.unbekannt.org. A IN\n" }, { - "time": 1198, + "time": 1201, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -37,20 +37,20 @@ "targetIp": "192.168.0.11" }, { - "time": 1645, + "time": 1648, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 17, "sourcePort": 53, - "destinationPort": 59169, - "payload": "ID=28614 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + "destinationPort": 61945, + "payload": "ID=42077 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" } ], "00000000-0000-0000-0000-000000000102": [ { - "time": 850, + "time": 852, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -58,7 +58,7 @@ "targetIp": "192.168.0.10" }, { - "time": 851, + "time": 853, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "arp": 2, @@ -66,18 +66,18 @@ "targetIp": "192.168.0.20" }, { - "time": 1078, + "time": 1081, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 17, - "sourcePort": 59169, + "sourcePort": 61945, "destinationPort": 53, - "payload": "ID=28614 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nx.unbekannt.org. A IN\n" + "payload": "ID=42077 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nx.unbekannt.org. A IN\n" }, { - "time": 1087, + "time": 1090, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -85,7 +85,7 @@ "targetIp": "192.168.0.11" }, { - "time": 1309, + "time": 1312, "source": "02:00:00:00:01:13", "destination": "02:00:00:00:01:12", "arp": 2, @@ -93,42 +93,42 @@ "targetIp": "192.168.0.10" }, { - "time": 1309, + "time": 1312, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:13", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.11", "protocol": 17, - "sourcePort": 61822, + "sourcePort": 60315, "destinationPort": 53, - "payload": "ID=44286 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nx.unbekannt.org. A IN\n" + "payload": "ID=5005 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nx.unbekannt.org. A IN\n" }, { - "time": 1533, + "time": 1536, "source": "02:00:00:00:01:13", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.11", "destinationIp": "192.168.0.10", "protocol": 17, "sourcePort": 53, - "destinationPort": 61822, - "payload": "ID=44286 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + "destinationPort": 60315, + "payload": "ID=5005 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" }, { - "time": 1534, + "time": 1537, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 17, "sourcePort": 53, - "destinationPort": 59169, - "payload": "ID=28614 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + "destinationPort": 61945, + "payload": "ID=42077 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" } ], "00000000-0000-0000-0000-000000000103": [ { - "time": 850, + "time": 852, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -136,7 +136,7 @@ "targetIp": "192.168.0.10" }, { - "time": 1198, + "time": 1201, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -144,7 +144,7 @@ "targetIp": "192.168.0.11" }, { - "time": 1198, + "time": 1201, "source": "02:00:00:00:01:13", "destination": "02:00:00:00:01:12", "arp": 2, @@ -152,31 +152,31 @@ "targetIp": "192.168.0.10" }, { - "time": 1421, + "time": 1424, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:13", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.11", "protocol": 17, - "sourcePort": 61822, + "sourcePort": 60315, "destinationPort": 53, - "payload": "ID=44286 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nx.unbekannt.org. A IN\n" + "payload": "ID=5005 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nx.unbekannt.org. A IN\n" }, { - "time": 1422, + "time": 1425, "source": "02:00:00:00:01:13", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.11", "destinationIp": "192.168.0.10", "protocol": 17, "sourcePort": 53, - "destinationPort": 61822, - "payload": "ID=44286 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + "destinationPort": 60315, + "payload": "ID=5005 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" } ], "00000000-0000-0000-0000-000000000104": [ { - "time": 850, + "time": 852, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -184,7 +184,7 @@ "targetIp": "192.168.0.10" }, { - "time": 1198, + "time": 1201, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -193,13 +193,929 @@ } ] }, + "rows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "192.168.0.20:61945", + "192.168.0.10:53", + "UDP", + "Transport", + "" + ], + [ + "3", + "192.168.0.20:61945", + "192.168.0.10:53", + "DNS", + "Anwendung", + "ID=42077 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nx.unbekannt.org. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "5", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "192.168.0.10:53", + "192.168.0.20:61945", + "UDP", + "Transport", + "" + ], + [ + "5", + "192.168.0.10:53", + "192.168.0.20:61945", + "DNS", + "Anwendung", + "ID=42077 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "192.168.0.20:61945", + "192.168.0.10:53", + "UDP", + "Transport", + "" + ], + [ + "3", + "192.168.0.20:61945", + "192.168.0.10:53", + "DNS", + "Anwendung", + "ID=42077 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nx.unbekannt.org. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "5", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "5", + "192.168.0.11", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.11, target=02:00:00:00:01:12|192.168.0.10]" + ], + [ + "6", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "6", + "192.168.0.10:60315", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "6", + "192.168.0.10:60315", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=5005 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nx.unbekannt.org. A IN\n" + ], + [ + "7", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "7", + "192.168.0.11:53", + "192.168.0.10:60315", + "UDP", + "Transport", + "" + ], + [ + "7", + "192.168.0.11:53", + "192.168.0.10:60315", + "DNS", + "Anwendung", + "ID=5005 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ], + [ + "8", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "8", + "192.168.0.10:53", + "192.168.0.20:61945", + "UDP", + "Transport", + "" + ], + [ + "8", + "192.168.0.10:53", + "192.168.0.20:61945", + "DNS", + "Anwendung", + "ID=42077 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "3", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "192.168.0.11", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.11, target=02:00:00:00:01:12|192.168.0.10]" + ], + [ + "4", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "192.168.0.10:60315", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "4", + "192.168.0.10:60315", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=5005 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nx.unbekannt.org. A IN\n" + ], + [ + "5", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "192.168.0.11:53", + "192.168.0.10:60315", + "UDP", + "Transport", + "" + ], + [ + "5", + "192.168.0.11:53", + "192.168.0.10:60315", + "DNS", + "Anwendung", + "ID=5005 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ] + ], + "00000000-0000-0000-0000-000000000104": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "61945", + "53", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "DNS", + "Anwendung", + "ID=42077 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nx.unbekannt.org. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "5", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "53", + "61945", + "UDP", + "Transport", + "" + ], + [ + "5", + null, + null, + "DNS", + "Anwendung", + "ID=42077 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "61945", + "53", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "DNS", + "Anwendung", + "ID=42077 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nx.unbekannt.org. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "5", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "5", + "192.168.0.11", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.11, target=02:00:00:00:01:12|192.168.0.10]" + ], + [ + "6", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "6", + "60315", + "53", + "UDP", + "Transport", + "" + ], + [ + "6", + null, + null, + "DNS", + "Anwendung", + "ID=5005 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nx.unbekannt.org. A IN\n" + ], + [ + "7", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "7", + "53", + "60315", + "UDP", + "Transport", + "" + ], + [ + "7", + null, + null, + "DNS", + "Anwendung", + "ID=5005 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ], + [ + "8", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "8", + "53", + "61945", + "UDP", + "Transport", + "" + ], + [ + "8", + null, + null, + "DNS", + "Anwendung", + "ID=42077 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "3", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "192.168.0.11", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.11, target=02:00:00:00:01:12|192.168.0.10]" + ], + [ + "4", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "60315", + "53", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "DNS", + "Anwendung", + "ID=5005 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nx.unbekannt.org. A IN\n" + ], + [ + "5", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "53", + "60315", + "UDP", + "Transport", + "" + ], + [ + "5", + null, + null, + "DNS", + "Anwendung", + "ID=5005 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ] + ], + "00000000-0000-0000-0000-000000000104": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ] + ] + }, "events": [ [ - 719, + 718, "holeIPAdresse x.unbekannt.org called" ], [ - 1646, + 1648, "holeIPAdresse x.unbekannt.org returned null" ] ] diff --git a/packages/core/test/scenarios/dns-recursive-java-unknownInOwnZone.java.json b/packages/core/test/scenarios/dns-recursive-java-unknownInOwnZone.java.json index 78e0fa4..1389cfc 100644 --- a/packages/core/test/scenarios/dns-recursive-java-unknownInOwnZone.java.json +++ b/packages/core/test/scenarios/dns-recursive-java-unknownInOwnZone.java.json @@ -2,7 +2,7 @@ "frames": { "00000000-0000-0000-0000-000000000101": [ { - "time": 735, + "time": 729, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -10,7 +10,7 @@ "targetIp": "192.168.0.10" }, { - "time": 969, + "time": 965, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "arp": 2, @@ -18,18 +18,18 @@ "targetIp": "192.168.0.20" }, { - "time": 972, + "time": 968, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 17, - "sourcePort": 51431, + "sourcePort": 64620, "destinationPort": 53, - "payload": "ID=22768 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + "payload": "ID=13859 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" }, { - "time": 15066, + "time": 14960, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -39,7 +39,7 @@ ], "00000000-0000-0000-0000-000000000102": [ { - "time": 857, + "time": 852, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -47,7 +47,7 @@ "targetIp": "192.168.0.10" }, { - "time": 858, + "time": 853, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "arp": 2, @@ -55,18 +55,18 @@ "targetIp": "192.168.0.20" }, { - "time": 1085, + "time": 1081, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 17, - "sourcePort": 51431, + "sourcePort": 64620, "destinationPort": 53, - "payload": "ID=22768 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + "payload": "ID=13859 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" }, { - "time": 14910, + "time": 14843, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -74,7 +74,7 @@ "targetIp": "192.168.0.11" }, { - "time": 15276, + "time": 15072, "source": "02:00:00:00:01:13", "destination": "02:00:00:00:01:12", "arp": 2, @@ -82,68 +82,119 @@ "targetIp": "192.168.0.10" }, { - "time": 15278, + "time": 15072, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:13", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.11", "protocol": 17, - "sourcePort": 52690, + "sourcePort": 58846, "destinationPort": 53, - "payload": "ID=54566 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" - } - ], - "00000000-0000-0000-0000-000000000103": [ - { - "time": 856, - "source": "02:00:00:00:01:11", - "destination": "FF:FF:FF:FF:FF:FF", - "arp": 1, - "senderIp": "192.168.0.20", - "targetIp": "192.168.0.10" + "payload": "ID=65055 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" }, { - "time": 15066, - "source": "02:00:00:00:01:12", - "destination": "FF:FF:FF:FF:FF:FF", - "arp": 1, - "senderIp": "192.168.0.10", - "targetIp": "192.168.0.11" - }, - { - "time": 15073, - "source": "02:00:00:00:01:13", - "destination": "02:00:00:00:01:12", - "arp": 2, - "senderIp": "192.168.0.11", - "targetIp": "192.168.0.10" - }, - { - "time": 15423, + "time": 15128, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:13", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.11", "protocol": 17, - "sourcePort": 52690, + "sourcePort": 62010, "destinationPort": 53, - "payload": "ID=54566 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + "payload": "ID=54729 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" }, { - "time": 15434, + "time": 15199, + "source": "02:00:00:00:01:12", + "destination": "02:00:00:00:01:13", + "sourceIp": "192.168.0.10", + "destinationIp": "192.168.0.11", + "protocol": 17, + "sourcePort": 59832, + "destinationPort": 53, + "payload": "ID=39279 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + }, + { + "time": 15199, + "source": "02:00:00:00:01:12", + "destination": "02:00:00:00:01:13", + "sourceIp": "192.168.0.10", + "destinationIp": "192.168.0.11", + "protocol": 17, + "sourcePort": 55672, + "destinationPort": 53, + "payload": "ID=51240 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + }, + { + "time": 15199, + "source": "02:00:00:00:01:12", + "destination": "02:00:00:00:01:13", + "sourceIp": "192.168.0.10", + "destinationIp": "192.168.0.11", + "protocol": 17, + "sourcePort": 61005, + "destinationPort": 53, + "payload": "ID=23057 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + }, + { + "time": 15199, + "source": "02:00:00:00:01:12", + "destination": "02:00:00:00:01:13", + "sourceIp": "192.168.0.10", + "destinationIp": "192.168.0.11", + "protocol": 17, + "sourcePort": 51173, + "destinationPort": 53, + "payload": "ID=8010 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + }, + { + "time": 15199, + "source": "02:00:00:00:01:12", + "destination": "02:00:00:00:01:13", + "sourceIp": "192.168.0.10", + "destinationIp": "192.168.0.11", + "protocol": 17, + "sourcePort": 64403, + "destinationPort": 53, + "payload": "ID=59222 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + }, + { + "time": 15324, "source": "02:00:00:00:01:13", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.11", "destinationIp": "192.168.0.10", "protocol": 17, "sourcePort": 53, - "destinationPort": 52690, - "payload": "ID=54566 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + "destinationPort": 58846, + "payload": "ID=65055 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + }, + { + "time": 15397, + "source": "02:00:00:00:01:13", + "destination": "02:00:00:00:01:12", + "sourceIp": "192.168.0.11", + "destinationIp": "192.168.0.10", + "protocol": 17, + "sourcePort": 53, + "destinationPort": 62010, + "payload": "ID=54729 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + }, + { + "time": 15456, + "source": "02:00:00:00:01:13", + "destination": "02:00:00:00:01:12", + "sourceIp": "192.168.0.11", + "destinationIp": "192.168.0.10", + "protocol": 17, + "sourcePort": 53, + "destinationPort": 59832, + "payload": "ID=39279 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" } ], - "00000000-0000-0000-0000-000000000104": [ + "00000000-0000-0000-0000-000000000103": [ { - "time": 856, + "time": 852, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -151,7 +202,143 @@ "targetIp": "192.168.0.10" }, { - "time": 15059, + "time": 14960, + "source": "02:00:00:00:01:12", + "destination": "FF:FF:FF:FF:FF:FF", + "arp": 1, + "senderIp": "192.168.0.10", + "targetIp": "192.168.0.11" + }, + { + "time": 14961, + "source": "02:00:00:00:01:13", + "destination": "02:00:00:00:01:12", + "arp": 2, + "senderIp": "192.168.0.11", + "targetIp": "192.168.0.10" + }, + { + "time": 15199, + "source": "02:00:00:00:01:12", + "destination": "02:00:00:00:01:13", + "sourceIp": "192.168.0.10", + "destinationIp": "192.168.0.11", + "protocol": 17, + "sourcePort": 58846, + "destinationPort": 53, + "payload": "ID=65055 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + }, + { + "time": 15201, + "source": "02:00:00:00:01:13", + "destination": "02:00:00:00:01:12", + "sourceIp": "192.168.0.11", + "destinationIp": "192.168.0.10", + "protocol": 17, + "sourcePort": 53, + "destinationPort": 58846, + "payload": "ID=65055 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + }, + { + "time": 15256, + "source": "02:00:00:00:01:12", + "destination": "02:00:00:00:01:13", + "sourceIp": "192.168.0.10", + "destinationIp": "192.168.0.11", + "protocol": 17, + "sourcePort": 62010, + "destinationPort": 53, + "payload": "ID=54729 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + }, + { + "time": 15257, + "source": "02:00:00:00:01:13", + "destination": "02:00:00:00:01:12", + "sourceIp": "192.168.0.11", + "destinationIp": "192.168.0.10", + "protocol": 17, + "sourcePort": 53, + "destinationPort": 62010, + "payload": "ID=54729 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + }, + { + "time": 15321, + "source": "02:00:00:00:01:12", + "destination": "02:00:00:00:01:13", + "sourceIp": "192.168.0.10", + "destinationIp": "192.168.0.11", + "protocol": 17, + "sourcePort": 59832, + "destinationPort": 53, + "payload": "ID=39279 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + }, + { + "time": 15332, + "source": "02:00:00:00:01:13", + "destination": "02:00:00:00:01:12", + "sourceIp": "192.168.0.11", + "destinationIp": "192.168.0.10", + "protocol": 17, + "sourcePort": 53, + "destinationPort": 59832, + "payload": "ID=39279 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + }, + { + "time": 15394, + "source": "02:00:00:00:01:12", + "destination": "02:00:00:00:01:13", + "sourceIp": "192.168.0.10", + "destinationIp": "192.168.0.11", + "protocol": 17, + "sourcePort": 55672, + "destinationPort": 53, + "payload": "ID=51240 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + }, + { + "time": 15400, + "source": "02:00:00:00:01:13", + "destination": "02:00:00:00:01:12", + "sourceIp": "192.168.0.11", + "destinationIp": "192.168.0.10", + "protocol": 17, + "sourcePort": 53, + "destinationPort": 55672, + "payload": "ID=51240 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + }, + { + "time": 15451, + "source": "02:00:00:00:01:12", + "destination": "02:00:00:00:01:13", + "sourceIp": "192.168.0.10", + "destinationIp": "192.168.0.11", + "protocol": 17, + "sourcePort": 61005, + "destinationPort": 53, + "payload": "ID=23057 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + }, + { + "time": 15456, + "source": "02:00:00:00:01:13", + "destination": "02:00:00:00:01:12", + "sourceIp": "192.168.0.11", + "destinationIp": "192.168.0.10", + "protocol": 17, + "sourcePort": 53, + "destinationPort": 61005, + "payload": "ID=23057 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + } + ], + "00000000-0000-0000-0000-000000000104": [ + { + "time": 852, + "source": "02:00:00:00:01:11", + "destination": "FF:FF:FF:FF:FF:FF", + "arp": 1, + "senderIp": "192.168.0.20", + "targetIp": "192.168.0.10" + }, + { + "time": 14960, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -160,13 +347,5633 @@ } ] }, + "rows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "192.168.0.20:64620", + "192.168.0.10:53", + "UDP", + "Transport", + "" + ], + [ + "3", + "192.168.0.20:64620", + "192.168.0.10:53", + "DNS", + "Anwendung", + "ID=13859 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "192.168.0.20:64620", + "192.168.0.10:53", + "UDP", + "Transport", + "" + ], + [ + "3", + "192.168.0.20:64620", + "192.168.0.10:53", + "DNS", + "Anwendung", + "ID=13859 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "5", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "5", + "192.168.0.11", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.11, target=02:00:00:00:01:12|192.168.0.10]" + ], + [ + "6", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "6", + "192.168.0.10:58846", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "6", + "192.168.0.10:58846", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=65055 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "7", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "7", + "192.168.0.10:62010", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "7", + "192.168.0.10:62010", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=54729 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "8", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "8", + "192.168.0.10:59832", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "8", + "192.168.0.10:59832", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=39279 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "9", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "9", + "192.168.0.10:55672", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "9", + "192.168.0.10:55672", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=51240 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "10", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "10", + "192.168.0.10:61005", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "10", + "192.168.0.10:61005", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=23057 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "11", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "11", + "192.168.0.10:51173", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "11", + "192.168.0.10:51173", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=8010 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "12", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "12", + "192.168.0.10:64403", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "12", + "192.168.0.10:64403", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=59222 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "13", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "13", + "192.168.0.11:53", + "192.168.0.10:58846", + "UDP", + "Transport", + "" + ], + [ + "13", + "192.168.0.11:53", + "192.168.0.10:58846", + "DNS", + "Anwendung", + "ID=65055 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ], + [ + "14", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "14", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "14", + "192.168.0.11:53", + "192.168.0.10:62010", + "UDP", + "Transport", + "" + ], + [ + "14", + "192.168.0.11:53", + "192.168.0.10:62010", + "DNS", + "Anwendung", + "ID=54729 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ], + [ + "15", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "15", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "15", + "192.168.0.11:53", + "192.168.0.10:59832", + "UDP", + "Transport", + "" + ], + [ + "15", + "192.168.0.11:53", + "192.168.0.10:59832", + "DNS", + "Anwendung", + "ID=39279 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ], + [ + "16", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "16", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "16", + "192.168.0.10:62964", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "16", + "192.168.0.10:62964", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=16299 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "17", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "17", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "17", + "192.168.0.10:63492", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "17", + "192.168.0.10:63492", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=56319 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "18", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "18", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "18", + "192.168.0.10:56396", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "18", + "192.168.0.10:56396", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=10967 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "19", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "19", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "19", + "192.168.0.10:50477", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "19", + "192.168.0.10:50477", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=25683 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "20", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "20", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "20", + "192.168.0.10:57471", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "20", + "192.168.0.10:57471", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=21162 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "21", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "21", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "21", + "192.168.0.10:56116", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "21", + "192.168.0.10:56116", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=15888 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "22", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "22", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "22", + "192.168.0.10:65442", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "22", + "192.168.0.10:65442", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=21396 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "23", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "23", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "23", + "192.168.0.10:49713", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "23", + "192.168.0.10:49713", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=24378 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "24", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "24", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "24", + "192.168.0.10:64924", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "24", + "192.168.0.10:64924", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=50594 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "25", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "25", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "25", + "192.168.0.10:59864", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "25", + "192.168.0.10:59864", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=13198 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "26", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "26", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "26", + "192.168.0.10:59748", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "26", + "192.168.0.10:59748", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=15098 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "27", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "27", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "27", + "192.168.0.10:63858", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "27", + "192.168.0.10:63858", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=40238 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "28", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "28", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "28", + "192.168.0.10:58181", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "28", + "192.168.0.10:58181", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=41291 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "29", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "29", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "29", + "192.168.0.10:59430", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "29", + "192.168.0.10:59430", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=39621 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "30", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "30", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "30", + "192.168.0.10:56616", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "30", + "192.168.0.10:56616", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=54887 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "31", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "31", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "31", + "192.168.0.10:59241", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "31", + "192.168.0.10:59241", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=49971 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "32", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "32", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "32", + "192.168.0.10:56751", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "32", + "192.168.0.10:56751", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=4870 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "33", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "33", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "33", + "192.168.0.10:49936", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "33", + "192.168.0.10:49936", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=11941 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "34", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "34", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "34", + "192.168.0.10:56775", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "34", + "192.168.0.10:56775", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=20218 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "35", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "35", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "35", + "192.168.0.10:57507", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "35", + "192.168.0.10:57507", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=4186 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "36", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "36", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "36", + "192.168.0.10:53677", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "36", + "192.168.0.10:53677", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=1420 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "37", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "37", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "37", + "192.168.0.10:54603", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "37", + "192.168.0.10:54603", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=29932 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "38", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "38", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "38", + "192.168.0.10:64817", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "38", + "192.168.0.10:64817", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=42827 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "39", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "39", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "39", + "192.168.0.10:55568", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "39", + "192.168.0.10:55568", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=23460 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "40", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "40", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "40", + "192.168.0.10:57161", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "40", + "192.168.0.10:57161", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=10769 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "41", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "41", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "41", + "192.168.0.10:59254", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "41", + "192.168.0.10:59254", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=58601 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "42", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "42", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "42", + "192.168.0.10:65140", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "42", + "192.168.0.10:65140", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=37306 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "43", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "43", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "43", + "192.168.0.10:56783", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "43", + "192.168.0.10:56783", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=44127 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "44", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "44", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "44", + "192.168.0.10:55088", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "44", + "192.168.0.10:55088", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=6002 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "45", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "45", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "45", + "192.168.0.10:52624", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "45", + "192.168.0.10:52624", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=32920 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "46", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "46", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "46", + "192.168.0.10:60221", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "46", + "192.168.0.10:60221", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=48786 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "47", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "47", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "47", + "192.168.0.10:55084", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "47", + "192.168.0.10:55084", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=609 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "48", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "48", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "48", + "192.168.0.10:60309", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "48", + "192.168.0.10:60309", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=46791 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "49", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "49", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "49", + "192.168.0.10:56372", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "49", + "192.168.0.10:56372", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=19060 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "50", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "50", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "50", + "192.168.0.10:56189", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "50", + "192.168.0.10:56189", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=16817 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "51", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "51", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "51", + "192.168.0.10:57911", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "51", + "192.168.0.10:57911", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=3083 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "52", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "52", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "52", + "192.168.0.10:57076", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "52", + "192.168.0.10:57076", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=33089 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "53", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "53", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "53", + "192.168.0.10:55670", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "53", + "192.168.0.10:55670", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=28037 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "54", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "54", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "54", + "192.168.0.10:50733", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "54", + "192.168.0.10:50733", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=55971 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "55", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "55", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "55", + "192.168.0.10:57053", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "55", + "192.168.0.10:57053", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=17991 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "56", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "56", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "56", + "192.168.0.10:57031", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "56", + "192.168.0.10:57031", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=49578 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "57", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "57", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "57", + "192.168.0.10:61286", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "57", + "192.168.0.10:61286", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=51860 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "58", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "58", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "58", + "192.168.0.10:49379", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "58", + "192.168.0.10:49379", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=35418 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "59", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "59", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "59", + "192.168.0.10:63714", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "59", + "192.168.0.10:63714", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=19206 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "60", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "60", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "60", + "192.168.0.10:63714", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "60", + "192.168.0.10:63714", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=4713 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "61", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "61", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "61", + "192.168.0.10:54674", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "61", + "192.168.0.10:54674", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=47118 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "62", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "62", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "62", + "192.168.0.10:52481", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "62", + "192.168.0.10:52481", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=25079 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "63", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "63", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "63", + "192.168.0.10:53671", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "63", + "192.168.0.10:53671", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=3684 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "64", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "64", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "64", + "192.168.0.10:51907", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "64", + "192.168.0.10:51907", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=29465 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "65", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "65", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "65", + "192.168.0.10:58516", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "65", + "192.168.0.10:58516", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=34671 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "66", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "66", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "66", + "192.168.0.10:58619", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "66", + "192.168.0.10:58619", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=57187 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "67", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "67", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "67", + "192.168.0.10:53775", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "67", + "192.168.0.10:53775", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=27483 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "68", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "68", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "68", + "192.168.0.10:50346", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "68", + "192.168.0.10:50346", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=27145 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "69", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "69", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "69", + "192.168.0.10:60796", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "69", + "192.168.0.10:60796", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=17064 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "70", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "70", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "70", + "192.168.0.10:49245", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "70", + "192.168.0.10:49245", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=25267 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "71", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "71", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "71", + "192.168.0.10:53072", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "71", + "192.168.0.10:53072", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=64079 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "72", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "72", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "72", + "192.168.0.10:55677", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "72", + "192.168.0.10:55677", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=30688 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "73", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "73", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "73", + "192.168.0.10:55799", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "73", + "192.168.0.10:55799", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=195 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "3", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "192.168.0.11", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.11, target=02:00:00:00:01:12|192.168.0.10]" + ], + [ + "4", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "192.168.0.10:58846", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "4", + "192.168.0.10:58846", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=65055 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "5", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "192.168.0.11:53", + "192.168.0.10:58846", + "UDP", + "Transport", + "" + ], + [ + "5", + "192.168.0.11:53", + "192.168.0.10:58846", + "DNS", + "Anwendung", + "ID=65055 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ], + [ + "6", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "6", + "192.168.0.10:62010", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "6", + "192.168.0.10:62010", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=54729 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "7", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "7", + "192.168.0.11:53", + "192.168.0.10:62010", + "UDP", + "Transport", + "" + ], + [ + "7", + "192.168.0.11:53", + "192.168.0.10:62010", + "DNS", + "Anwendung", + "ID=54729 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ], + [ + "8", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "8", + "192.168.0.10:59832", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "8", + "192.168.0.10:59832", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=39279 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "9", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "9", + "192.168.0.11:53", + "192.168.0.10:59832", + "UDP", + "Transport", + "" + ], + [ + "9", + "192.168.0.11:53", + "192.168.0.10:59832", + "DNS", + "Anwendung", + "ID=39279 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ], + [ + "10", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "10", + "192.168.0.10:55672", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "10", + "192.168.0.10:55672", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=51240 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "11", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "11", + "192.168.0.11:53", + "192.168.0.10:55672", + "UDP", + "Transport", + "" + ], + [ + "11", + "192.168.0.11:53", + "192.168.0.10:55672", + "DNS", + "Anwendung", + "ID=51240 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ], + [ + "12", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "12", + "192.168.0.10:61005", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "12", + "192.168.0.10:61005", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=23057 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "13", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "13", + "192.168.0.11:53", + "192.168.0.10:61005", + "UDP", + "Transport", + "" + ], + [ + "13", + "192.168.0.11:53", + "192.168.0.10:61005", + "DNS", + "Anwendung", + "ID=23057 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ], + [ + "14", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "14", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "14", + "192.168.0.10:51173", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "14", + "192.168.0.10:51173", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=8010 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ] + ], + "00000000-0000-0000-0000-000000000104": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "64620", + "53", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "DNS", + "Anwendung", + "ID=13859 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "64620", + "53", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "DNS", + "Anwendung", + "ID=13859 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "5", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "5", + "192.168.0.11", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.11, target=02:00:00:00:01:12|192.168.0.10]" + ], + [ + "6", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "6", + "58846", + "53", + "UDP", + "Transport", + "" + ], + [ + "6", + null, + null, + "DNS", + "Anwendung", + "ID=65055 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "7", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "7", + "62010", + "53", + "UDP", + "Transport", + "" + ], + [ + "7", + null, + null, + "DNS", + "Anwendung", + "ID=54729 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "8", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "8", + "59832", + "53", + "UDP", + "Transport", + "" + ], + [ + "8", + null, + null, + "DNS", + "Anwendung", + "ID=39279 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "9", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "9", + "55672", + "53", + "UDP", + "Transport", + "" + ], + [ + "9", + null, + null, + "DNS", + "Anwendung", + "ID=51240 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "10", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "10", + "61005", + "53", + "UDP", + "Transport", + "" + ], + [ + "10", + null, + null, + "DNS", + "Anwendung", + "ID=23057 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "11", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "11", + "51173", + "53", + "UDP", + "Transport", + "" + ], + [ + "11", + null, + null, + "DNS", + "Anwendung", + "ID=8010 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "12", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "12", + "64403", + "53", + "UDP", + "Transport", + "" + ], + [ + "12", + null, + null, + "DNS", + "Anwendung", + "ID=59222 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "13", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "13", + "53", + "58846", + "UDP", + "Transport", + "" + ], + [ + "13", + null, + null, + "DNS", + "Anwendung", + "ID=65055 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ], + [ + "14", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "14", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "14", + "53", + "62010", + "UDP", + "Transport", + "" + ], + [ + "14", + null, + null, + "DNS", + "Anwendung", + "ID=54729 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ], + [ + "15", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "15", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "15", + "53", + "59832", + "UDP", + "Transport", + "" + ], + [ + "15", + null, + null, + "DNS", + "Anwendung", + "ID=39279 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ], + [ + "16", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "16", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "16", + "62964", + "53", + "UDP", + "Transport", + "" + ], + [ + "16", + null, + null, + "DNS", + "Anwendung", + "ID=16299 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "17", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "17", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "17", + "63492", + "53", + "UDP", + "Transport", + "" + ], + [ + "17", + null, + null, + "DNS", + "Anwendung", + "ID=56319 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "18", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "18", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "18", + "56396", + "53", + "UDP", + "Transport", + "" + ], + [ + "18", + null, + null, + "DNS", + "Anwendung", + "ID=10967 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "19", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "19", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "19", + "50477", + "53", + "UDP", + "Transport", + "" + ], + [ + "19", + null, + null, + "DNS", + "Anwendung", + "ID=25683 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "20", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "20", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "20", + "57471", + "53", + "UDP", + "Transport", + "" + ], + [ + "20", + null, + null, + "DNS", + "Anwendung", + "ID=21162 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "21", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "21", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "21", + "56116", + "53", + "UDP", + "Transport", + "" + ], + [ + "21", + null, + null, + "DNS", + "Anwendung", + "ID=15888 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "22", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "22", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "22", + "65442", + "53", + "UDP", + "Transport", + "" + ], + [ + "22", + null, + null, + "DNS", + "Anwendung", + "ID=21396 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "23", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "23", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "23", + "49713", + "53", + "UDP", + "Transport", + "" + ], + [ + "23", + null, + null, + "DNS", + "Anwendung", + "ID=24378 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "24", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "24", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "24", + "64924", + "53", + "UDP", + "Transport", + "" + ], + [ + "24", + null, + null, + "DNS", + "Anwendung", + "ID=50594 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "25", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "25", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "25", + "59864", + "53", + "UDP", + "Transport", + "" + ], + [ + "25", + null, + null, + "DNS", + "Anwendung", + "ID=13198 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "26", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "26", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "26", + "59748", + "53", + "UDP", + "Transport", + "" + ], + [ + "26", + null, + null, + "DNS", + "Anwendung", + "ID=15098 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "27", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "27", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "27", + "63858", + "53", + "UDP", + "Transport", + "" + ], + [ + "27", + null, + null, + "DNS", + "Anwendung", + "ID=40238 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "28", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "28", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "28", + "58181", + "53", + "UDP", + "Transport", + "" + ], + [ + "28", + null, + null, + "DNS", + "Anwendung", + "ID=41291 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "29", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "29", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "29", + "59430", + "53", + "UDP", + "Transport", + "" + ], + [ + "29", + null, + null, + "DNS", + "Anwendung", + "ID=39621 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "30", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "30", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "30", + "56616", + "53", + "UDP", + "Transport", + "" + ], + [ + "30", + null, + null, + "DNS", + "Anwendung", + "ID=54887 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "31", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "31", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "31", + "59241", + "53", + "UDP", + "Transport", + "" + ], + [ + "31", + null, + null, + "DNS", + "Anwendung", + "ID=49971 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "32", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "32", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "32", + "56751", + "53", + "UDP", + "Transport", + "" + ], + [ + "32", + null, + null, + "DNS", + "Anwendung", + "ID=4870 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "33", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "33", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "33", + "49936", + "53", + "UDP", + "Transport", + "" + ], + [ + "33", + null, + null, + "DNS", + "Anwendung", + "ID=11941 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "34", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "34", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "34", + "56775", + "53", + "UDP", + "Transport", + "" + ], + [ + "34", + null, + null, + "DNS", + "Anwendung", + "ID=20218 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "35", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "35", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "35", + "57507", + "53", + "UDP", + "Transport", + "" + ], + [ + "35", + null, + null, + "DNS", + "Anwendung", + "ID=4186 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "36", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "36", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "36", + "53677", + "53", + "UDP", + "Transport", + "" + ], + [ + "36", + null, + null, + "DNS", + "Anwendung", + "ID=1420 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "37", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "37", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "37", + "54603", + "53", + "UDP", + "Transport", + "" + ], + [ + "37", + null, + null, + "DNS", + "Anwendung", + "ID=29932 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "38", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "38", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "38", + "64817", + "53", + "UDP", + "Transport", + "" + ], + [ + "38", + null, + null, + "DNS", + "Anwendung", + "ID=42827 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "39", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "39", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "39", + "55568", + "53", + "UDP", + "Transport", + "" + ], + [ + "39", + null, + null, + "DNS", + "Anwendung", + "ID=23460 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "40", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "40", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "40", + "57161", + "53", + "UDP", + "Transport", + "" + ], + [ + "40", + null, + null, + "DNS", + "Anwendung", + "ID=10769 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "41", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "41", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "41", + "59254", + "53", + "UDP", + "Transport", + "" + ], + [ + "41", + null, + null, + "DNS", + "Anwendung", + "ID=58601 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "42", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "42", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "42", + "65140", + "53", + "UDP", + "Transport", + "" + ], + [ + "42", + null, + null, + "DNS", + "Anwendung", + "ID=37306 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "43", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "43", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "43", + "56783", + "53", + "UDP", + "Transport", + "" + ], + [ + "43", + null, + null, + "DNS", + "Anwendung", + "ID=44127 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "44", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "44", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "44", + "55088", + "53", + "UDP", + "Transport", + "" + ], + [ + "44", + null, + null, + "DNS", + "Anwendung", + "ID=6002 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "45", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "45", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "45", + "52624", + "53", + "UDP", + "Transport", + "" + ], + [ + "45", + null, + null, + "DNS", + "Anwendung", + "ID=32920 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "46", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "46", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "46", + "60221", + "53", + "UDP", + "Transport", + "" + ], + [ + "46", + null, + null, + "DNS", + "Anwendung", + "ID=48786 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "47", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "47", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "47", + "55084", + "53", + "UDP", + "Transport", + "" + ], + [ + "47", + null, + null, + "DNS", + "Anwendung", + "ID=609 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "48", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "48", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "48", + "60309", + "53", + "UDP", + "Transport", + "" + ], + [ + "48", + null, + null, + "DNS", + "Anwendung", + "ID=46791 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "49", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "49", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "49", + "56372", + "53", + "UDP", + "Transport", + "" + ], + [ + "49", + null, + null, + "DNS", + "Anwendung", + "ID=19060 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "50", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "50", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "50", + "56189", + "53", + "UDP", + "Transport", + "" + ], + [ + "50", + null, + null, + "DNS", + "Anwendung", + "ID=16817 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "51", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "51", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "51", + "57911", + "53", + "UDP", + "Transport", + "" + ], + [ + "51", + null, + null, + "DNS", + "Anwendung", + "ID=3083 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "52", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "52", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "52", + "57076", + "53", + "UDP", + "Transport", + "" + ], + [ + "52", + null, + null, + "DNS", + "Anwendung", + "ID=33089 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "53", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "53", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "53", + "55670", + "53", + "UDP", + "Transport", + "" + ], + [ + "53", + null, + null, + "DNS", + "Anwendung", + "ID=28037 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "54", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "54", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "54", + "50733", + "53", + "UDP", + "Transport", + "" + ], + [ + "54", + null, + null, + "DNS", + "Anwendung", + "ID=55971 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "55", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "55", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "55", + "57053", + "53", + "UDP", + "Transport", + "" + ], + [ + "55", + null, + null, + "DNS", + "Anwendung", + "ID=17991 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "56", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "56", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "56", + "57031", + "53", + "UDP", + "Transport", + "" + ], + [ + "56", + null, + null, + "DNS", + "Anwendung", + "ID=49578 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "57", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "57", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "57", + "61286", + "53", + "UDP", + "Transport", + "" + ], + [ + "57", + null, + null, + "DNS", + "Anwendung", + "ID=51860 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "58", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "58", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "58", + "49379", + "53", + "UDP", + "Transport", + "" + ], + [ + "58", + null, + null, + "DNS", + "Anwendung", + "ID=35418 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "59", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "59", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "59", + "63714", + "53", + "UDP", + "Transport", + "" + ], + [ + "59", + null, + null, + "DNS", + "Anwendung", + "ID=19206 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "60", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "60", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "60", + "63714", + "53", + "UDP", + "Transport", + "" + ], + [ + "60", + null, + null, + "DNS", + "Anwendung", + "ID=4713 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "61", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "61", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "61", + "54674", + "53", + "UDP", + "Transport", + "" + ], + [ + "61", + null, + null, + "DNS", + "Anwendung", + "ID=47118 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "62", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "62", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "62", + "52481", + "53", + "UDP", + "Transport", + "" + ], + [ + "62", + null, + null, + "DNS", + "Anwendung", + "ID=25079 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "63", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "63", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "63", + "53671", + "53", + "UDP", + "Transport", + "" + ], + [ + "63", + null, + null, + "DNS", + "Anwendung", + "ID=3684 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "64", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "64", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "64", + "51907", + "53", + "UDP", + "Transport", + "" + ], + [ + "64", + null, + null, + "DNS", + "Anwendung", + "ID=29465 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "65", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "65", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "65", + "58516", + "53", + "UDP", + "Transport", + "" + ], + [ + "65", + null, + null, + "DNS", + "Anwendung", + "ID=34671 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "66", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "66", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "66", + "58619", + "53", + "UDP", + "Transport", + "" + ], + [ + "66", + null, + null, + "DNS", + "Anwendung", + "ID=57187 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "67", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "67", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "67", + "53775", + "53", + "UDP", + "Transport", + "" + ], + [ + "67", + null, + null, + "DNS", + "Anwendung", + "ID=27483 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "68", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "68", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "68", + "50346", + "53", + "UDP", + "Transport", + "" + ], + [ + "68", + null, + null, + "DNS", + "Anwendung", + "ID=27145 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "69", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "69", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "69", + "60796", + "53", + "UDP", + "Transport", + "" + ], + [ + "69", + null, + null, + "DNS", + "Anwendung", + "ID=17064 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "70", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "70", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "70", + "49245", + "53", + "UDP", + "Transport", + "" + ], + [ + "70", + null, + null, + "DNS", + "Anwendung", + "ID=25267 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "71", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "71", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "71", + "53072", + "53", + "UDP", + "Transport", + "" + ], + [ + "71", + null, + null, + "DNS", + "Anwendung", + "ID=64079 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "72", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "72", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "72", + "55677", + "53", + "UDP", + "Transport", + "" + ], + [ + "72", + null, + null, + "DNS", + "Anwendung", + "ID=30688 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "73", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "73", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "73", + "55799", + "53", + "UDP", + "Transport", + "" + ], + [ + "73", + null, + null, + "DNS", + "Anwendung", + "ID=195 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "3", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "192.168.0.11", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.11, target=02:00:00:00:01:12|192.168.0.10]" + ], + [ + "4", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "58846", + "53", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "DNS", + "Anwendung", + "ID=65055 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "5", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "53", + "58846", + "UDP", + "Transport", + "" + ], + [ + "5", + null, + null, + "DNS", + "Anwendung", + "ID=65055 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ], + [ + "6", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "6", + "62010", + "53", + "UDP", + "Transport", + "" + ], + [ + "6", + null, + null, + "DNS", + "Anwendung", + "ID=54729 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "7", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "7", + "53", + "62010", + "UDP", + "Transport", + "" + ], + [ + "7", + null, + null, + "DNS", + "Anwendung", + "ID=54729 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ], + [ + "8", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "8", + "59832", + "53", + "UDP", + "Transport", + "" + ], + [ + "8", + null, + null, + "DNS", + "Anwendung", + "ID=39279 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "9", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "9", + "53", + "59832", + "UDP", + "Transport", + "" + ], + [ + "9", + null, + null, + "DNS", + "Anwendung", + "ID=39279 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ], + [ + "10", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "10", + "55672", + "53", + "UDP", + "Transport", + "" + ], + [ + "10", + null, + null, + "DNS", + "Anwendung", + "ID=51240 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "11", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "11", + "53", + "55672", + "UDP", + "Transport", + "" + ], + [ + "11", + null, + null, + "DNS", + "Anwendung", + "ID=51240 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ], + [ + "12", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "12", + "61005", + "53", + "UDP", + "Transport", + "" + ], + [ + "12", + null, + null, + "DNS", + "Anwendung", + "ID=23057 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "13", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "13", + "53", + "61005", + "UDP", + "Transport", + "" + ], + [ + "13", + null, + null, + "DNS", + "Anwendung", + "ID=23057 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ], + [ + "14", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "14", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "14", + "51173", + "53", + "UDP", + "Transport", + "" + ], + [ + "14", + null, + null, + "DNS", + "Anwendung", + "ID=8010 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.filius.de. A IN\n" + ], + [ + "15", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "15", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "15", + "53", + "51173", + "UDP", + "Transport", + "" + ], + [ + "15", + null, + null, + "DNS", + "Anwendung", + "ID=8010 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ] + ], + "00000000-0000-0000-0000-000000000104": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ] + ] + }, "events": [ [ - 724, + 716, "holeIPAdresse nix.filius.de called" ], [ - 14485, + 14477, "holeIPAdresse nix.filius.de failed TimeOutException" ] ] diff --git a/packages/core/test/scenarios/dns-recursive-java-unknownInZone.java.json b/packages/core/test/scenarios/dns-recursive-java-unknownInZone.java.json index 6dafa64..4df45d1 100644 --- a/packages/core/test/scenarios/dns-recursive-java-unknownInZone.java.json +++ b/packages/core/test/scenarios/dns-recursive-java-unknownInZone.java.json @@ -2,7 +2,7 @@ "frames": { "00000000-0000-0000-0000-000000000101": [ { - "time": 750, + "time": 728, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -10,7 +10,7 @@ "targetIp": "192.168.0.10" }, { - "time": 984, + "time": 961, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "arp": 2, @@ -18,18 +18,18 @@ "targetIp": "192.168.0.20" }, { - "time": 987, + "time": 964, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 17, - "sourcePort": 64317, + "sourcePort": 56738, "destinationPort": 53, - "payload": "ID=59872 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" + "payload": "ID=37623 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" }, { - "time": 1221, + "time": 1197, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -37,18 +37,18 @@ "targetIp": "192.168.0.11" }, { - "time": 1897, + "time": 1868, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 17, "sourcePort": 53, - "destinationPort": 64317, - "payload": "ID=59872 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=2 NSCOUNT=0 ARCOUNT=0 \nschule.de. NS 3600 ns.schule.de.\nns.schule.de. A 3600 192.168.0.11\n" + "destinationPort": 56738, + "payload": "ID=37623 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=2 NSCOUNT=0 ARCOUNT=0 \nschule.de. NS 3600 ns.schule.de.\nns.schule.de. A 3600 192.168.0.11\n" }, { - "time": 1899, + "time": 1868, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -56,7 +56,7 @@ "targetIp": "192.168.0.11" }, { - "time": 2121, + "time": 2090, "source": "02:00:00:00:01:13", "destination": "02:00:00:00:01:11", "arp": 2, @@ -64,31 +64,31 @@ "targetIp": "192.168.0.20" }, { - "time": 2121, + "time": 2090, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:13", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.11", "protocol": 17, - "sourcePort": 53912, + "sourcePort": 59860, "destinationPort": 53, - "payload": "ID=65453 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" + "payload": "ID=26956 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" }, { - "time": 2345, + "time": 2313, "source": "02:00:00:00:01:13", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.11", "destinationIp": "192.168.0.20", "protocol": 17, "sourcePort": 53, - "destinationPort": 53912, - "payload": "ID=65453 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + "destinationPort": 59860, + "payload": "ID=26956 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" } ], "00000000-0000-0000-0000-000000000102": [ { - "time": 871, + "time": 848, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -96,7 +96,7 @@ "targetIp": "192.168.0.10" }, { - "time": 873, + "time": 849, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "arp": 2, @@ -104,18 +104,18 @@ "targetIp": "192.168.0.20" }, { - "time": 1100, + "time": 1077, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 17, - "sourcePort": 64317, + "sourcePort": 56738, "destinationPort": 53, - "payload": "ID=59872 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" + "payload": "ID=37623 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" }, { - "time": 1109, + "time": 1086, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -123,7 +123,7 @@ "targetIp": "192.168.0.11" }, { - "time": 1333, + "time": 1308, "source": "02:00:00:00:01:13", "destination": "02:00:00:00:01:12", "arp": 2, @@ -131,62 +131,62 @@ "targetIp": "192.168.0.10" }, { - "time": 1333, + "time": 1308, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:13", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.11", "protocol": 17, - "sourcePort": 50451, + "sourcePort": 64537, "destinationPort": 53, - "payload": "ID=16993 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" + "payload": "ID=8610 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" }, { - "time": 1558, + "time": 1531, "source": "02:00:00:00:01:13", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.11", "destinationIp": "192.168.0.10", "protocol": 17, "sourcePort": 53, - "destinationPort": 50451, - "payload": "ID=16993 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + "destinationPort": 64537, + "payload": "ID=8610 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" }, { - "time": 1558, + "time": 1532, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:13", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.11", "protocol": 17, - "sourcePort": 60605, + "sourcePort": 59840, "destinationPort": 53, - "payload": "ID=33013 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" + "payload": "ID=55399 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" }, { - "time": 1783, + "time": 1755, "source": "02:00:00:00:01:13", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.11", "destinationIp": "192.168.0.10", "protocol": 17, "sourcePort": 53, - "destinationPort": 60605, - "payload": "ID=33013 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + "destinationPort": 59840, + "payload": "ID=55399 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" }, { - "time": 1786, + "time": 1756, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 17, "sourcePort": 53, - "destinationPort": 64317, - "payload": "ID=59872 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=2 NSCOUNT=0 ARCOUNT=0 \nschule.de. NS 3600 ns.schule.de.\nns.schule.de. A 3600 192.168.0.11\n" + "destinationPort": 56738, + "payload": "ID=37623 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=2 NSCOUNT=0 ARCOUNT=0 \nschule.de. NS 3600 ns.schule.de.\nns.schule.de. A 3600 192.168.0.11\n" }, { - "time": 2010, + "time": 1979, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -196,7 +196,7 @@ ], "00000000-0000-0000-0000-000000000103": [ { - "time": 871, + "time": 848, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -204,7 +204,7 @@ "targetIp": "192.168.0.10" }, { - "time": 1221, + "time": 1197, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -212,7 +212,7 @@ "targetIp": "192.168.0.11" }, { - "time": 1221, + "time": 1197, "source": "02:00:00:00:01:13", "destination": "02:00:00:00:01:12", "arp": 2, @@ -220,51 +220,51 @@ "targetIp": "192.168.0.10" }, { - "time": 1445, + "time": 1419, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:13", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.11", "protocol": 17, - "sourcePort": 50451, + "sourcePort": 64537, "destinationPort": 53, - "payload": "ID=16993 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" + "payload": "ID=8610 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" }, { - "time": 1446, + "time": 1420, "source": "02:00:00:00:01:13", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.11", "destinationIp": "192.168.0.10", "protocol": 17, "sourcePort": 53, - "destinationPort": 50451, - "payload": "ID=16993 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + "destinationPort": 64537, + "payload": "ID=8610 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" }, { - "time": 1670, + "time": 1643, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:13", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.11", "protocol": 17, - "sourcePort": 60605, + "sourcePort": 59840, "destinationPort": 53, - "payload": "ID=33013 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" + "payload": "ID=55399 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" }, { - "time": 1671, + "time": 1644, "source": "02:00:00:00:01:13", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.11", "destinationIp": "192.168.0.10", "protocol": 17, "sourcePort": 53, - "destinationPort": 60605, - "payload": "ID=33013 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + "destinationPort": 59840, + "payload": "ID=55399 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" }, { - "time": 2010, + "time": 1979, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -272,7 +272,7 @@ "targetIp": "192.168.0.11" }, { - "time": 2010, + "time": 1979, "source": "02:00:00:00:01:13", "destination": "02:00:00:00:01:11", "arp": 2, @@ -280,31 +280,31 @@ "targetIp": "192.168.0.20" }, { - "time": 2233, + "time": 2201, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:13", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.11", "protocol": 17, - "sourcePort": 53912, + "sourcePort": 59860, "destinationPort": 53, - "payload": "ID=65453 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" + "payload": "ID=26956 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" }, { - "time": 2234, + "time": 2202, "source": "02:00:00:00:01:13", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.11", "destinationIp": "192.168.0.20", "protocol": 17, "sourcePort": 53, - "destinationPort": 53912, - "payload": "ID=65453 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + "destinationPort": 59860, + "payload": "ID=26956 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" } ], "00000000-0000-0000-0000-000000000104": [ { - "time": 871, + "time": 848, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -312,7 +312,7 @@ "targetIp": "192.168.0.10" }, { - "time": 1221, + "time": 1197, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -320,7 +320,7 @@ "targetIp": "192.168.0.11" }, { - "time": 2010, + "time": 1979, "source": "02:00:00:00:01:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -329,13 +329,1633 @@ } ] }, + "rows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "192.168.0.20:56738", + "192.168.0.10:53", + "UDP", + "Transport", + "" + ], + [ + "3", + "192.168.0.20:56738", + "192.168.0.10:53", + "DNS", + "Anwendung", + "ID=37623 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "5", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "192.168.0.10:53", + "192.168.0.20:56738", + "UDP", + "Transport", + "" + ], + [ + "5", + "192.168.0.10:53", + "192.168.0.20:56738", + "DNS", + "Anwendung", + "ID=37623 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=2 NSCOUNT=0 ARCOUNT=0 \nschule.de. NS 3600 ns.schule.de.\nns.schule.de. A 3600 192.168.0.11\n" + ], + [ + "6", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "6", + "192.168.0.20", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "7", + "02:00:00:00:01:13", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "7", + "192.168.0.11", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.11, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "8", + "02:00:00:00:01:11", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "192.168.0.20", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "8", + "192.168.0.20:59860", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "8", + "192.168.0.20:59860", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=26956 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" + ], + [ + "9", + "02:00:00:00:01:13", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "192.168.0.11", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "9", + "192.168.0.11:53", + "192.168.0.20:59860", + "UDP", + "Transport", + "" + ], + [ + "9", + "192.168.0.11:53", + "192.168.0.20:59860", + "DNS", + "Anwendung", + "ID=26956 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "192.168.0.20:56738", + "192.168.0.10:53", + "UDP", + "Transport", + "" + ], + [ + "3", + "192.168.0.20:56738", + "192.168.0.10:53", + "DNS", + "Anwendung", + "ID=37623 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "5", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "5", + "192.168.0.11", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.11, target=02:00:00:00:01:12|192.168.0.10]" + ], + [ + "6", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "6", + "192.168.0.10:64537", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "6", + "192.168.0.10:64537", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=8610 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" + ], + [ + "7", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "7", + "192.168.0.11:53", + "192.168.0.10:64537", + "UDP", + "Transport", + "" + ], + [ + "7", + "192.168.0.11:53", + "192.168.0.10:64537", + "DNS", + "Anwendung", + "ID=8610 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ], + [ + "8", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "8", + "192.168.0.10:59840", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "8", + "192.168.0.10:59840", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=55399 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" + ], + [ + "9", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "9", + "192.168.0.11:53", + "192.168.0.10:59840", + "UDP", + "Transport", + "" + ], + [ + "9", + "192.168.0.11:53", + "192.168.0.10:59840", + "DNS", + "Anwendung", + "ID=55399 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ], + [ + "10", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "10", + "192.168.0.10:53", + "192.168.0.20:56738", + "UDP", + "Transport", + "" + ], + [ + "10", + "192.168.0.10:53", + "192.168.0.20:56738", + "DNS", + "Anwendung", + "ID=37623 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=2 NSCOUNT=0 ARCOUNT=0 \nschule.de. NS 3600 ns.schule.de.\nns.schule.de. A 3600 192.168.0.11\n" + ], + [ + "11", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "11", + "192.168.0.20", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "3", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "192.168.0.11", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.11, target=02:00:00:00:01:12|192.168.0.10]" + ], + [ + "4", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "192.168.0.10:64537", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "4", + "192.168.0.10:64537", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=8610 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" + ], + [ + "5", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "192.168.0.11:53", + "192.168.0.10:64537", + "UDP", + "Transport", + "" + ], + [ + "5", + "192.168.0.11:53", + "192.168.0.10:64537", + "DNS", + "Anwendung", + "ID=8610 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ], + [ + "6", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "6", + "192.168.0.10:59840", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "6", + "192.168.0.10:59840", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=55399 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" + ], + [ + "7", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "7", + "192.168.0.11:53", + "192.168.0.10:59840", + "UDP", + "Transport", + "" + ], + [ + "7", + "192.168.0.11:53", + "192.168.0.10:59840", + "DNS", + "Anwendung", + "ID=55399 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ], + [ + "8", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "8", + "192.168.0.20", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "9", + "02:00:00:00:01:13", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "9", + "192.168.0.11", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.11, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "10", + "02:00:00:00:01:11", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "192.168.0.20", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "10", + "192.168.0.20:59860", + "192.168.0.11:53", + "UDP", + "Transport", + "" + ], + [ + "10", + "192.168.0.20:59860", + "192.168.0.11:53", + "DNS", + "Anwendung", + "ID=26956 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" + ], + [ + "11", + "02:00:00:00:01:13", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "192.168.0.11", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "11", + "192.168.0.11:53", + "192.168.0.20:59860", + "UDP", + "Transport", + "" + ], + [ + "11", + "192.168.0.11:53", + "192.168.0.20:59860", + "DNS", + "Anwendung", + "ID=26956 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ] + ], + "00000000-0000-0000-0000-000000000104": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "3", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "192.168.0.20", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "56738", + "53", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "DNS", + "Anwendung", + "ID=37623 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "5", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "53", + "56738", + "UDP", + "Transport", + "" + ], + [ + "5", + null, + null, + "DNS", + "Anwendung", + "ID=37623 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=2 NSCOUNT=0 ARCOUNT=0 \nschule.de. NS 3600 ns.schule.de.\nns.schule.de. A 3600 192.168.0.11\n" + ], + [ + "6", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "6", + "192.168.0.20", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "7", + "02:00:00:00:01:13", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "7", + "192.168.0.11", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.11, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "8", + "02:00:00:00:01:11", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "192.168.0.20", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "8", + "59860", + "53", + "UDP", + "Transport", + "" + ], + [ + "8", + null, + null, + "DNS", + "Anwendung", + "ID=26956 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" + ], + [ + "9", + "02:00:00:00:01:13", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "192.168.0.11", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "9", + "53", + "59860", + "UDP", + "Transport", + "" + ], + [ + "9", + null, + null, + "DNS", + "Anwendung", + "ID=26956 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:12 [op=REPLY, sender=02:00:00:00:01:12|192.168.0.10, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "56738", + "53", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "DNS", + "Anwendung", + "ID=37623 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" + ], + [ + "4", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "4", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "5", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "5", + "192.168.0.11", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.11, target=02:00:00:00:01:12|192.168.0.10]" + ], + [ + "6", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "6", + "64537", + "53", + "UDP", + "Transport", + "" + ], + [ + "6", + null, + null, + "DNS", + "Anwendung", + "ID=8610 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" + ], + [ + "7", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "7", + "53", + "64537", + "UDP", + "Transport", + "" + ], + [ + "7", + null, + null, + "DNS", + "Anwendung", + "ID=8610 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ], + [ + "8", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "8", + "59840", + "53", + "UDP", + "Transport", + "" + ], + [ + "8", + null, + null, + "DNS", + "Anwendung", + "ID=55399 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" + ], + [ + "9", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "9", + "53", + "59840", + "UDP", + "Transport", + "" + ], + [ + "9", + null, + null, + "DNS", + "Anwendung", + "ID=55399 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ], + [ + "10", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "10", + "53", + "56738", + "UDP", + "Transport", + "" + ], + [ + "10", + null, + null, + "DNS", + "Anwendung", + "ID=37623 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=2 NSCOUNT=0 ARCOUNT=0 \nschule.de. NS 3600 ns.schule.de.\nns.schule.de. A 3600 192.168.0.11\n" + ], + [ + "11", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "11", + "192.168.0.20", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "3", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "192.168.0.11", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.11, target=02:00:00:00:01:12|192.168.0.10]" + ], + [ + "4", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "64537", + "53", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "DNS", + "Anwendung", + "ID=8610 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" + ], + [ + "5", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "53", + "64537", + "UDP", + "Transport", + "" + ], + [ + "5", + null, + null, + "DNS", + "Anwendung", + "ID=8610 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ], + [ + "6", + "02:00:00:00:01:12", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.10", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "6", + "59840", + "53", + "UDP", + "Transport", + "" + ], + [ + "6", + null, + null, + "DNS", + "Anwendung", + "ID=55399 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" + ], + [ + "7", + "02:00:00:00:01:13", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.11", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "7", + "53", + "59840", + "UDP", + "Transport", + "" + ], + [ + "7", + null, + null, + "DNS", + "Anwendung", + "ID=55399 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ], + [ + "8", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "8", + "192.168.0.20", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "9", + "02:00:00:00:01:13", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x806" + ], + [ + "9", + "192.168.0.11", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:13 [op=REPLY, sender=02:00:00:00:01:13|192.168.0.11, target=02:00:00:00:01:11|192.168.0.20]" + ], + [ + "10", + "02:00:00:00:01:11", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "192.168.0.20", + "192.168.0.11", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "10", + "59860", + "53", + "UDP", + "Transport", + "" + ], + [ + "10", + null, + null, + "DNS", + "Anwendung", + "ID=26956 QR=0 RCODE=0 QDCOUNT=1 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \nnix.schule.de. A IN\n" + ], + [ + "11", + "02:00:00:00:01:13", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "192.168.0.11", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "11", + "53", + "59860", + "UDP", + "Transport", + "" + ], + [ + "11", + null, + null, + "DNS", + "Anwendung", + "ID=26956 QR=1 RCODE=0 QDCOUNT=0 ANCOUNT=0 NSCOUNT=0 ARCOUNT=0 \n" + ] + ], + "00000000-0000-0000-0000-000000000104": [ + [ + "1", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ], + [ + "3", + "02:00:00:00:01:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "192.168.0.20", + "192.168.0.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.11 [op=REQUEST, sender=02:00:00:00:01:11|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.11]" + ] + ] + }, "events": [ [ - 738, + 718, "holeIPAdresse nix.schule.de called" ], [ - 2345, + 2313, "holeIPAdresse nix.schule.de returned null" ] ] diff --git a/packages/core/test/scenarios/nat-java-forward.java.json b/packages/core/test/scenarios/nat-java-forward.java.json index f1d2d2f..f466679 100644 --- a/packages/core/test/scenarios/nat-java-forward.java.json +++ b/packages/core/test/scenarios/nat-java-forward.java.json @@ -2,7 +2,7 @@ "frames": { "00000000-0000-0000-0000-000000000501": [ { - "time": 1342, + "time": 1339, "source": "02:00:00:00:05:22", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -10,7 +10,7 @@ "targetIp": "192.168.0.10" }, { - "time": 1343, + "time": 1339, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "arp": 2, @@ -18,163 +18,163 @@ "targetIp": "192.168.0.1" }, { - "time": 1454, + "time": 1451, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "sourceIp": "42.0.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 49255, + "sourcePort": 59062, "destinationPort": 80, "payload": null, "tcpFlags": "S", - "sequence": 3000000, + "sequence": 2000000, "acknowledgement": 0 }, { - "time": 1456, + "time": 1452, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "sourceIp": "192.168.0.10", "destinationIp": "42.0.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 49255, + "destinationPort": 59062, "payload": null, "tcpFlags": "SA", - "sequence": 2000000, - "acknowledgement": 3000001 - }, - { - "time": 1791, - "source": "02:00:00:00:05:22", - "destination": "02:00:00:00:05:11", - "sourceIp": "42.0.0.20", - "destinationIp": "192.168.0.10", - "protocol": 6, - "sourcePort": 49255, - "destinationPort": 80, - "payload": null, - "tcpFlags": "A", - "sequence": 3000001, + "sequence": 1000000, "acknowledgement": 2000001 }, { - "time": 1890, + "time": 1787, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "sourceIp": "42.0.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 49255, + "sourcePort": 59062, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 2000001, + "acknowledgement": 1000001 + }, + { + "time": 1885, + "source": "02:00:00:00:05:22", + "destination": "02:00:00:00:05:11", + "sourceIp": "42.0.0.20", + "destinationIp": "192.168.0.10", + "protocol": 6, + "sourcePort": 59062, "destinationPort": 80, "payload": "hello", "tcpFlags": "P", - "sequence": 3000001, + "sequence": 2000001, "acknowledgement": 0 }, { - "time": 1890, + "time": 1886, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "sourceIp": "192.168.0.10", "destinationIp": "42.0.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 49255, + "destinationPort": 59062, "payload": null, "tcpFlags": "A", - "sequence": 2000001, - "acknowledgement": 3000006 + "sequence": 1000001, + "acknowledgement": 2000006 }, { - "time": 1946, + "time": 1941, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "sourceIp": "192.168.0.10", "destinationIp": "42.0.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 49255, + "destinationPort": 59062, "payload": "reply hello", "tcpFlags": "P", - "sequence": 2000001, + "sequence": 1000001, "acknowledgement": 0 }, { - "time": 2281, + "time": 2275, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "sourceIp": "42.0.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 49255, + "sourcePort": 59062, "destinationPort": 80, "payload": null, "tcpFlags": "A", - "sequence": 3000006, - "acknowledgement": 2000012 + "sequence": 2000006, + "acknowledgement": 1000012 }, { - "time": 2337, + "time": 2331, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "sourceIp": "42.0.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 49255, + "sourcePort": 59062, "destinationPort": 80, "payload": null, "tcpFlags": "F", - "sequence": 3000006, + "sequence": 2000006, "acknowledgement": 0 }, { - "time": 2337, + "time": 2331, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "sourceIp": "192.168.0.10", "destinationIp": "42.0.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 49255, + "destinationPort": 59062, "payload": null, "tcpFlags": "A", - "sequence": 2000012, - "acknowledgement": 3000007 + "sequence": 1000012, + "acknowledgement": 2000007 }, { - "time": 2392, + "time": 2387, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "sourceIp": "192.168.0.10", "destinationIp": "42.0.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 49255, + "destinationPort": 59062, "payload": null, "tcpFlags": "F", - "sequence": 2000012, + "sequence": 1000012, "acknowledgement": 0 }, { - "time": 2727, + "time": 2721, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "sourceIp": "42.0.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 49255, + "sourcePort": 59062, "destinationPort": 80, "payload": null, "tcpFlags": "A", - "sequence": 3000007, - "acknowledgement": 2000013 + "sequence": 2000007, + "acknowledgement": 1000013 } ], "00000000-0000-0000-0000-000000000502": [ { - "time": 1057, + "time": 1053, "source": "02:00:00:00:05:41", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -182,7 +182,7 @@ "targetIp": "42.0.0.10" }, { - "time": 1058, + "time": 1054, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "arp": 2, @@ -190,163 +190,163 @@ "targetIp": "42.0.0.20" }, { - "time": 1286, + "time": 1282, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "sourceIp": "42.0.0.20", "destinationIp": "42.0.0.10", "protocol": 6, - "sourcePort": 49255, + "sourcePort": 59062, "destinationPort": 8080, "payload": null, "tcpFlags": "S", - "sequence": 3000000, + "sequence": 2000000, "acknowledgement": 0 }, { - "time": 1512, + "time": 1508, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "sourceIp": "42.0.0.10", "destinationIp": "42.0.0.20", "protocol": 6, "sourcePort": 8080, - "destinationPort": 49255, + "destinationPort": 59062, "payload": null, "tcpFlags": "SA", - "sequence": 2000000, - "acknowledgement": 3000001 - }, - { - "time": 1735, - "source": "02:00:00:00:05:41", - "destination": "02:00:00:00:05:21", - "sourceIp": "42.0.0.20", - "destinationIp": "42.0.0.10", - "protocol": 6, - "sourcePort": 49255, - "destinationPort": 8080, - "payload": null, - "tcpFlags": "A", - "sequence": 3000001, + "sequence": 1000000, "acknowledgement": 2000001 }, { - "time": 1834, + "time": 1731, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "sourceIp": "42.0.0.20", "destinationIp": "42.0.0.10", "protocol": 6, - "sourcePort": 49255, + "sourcePort": 59062, + "destinationPort": 8080, + "payload": null, + "tcpFlags": "A", + "sequence": 2000001, + "acknowledgement": 1000001 + }, + { + "time": 1829, + "source": "02:00:00:00:05:41", + "destination": "02:00:00:00:05:21", + "sourceIp": "42.0.0.20", + "destinationIp": "42.0.0.10", + "protocol": 6, + "sourcePort": 59062, "destinationPort": 8080, "payload": "hello", "tcpFlags": "P", - "sequence": 3000001, + "sequence": 2000001, "acknowledgement": 0 }, { - "time": 1946, + "time": 1941, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "sourceIp": "42.0.0.10", "destinationIp": "42.0.0.20", "protocol": 6, "sourcePort": 8080, - "destinationPort": 49255, + "destinationPort": 59062, "payload": null, "tcpFlags": "A", - "sequence": 2000001, - "acknowledgement": 3000006 + "sequence": 1000001, + "acknowledgement": 2000006 }, { - "time": 2002, + "time": 1997, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "sourceIp": "42.0.0.10", "destinationIp": "42.0.0.20", "protocol": 6, "sourcePort": 8080, - "destinationPort": 49255, + "destinationPort": 59062, "payload": "reply hello", "tcpFlags": "P", - "sequence": 2000001, + "sequence": 1000001, "acknowledgement": 0 }, { - "time": 2225, + "time": 2219, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "sourceIp": "42.0.0.20", "destinationIp": "42.0.0.10", "protocol": 6, - "sourcePort": 49255, + "sourcePort": 59062, "destinationPort": 8080, "payload": null, "tcpFlags": "A", - "sequence": 3000006, - "acknowledgement": 2000012 + "sequence": 2000006, + "acknowledgement": 1000012 }, { - "time": 2281, + "time": 2275, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "sourceIp": "42.0.0.20", "destinationIp": "42.0.0.10", "protocol": 6, - "sourcePort": 49255, + "sourcePort": 59062, "destinationPort": 8080, "payload": null, "tcpFlags": "F", - "sequence": 3000006, + "sequence": 2000006, "acknowledgement": 0 }, { - "time": 2393, + "time": 2387, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "sourceIp": "42.0.0.10", "destinationIp": "42.0.0.20", "protocol": 6, "sourcePort": 8080, - "destinationPort": 49255, + "destinationPort": 59062, "payload": null, "tcpFlags": "A", - "sequence": 2000012, - "acknowledgement": 3000007 + "sequence": 1000012, + "acknowledgement": 2000007 }, { - "time": 2448, + "time": 2442, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "sourceIp": "42.0.0.10", "destinationIp": "42.0.0.20", "protocol": 6, "sourcePort": 8080, - "destinationPort": 49255, + "destinationPort": 59062, "payload": null, "tcpFlags": "F", - "sequence": 2000012, + "sequence": 1000012, "acknowledgement": 0 }, { - "time": 2671, + "time": 2665, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "sourceIp": "42.0.0.20", "destinationIp": "42.0.0.10", "protocol": 6, - "sourcePort": 49255, + "sourcePort": 59062, "destinationPort": 8080, "payload": null, "tcpFlags": "A", - "sequence": 3000007, - "acknowledgement": 2000013 + "sequence": 2000007, + "acknowledgement": 1000013 } ], "00000000-0000-0000-0000-000000000502#1": [ { - "time": 1287, + "time": 1283, "source": "02:00:00:00:05:22", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -354,7 +354,7 @@ "targetIp": "192.168.0.10" }, { - "time": 1398, + "time": 1395, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "arp": 2, @@ -362,163 +362,163 @@ "targetIp": "192.168.0.1" }, { - "time": 1399, + "time": 1395, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "sourceIp": "42.0.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 49255, + "sourcePort": 59062, "destinationPort": 80, "payload": null, "tcpFlags": "S", - "sequence": 3000000, + "sequence": 2000000, "acknowledgement": 0 }, { - "time": 1512, + "time": 1508, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "sourceIp": "192.168.0.10", "destinationIp": "42.0.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 49255, + "destinationPort": 59062, "payload": null, "tcpFlags": "SA", - "sequence": 2000000, - "acknowledgement": 3000001 - }, - { - "time": 1736, - "source": "02:00:00:00:05:22", - "destination": "02:00:00:00:05:11", - "sourceIp": "42.0.0.20", - "destinationIp": "192.168.0.10", - "protocol": 6, - "sourcePort": 49255, - "destinationPort": 80, - "payload": null, - "tcpFlags": "A", - "sequence": 3000001, + "sequence": 1000000, "acknowledgement": 2000001 }, { - "time": 1834, + "time": 1732, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "sourceIp": "42.0.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 49255, + "sourcePort": 59062, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 2000001, + "acknowledgement": 1000001 + }, + { + "time": 1830, + "source": "02:00:00:00:05:22", + "destination": "02:00:00:00:05:11", + "sourceIp": "42.0.0.20", + "destinationIp": "192.168.0.10", + "protocol": 6, + "sourcePort": 59062, "destinationPort": 80, "payload": "hello", "tcpFlags": "P", - "sequence": 3000001, + "sequence": 2000001, "acknowledgement": 0 }, { - "time": 1946, + "time": 1941, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "sourceIp": "192.168.0.10", "destinationIp": "42.0.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 49255, + "destinationPort": 59062, "payload": null, "tcpFlags": "A", - "sequence": 2000001, - "acknowledgement": 3000006 + "sequence": 1000001, + "acknowledgement": 2000006 }, { - "time": 2002, + "time": 1997, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "sourceIp": "192.168.0.10", "destinationIp": "42.0.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 49255, + "destinationPort": 59062, "payload": "reply hello", "tcpFlags": "P", - "sequence": 2000001, + "sequence": 1000001, "acknowledgement": 0 }, { - "time": 2225, + "time": 2220, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "sourceIp": "42.0.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 49255, + "sourcePort": 59062, "destinationPort": 80, "payload": null, "tcpFlags": "A", - "sequence": 3000006, - "acknowledgement": 2000012 + "sequence": 2000006, + "acknowledgement": 1000012 }, { - "time": 2281, + "time": 2275, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "sourceIp": "42.0.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 49255, + "sourcePort": 59062, "destinationPort": 80, "payload": null, "tcpFlags": "F", - "sequence": 3000006, + "sequence": 2000006, "acknowledgement": 0 }, { - "time": 2392, + "time": 2387, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "sourceIp": "192.168.0.10", "destinationIp": "42.0.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 49255, + "destinationPort": 59062, "payload": null, "tcpFlags": "A", - "sequence": 2000012, - "acknowledgement": 3000007 + "sequence": 1000012, + "acknowledgement": 2000007 }, { - "time": 2448, + "time": 2442, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "sourceIp": "192.168.0.10", "destinationIp": "42.0.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 49255, + "destinationPort": 59062, "payload": null, "tcpFlags": "F", - "sequence": 2000012, + "sequence": 1000012, "acknowledgement": 0 }, { - "time": 2671, + "time": 2665, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "sourceIp": "42.0.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 49255, + "sourcePort": 59062, "destinationPort": 80, "payload": null, "tcpFlags": "A", - "sequence": 3000007, - "acknowledgement": 2000013 + "sequence": 2000007, + "acknowledgement": 1000013 } ], "00000000-0000-0000-0000-000000000504": [ { - "time": 935, + "time": 930, "source": "02:00:00:00:05:41", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -526,7 +526,7 @@ "targetIp": "42.0.0.10" }, { - "time": 1170, + "time": 1166, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "arp": 2, @@ -534,163 +534,163 @@ "targetIp": "42.0.0.20" }, { - "time": 1172, + "time": 1169, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "sourceIp": "42.0.0.20", "destinationIp": "42.0.0.10", "protocol": 6, - "sourcePort": 49255, + "sourcePort": 59062, "destinationPort": 8080, "payload": null, "tcpFlags": "S", - "sequence": 3000000, + "sequence": 2000000, "acknowledgement": 0 }, { - "time": 1624, + "time": 1620, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "sourceIp": "42.0.0.10", "destinationIp": "42.0.0.20", "protocol": 6, "sourcePort": 8080, - "destinationPort": 49255, + "destinationPort": 59062, "payload": null, "tcpFlags": "SA", - "sequence": 2000000, - "acknowledgement": 3000001 - }, - { - "time": 1624, - "source": "02:00:00:00:05:41", - "destination": "02:00:00:00:05:21", - "sourceIp": "42.0.0.20", - "destinationIp": "42.0.0.10", - "protocol": 6, - "sourcePort": 49255, - "destinationPort": 8080, - "payload": null, - "tcpFlags": "A", - "sequence": 3000001, + "sequence": 1000000, "acknowledgement": 2000001 }, { - "time": 1723, + "time": 1620, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "sourceIp": "42.0.0.20", "destinationIp": "42.0.0.10", "protocol": 6, - "sourcePort": 49255, + "sourcePort": 59062, + "destinationPort": 8080, + "payload": null, + "tcpFlags": "A", + "sequence": 2000001, + "acknowledgement": 1000001 + }, + { + "time": 1718, + "source": "02:00:00:00:05:41", + "destination": "02:00:00:00:05:21", + "sourceIp": "42.0.0.20", + "destinationIp": "42.0.0.10", + "protocol": 6, + "sourcePort": 59062, "destinationPort": 8080, "payload": "hello", "tcpFlags": "P", - "sequence": 3000001, + "sequence": 2000001, "acknowledgement": 0 }, { - "time": 2057, + "time": 2052, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "sourceIp": "42.0.0.10", "destinationIp": "42.0.0.20", "protocol": 6, "sourcePort": 8080, - "destinationPort": 49255, + "destinationPort": 59062, "payload": null, "tcpFlags": "A", - "sequence": 2000001, - "acknowledgement": 3000006 + "sequence": 1000001, + "acknowledgement": 2000006 }, { - "time": 2113, + "time": 2108, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "sourceIp": "42.0.0.10", "destinationIp": "42.0.0.20", "protocol": 6, "sourcePort": 8080, - "destinationPort": 49255, + "destinationPort": 59062, "payload": "reply hello", "tcpFlags": "P", - "sequence": 2000001, + "sequence": 1000001, "acknowledgement": 0 }, { - "time": 2114, + "time": 2109, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "sourceIp": "42.0.0.20", "destinationIp": "42.0.0.10", "protocol": 6, - "sourcePort": 49255, + "sourcePort": 59062, "destinationPort": 8080, "payload": null, "tcpFlags": "A", - "sequence": 3000006, - "acknowledgement": 2000012 + "sequence": 2000006, + "acknowledgement": 1000012 }, { - "time": 2169, + "time": 2164, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "sourceIp": "42.0.0.20", "destinationIp": "42.0.0.10", "protocol": 6, - "sourcePort": 49255, + "sourcePort": 59062, "destinationPort": 8080, "payload": null, "tcpFlags": "F", - "sequence": 3000006, + "sequence": 2000006, "acknowledgement": 0 }, { - "time": 2504, + "time": 2498, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "sourceIp": "42.0.0.10", "destinationIp": "42.0.0.20", "protocol": 6, "sourcePort": 8080, - "destinationPort": 49255, + "destinationPort": 59062, "payload": null, "tcpFlags": "A", - "sequence": 2000012, - "acknowledgement": 3000007 + "sequence": 1000012, + "acknowledgement": 2000007 }, { - "time": 2560, + "time": 2554, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "sourceIp": "42.0.0.10", "destinationIp": "42.0.0.20", "protocol": 6, "sourcePort": 8080, - "destinationPort": 49255, + "destinationPort": 59062, "payload": null, "tcpFlags": "F", - "sequence": 2000012, + "sequence": 1000012, "acknowledgement": 0 }, { - "time": 2560, + "time": 2554, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "sourceIp": "42.0.0.20", "destinationIp": "42.0.0.10", "protocol": 6, - "sourcePort": 49255, + "sourcePort": 59062, "destinationPort": 8080, "payload": null, "tcpFlags": "A", - "sequence": 3000007, - "acknowledgement": 2000013 + "sequence": 2000007, + "acknowledgement": 1000013 } ], "00000000-0000-0000-0000-000000000505": [ { - "time": 1057, + "time": 1053, "source": "02:00:00:00:05:41", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -699,61 +699,2613 @@ } ] }, + "rows": { + "00000000-0000-0000-0000-000000000501": [ + [ + "1", + "02:00:00:00:05:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.1", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:05:22|192.168.0.1, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.1", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:11 [op=REPLY, sender=02:00:00:00:05:11|192.168.0.10, target=02:00:00:00:05:22|192.168.0.1]" + ], + [ + "3", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "3", + "42.0.0.20:59062", + "192.168.0.10:80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "192.168.0.10:80", + "42.0.0.20:59062", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "5", + "42.0.0.20:59062", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "6", + "42.0.0.20:59062", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "6", + "42.0.0.20:59062", + "192.168.0.10:80", + "", + "Anwendung", + "hello" + ], + [ + "7", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "7", + "192.168.0.10:80", + "42.0.0.20:59062", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.006" + ], + [ + "8", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "8", + "192.168.0.10:80", + "42.0.0.20:59062", + "TCP", + "Transport", + "SEQ: 1.000.001" + ], + [ + "8", + "192.168.0.10:80", + "42.0.0.20:59062", + "HTTP", + "Anwendung", + "reply hello" + ], + [ + "9", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "9", + "42.0.0.20:59062", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.006, ACK: 1.000.012" + ], + [ + "10", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "10", + "42.0.0.20:59062", + "192.168.0.10:80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.006" + ], + [ + "11", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "11", + "192.168.0.10:80", + "42.0.0.20:59062", + "TCP", + "Transport", + "SEQ: 1.000.012, ACK: 2.000.007" + ], + [ + "12", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "12", + "192.168.0.10:80", + "42.0.0.20:59062", + "TCP", + "Transport", + "FIN, SEQ: 1.000.012" + ], + [ + "13", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "13", + "42.0.0.20:59062", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.007, ACK: 1.000.013" + ] + ], + "00000000-0000-0000-0000-000000000502": [ + [ + "1", + "02:00:00:00:05:41", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.20", + "42.0.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.10 [op=REQUEST, sender=02:00:00:00:05:41|42.0.0.20, target=FF:FF:FF:FF:FF:FF|42.0.0.10]" + ], + [ + "2", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:21 [op=REPLY, sender=02:00:00:00:05:21|42.0.0.10, target=02:00:00:00:05:41|42.0.0.20]" + ], + [ + "3", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "42.0.0.20:59062", + "42.0.0.10:8080", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "4", + "42.0.0.10:8080", + "42.0.0.20:59062", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "42.0.0.20:59062", + "42.0.0.10:8080", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "42.0.0.20:59062", + "42.0.0.10:8080", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "6", + "42.0.0.20:59062", + "42.0.0.10:8080", + "", + "Anwendung", + "hello" + ], + [ + "7", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "7", + "42.0.0.10:8080", + "42.0.0.20:59062", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.006" + ], + [ + "8", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "8", + "42.0.0.10:8080", + "42.0.0.20:59062", + "TCP", + "Transport", + "SEQ: 1.000.001" + ], + [ + "8", + "42.0.0.10:8080", + "42.0.0.20:59062", + "", + "Anwendung", + "reply hello" + ], + [ + "9", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "9", + "42.0.0.20:59062", + "42.0.0.10:8080", + "TCP", + "Transport", + "SEQ: 2.000.006, ACK: 1.000.012" + ], + [ + "10", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "10", + "42.0.0.20:59062", + "42.0.0.10:8080", + "TCP", + "Transport", + "FIN, SEQ: 2.000.006" + ], + [ + "11", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "11", + "42.0.0.10:8080", + "42.0.0.20:59062", + "TCP", + "Transport", + "SEQ: 1.000.012, ACK: 2.000.007" + ], + [ + "12", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "12", + "42.0.0.10:8080", + "42.0.0.20:59062", + "TCP", + "Transport", + "FIN, SEQ: 1.000.012" + ], + [ + "13", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "13", + "42.0.0.20:59062", + "42.0.0.10:8080", + "TCP", + "Transport", + "SEQ: 2.000.007, ACK: 1.000.013" + ] + ], + "00000000-0000-0000-0000-000000000502#1": [ + [ + "1", + "02:00:00:00:05:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.1", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:05:22|192.168.0.1, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.1", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:11 [op=REPLY, sender=02:00:00:00:05:11|192.168.0.10, target=02:00:00:00:05:22|192.168.0.1]" + ], + [ + "3", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "3", + "42.0.0.20:59062", + "192.168.0.10:80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "192.168.0.10:80", + "42.0.0.20:59062", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "5", + "42.0.0.20:59062", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "6", + "42.0.0.20:59062", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "6", + "42.0.0.20:59062", + "192.168.0.10:80", + "", + "Anwendung", + "hello" + ], + [ + "7", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "7", + "192.168.0.10:80", + "42.0.0.20:59062", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.006" + ], + [ + "8", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "8", + "192.168.0.10:80", + "42.0.0.20:59062", + "TCP", + "Transport", + "SEQ: 1.000.001" + ], + [ + "8", + "192.168.0.10:80", + "42.0.0.20:59062", + "HTTP", + "Anwendung", + "reply hello" + ], + [ + "9", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "9", + "42.0.0.20:59062", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.006, ACK: 1.000.012" + ], + [ + "10", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "10", + "42.0.0.20:59062", + "192.168.0.10:80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.006" + ], + [ + "11", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "11", + "192.168.0.10:80", + "42.0.0.20:59062", + "TCP", + "Transport", + "SEQ: 1.000.012, ACK: 2.000.007" + ], + [ + "12", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "12", + "192.168.0.10:80", + "42.0.0.20:59062", + "TCP", + "Transport", + "FIN, SEQ: 1.000.012" + ], + [ + "13", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "13", + "42.0.0.20:59062", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.007, ACK: 1.000.013" + ] + ], + "00000000-0000-0000-0000-000000000504": [ + [ + "1", + "02:00:00:00:05:41", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.20", + "42.0.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.10 [op=REQUEST, sender=02:00:00:00:05:41|42.0.0.20, target=FF:FF:FF:FF:FF:FF|42.0.0.10]" + ], + [ + "2", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:21 [op=REPLY, sender=02:00:00:00:05:21|42.0.0.10, target=02:00:00:00:05:41|42.0.0.20]" + ], + [ + "3", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "42.0.0.20:59062", + "42.0.0.10:8080", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "4", + "42.0.0.10:8080", + "42.0.0.20:59062", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "42.0.0.20:59062", + "42.0.0.10:8080", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "42.0.0.20:59062", + "42.0.0.10:8080", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "6", + "42.0.0.20:59062", + "42.0.0.10:8080", + "", + "Anwendung", + "hello" + ], + [ + "7", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "7", + "42.0.0.10:8080", + "42.0.0.20:59062", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.006" + ], + [ + "8", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "8", + "42.0.0.10:8080", + "42.0.0.20:59062", + "TCP", + "Transport", + "SEQ: 1.000.001" + ], + [ + "8", + "42.0.0.10:8080", + "42.0.0.20:59062", + "", + "Anwendung", + "reply hello" + ], + [ + "9", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "9", + "42.0.0.20:59062", + "42.0.0.10:8080", + "TCP", + "Transport", + "SEQ: 2.000.006, ACK: 1.000.012" + ], + [ + "10", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "10", + "42.0.0.20:59062", + "42.0.0.10:8080", + "TCP", + "Transport", + "FIN, SEQ: 2.000.006" + ], + [ + "11", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "11", + "42.0.0.10:8080", + "42.0.0.20:59062", + "TCP", + "Transport", + "SEQ: 1.000.012, ACK: 2.000.007" + ], + [ + "12", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "12", + "42.0.0.10:8080", + "42.0.0.20:59062", + "TCP", + "Transport", + "FIN, SEQ: 1.000.012" + ], + [ + "13", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "13", + "42.0.0.20:59062", + "42.0.0.10:8080", + "TCP", + "Transport", + "SEQ: 2.000.007, ACK: 1.000.013" + ] + ], + "00000000-0000-0000-0000-000000000505": [ + [ + "1", + "02:00:00:00:05:41", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.20", + "42.0.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.10 [op=REQUEST, sender=02:00:00:00:05:41|42.0.0.20, target=FF:FF:FF:FF:FF:FF|42.0.0.10]" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000501": [ + [ + "1", + "02:00:00:00:05:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.1", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:05:22|192.168.0.1, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.1", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:11 [op=REPLY, sender=02:00:00:00:05:11|192.168.0.10, target=02:00:00:00:05:22|192.168.0.1]" + ], + [ + "3", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "3", + "59062", + "80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "80", + "59062", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "5", + "59062", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "6", + "59062", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "6", + null, + null, + "", + "Anwendung", + "hello" + ], + [ + "7", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "7", + "80", + "59062", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.006" + ], + [ + "8", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "8", + "80", + "59062", + "TCP", + "Transport", + "SEQ: 1.000.001" + ], + [ + "8", + null, + null, + "HTTP", + "Anwendung", + "reply hello" + ], + [ + "9", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "9", + "59062", + "80", + "TCP", + "Transport", + "SEQ: 2.000.006, ACK: 1.000.012" + ], + [ + "10", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "10", + "59062", + "80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.006" + ], + [ + "11", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "11", + "80", + "59062", + "TCP", + "Transport", + "SEQ: 1.000.012, ACK: 2.000.007" + ], + [ + "12", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "12", + "80", + "59062", + "TCP", + "Transport", + "FIN, SEQ: 1.000.012" + ], + [ + "13", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "13", + "59062", + "80", + "TCP", + "Transport", + "SEQ: 2.000.007, ACK: 1.000.013" + ] + ], + "00000000-0000-0000-0000-000000000502": [ + [ + "1", + "02:00:00:00:05:41", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.20", + "42.0.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.10 [op=REQUEST, sender=02:00:00:00:05:41|42.0.0.20, target=FF:FF:FF:FF:FF:FF|42.0.0.10]" + ], + [ + "2", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:21 [op=REPLY, sender=02:00:00:00:05:21|42.0.0.10, target=02:00:00:00:05:41|42.0.0.20]" + ], + [ + "3", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "59062", + "8080", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "4", + "8080", + "59062", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "59062", + "8080", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "59062", + "8080", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "6", + null, + null, + "", + "Anwendung", + "hello" + ], + [ + "7", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "7", + "8080", + "59062", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.006" + ], + [ + "8", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "8", + "8080", + "59062", + "TCP", + "Transport", + "SEQ: 1.000.001" + ], + [ + "8", + null, + null, + "", + "Anwendung", + "reply hello" + ], + [ + "9", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "9", + "59062", + "8080", + "TCP", + "Transport", + "SEQ: 2.000.006, ACK: 1.000.012" + ], + [ + "10", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "10", + "59062", + "8080", + "TCP", + "Transport", + "FIN, SEQ: 2.000.006" + ], + [ + "11", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "11", + "8080", + "59062", + "TCP", + "Transport", + "SEQ: 1.000.012, ACK: 2.000.007" + ], + [ + "12", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "12", + "8080", + "59062", + "TCP", + "Transport", + "FIN, SEQ: 1.000.012" + ], + [ + "13", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "13", + "59062", + "8080", + "TCP", + "Transport", + "SEQ: 2.000.007, ACK: 1.000.013" + ] + ], + "00000000-0000-0000-0000-000000000502#1": [ + [ + "1", + "02:00:00:00:05:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.1", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:05:22|192.168.0.1, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.1", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:11 [op=REPLY, sender=02:00:00:00:05:11|192.168.0.10, target=02:00:00:00:05:22|192.168.0.1]" + ], + [ + "3", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "3", + "59062", + "80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "80", + "59062", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "5", + "59062", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "6", + "59062", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "6", + null, + null, + "", + "Anwendung", + "hello" + ], + [ + "7", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "7", + "80", + "59062", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.006" + ], + [ + "8", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "8", + "80", + "59062", + "TCP", + "Transport", + "SEQ: 1.000.001" + ], + [ + "8", + null, + null, + "HTTP", + "Anwendung", + "reply hello" + ], + [ + "9", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "9", + "59062", + "80", + "TCP", + "Transport", + "SEQ: 2.000.006, ACK: 1.000.012" + ], + [ + "10", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "10", + "59062", + "80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.006" + ], + [ + "11", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "11", + "80", + "59062", + "TCP", + "Transport", + "SEQ: 1.000.012, ACK: 2.000.007" + ], + [ + "12", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "12", + "80", + "59062", + "TCP", + "Transport", + "FIN, SEQ: 1.000.012" + ], + [ + "13", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "13", + "59062", + "80", + "TCP", + "Transport", + "SEQ: 2.000.007, ACK: 1.000.013" + ] + ], + "00000000-0000-0000-0000-000000000504": [ + [ + "1", + "02:00:00:00:05:41", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.20", + "42.0.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.10 [op=REQUEST, sender=02:00:00:00:05:41|42.0.0.20, target=FF:FF:FF:FF:FF:FF|42.0.0.10]" + ], + [ + "2", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:21 [op=REPLY, sender=02:00:00:00:05:21|42.0.0.10, target=02:00:00:00:05:41|42.0.0.20]" + ], + [ + "3", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "59062", + "8080", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "4", + "8080", + "59062", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "59062", + "8080", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "59062", + "8080", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "6", + null, + null, + "", + "Anwendung", + "hello" + ], + [ + "7", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "7", + "8080", + "59062", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.006" + ], + [ + "8", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "8", + "8080", + "59062", + "TCP", + "Transport", + "SEQ: 1.000.001" + ], + [ + "8", + null, + null, + "", + "Anwendung", + "reply hello" + ], + [ + "9", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "9", + "59062", + "8080", + "TCP", + "Transport", + "SEQ: 2.000.006, ACK: 1.000.012" + ], + [ + "10", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "10", + "59062", + "8080", + "TCP", + "Transport", + "FIN, SEQ: 2.000.006" + ], + [ + "11", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "11", + "8080", + "59062", + "TCP", + "Transport", + "SEQ: 1.000.012, ACK: 2.000.007" + ], + [ + "12", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "12", + "8080", + "59062", + "TCP", + "Transport", + "FIN, SEQ: 1.000.012" + ], + [ + "13", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "13", + "59062", + "8080", + "TCP", + "Transport", + "SEQ: 2.000.007, ACK: 1.000.013" + ] + ], + "00000000-0000-0000-0000-000000000505": [ + [ + "1", + "02:00:00:00:05:41", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.20", + "42.0.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.10 [op=REQUEST, sender=02:00:00:00:05:41|42.0.0.20, target=FF:FF:FF:FF:FF:FF|42.0.0.10]" + ] + ] + }, "events": [ [ - 719, + 717, "server oeffnen called" ], [ - 921, + 917, "client verbinden called" ], [ - 1722, + 1717, "client verbinden returned " ], [ - 1722, + 1718, "client senden called" ], [ 1820, - "server oeffnen returned filius.software.transportschicht.TCPSocket@290a67fb" + "server oeffnen returned filius.software.transportschicht.TCPSocket@6b49fb42" ], [ 1820, "server empfangen called" ], [ - 1890, + 1885, "server empfangen returned hello" ], [ - 1891, + 1886, "server senden called" ], [ - 2058, + 2053, "client senden returned " ], [ - 2058, + 2053, "client empfangen called" ], [ - 2114, + 2108, "client empfangen returned reply hello" ], [ - 2114, + 2109, "client schliessen called" ], [ - 2114, + 2109, "client schliessen returned " ], [ - 2281, + 2275, "server senden returned " ] ], diff --git a/packages/core/test/scenarios/nat-java-pingOut.java.json b/packages/core/test/scenarios/nat-java-pingOut.java.json index ea671e4..eb2619a 100644 --- a/packages/core/test/scenarios/nat-java-pingOut.java.json +++ b/packages/core/test/scenarios/nat-java-pingOut.java.json @@ -2,7 +2,7 @@ "frames": { "00000000-0000-0000-0000-000000000501": [ { - "time": 717, + "time": 720, "source": "02:00:00:00:05:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -10,7 +10,7 @@ "targetIp": "192.168.0.1" }, { - "time": 837, + "time": 839, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "arp": 2, @@ -18,7 +18,7 @@ "targetIp": "192.168.0.10" }, { - "time": 841, + "time": 842, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "icmp": 8, @@ -28,7 +28,7 @@ "sequence": 1 }, { - "time": 1409, + "time": 1410, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "icmp": 0, @@ -40,7 +40,7 @@ ], "00000000-0000-0000-0000-000000000502": [ { - "time": 903, + "time": 904, "source": "02:00:00:00:05:21", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -48,7 +48,7 @@ "targetIp": "42.0.0.20" }, { - "time": 1130, + "time": 1131, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "arp": 2, @@ -56,7 +56,7 @@ "targetIp": "42.0.0.10" }, { - "time": 1130, + "time": 1131, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "icmp": 8, @@ -66,7 +66,7 @@ "sequence": 1 }, { - "time": 1352, + "time": 1354, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "icmp": 0, @@ -78,7 +78,7 @@ ], "00000000-0000-0000-0000-000000000502#1": [ { - "time": 780, + "time": 782, "source": "02:00:00:00:05:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -86,7 +86,7 @@ "targetIp": "192.168.0.1" }, { - "time": 782, + "time": 783, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "arp": 2, @@ -94,7 +94,7 @@ "targetIp": "192.168.0.10" }, { - "time": 898, + "time": 900, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "icmp": 8, @@ -104,7 +104,7 @@ "sequence": 1 }, { - "time": 1353, + "time": 1354, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "icmp": 0, @@ -116,7 +116,7 @@ ], "00000000-0000-0000-0000-000000000504": [ { - "time": 1018, + "time": 1020, "source": "02:00:00:00:05:21", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -124,7 +124,7 @@ "targetIp": "42.0.0.20" }, { - "time": 1018, + "time": 1020, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "arp": 2, @@ -132,7 +132,7 @@ "targetIp": "42.0.0.10" }, { - "time": 1241, + "time": 1243, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "icmp": 8, @@ -142,7 +142,7 @@ "sequence": 1 }, { - "time": 1241, + "time": 1243, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "icmp": 0, @@ -154,7 +154,7 @@ ], "00000000-0000-0000-0000-000000000505": [ { - "time": 1018, + "time": 1020, "source": "02:00:00:00:05:21", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -163,13 +163,581 @@ } ] }, + "rows": { + "00000000-0000-0000-0000-000000000501": [ + [ + "1", + "02:00:00:00:05:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.10", + "192.168.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.1 [op=REQUEST, sender=02:00:00:00:05:11|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.1]" + ], + [ + "2", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.1", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:22 [op=REPLY, sender=02:00:00:00:05:22|192.168.0.1, target=02:00:00:00:05:11|192.168.0.10]" + ], + [ + "3", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.10", + "42.0.0.20", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "192.168.0.10", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 63, Identifier: 1, Seq.-No.: 1" + ] + ], + "00000000-0000-0000-0000-000000000502": [ + [ + "1", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.20 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.20]" + ], + [ + "2", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "42.0.0.20", + "42.0.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:41 [op=REPLY, sender=02:00:00:00:05:41|42.0.0.20, target=02:00:00:00:05:21|42.0.0.10]" + ], + [ + "3", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "42.0.0.10", + "42.0.0.20", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 63, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "42.0.0.10", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 1" + ] + ], + "00000000-0000-0000-0000-000000000502#1": [ + [ + "1", + "02:00:00:00:05:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.10", + "192.168.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.1 [op=REQUEST, sender=02:00:00:00:05:11|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.1]" + ], + [ + "2", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.1", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:22 [op=REPLY, sender=02:00:00:00:05:22|192.168.0.1, target=02:00:00:00:05:11|192.168.0.10]" + ], + [ + "3", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.10", + "42.0.0.20", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "192.168.0.10", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 63, Identifier: 1, Seq.-No.: 1" + ] + ], + "00000000-0000-0000-0000-000000000504": [ + [ + "1", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.20 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.20]" + ], + [ + "2", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "42.0.0.20", + "42.0.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:41 [op=REPLY, sender=02:00:00:00:05:41|42.0.0.20, target=02:00:00:00:05:21|42.0.0.10]" + ], + [ + "3", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "42.0.0.10", + "42.0.0.20", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 63, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "42.0.0.10", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 1" + ] + ], + "00000000-0000-0000-0000-000000000505": [ + [ + "1", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.20 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.20]" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000501": [ + [ + "1", + "02:00:00:00:05:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.10", + "192.168.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.1 [op=REQUEST, sender=02:00:00:00:05:11|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.1]" + ], + [ + "2", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.1", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:22 [op=REPLY, sender=02:00:00:00:05:22|192.168.0.1, target=02:00:00:00:05:11|192.168.0.10]" + ], + [ + "3", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.10", + "42.0.0.20", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "192.168.0.10", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 63, Identifier: 1, Seq.-No.: 1" + ] + ], + "00000000-0000-0000-0000-000000000502": [ + [ + "1", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.20 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.20]" + ], + [ + "2", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "42.0.0.20", + "42.0.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:41 [op=REPLY, sender=02:00:00:00:05:41|42.0.0.20, target=02:00:00:00:05:21|42.0.0.10]" + ], + [ + "3", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "42.0.0.10", + "42.0.0.20", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 63, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "42.0.0.10", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 1" + ] + ], + "00000000-0000-0000-0000-000000000502#1": [ + [ + "1", + "02:00:00:00:05:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.10", + "192.168.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.1 [op=REQUEST, sender=02:00:00:00:05:11|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.1]" + ], + [ + "2", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.1", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:22 [op=REPLY, sender=02:00:00:00:05:22|192.168.0.1, target=02:00:00:00:05:11|192.168.0.10]" + ], + [ + "3", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.10", + "42.0.0.20", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "192.168.0.10", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 63, Identifier: 1, Seq.-No.: 1" + ] + ], + "00000000-0000-0000-0000-000000000504": [ + [ + "1", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.20 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.20]" + ], + [ + "2", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "42.0.0.20", + "42.0.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:41 [op=REPLY, sender=02:00:00:00:05:41|42.0.0.20, target=02:00:00:00:05:21|42.0.0.10]" + ], + [ + "3", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "42.0.0.10", + "42.0.0.20", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 63, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "42.0.0.10", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 1" + ] + ], + "00000000-0000-0000-0000-000000000505": [ + [ + "1", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.20 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.20]" + ] + ] + }, "events": [ [ - 713, + 716, "sendProbe 42.0.0.20 called" ], [ - 1410, + 1411, "sendProbe 42.0.0.20 returned ICMP 0/0 from 42.0.0.20" ] ], diff --git a/packages/core/test/scenarios/nat-java-pingWan.java.json b/packages/core/test/scenarios/nat-java-pingWan.java.json index 99fa067..c35e58f 100644 --- a/packages/core/test/scenarios/nat-java-pingWan.java.json +++ b/packages/core/test/scenarios/nat-java-pingWan.java.json @@ -3,7 +3,7 @@ "00000000-0000-0000-0000-000000000501": [], "00000000-0000-0000-0000-000000000502": [ { - "time": 851, + "time": 840, "source": "02:00:00:00:05:41", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -11,7 +11,7 @@ "targetIp": "42.0.0.10" }, { - "time": 853, + "time": 842, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "arp": 2, @@ -19,7 +19,7 @@ "targetIp": "42.0.0.20" }, { - "time": 1083, + "time": 1071, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "icmp": 8, @@ -29,7 +29,7 @@ "sequence": 1 }, { - "time": 1083, + "time": 1071, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "icmp": 0, @@ -39,7 +39,7 @@ "sequence": 1 }, { - "time": 1308, + "time": 1295, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "icmp": 8, @@ -52,7 +52,7 @@ "00000000-0000-0000-0000-000000000502#1": [], "00000000-0000-0000-0000-000000000504": [ { - "time": 729, + "time": 718, "source": "02:00:00:00:05:41", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -60,7 +60,7 @@ "targetIp": "42.0.0.10" }, { - "time": 965, + "time": 954, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "arp": 2, @@ -68,7 +68,7 @@ "targetIp": "42.0.0.20" }, { - "time": 969, + "time": 958, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "icmp": 8, @@ -78,7 +78,7 @@ "sequence": 1 }, { - "time": 1194, + "time": 1182, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "icmp": 0, @@ -88,7 +88,7 @@ "sequence": 1 }, { - "time": 1196, + "time": 1184, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "icmp": 8, @@ -100,7 +100,7 @@ ], "00000000-0000-0000-0000-000000000505": [ { - "time": 851, + "time": 840, "source": "02:00:00:00:05:41", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -109,21 +109,393 @@ } ] }, + "rows": { + "00000000-0000-0000-0000-000000000501": [], + "00000000-0000-0000-0000-000000000502": [ + [ + "1", + "02:00:00:00:05:41", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.20", + "42.0.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.10 [op=REQUEST, sender=02:00:00:00:05:41|42.0.0.20, target=FF:FF:FF:FF:FF:FF|42.0.0.10]" + ], + [ + "2", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:21 [op=REPLY, sender=02:00:00:00:05:21|42.0.0.10, target=02:00:00:00:05:41|42.0.0.20]" + ], + [ + "3", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "42.0.0.20", + "42.0.0.10", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.10", + "42.0.0.20", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "5", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "42.0.0.20", + "192.168.0.10", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 2" + ] + ], + "00000000-0000-0000-0000-000000000502#1": [], + "00000000-0000-0000-0000-000000000504": [ + [ + "1", + "02:00:00:00:05:41", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.20", + "42.0.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.10 [op=REQUEST, sender=02:00:00:00:05:41|42.0.0.20, target=FF:FF:FF:FF:FF:FF|42.0.0.10]" + ], + [ + "2", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:21 [op=REPLY, sender=02:00:00:00:05:21|42.0.0.10, target=02:00:00:00:05:41|42.0.0.20]" + ], + [ + "3", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "42.0.0.20", + "42.0.0.10", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.10", + "42.0.0.20", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "5", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "42.0.0.20", + "192.168.0.10", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 2" + ] + ], + "00000000-0000-0000-0000-000000000505": [ + [ + "1", + "02:00:00:00:05:41", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.20", + "42.0.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.10 [op=REQUEST, sender=02:00:00:00:05:41|42.0.0.20, target=FF:FF:FF:FF:FF:FF|42.0.0.10]" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000501": [], + "00000000-0000-0000-0000-000000000502": [ + [ + "1", + "02:00:00:00:05:41", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.20", + "42.0.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.10 [op=REQUEST, sender=02:00:00:00:05:41|42.0.0.20, target=FF:FF:FF:FF:FF:FF|42.0.0.10]" + ], + [ + "2", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:21 [op=REPLY, sender=02:00:00:00:05:21|42.0.0.10, target=02:00:00:00:05:41|42.0.0.20]" + ], + [ + "3", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "42.0.0.20", + "42.0.0.10", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.10", + "42.0.0.20", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "5", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "42.0.0.20", + "192.168.0.10", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 2" + ] + ], + "00000000-0000-0000-0000-000000000502#1": [], + "00000000-0000-0000-0000-000000000504": [ + [ + "1", + "02:00:00:00:05:41", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.20", + "42.0.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.10 [op=REQUEST, sender=02:00:00:00:05:41|42.0.0.20, target=FF:FF:FF:FF:FF:FF|42.0.0.10]" + ], + [ + "2", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:21 [op=REPLY, sender=02:00:00:00:05:21|42.0.0.10, target=02:00:00:00:05:41|42.0.0.20]" + ], + [ + "3", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "42.0.0.20", + "42.0.0.10", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.10", + "42.0.0.20", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "5", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "42.0.0.20", + "192.168.0.10", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 2" + ] + ], + "00000000-0000-0000-0000-000000000505": [ + [ + "1", + "02:00:00:00:05:41", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.20", + "42.0.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.10 [op=REQUEST, sender=02:00:00:00:05:41|42.0.0.20, target=FF:FF:FF:FF:FF:FF|42.0.0.10]" + ] + ] + }, "events": [ [ - 725, + 713, "sendProbe 42.0.0.10 called" ], [ - 1196, + 1184, "sendProbe 42.0.0.10 returned ICMP 0/0 from 42.0.0.10" ], [ - 1196, + 1184, "sendProbe 192.168.0.10 called" ], [ - 3946, + 3934, "sendProbe 192.168.0.10 returned null" ] ], diff --git a/packages/core/test/scenarios/nat-java-tcpOut.java.json b/packages/core/test/scenarios/nat-java-tcpOut.java.json index eb9a7e4..ef54fd2 100644 --- a/packages/core/test/scenarios/nat-java-tcpOut.java.json +++ b/packages/core/test/scenarios/nat-java-tcpOut.java.json @@ -2,7 +2,7 @@ "frames": { "00000000-0000-0000-0000-000000000501": [ { - "time": 943, + "time": 934, "source": "02:00:00:00:05:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -10,7 +10,7 @@ "targetIp": "192.168.0.1" }, { - "time": 1063, + "time": 1056, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "arp": 2, @@ -18,13 +18,13 @@ "targetIp": "192.168.0.10" }, { - "time": 1066, + "time": 1058, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "sourceIp": "192.168.0.10", "destinationIp": "42.0.0.20", "protocol": 6, - "sourcePort": 49413, + "sourcePort": 49833, "destinationPort": 80, "payload": null, "tcpFlags": "S", @@ -32,27 +32,27 @@ "acknowledgement": 0 }, { - "time": 1633, + "time": 1623, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "sourceIp": "42.0.0.20", "destinationIp": "192.168.0.10", "protocol": 6, "sourcePort": 80, - "destinationPort": 49413, + "destinationPort": 49833, "payload": null, "tcpFlags": "SA", "sequence": 1000000, "acknowledgement": 2000001 }, { - "time": 1633, + "time": 1623, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "sourceIp": "192.168.0.10", "destinationIp": "42.0.0.20", "protocol": 6, - "sourcePort": 49413, + "sourcePort": 49833, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -60,13 +60,13 @@ "acknowledgement": 1000001 }, { - "time": 1726, + "time": 1717, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "sourceIp": "192.168.0.10", "destinationIp": "42.0.0.20", "protocol": 6, - "sourcePort": 49413, + "sourcePort": 49833, "destinationPort": 80, "payload": "hello", "tcpFlags": "P", @@ -74,41 +74,41 @@ "acknowledgement": 0 }, { - "time": 2061, + "time": 2051, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "sourceIp": "42.0.0.20", "destinationIp": "192.168.0.10", "protocol": 6, "sourcePort": 80, - "destinationPort": 49413, + "destinationPort": 49833, "payload": null, "tcpFlags": "A", "sequence": 1000001, "acknowledgement": 2000006 }, { - "time": 2117, + "time": 2107, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "sourceIp": "42.0.0.20", "destinationIp": "192.168.0.10", "protocol": 6, "sourcePort": 80, - "destinationPort": 49413, + "destinationPort": 49833, "payload": "reply hello", "tcpFlags": "P", "sequence": 1000001, "acknowledgement": 0 }, { - "time": 2117, + "time": 2107, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "sourceIp": "192.168.0.10", "destinationIp": "42.0.0.20", "protocol": 6, - "sourcePort": 49413, + "sourcePort": 49833, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -116,13 +116,13 @@ "acknowledgement": 1000012 }, { - "time": 2173, + "time": 2163, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "sourceIp": "192.168.0.10", "destinationIp": "42.0.0.20", "protocol": 6, - "sourcePort": 49413, + "sourcePort": 49833, "destinationPort": 80, "payload": null, "tcpFlags": "F", @@ -130,41 +130,41 @@ "acknowledgement": 0 }, { - "time": 2507, + "time": 2497, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "sourceIp": "42.0.0.20", "destinationIp": "192.168.0.10", "protocol": 6, "sourcePort": 80, - "destinationPort": 49413, + "destinationPort": 49833, "payload": null, "tcpFlags": "A", "sequence": 1000012, "acknowledgement": 2000007 }, { - "time": 2562, + "time": 2552, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "sourceIp": "42.0.0.20", "destinationIp": "192.168.0.10", "protocol": 6, "sourcePort": 80, - "destinationPort": 49413, + "destinationPort": 49833, "payload": null, "tcpFlags": "F", "sequence": 1000012, "acknowledgement": 0 }, { - "time": 2563, + "time": 2553, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "sourceIp": "192.168.0.10", "destinationIp": "42.0.0.20", "protocol": 6, - "sourcePort": 49413, + "sourcePort": 49833, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -174,7 +174,7 @@ ], "00000000-0000-0000-0000-000000000502": [ { - "time": 1124, + "time": 1117, "source": "02:00:00:00:05:21", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -182,7 +182,7 @@ "targetIp": "42.0.0.20" }, { - "time": 1352, + "time": 1342, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "arp": 2, @@ -190,13 +190,13 @@ "targetIp": "42.0.0.10" }, { - "time": 1352, + "time": 1343, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "sourceIp": "42.0.0.10", "destinationIp": "42.0.0.20", "protocol": 6, - "sourcePort": 65308, + "sourcePort": 57218, "destinationPort": 80, "payload": null, "tcpFlags": "S", @@ -204,27 +204,27 @@ "acknowledgement": 0 }, { - "time": 1577, + "time": 1567, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "sourceIp": "42.0.0.20", "destinationIp": "42.0.0.10", "protocol": 6, "sourcePort": 80, - "destinationPort": 65308, + "destinationPort": 57218, "payload": null, "tcpFlags": "SA", "sequence": 1000000, "acknowledgement": 2000001 }, { - "time": 1689, + "time": 1679, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "sourceIp": "42.0.0.10", "destinationIp": "42.0.0.20", "protocol": 6, - "sourcePort": 65308, + "sourcePort": 57218, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -232,13 +232,13 @@ "acknowledgement": 1000001 }, { - "time": 1782, + "time": 1773, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "sourceIp": "42.0.0.10", "destinationIp": "42.0.0.20", "protocol": 6, - "sourcePort": 65308, + "sourcePort": 57218, "destinationPort": 80, "payload": "hello", "tcpFlags": "P", @@ -246,41 +246,41 @@ "acknowledgement": 0 }, { - "time": 2005, + "time": 1996, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "sourceIp": "42.0.0.20", "destinationIp": "42.0.0.10", "protocol": 6, "sourcePort": 80, - "destinationPort": 65308, + "destinationPort": 57218, "payload": null, "tcpFlags": "A", "sequence": 1000001, "acknowledgement": 2000006 }, { - "time": 2061, + "time": 2051, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "sourceIp": "42.0.0.20", "destinationIp": "42.0.0.10", "protocol": 6, "sourcePort": 80, - "destinationPort": 65308, + "destinationPort": 57218, "payload": "reply hello", "tcpFlags": "P", "sequence": 1000001, "acknowledgement": 0 }, { - "time": 2173, + "time": 2163, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "sourceIp": "42.0.0.10", "destinationIp": "42.0.0.20", "protocol": 6, - "sourcePort": 65308, + "sourcePort": 57218, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -288,13 +288,13 @@ "acknowledgement": 1000012 }, { - "time": 2229, + "time": 2219, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "sourceIp": "42.0.0.10", "destinationIp": "42.0.0.20", "protocol": 6, - "sourcePort": 65308, + "sourcePort": 57218, "destinationPort": 80, "payload": null, "tcpFlags": "F", @@ -302,41 +302,41 @@ "acknowledgement": 0 }, { - "time": 2451, + "time": 2441, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "sourceIp": "42.0.0.20", "destinationIp": "42.0.0.10", "protocol": 6, "sourcePort": 80, - "destinationPort": 65308, + "destinationPort": 57218, "payload": null, "tcpFlags": "A", "sequence": 1000012, "acknowledgement": 2000007 }, { - "time": 2507, + "time": 2496, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "sourceIp": "42.0.0.20", "destinationIp": "42.0.0.10", "protocol": 6, "sourcePort": 80, - "destinationPort": 65308, + "destinationPort": 57218, "payload": null, "tcpFlags": "F", "sequence": 1000012, "acknowledgement": 0 }, { - "time": 2619, + "time": 2608, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "sourceIp": "42.0.0.10", "destinationIp": "42.0.0.20", "protocol": 6, - "sourcePort": 65308, + "sourcePort": 57218, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -346,7 +346,7 @@ ], "00000000-0000-0000-0000-000000000502#1": [ { - "time": 1006, + "time": 998, "source": "02:00:00:00:05:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -354,7 +354,7 @@ "targetIp": "192.168.0.1" }, { - "time": 1007, + "time": 1000, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "arp": 2, @@ -362,13 +362,13 @@ "targetIp": "192.168.0.10" }, { - "time": 1123, + "time": 1115, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "sourceIp": "192.168.0.10", "destinationIp": "42.0.0.20", "protocol": 6, - "sourcePort": 49413, + "sourcePort": 49833, "destinationPort": 80, "payload": null, "tcpFlags": "S", @@ -376,27 +376,27 @@ "acknowledgement": 0 }, { - "time": 1577, + "time": 1567, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "sourceIp": "42.0.0.20", "destinationIp": "192.168.0.10", "protocol": 6, "sourcePort": 80, - "destinationPort": 49413, + "destinationPort": 49833, "payload": null, "tcpFlags": "SA", "sequence": 1000000, "acknowledgement": 2000001 }, { - "time": 1689, + "time": 1679, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "sourceIp": "192.168.0.10", "destinationIp": "42.0.0.20", "protocol": 6, - "sourcePort": 49413, + "sourcePort": 49833, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -404,13 +404,13 @@ "acknowledgement": 1000001 }, { - "time": 1782, + "time": 1773, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "sourceIp": "192.168.0.10", "destinationIp": "42.0.0.20", "protocol": 6, - "sourcePort": 49413, + "sourcePort": 49833, "destinationPort": 80, "payload": "hello", "tcpFlags": "P", @@ -418,41 +418,41 @@ "acknowledgement": 0 }, { - "time": 2005, + "time": 1996, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "sourceIp": "42.0.0.20", "destinationIp": "192.168.0.10", "protocol": 6, "sourcePort": 80, - "destinationPort": 49413, + "destinationPort": 49833, "payload": null, "tcpFlags": "A", "sequence": 1000001, "acknowledgement": 2000006 }, { - "time": 2061, + "time": 2051, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "sourceIp": "42.0.0.20", "destinationIp": "192.168.0.10", "protocol": 6, "sourcePort": 80, - "destinationPort": 49413, + "destinationPort": 49833, "payload": "reply hello", "tcpFlags": "P", "sequence": 1000001, "acknowledgement": 0 }, { - "time": 2172, + "time": 2163, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "sourceIp": "192.168.0.10", "destinationIp": "42.0.0.20", "protocol": 6, - "sourcePort": 49413, + "sourcePort": 49833, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -460,13 +460,13 @@ "acknowledgement": 1000012 }, { - "time": 2228, + "time": 2218, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "sourceIp": "192.168.0.10", "destinationIp": "42.0.0.20", "protocol": 6, - "sourcePort": 49413, + "sourcePort": 49833, "destinationPort": 80, "payload": null, "tcpFlags": "F", @@ -474,41 +474,41 @@ "acknowledgement": 0 }, { - "time": 2452, + "time": 2441, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "sourceIp": "42.0.0.20", "destinationIp": "192.168.0.10", "protocol": 6, "sourcePort": 80, - "destinationPort": 49413, + "destinationPort": 49833, "payload": null, "tcpFlags": "A", "sequence": 1000012, "acknowledgement": 2000007 }, { - "time": 2507, + "time": 2497, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "sourceIp": "42.0.0.20", "destinationIp": "192.168.0.10", "protocol": 6, "sourcePort": 80, - "destinationPort": 49413, + "destinationPort": 49833, "payload": null, "tcpFlags": "F", "sequence": 1000012, "acknowledgement": 0 }, { - "time": 2618, + "time": 2608, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "sourceIp": "192.168.0.10", "destinationIp": "42.0.0.20", "protocol": 6, - "sourcePort": 49413, + "sourcePort": 49833, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -518,7 +518,7 @@ ], "00000000-0000-0000-0000-000000000504": [ { - "time": 1240, + "time": 1231, "source": "02:00:00:00:05:21", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -526,7 +526,7 @@ "targetIp": "42.0.0.20" }, { - "time": 1240, + "time": 1231, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "arp": 2, @@ -534,13 +534,13 @@ "targetIp": "42.0.0.10" }, { - "time": 1464, + "time": 1454, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "sourceIp": "42.0.0.10", "destinationIp": "42.0.0.20", "protocol": 6, - "sourcePort": 65308, + "sourcePort": 57218, "destinationPort": 80, "payload": null, "tcpFlags": "S", @@ -548,27 +548,27 @@ "acknowledgement": 0 }, { - "time": 1466, + "time": 1456, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "sourceIp": "42.0.0.20", "destinationIp": "42.0.0.10", "protocol": 6, "sourcePort": 80, - "destinationPort": 65308, + "destinationPort": 57218, "payload": null, "tcpFlags": "SA", "sequence": 1000000, "acknowledgement": 2000001 }, { - "time": 1800, + "time": 1790, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "sourceIp": "42.0.0.10", "destinationIp": "42.0.0.20", "protocol": 6, - "sourcePort": 65308, + "sourcePort": 57218, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -576,13 +576,13 @@ "acknowledgement": 1000001 }, { - "time": 1894, + "time": 1884, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "sourceIp": "42.0.0.10", "destinationIp": "42.0.0.20", "protocol": 6, - "sourcePort": 65308, + "sourcePort": 57218, "destinationPort": 80, "payload": "hello", "tcpFlags": "P", @@ -590,41 +590,41 @@ "acknowledgement": 0 }, { - "time": 1894, + "time": 1885, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "sourceIp": "42.0.0.20", "destinationIp": "42.0.0.10", "protocol": 6, "sourcePort": 80, - "destinationPort": 65308, + "destinationPort": 57218, "payload": null, "tcpFlags": "A", "sequence": 1000001, "acknowledgement": 2000006 }, { - "time": 1949, + "time": 1940, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "sourceIp": "42.0.0.20", "destinationIp": "42.0.0.10", "protocol": 6, "sourcePort": 80, - "destinationPort": 65308, + "destinationPort": 57218, "payload": "reply hello", "tcpFlags": "P", "sequence": 1000001, "acknowledgement": 0 }, { - "time": 2284, + "time": 2274, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "sourceIp": "42.0.0.10", "destinationIp": "42.0.0.20", "protocol": 6, - "sourcePort": 65308, + "sourcePort": 57218, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -632,13 +632,13 @@ "acknowledgement": 1000012 }, { - "time": 2340, + "time": 2330, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "sourceIp": "42.0.0.10", "destinationIp": "42.0.0.20", "protocol": 6, - "sourcePort": 65308, + "sourcePort": 57218, "destinationPort": 80, "payload": null, "tcpFlags": "F", @@ -646,41 +646,41 @@ "acknowledgement": 0 }, { - "time": 2340, + "time": 2330, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "sourceIp": "42.0.0.20", "destinationIp": "42.0.0.10", "protocol": 6, "sourcePort": 80, - "destinationPort": 65308, + "destinationPort": 57218, "payload": null, "tcpFlags": "A", "sequence": 1000012, "acknowledgement": 2000007 }, { - "time": 2396, + "time": 2385, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "sourceIp": "42.0.0.20", "destinationIp": "42.0.0.10", "protocol": 6, "sourcePort": 80, - "destinationPort": 65308, + "destinationPort": 57218, "payload": null, "tcpFlags": "F", "sequence": 1000012, "acknowledgement": 0 }, { - "time": 2730, + "time": 2719, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "sourceIp": "42.0.0.10", "destinationIp": "42.0.0.20", "protocol": 6, - "sourcePort": 65308, + "sourcePort": 57218, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -690,7 +690,7 @@ ], "00000000-0000-0000-0000-000000000505": [ { - "time": 1240, + "time": 1231, "source": "02:00:00:00:05:21", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -699,65 +699,2617 @@ } ] }, + "rows": { + "00000000-0000-0000-0000-000000000501": [ + [ + "1", + "02:00:00:00:05:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.10", + "192.168.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.1 [op=REQUEST, sender=02:00:00:00:05:11|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.1]" + ], + [ + "2", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.1", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:22 [op=REPLY, sender=02:00:00:00:05:22|192.168.0.1, target=02:00:00:00:05:11|192.168.0.10]" + ], + [ + "3", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "192.168.0.10:49833", + "42.0.0.20:80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "4", + "42.0.0.20:80", + "192.168.0.10:49833", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "192.168.0.10:49833", + "42.0.0.20:80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "192.168.0.10:49833", + "42.0.0.20:80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "6", + "192.168.0.10:49833", + "42.0.0.20:80", + "", + "Anwendung", + "hello" + ], + [ + "7", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "7", + "42.0.0.20:80", + "192.168.0.10:49833", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.006" + ], + [ + "8", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "8", + "42.0.0.20:80", + "192.168.0.10:49833", + "TCP", + "Transport", + "SEQ: 1.000.001" + ], + [ + "8", + "42.0.0.20:80", + "192.168.0.10:49833", + "HTTP", + "Anwendung", + "reply hello" + ], + [ + "9", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "9", + "192.168.0.10:49833", + "42.0.0.20:80", + "TCP", + "Transport", + "SEQ: 2.000.006, ACK: 1.000.012" + ], + [ + "10", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "10", + "192.168.0.10:49833", + "42.0.0.20:80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.006" + ], + [ + "11", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "11", + "42.0.0.20:80", + "192.168.0.10:49833", + "TCP", + "Transport", + "SEQ: 1.000.012, ACK: 2.000.007" + ], + [ + "12", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "12", + "42.0.0.20:80", + "192.168.0.10:49833", + "TCP", + "Transport", + "FIN, SEQ: 1.000.012" + ], + [ + "13", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "13", + "192.168.0.10:49833", + "42.0.0.20:80", + "TCP", + "Transport", + "SEQ: 2.000.007, ACK: 1.000.013" + ] + ], + "00000000-0000-0000-0000-000000000502": [ + [ + "1", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.20 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.20]" + ], + [ + "2", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "42.0.0.20", + "42.0.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:41 [op=REPLY, sender=02:00:00:00:05:41|42.0.0.20, target=02:00:00:00:05:21|42.0.0.10]" + ], + [ + "3", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "3", + "42.0.0.10:57218", + "42.0.0.20:80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "42.0.0.20:80", + "42.0.0.10:57218", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "5", + "42.0.0.10:57218", + "42.0.0.20:80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "6", + "42.0.0.10:57218", + "42.0.0.20:80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "6", + "42.0.0.10:57218", + "42.0.0.20:80", + "", + "Anwendung", + "hello" + ], + [ + "7", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "7", + "42.0.0.20:80", + "42.0.0.10:57218", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.006" + ], + [ + "8", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "8", + "42.0.0.20:80", + "42.0.0.10:57218", + "TCP", + "Transport", + "SEQ: 1.000.001" + ], + [ + "8", + "42.0.0.20:80", + "42.0.0.10:57218", + "HTTP", + "Anwendung", + "reply hello" + ], + [ + "9", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "9", + "42.0.0.10:57218", + "42.0.0.20:80", + "TCP", + "Transport", + "SEQ: 2.000.006, ACK: 1.000.012" + ], + [ + "10", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "10", + "42.0.0.10:57218", + "42.0.0.20:80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.006" + ], + [ + "11", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "11", + "42.0.0.20:80", + "42.0.0.10:57218", + "TCP", + "Transport", + "SEQ: 1.000.012, ACK: 2.000.007" + ], + [ + "12", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "12", + "42.0.0.20:80", + "42.0.0.10:57218", + "TCP", + "Transport", + "FIN, SEQ: 1.000.012" + ], + [ + "13", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "13", + "42.0.0.10:57218", + "42.0.0.20:80", + "TCP", + "Transport", + "SEQ: 2.000.007, ACK: 1.000.013" + ] + ], + "00000000-0000-0000-0000-000000000502#1": [ + [ + "1", + "02:00:00:00:05:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.10", + "192.168.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.1 [op=REQUEST, sender=02:00:00:00:05:11|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.1]" + ], + [ + "2", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.1", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:22 [op=REPLY, sender=02:00:00:00:05:22|192.168.0.1, target=02:00:00:00:05:11|192.168.0.10]" + ], + [ + "3", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "192.168.0.10:49833", + "42.0.0.20:80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "4", + "42.0.0.20:80", + "192.168.0.10:49833", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "192.168.0.10:49833", + "42.0.0.20:80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "192.168.0.10:49833", + "42.0.0.20:80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "6", + "192.168.0.10:49833", + "42.0.0.20:80", + "", + "Anwendung", + "hello" + ], + [ + "7", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "7", + "42.0.0.20:80", + "192.168.0.10:49833", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.006" + ], + [ + "8", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "8", + "42.0.0.20:80", + "192.168.0.10:49833", + "TCP", + "Transport", + "SEQ: 1.000.001" + ], + [ + "8", + "42.0.0.20:80", + "192.168.0.10:49833", + "HTTP", + "Anwendung", + "reply hello" + ], + [ + "9", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "9", + "192.168.0.10:49833", + "42.0.0.20:80", + "TCP", + "Transport", + "SEQ: 2.000.006, ACK: 1.000.012" + ], + [ + "10", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "10", + "192.168.0.10:49833", + "42.0.0.20:80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.006" + ], + [ + "11", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "11", + "42.0.0.20:80", + "192.168.0.10:49833", + "TCP", + "Transport", + "SEQ: 1.000.012, ACK: 2.000.007" + ], + [ + "12", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "12", + "42.0.0.20:80", + "192.168.0.10:49833", + "TCP", + "Transport", + "FIN, SEQ: 1.000.012" + ], + [ + "13", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "13", + "192.168.0.10:49833", + "42.0.0.20:80", + "TCP", + "Transport", + "SEQ: 2.000.007, ACK: 1.000.013" + ] + ], + "00000000-0000-0000-0000-000000000504": [ + [ + "1", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.20 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.20]" + ], + [ + "2", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "42.0.0.20", + "42.0.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:41 [op=REPLY, sender=02:00:00:00:05:41|42.0.0.20, target=02:00:00:00:05:21|42.0.0.10]" + ], + [ + "3", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "3", + "42.0.0.10:57218", + "42.0.0.20:80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "42.0.0.20:80", + "42.0.0.10:57218", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "5", + "42.0.0.10:57218", + "42.0.0.20:80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "6", + "42.0.0.10:57218", + "42.0.0.20:80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "6", + "42.0.0.10:57218", + "42.0.0.20:80", + "", + "Anwendung", + "hello" + ], + [ + "7", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "7", + "42.0.0.20:80", + "42.0.0.10:57218", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.006" + ], + [ + "8", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "8", + "42.0.0.20:80", + "42.0.0.10:57218", + "TCP", + "Transport", + "SEQ: 1.000.001" + ], + [ + "8", + "42.0.0.20:80", + "42.0.0.10:57218", + "HTTP", + "Anwendung", + "reply hello" + ], + [ + "9", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "9", + "42.0.0.10:57218", + "42.0.0.20:80", + "TCP", + "Transport", + "SEQ: 2.000.006, ACK: 1.000.012" + ], + [ + "10", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "10", + "42.0.0.10:57218", + "42.0.0.20:80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.006" + ], + [ + "11", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "11", + "42.0.0.20:80", + "42.0.0.10:57218", + "TCP", + "Transport", + "SEQ: 1.000.012, ACK: 2.000.007" + ], + [ + "12", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "12", + "42.0.0.20:80", + "42.0.0.10:57218", + "TCP", + "Transport", + "FIN, SEQ: 1.000.012" + ], + [ + "13", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "13", + "42.0.0.10:57218", + "42.0.0.20:80", + "TCP", + "Transport", + "SEQ: 2.000.007, ACK: 1.000.013" + ] + ], + "00000000-0000-0000-0000-000000000505": [ + [ + "1", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.20 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.20]" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000501": [ + [ + "1", + "02:00:00:00:05:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.10", + "192.168.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.1 [op=REQUEST, sender=02:00:00:00:05:11|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.1]" + ], + [ + "2", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.1", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:22 [op=REPLY, sender=02:00:00:00:05:22|192.168.0.1, target=02:00:00:00:05:11|192.168.0.10]" + ], + [ + "3", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "49833", + "80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "4", + "80", + "49833", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "49833", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "49833", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "6", + null, + null, + "", + "Anwendung", + "hello" + ], + [ + "7", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "7", + "80", + "49833", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.006" + ], + [ + "8", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "8", + "80", + "49833", + "TCP", + "Transport", + "SEQ: 1.000.001" + ], + [ + "8", + null, + null, + "HTTP", + "Anwendung", + "reply hello" + ], + [ + "9", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "9", + "49833", + "80", + "TCP", + "Transport", + "SEQ: 2.000.006, ACK: 1.000.012" + ], + [ + "10", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "10", + "49833", + "80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.006" + ], + [ + "11", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "11", + "80", + "49833", + "TCP", + "Transport", + "SEQ: 1.000.012, ACK: 2.000.007" + ], + [ + "12", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "12", + "80", + "49833", + "TCP", + "Transport", + "FIN, SEQ: 1.000.012" + ], + [ + "13", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "13", + "49833", + "80", + "TCP", + "Transport", + "SEQ: 2.000.007, ACK: 1.000.013" + ] + ], + "00000000-0000-0000-0000-000000000502": [ + [ + "1", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.20 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.20]" + ], + [ + "2", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "42.0.0.20", + "42.0.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:41 [op=REPLY, sender=02:00:00:00:05:41|42.0.0.20, target=02:00:00:00:05:21|42.0.0.10]" + ], + [ + "3", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "3", + "57218", + "80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "80", + "57218", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "5", + "57218", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "6", + "57218", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "6", + null, + null, + "", + "Anwendung", + "hello" + ], + [ + "7", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "7", + "80", + "57218", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.006" + ], + [ + "8", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "8", + "80", + "57218", + "TCP", + "Transport", + "SEQ: 1.000.001" + ], + [ + "8", + null, + null, + "HTTP", + "Anwendung", + "reply hello" + ], + [ + "9", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "9", + "57218", + "80", + "TCP", + "Transport", + "SEQ: 2.000.006, ACK: 1.000.012" + ], + [ + "10", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "10", + "57218", + "80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.006" + ], + [ + "11", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "11", + "80", + "57218", + "TCP", + "Transport", + "SEQ: 1.000.012, ACK: 2.000.007" + ], + [ + "12", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "12", + "80", + "57218", + "TCP", + "Transport", + "FIN, SEQ: 1.000.012" + ], + [ + "13", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "13", + "57218", + "80", + "TCP", + "Transport", + "SEQ: 2.000.007, ACK: 1.000.013" + ] + ], + "00000000-0000-0000-0000-000000000502#1": [ + [ + "1", + "02:00:00:00:05:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.10", + "192.168.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.1 [op=REQUEST, sender=02:00:00:00:05:11|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.1]" + ], + [ + "2", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.1", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:22 [op=REPLY, sender=02:00:00:00:05:22|192.168.0.1, target=02:00:00:00:05:11|192.168.0.10]" + ], + [ + "3", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "49833", + "80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "4", + "80", + "49833", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "49833", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "49833", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "6", + null, + null, + "", + "Anwendung", + "hello" + ], + [ + "7", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "7", + "80", + "49833", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.006" + ], + [ + "8", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "8", + "80", + "49833", + "TCP", + "Transport", + "SEQ: 1.000.001" + ], + [ + "8", + null, + null, + "HTTP", + "Anwendung", + "reply hello" + ], + [ + "9", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "9", + "49833", + "80", + "TCP", + "Transport", + "SEQ: 2.000.006, ACK: 1.000.012" + ], + [ + "10", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "10", + "49833", + "80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.006" + ], + [ + "11", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "11", + "80", + "49833", + "TCP", + "Transport", + "SEQ: 1.000.012, ACK: 2.000.007" + ], + [ + "12", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "12", + "80", + "49833", + "TCP", + "Transport", + "FIN, SEQ: 1.000.012" + ], + [ + "13", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "13", + "49833", + "80", + "TCP", + "Transport", + "SEQ: 2.000.007, ACK: 1.000.013" + ] + ], + "00000000-0000-0000-0000-000000000504": [ + [ + "1", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.20 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.20]" + ], + [ + "2", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "42.0.0.20", + "42.0.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:41 [op=REPLY, sender=02:00:00:00:05:41|42.0.0.20, target=02:00:00:00:05:21|42.0.0.10]" + ], + [ + "3", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "3", + "57218", + "80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "80", + "57218", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "5", + "57218", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "6", + "57218", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "6", + null, + null, + "", + "Anwendung", + "hello" + ], + [ + "7", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "7", + "80", + "57218", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.006" + ], + [ + "8", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "8", + "80", + "57218", + "TCP", + "Transport", + "SEQ: 1.000.001" + ], + [ + "8", + null, + null, + "HTTP", + "Anwendung", + "reply hello" + ], + [ + "9", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "9", + "57218", + "80", + "TCP", + "Transport", + "SEQ: 2.000.006, ACK: 1.000.012" + ], + [ + "10", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "10", + "57218", + "80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.006" + ], + [ + "11", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "11", + "80", + "57218", + "TCP", + "Transport", + "SEQ: 1.000.012, ACK: 2.000.007" + ], + [ + "12", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "12", + "80", + "57218", + "TCP", + "Transport", + "FIN, SEQ: 1.000.012" + ], + [ + "13", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 63" + ], + [ + "13", + "57218", + "80", + "TCP", + "Transport", + "SEQ: 2.000.007, ACK: 1.000.013" + ] + ], + "00000000-0000-0000-0000-000000000505": [ + [ + "1", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.20 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.20]" + ] + ] + }, "events": [ [ - 725, + 716, "server oeffnen called" ], [ - 925, + 916, "client verbinden called" ], [ - 1726, + 1717, "client verbinden returned " ], [ - 1726, + 1717, "client senden called" ], [ - 1829, - "server oeffnen returned filius.software.transportschicht.TCPSocket@678eb1ba" + 1819, + "server oeffnen returned filius.software.transportschicht.TCPSocket@37a760c6" ], [ - 1829, + 1819, "server empfangen called" ], [ - 1894, + 1884, "server empfangen returned hello" ], [ - 1894, + 1885, "server senden called" ], [ - 2061, + 2052, "client senden returned " ], [ - 2061, + 2052, "client empfangen called" ], [ - 2117, + 2107, "client empfangen returned reply hello" ], [ - 2117, + 2108, "client schliessen called" ], [ - 2117, + 2108, "client schliessen returned " ], [ - 2284, + 2274, "server senden returned " ] ], "nat": [ - "6 42.0.0.20:65308 -> 192.168.0.10:49413 DynamicEntry" + "6 42.0.0.20:57218 -> 192.168.0.10:49833 DynamicEntry" ] } diff --git a/packages/core/test/scenarios/nat-java-ttlOut.java.json b/packages/core/test/scenarios/nat-java-ttlOut.java.json new file mode 100644 index 0000000..edb71e5 --- /dev/null +++ b/packages/core/test/scenarios/nat-java-ttlOut.java.json @@ -0,0 +1,368 @@ +{ + "frames": { + "00000000-0000-0000-0000-000000000501": [ + { + "time": 719, + "source": "02:00:00:00:05:11", + "destination": "FF:FF:FF:FF:FF:FF", + "arp": 1, + "senderIp": "192.168.0.10", + "targetIp": "192.168.0.1" + }, + { + "time": 839, + "source": "02:00:00:00:05:22", + "destination": "02:00:00:00:05:11", + "arp": 2, + "senderIp": "192.168.0.1", + "targetIp": "192.168.0.10" + }, + { + "time": 843, + "source": "02:00:00:00:05:11", + "destination": "02:00:00:00:05:22", + "icmp": 8, + "icmpCode": 0, + "sourceIp": "192.168.0.10", + "destinationIp": "42.0.0.20", + "sequence": 1 + }, + { + "time": 957, + "source": "02:00:00:00:05:22", + "destination": "02:00:00:00:05:11", + "icmp": 11, + "icmpCode": 0, + "sourceIp": "192.168.0.1", + "destinationIp": "192.168.0.10", + "sequence": 0 + } + ], + "00000000-0000-0000-0000-000000000502": [], + "00000000-0000-0000-0000-000000000502#1": [ + { + "time": 781, + "source": "02:00:00:00:05:11", + "destination": "FF:FF:FF:FF:FF:FF", + "arp": 1, + "senderIp": "192.168.0.10", + "targetIp": "192.168.0.1" + }, + { + "time": 783, + "source": "02:00:00:00:05:22", + "destination": "02:00:00:00:05:11", + "arp": 2, + "senderIp": "192.168.0.1", + "targetIp": "192.168.0.10" + }, + { + "time": 901, + "source": "02:00:00:00:05:11", + "destination": "02:00:00:00:05:22", + "icmp": 8, + "icmpCode": 0, + "sourceIp": "192.168.0.10", + "destinationIp": "42.0.0.20", + "sequence": 1 + }, + { + "time": 901, + "source": "02:00:00:00:05:22", + "destination": "02:00:00:00:05:11", + "icmp": 11, + "icmpCode": 0, + "sourceIp": "192.168.0.1", + "destinationIp": "192.168.0.10", + "sequence": 0 + } + ], + "00000000-0000-0000-0000-000000000504": [], + "00000000-0000-0000-0000-000000000505": [] + }, + "rows": { + "00000000-0000-0000-0000-000000000501": [ + [ + "1", + "02:00:00:00:05:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.10", + "192.168.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.1 [op=REQUEST, sender=02:00:00:00:05:11|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.1]" + ], + [ + "2", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.1", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:22 [op=REPLY, sender=02:00:00:00:05:22|192.168.0.1, target=02:00:00:00:05:11|192.168.0.10]" + ], + [ + "3", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.10", + "42.0.0.20", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 1, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.1", + "192.168.0.10", + "ICMP", + "Vermittlung", + "ICMP Time Exeeded (poof), TTL: 64, Identifier: 0, Seq.-No.: 0, Payload: [id=1; ttl=1; protocol=1; sender=192.168.0.10; target=42.0.0.20; icmpType=8; icmpCode=0; identifier=1; seqNr=1]" + ] + ], + "00000000-0000-0000-0000-000000000502": [], + "00000000-0000-0000-0000-000000000502#1": [ + [ + "1", + "02:00:00:00:05:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.10", + "192.168.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.1 [op=REQUEST, sender=02:00:00:00:05:11|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.1]" + ], + [ + "2", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.1", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:22 [op=REPLY, sender=02:00:00:00:05:22|192.168.0.1, target=02:00:00:00:05:11|192.168.0.10]" + ], + [ + "3", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.10", + "42.0.0.20", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 1, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.1", + "192.168.0.10", + "ICMP", + "Vermittlung", + "ICMP Time Exeeded (poof), TTL: 64, Identifier: 0, Seq.-No.: 0, Payload: [id=1; ttl=1; protocol=1; sender=192.168.0.10; target=42.0.0.20; icmpType=8; icmpCode=0; identifier=1; seqNr=1]" + ] + ], + "00000000-0000-0000-0000-000000000504": [], + "00000000-0000-0000-0000-000000000505": [] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000501": [ + [ + "1", + "02:00:00:00:05:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.10", + "192.168.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.1 [op=REQUEST, sender=02:00:00:00:05:11|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.1]" + ], + [ + "2", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.1", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:22 [op=REPLY, sender=02:00:00:00:05:22|192.168.0.1, target=02:00:00:00:05:11|192.168.0.10]" + ], + [ + "3", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.10", + "42.0.0.20", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 1, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.1", + "192.168.0.10", + "ICMP", + "Vermittlung", + "ICMP Time Exeeded (poof), TTL: 64, Identifier: 0, Seq.-No.: 0, Payload: [id=1; ttl=1; protocol=1; sender=192.168.0.10; target=42.0.0.20; icmpType=8; icmpCode=0; identifier=1; seqNr=1]" + ] + ], + "00000000-0000-0000-0000-000000000502": [], + "00000000-0000-0000-0000-000000000502#1": [ + [ + "1", + "02:00:00:00:05:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.10", + "192.168.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.1 [op=REQUEST, sender=02:00:00:00:05:11|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.1]" + ], + [ + "2", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.1", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:22 [op=REPLY, sender=02:00:00:00:05:22|192.168.0.1, target=02:00:00:00:05:11|192.168.0.10]" + ], + [ + "3", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.10", + "42.0.0.20", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 1, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.1", + "192.168.0.10", + "ICMP", + "Vermittlung", + "ICMP Time Exeeded (poof), TTL: 64, Identifier: 0, Seq.-No.: 0, Payload: [id=1; ttl=1; protocol=1; sender=192.168.0.10; target=42.0.0.20; icmpType=8; icmpCode=0; identifier=1; seqNr=1]" + ] + ], + "00000000-0000-0000-0000-000000000504": [], + "00000000-0000-0000-0000-000000000505": [] + }, + "events": [ + [ + 715, + "sendProbe 42.0.0.20 called" + ], + [ + 959, + "sendProbe 42.0.0.20 returned ICMP 11/0 from 192.168.0.1" + ] + ], + "nat": [] +} diff --git a/packages/core/test/scenarios/nat-java-udpOut.java.json b/packages/core/test/scenarios/nat-java-udpOut.java.json index a2e3f47..097f8a9 100644 --- a/packages/core/test/scenarios/nat-java-udpOut.java.json +++ b/packages/core/test/scenarios/nat-java-udpOut.java.json @@ -2,7 +2,7 @@ "frames": { "00000000-0000-0000-0000-000000000501": [ { - "time": 927, + "time": 926, "source": "02:00:00:00:05:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -10,7 +10,7 @@ "targetIp": "192.168.0.1" }, { - "time": 1048, + "time": 1044, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "arp": 2, @@ -18,31 +18,31 @@ "targetIp": "192.168.0.10" }, { - "time": 1051, + "time": 1046, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "sourceIp": "192.168.0.10", "destinationIp": "42.0.0.20", "protocol": 17, - "sourcePort": 50152, + "sourcePort": 51690, "destinationPort": 7, "payload": "one" }, { - "time": 1620, + "time": 1617, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "sourceIp": "42.0.0.20", "destinationIp": "192.168.0.10", "protocol": 17, "sourcePort": 7, - "destinationPort": 50152, + "destinationPort": 51690, "payload": "pong one" } ], "00000000-0000-0000-0000-000000000502": [ { - "time": 1112, + "time": 1108, "source": "02:00:00:00:05:21", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -50,7 +50,7 @@ "targetIp": "42.0.0.20" }, { - "time": 1339, + "time": 1335, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "arp": 2, @@ -58,31 +58,31 @@ "targetIp": "42.0.0.10" }, { - "time": 1339, + "time": 1335, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "sourceIp": "42.0.0.10", "destinationIp": "42.0.0.20", "protocol": 17, - "sourcePort": 63618, + "sourcePort": 64339, "destinationPort": 7, "payload": "one" }, { - "time": 1564, + "time": 1560, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "sourceIp": "42.0.0.20", "destinationIp": "42.0.0.10", "protocol": 17, "sourcePort": 7, - "destinationPort": 63618, + "destinationPort": 64339, "payload": "pong one" } ], "00000000-0000-0000-0000-000000000502#1": [ { - "time": 991, + "time": 987, "source": "02:00:00:00:05:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -90,7 +90,7 @@ "targetIp": "192.168.0.1" }, { - "time": 992, + "time": 988, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "arp": 2, @@ -98,31 +98,31 @@ "targetIp": "192.168.0.10" }, { - "time": 1108, + "time": 1103, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "sourceIp": "192.168.0.10", "destinationIp": "42.0.0.20", "protocol": 17, - "sourcePort": 50152, + "sourcePort": 51690, "destinationPort": 7, "payload": "one" }, { - "time": 1564, + "time": 1561, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "sourceIp": "42.0.0.20", "destinationIp": "192.168.0.10", "protocol": 17, "sourcePort": 7, - "destinationPort": 50152, + "destinationPort": 51690, "payload": "pong one" } ], "00000000-0000-0000-0000-000000000504": [ { - "time": 1227, + "time": 1223, "source": "02:00:00:00:05:21", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -130,7 +130,7 @@ "targetIp": "42.0.0.20" }, { - "time": 1227, + "time": 1223, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "arp": 2, @@ -138,31 +138,31 @@ "targetIp": "42.0.0.10" }, { - "time": 1450, + "time": 1447, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "sourceIp": "42.0.0.10", "destinationIp": "42.0.0.20", "protocol": 17, - "sourcePort": 63618, + "sourcePort": 64339, "destinationPort": 7, "payload": "one" }, { - "time": 1452, + "time": 1449, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "sourceIp": "42.0.0.20", "destinationIp": "42.0.0.10", "protocol": 17, "sourcePort": 7, - "destinationPort": 63618, + "destinationPort": 64339, "payload": "pong one" } ], "00000000-0000-0000-0000-000000000505": [ { - "time": 1227, + "time": 1223, "source": "02:00:00:00:05:21", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -171,13 +171,837 @@ } ] }, + "rows": { + "00000000-0000-0000-0000-000000000501": [ + [ + "1", + "02:00:00:00:05:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.10", + "192.168.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.1 [op=REQUEST, sender=02:00:00:00:05:11|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.1]" + ], + [ + "2", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.1", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:22 [op=REPLY, sender=02:00:00:00:05:22|192.168.0.1, target=02:00:00:00:05:11|192.168.0.10]" + ], + [ + "3", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "192.168.0.10:51690", + "42.0.0.20:7", + "UDP", + "Transport", + "" + ], + [ + "3", + "192.168.0.10:51690", + "42.0.0.20:7", + "", + "Anwendung", + "one" + ], + [ + "4", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 63" + ], + [ + "4", + "42.0.0.20:7", + "192.168.0.10:51690", + "UDP", + "Transport", + "" + ], + [ + "4", + "42.0.0.20:7", + "192.168.0.10:51690", + "", + "Anwendung", + "pong one" + ] + ], + "00000000-0000-0000-0000-000000000502": [ + [ + "1", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.20 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.20]" + ], + [ + "2", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "42.0.0.20", + "42.0.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:41 [op=REPLY, sender=02:00:00:00:05:41|42.0.0.20, target=02:00:00:00:05:21|42.0.0.10]" + ], + [ + "3", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 63" + ], + [ + "3", + "42.0.0.10:64339", + "42.0.0.20:7", + "UDP", + "Transport", + "" + ], + [ + "3", + "42.0.0.10:64339", + "42.0.0.20:7", + "", + "Anwendung", + "one" + ], + [ + "4", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "42.0.0.20:7", + "42.0.0.10:64339", + "UDP", + "Transport", + "" + ], + [ + "4", + "42.0.0.20:7", + "42.0.0.10:64339", + "", + "Anwendung", + "pong one" + ] + ], + "00000000-0000-0000-0000-000000000502#1": [ + [ + "1", + "02:00:00:00:05:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.10", + "192.168.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.1 [op=REQUEST, sender=02:00:00:00:05:11|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.1]" + ], + [ + "2", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.1", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:22 [op=REPLY, sender=02:00:00:00:05:22|192.168.0.1, target=02:00:00:00:05:11|192.168.0.10]" + ], + [ + "3", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "192.168.0.10:51690", + "42.0.0.20:7", + "UDP", + "Transport", + "" + ], + [ + "3", + "192.168.0.10:51690", + "42.0.0.20:7", + "", + "Anwendung", + "one" + ], + [ + "4", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 63" + ], + [ + "4", + "42.0.0.20:7", + "192.168.0.10:51690", + "UDP", + "Transport", + "" + ], + [ + "4", + "42.0.0.20:7", + "192.168.0.10:51690", + "", + "Anwendung", + "pong one" + ] + ], + "00000000-0000-0000-0000-000000000504": [ + [ + "1", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.20 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.20]" + ], + [ + "2", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "42.0.0.20", + "42.0.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:41 [op=REPLY, sender=02:00:00:00:05:41|42.0.0.20, target=02:00:00:00:05:21|42.0.0.10]" + ], + [ + "3", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 63" + ], + [ + "3", + "42.0.0.10:64339", + "42.0.0.20:7", + "UDP", + "Transport", + "" + ], + [ + "3", + "42.0.0.10:64339", + "42.0.0.20:7", + "", + "Anwendung", + "one" + ], + [ + "4", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "42.0.0.20:7", + "42.0.0.10:64339", + "UDP", + "Transport", + "" + ], + [ + "4", + "42.0.0.20:7", + "42.0.0.10:64339", + "", + "Anwendung", + "pong one" + ] + ], + "00000000-0000-0000-0000-000000000505": [ + [ + "1", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.20 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.20]" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000501": [ + [ + "1", + "02:00:00:00:05:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.10", + "192.168.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.1 [op=REQUEST, sender=02:00:00:00:05:11|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.1]" + ], + [ + "2", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.1", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:22 [op=REPLY, sender=02:00:00:00:05:22|192.168.0.1, target=02:00:00:00:05:11|192.168.0.10]" + ], + [ + "3", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "51690", + "7", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "", + "Anwendung", + "one" + ], + [ + "4", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 63" + ], + [ + "4", + "7", + "51690", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "", + "Anwendung", + "pong one" + ] + ], + "00000000-0000-0000-0000-000000000502": [ + [ + "1", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.20 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.20]" + ], + [ + "2", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "42.0.0.20", + "42.0.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:41 [op=REPLY, sender=02:00:00:00:05:41|42.0.0.20, target=02:00:00:00:05:21|42.0.0.10]" + ], + [ + "3", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 63" + ], + [ + "3", + "64339", + "7", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "", + "Anwendung", + "one" + ], + [ + "4", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "7", + "64339", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "", + "Anwendung", + "pong one" + ] + ], + "00000000-0000-0000-0000-000000000502#1": [ + [ + "1", + "02:00:00:00:05:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.10", + "192.168.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.1 [op=REQUEST, sender=02:00:00:00:05:11|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.1]" + ], + [ + "2", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.1", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:22 [op=REPLY, sender=02:00:00:00:05:22|192.168.0.1, target=02:00:00:00:05:11|192.168.0.10]" + ], + [ + "3", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "51690", + "7", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "", + "Anwendung", + "one" + ], + [ + "4", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 63" + ], + [ + "4", + "7", + "51690", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "", + "Anwendung", + "pong one" + ] + ], + "00000000-0000-0000-0000-000000000504": [ + [ + "1", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.20 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.20]" + ], + [ + "2", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "42.0.0.20", + "42.0.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:41 [op=REPLY, sender=02:00:00:00:05:41|42.0.0.20, target=02:00:00:00:05:21|42.0.0.10]" + ], + [ + "3", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 63" + ], + [ + "3", + "64339", + "7", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "", + "Anwendung", + "one" + ], + [ + "4", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "7", + "64339", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "", + "Anwendung", + "pong one" + ] + ], + "00000000-0000-0000-0000-000000000505": [ + [ + "1", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.20 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.20]" + ] + ] + }, "events": [ [ 920, "senden 42.0.0.20 called" ], [ - 922, + 921, "senden 42.0.0.20 returned " ], [ @@ -185,15 +1009,15 @@ "empfangen called" ], [ - 1452, + 1448, "server received one" ], [ - 1620, + 1617, "empfangen returned pong one" ] ], "nat": [ - "17 42.0.0.20:63618 -> 192.168.0.10:50152 DynamicEntry" + "17 42.0.0.20:64339 -> 192.168.0.10:51690 DynamicEntry" ] } diff --git a/packages/core/test/scenarios/nat-java-udpTwoRemotes.java.json b/packages/core/test/scenarios/nat-java-udpTwoRemotes.java.json index 2de16f8..94d0902 100644 --- a/packages/core/test/scenarios/nat-java-udpTwoRemotes.java.json +++ b/packages/core/test/scenarios/nat-java-udpTwoRemotes.java.json @@ -2,7 +2,7 @@ "frames": { "00000000-0000-0000-0000-000000000501": [ { - "time": 921, + "time": 922, "source": "02:00:00:00:05:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -10,7 +10,7 @@ "targetIp": "192.168.0.1" }, { - "time": 1041, + "time": 1044, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "arp": 2, @@ -18,42 +18,42 @@ "targetIp": "192.168.0.10" }, { - "time": 1044, + "time": 1047, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "sourceIp": "192.168.0.10", "destinationIp": "42.0.0.20", "protocol": 17, - "sourcePort": 51562, + "sourcePort": 62587, "destinationPort": 7, "payload": "one" }, { - "time": 1615, + "time": 1619, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "sourceIp": "42.0.0.20", "destinationIp": "192.168.0.10", "protocol": 17, "sourcePort": 7, - "destinationPort": 51562, + "destinationPort": 62587, "payload": "pong one" }, { - "time": 1616, + "time": 1620, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "sourceIp": "192.168.0.10", "destinationIp": "42.0.0.30", "protocol": 17, - "sourcePort": 51562, + "sourcePort": 62587, "destinationPort": 7, "payload": "two" } ], "00000000-0000-0000-0000-000000000502": [ { - "time": 1106, + "time": 1111, "source": "02:00:00:00:05:21", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -61,7 +61,7 @@ "targetIp": "42.0.0.20" }, { - "time": 1334, + "time": 1338, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "arp": 2, @@ -69,29 +69,29 @@ "targetIp": "42.0.0.10" }, { - "time": 1334, + "time": 1339, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "sourceIp": "42.0.0.10", "destinationIp": "42.0.0.20", "protocol": 17, - "sourcePort": 60310, + "sourcePort": 60168, "destinationPort": 7, "payload": "one" }, { - "time": 1559, + "time": 1563, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "sourceIp": "42.0.0.20", "destinationIp": "42.0.0.10", "protocol": 17, "sourcePort": 7, - "destinationPort": 60310, + "destinationPort": 60168, "payload": "pong one" }, { - "time": 1672, + "time": 1676, "source": "02:00:00:00:05:21", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -99,7 +99,7 @@ "targetIp": "42.0.0.30" }, { - "time": 1895, + "time": 1898, "source": "02:00:00:00:05:51", "destination": "02:00:00:00:05:21", "arp": 2, @@ -107,31 +107,31 @@ "targetIp": "42.0.0.10" }, { - "time": 1896, + "time": 1898, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:51", "sourceIp": "42.0.0.10", "destinationIp": "42.0.0.30", "protocol": 17, - "sourcePort": 60310, + "sourcePort": 60168, "destinationPort": 7, "payload": "two" }, { - "time": 2119, + "time": 2121, "source": "02:00:00:00:05:51", "destination": "02:00:00:00:05:21", "sourceIp": "42.0.0.30", "destinationIp": "42.0.0.10", "protocol": 17, "sourcePort": 7, - "destinationPort": 60310, + "destinationPort": 60168, "payload": "pong two" } ], "00000000-0000-0000-0000-000000000502#1": [ { - "time": 984, + "time": 987, "source": "02:00:00:00:05:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -139,7 +139,7 @@ "targetIp": "192.168.0.1" }, { - "time": 985, + "time": 989, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "arp": 2, @@ -147,42 +147,42 @@ "targetIp": "192.168.0.10" }, { - "time": 1101, + "time": 1105, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "sourceIp": "192.168.0.10", "destinationIp": "42.0.0.20", "protocol": 17, - "sourcePort": 51562, + "sourcePort": 62587, "destinationPort": 7, "payload": "one" }, { - "time": 1560, + "time": 1564, "source": "02:00:00:00:05:22", "destination": "02:00:00:00:05:11", "sourceIp": "42.0.0.20", "destinationIp": "192.168.0.10", "protocol": 17, "sourcePort": 7, - "destinationPort": 51562, + "destinationPort": 62587, "payload": "pong one" }, { - "time": 1672, + "time": 1676, "source": "02:00:00:00:05:11", "destination": "02:00:00:00:05:22", "sourceIp": "192.168.0.10", "destinationIp": "42.0.0.30", "protocol": 17, - "sourcePort": 51562, + "sourcePort": 62587, "destinationPort": 7, "payload": "two" } ], "00000000-0000-0000-0000-000000000504": [ { - "time": 1222, + "time": 1227, "source": "02:00:00:00:05:21", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -190,7 +190,7 @@ "targetIp": "42.0.0.20" }, { - "time": 1222, + "time": 1227, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "arp": 2, @@ -198,29 +198,29 @@ "targetIp": "42.0.0.10" }, { - "time": 1446, + "time": 1450, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:41", "sourceIp": "42.0.0.10", "destinationIp": "42.0.0.20", "protocol": 17, - "sourcePort": 60310, + "sourcePort": 60168, "destinationPort": 7, "payload": "one" }, { - "time": 1448, + "time": 1452, "source": "02:00:00:00:05:41", "destination": "02:00:00:00:05:21", "sourceIp": "42.0.0.20", "destinationIp": "42.0.0.10", "protocol": 17, "sourcePort": 7, - "destinationPort": 60310, + "destinationPort": 60168, "payload": "pong one" }, { - "time": 1784, + "time": 1787, "source": "02:00:00:00:05:21", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -230,7 +230,7 @@ ], "00000000-0000-0000-0000-000000000505": [ { - "time": 1222, + "time": 1227, "source": "02:00:00:00:05:21", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -238,7 +238,7 @@ "targetIp": "42.0.0.20" }, { - "time": 1784, + "time": 1787, "source": "02:00:00:00:05:21", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -246,7 +246,7 @@ "targetIp": "42.0.0.30" }, { - "time": 1784, + "time": 1787, "source": "02:00:00:00:05:51", "destination": "02:00:00:00:05:21", "arp": 2, @@ -254,72 +254,1440 @@ "targetIp": "42.0.0.10" }, { - "time": 2007, + "time": 2009, "source": "02:00:00:00:05:21", "destination": "02:00:00:00:05:51", "sourceIp": "42.0.0.10", "destinationIp": "42.0.0.30", "protocol": 17, - "sourcePort": 60310, + "sourcePort": 60168, "destinationPort": 7, "payload": "two" }, { - "time": 2007, + "time": 2010, "source": "02:00:00:00:05:51", "destination": "02:00:00:00:05:21", "sourceIp": "42.0.0.30", "destinationIp": "42.0.0.10", "protocol": 17, "sourcePort": 7, - "destinationPort": 60310, + "destinationPort": 60168, "payload": "pong two" } ] }, + "rows": { + "00000000-0000-0000-0000-000000000501": [ + [ + "1", + "02:00:00:00:05:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.10", + "192.168.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.1 [op=REQUEST, sender=02:00:00:00:05:11|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.1]" + ], + [ + "2", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.1", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:22 [op=REPLY, sender=02:00:00:00:05:22|192.168.0.1, target=02:00:00:00:05:11|192.168.0.10]" + ], + [ + "3", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "192.168.0.10:62587", + "42.0.0.20:7", + "UDP", + "Transport", + "" + ], + [ + "3", + "192.168.0.10:62587", + "42.0.0.20:7", + "", + "Anwendung", + "one" + ], + [ + "4", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 63" + ], + [ + "4", + "42.0.0.20:7", + "192.168.0.10:62587", + "UDP", + "Transport", + "" + ], + [ + "4", + "42.0.0.20:7", + "192.168.0.10:62587", + "", + "Anwendung", + "pong one" + ], + [ + "5", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.10", + "42.0.0.30", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "192.168.0.10:62587", + "42.0.0.30:7", + "UDP", + "Transport", + "" + ], + [ + "5", + "192.168.0.10:62587", + "42.0.0.30:7", + "", + "Anwendung", + "two" + ] + ], + "00000000-0000-0000-0000-000000000502": [ + [ + "1", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.20 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.20]" + ], + [ + "2", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "42.0.0.20", + "42.0.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:41 [op=REPLY, sender=02:00:00:00:05:41|42.0.0.20, target=02:00:00:00:05:21|42.0.0.10]" + ], + [ + "3", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 63" + ], + [ + "3", + "42.0.0.10:60168", + "42.0.0.20:7", + "UDP", + "Transport", + "" + ], + [ + "3", + "42.0.0.10:60168", + "42.0.0.20:7", + "", + "Anwendung", + "one" + ], + [ + "4", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "42.0.0.20:7", + "42.0.0.10:60168", + "UDP", + "Transport", + "" + ], + [ + "4", + "42.0.0.20:7", + "42.0.0.10:60168", + "", + "Anwendung", + "pong one" + ], + [ + "5", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "5", + "42.0.0.10", + "42.0.0.30", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.30 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.30]" + ], + [ + "6", + "02:00:00:00:05:51", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x806" + ], + [ + "6", + "42.0.0.30", + "42.0.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:51 [op=REPLY, sender=02:00:00:00:05:51|42.0.0.30, target=02:00:00:00:05:21|42.0.0.10]" + ], + [ + "7", + "02:00:00:00:05:21", + "02:00:00:00:05:51", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "42.0.0.10", + "42.0.0.30", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 63" + ], + [ + "7", + "42.0.0.10:60168", + "42.0.0.30:7", + "UDP", + "Transport", + "" + ], + [ + "7", + "42.0.0.10:60168", + "42.0.0.30:7", + "", + "Anwendung", + "two" + ], + [ + "8", + "02:00:00:00:05:51", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "42.0.0.30", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "8", + "42.0.0.30:7", + "42.0.0.10:60168", + "UDP", + "Transport", + "" + ], + [ + "8", + "42.0.0.30:7", + "42.0.0.10:60168", + "", + "Anwendung", + "pong two" + ] + ], + "00000000-0000-0000-0000-000000000502#1": [ + [ + "1", + "02:00:00:00:05:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.10", + "192.168.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.1 [op=REQUEST, sender=02:00:00:00:05:11|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.1]" + ], + [ + "2", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.1", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:22 [op=REPLY, sender=02:00:00:00:05:22|192.168.0.1, target=02:00:00:00:05:11|192.168.0.10]" + ], + [ + "3", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "192.168.0.10:62587", + "42.0.0.20:7", + "UDP", + "Transport", + "" + ], + [ + "3", + "192.168.0.10:62587", + "42.0.0.20:7", + "", + "Anwendung", + "one" + ], + [ + "4", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 63" + ], + [ + "4", + "42.0.0.20:7", + "192.168.0.10:62587", + "UDP", + "Transport", + "" + ], + [ + "4", + "42.0.0.20:7", + "192.168.0.10:62587", + "", + "Anwendung", + "pong one" + ], + [ + "5", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.10", + "42.0.0.30", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "192.168.0.10:62587", + "42.0.0.30:7", + "UDP", + "Transport", + "" + ], + [ + "5", + "192.168.0.10:62587", + "42.0.0.30:7", + "", + "Anwendung", + "two" + ] + ], + "00000000-0000-0000-0000-000000000504": [ + [ + "1", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.20 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.20]" + ], + [ + "2", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "42.0.0.20", + "42.0.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:41 [op=REPLY, sender=02:00:00:00:05:41|42.0.0.20, target=02:00:00:00:05:21|42.0.0.10]" + ], + [ + "3", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 63" + ], + [ + "3", + "42.0.0.10:60168", + "42.0.0.20:7", + "UDP", + "Transport", + "" + ], + [ + "3", + "42.0.0.10:60168", + "42.0.0.20:7", + "", + "Anwendung", + "one" + ], + [ + "4", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "42.0.0.20:7", + "42.0.0.10:60168", + "UDP", + "Transport", + "" + ], + [ + "4", + "42.0.0.20:7", + "42.0.0.10:60168", + "", + "Anwendung", + "pong one" + ], + [ + "5", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "5", + "42.0.0.10", + "42.0.0.30", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.30 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.30]" + ] + ], + "00000000-0000-0000-0000-000000000505": [ + [ + "1", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.20 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.20]" + ], + [ + "2", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "42.0.0.10", + "42.0.0.30", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.30 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.30]" + ], + [ + "3", + "02:00:00:00:05:51", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "42.0.0.30", + "42.0.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:51 [op=REPLY, sender=02:00:00:00:05:51|42.0.0.30, target=02:00:00:00:05:21|42.0.0.10]" + ], + [ + "4", + "02:00:00:00:05:21", + "02:00:00:00:05:51", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.10", + "42.0.0.30", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 63" + ], + [ + "4", + "42.0.0.10:60168", + "42.0.0.30:7", + "UDP", + "Transport", + "" + ], + [ + "4", + "42.0.0.10:60168", + "42.0.0.30:7", + "", + "Anwendung", + "two" + ], + [ + "5", + "02:00:00:00:05:51", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "42.0.0.30", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "42.0.0.30:7", + "42.0.0.10:60168", + "UDP", + "Transport", + "" + ], + [ + "5", + "42.0.0.30:7", + "42.0.0.10:60168", + "", + "Anwendung", + "pong two" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000501": [ + [ + "1", + "02:00:00:00:05:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.10", + "192.168.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.1 [op=REQUEST, sender=02:00:00:00:05:11|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.1]" + ], + [ + "2", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.1", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:22 [op=REPLY, sender=02:00:00:00:05:22|192.168.0.1, target=02:00:00:00:05:11|192.168.0.10]" + ], + [ + "3", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "62587", + "7", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "", + "Anwendung", + "one" + ], + [ + "4", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 63" + ], + [ + "4", + "7", + "62587", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "", + "Anwendung", + "pong one" + ], + [ + "5", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.10", + "42.0.0.30", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "62587", + "7", + "UDP", + "Transport", + "" + ], + [ + "5", + null, + null, + "", + "Anwendung", + "two" + ] + ], + "00000000-0000-0000-0000-000000000502": [ + [ + "1", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.20 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.20]" + ], + [ + "2", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "42.0.0.20", + "42.0.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:41 [op=REPLY, sender=02:00:00:00:05:41|42.0.0.20, target=02:00:00:00:05:21|42.0.0.10]" + ], + [ + "3", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 63" + ], + [ + "3", + "60168", + "7", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "", + "Anwendung", + "one" + ], + [ + "4", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "7", + "60168", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "", + "Anwendung", + "pong one" + ], + [ + "5", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "5", + "42.0.0.10", + "42.0.0.30", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.30 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.30]" + ], + [ + "6", + "02:00:00:00:05:51", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x806" + ], + [ + "6", + "42.0.0.30", + "42.0.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:51 [op=REPLY, sender=02:00:00:00:05:51|42.0.0.30, target=02:00:00:00:05:21|42.0.0.10]" + ], + [ + "7", + "02:00:00:00:05:21", + "02:00:00:00:05:51", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "42.0.0.10", + "42.0.0.30", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 63" + ], + [ + "7", + "60168", + "7", + "UDP", + "Transport", + "" + ], + [ + "7", + null, + null, + "", + "Anwendung", + "two" + ], + [ + "8", + "02:00:00:00:05:51", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "42.0.0.30", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "8", + "7", + "60168", + "UDP", + "Transport", + "" + ], + [ + "8", + null, + null, + "", + "Anwendung", + "pong two" + ] + ], + "00000000-0000-0000-0000-000000000502#1": [ + [ + "1", + "02:00:00:00:05:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.10", + "192.168.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.1 [op=REQUEST, sender=02:00:00:00:05:11|192.168.0.10, target=FF:FF:FF:FF:FF:FF|192.168.0.1]" + ], + [ + "2", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.1", + "192.168.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:22 [op=REPLY, sender=02:00:00:00:05:22|192.168.0.1, target=02:00:00:00:05:11|192.168.0.10]" + ], + [ + "3", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "3", + "62587", + "7", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "", + "Anwendung", + "one" + ], + [ + "4", + "02:00:00:00:05:22", + "02:00:00:00:05:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 63" + ], + [ + "4", + "7", + "62587", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "", + "Anwendung", + "pong one" + ], + [ + "5", + "02:00:00:00:05:11", + "02:00:00:00:05:22", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.10", + "42.0.0.30", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "62587", + "7", + "UDP", + "Transport", + "" + ], + [ + "5", + null, + null, + "", + "Anwendung", + "two" + ] + ], + "00000000-0000-0000-0000-000000000504": [ + [ + "1", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.20 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.20]" + ], + [ + "2", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "42.0.0.20", + "42.0.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:41 [op=REPLY, sender=02:00:00:00:05:41|42.0.0.20, target=02:00:00:00:05:21|42.0.0.10]" + ], + [ + "3", + "02:00:00:00:05:21", + "02:00:00:00:05:41", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "42.0.0.10", + "42.0.0.20", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 63" + ], + [ + "3", + "60168", + "7", + "UDP", + "Transport", + "" + ], + [ + "3", + null, + null, + "", + "Anwendung", + "one" + ], + [ + "4", + "02:00:00:00:05:41", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.20", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "4", + "7", + "60168", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "", + "Anwendung", + "pong one" + ], + [ + "5", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "5", + "42.0.0.10", + "42.0.0.30", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.30 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.30]" + ] + ], + "00000000-0000-0000-0000-000000000505": [ + [ + "1", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "42.0.0.10", + "42.0.0.20", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.20 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.20]" + ], + [ + "2", + "02:00:00:00:05:21", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "42.0.0.10", + "42.0.0.30", + "ARP", + "Vermittlung", + "Suche nach MAC für 42.0.0.30 [op=REQUEST, sender=02:00:00:00:05:21|42.0.0.10, target=FF:FF:FF:FF:FF:FF|42.0.0.30]" + ], + [ + "3", + "02:00:00:00:05:51", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x806" + ], + [ + "3", + "42.0.0.30", + "42.0.0.10", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:05:51 [op=REPLY, sender=02:00:00:00:05:51|42.0.0.30, target=02:00:00:00:05:21|42.0.0.10]" + ], + [ + "4", + "02:00:00:00:05:21", + "02:00:00:00:05:51", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "42.0.0.10", + "42.0.0.30", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 63" + ], + [ + "4", + "60168", + "7", + "UDP", + "Transport", + "" + ], + [ + "4", + null, + null, + "", + "Anwendung", + "two" + ], + [ + "5", + "02:00:00:00:05:51", + "02:00:00:00:05:21", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "42.0.0.30", + "42.0.0.10", + "IP", + "Vermittlung", + "Protokoll: 17, TTL: 64" + ], + [ + "5", + "7", + "60168", + "UDP", + "Transport", + "" + ], + [ + "5", + null, + null, + "", + "Anwendung", + "pong two" + ] + ] + }, "events": [ [ - 915, + 916, "senden 42.0.0.20 called" ], [ - 917, + 918, "senden 42.0.0.20 returned " ], [ - 917, + 918, "empfangen called" ], [ - 1448, + 1452, "server received one" ], [ - 1616, + 1619, "empfangen returned pong one" ], [ - 1616, + 1620, "senden 42.0.0.30 called" ], [ - 1616, + 1620, "senden 42.0.0.30 returned " ], [ - 1616, + 1620, "empfangen called" ], [ - 2007, + 2010, "other server received two" ], [ - 15366, + 15370, "empfangen returned null" ] ], "nat": [ - "17 42.0.0.20:60310 -> 192.168.0.10:51562 DynamicEntry" + "17 42.0.0.20:60168 -> 192.168.0.10:62587 DynamicEntry" ] } diff --git a/packages/core/test/scenarios/tcp-java-closedPort.java.json b/packages/core/test/scenarios/tcp-java-closedPort.java.json index 0829ef6..18c02d6 100644 --- a/packages/core/test/scenarios/tcp-java-closedPort.java.json +++ b/packages/core/test/scenarios/tcp-java-closedPort.java.json @@ -2,7 +2,7 @@ "frames": { "00000000-0000-0000-0000-000000000101": [ { - "time": 853, + "time": 862, "source": "02:00:00:00:01:13", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -10,7 +10,7 @@ "targetIp": "192.168.0.10" }, { - "time": 854, + "time": 863, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:13", "arp": 2, @@ -18,13 +18,13 @@ "targetIp": "192.168.0.30" }, { - "time": 1083, + "time": 1091, "source": "02:00:00:00:01:13", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.30", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 50448, + "sourcePort": 50292, "destinationPort": 81, "payload": null, "tcpFlags": "S", @@ -34,7 +34,7 @@ ], "00000000-0000-0000-0000-000000000102": [ { - "time": 853, + "time": 862, "source": "02:00:00:00:01:13", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -44,7 +44,7 @@ ], "00000000-0000-0000-0000-000000000103": [ { - "time": 731, + "time": 737, "source": "02:00:00:00:01:13", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -52,7 +52,7 @@ "targetIp": "192.168.0.10" }, { - "time": 966, + "time": 975, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:13", "arp": 2, @@ -60,13 +60,13 @@ "targetIp": "192.168.0.30" }, { - "time": 968, + "time": 977, "source": "02:00:00:00:01:13", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.30", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 50448, + "sourcePort": 50292, "destinationPort": 81, "payload": null, "tcpFlags": "S", @@ -75,28 +75,300 @@ } ] }, + "rows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:13", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.30", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:13|192.168.0.30, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.30", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:11 [op=REPLY, sender=02:00:00:00:01:11|192.168.0.10, target=02:00:00:00:01:13|192.168.0.30]" + ], + [ + "3", + "02:00:00:00:01:13", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.30", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "192.168.0.30:50292", + "192.168.0.10:81", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:13", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.30", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:13|192.168.0.30, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:13", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.30", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:13|192.168.0.30, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.30", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:11 [op=REPLY, sender=02:00:00:00:01:11|192.168.0.10, target=02:00:00:00:01:13|192.168.0.30]" + ], + [ + "3", + "02:00:00:00:01:13", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.30", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "192.168.0.30:50292", + "192.168.0.10:81", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:13", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.30", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:13|192.168.0.30, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.30", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:11 [op=REPLY, sender=02:00:00:00:01:11|192.168.0.10, target=02:00:00:00:01:13|192.168.0.30]" + ], + [ + "3", + "02:00:00:00:01:13", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.30", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "50292", + "81", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:13", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.30", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:13|192.168.0.30, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:13", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.30", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:13|192.168.0.30, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "02:00:00:00:01:13", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.30", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:11 [op=REPLY, sender=02:00:00:00:01:11|192.168.0.10, target=02:00:00:00:01:13|192.168.0.30]" + ], + [ + "3", + "02:00:00:00:01:13", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.30", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "50292", + "81", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000" + ] + ] + }, "events": [ [ - 715, + 716, "client verbinden called" ], [ - 9020, + 9021, "client verbinden failed TimeOutException" ] ], "states": { "client": [ [ - 714, + 715, "CLOSED" ], [ - 728, + 734, "SYN_SENT" ], [ - 8978, + 8984, "CLOSED" ] ] diff --git a/packages/core/test/scenarios/tcp-java-exchange.java.json b/packages/core/test/scenarios/tcp-java-exchange.java.json index 87b5d98..c07b603 100644 --- a/packages/core/test/scenarios/tcp-java-exchange.java.json +++ b/packages/core/test/scenarios/tcp-java-exchange.java.json @@ -2,7 +2,7 @@ "frames": { "00000000-0000-0000-0000-000000000101": [ { - "time": 856, + "time": 851, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -10,7 +10,7 @@ "targetIp": "192.168.0.10" }, { - "time": 857, + "time": 853, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "arp": 2, @@ -18,13 +18,13 @@ "targetIp": "192.168.0.20" }, { - "time": 1084, + "time": 1081, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 49357, + "sourcePort": 58347, "destinationPort": 80, "payload": null, "tcpFlags": "S", @@ -32,27 +32,27 @@ "acknowledgement": 0 }, { - "time": 1086, + "time": 1083, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 49357, + "destinationPort": 58347, "payload": null, "tcpFlags": "SA", "sequence": 1000000, "acknowledgement": 2000001 }, { - "time": 1309, + "time": 1306, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 49357, + "sourcePort": 58347, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -60,13 +60,13 @@ "acknowledgement": 1000001 }, { - "time": 1364, + "time": 1362, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 49357, + "sourcePort": 58347, "destinationPort": 80, "payload": "GET /", "tcpFlags": "P", @@ -74,41 +74,41 @@ "acknowledgement": 0 }, { - "time": 1365, + "time": 1362, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 49357, + "destinationPort": 58347, "payload": null, "tcpFlags": "A", "sequence": 1000001, "acknowledgement": 2000006 }, { - "time": 1420, + "time": 1418, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 49357, + "destinationPort": 58347, "payload": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "tcpFlags": "", "sequence": 1000001, "acknowledgement": 0 }, { - "time": 1643, + "time": 1640, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 49357, + "sourcePort": 58347, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -116,27 +116,27 @@ "acknowledgement": 1001461 }, { - "time": 1644, + "time": 1641, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 49357, + "destinationPort": 58347, "payload": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "tcpFlags": "", "sequence": 1001461, "acknowledgement": 0 }, { - "time": 1867, + "time": 1863, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 49357, + "sourcePort": 58347, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -144,27 +144,27 @@ "acknowledgement": 1002921 }, { - "time": 1867, + "time": 1864, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 49357, + "destinationPort": 58347, "payload": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "tcpFlags": "P", "sequence": 1002921, "acknowledgement": 0 }, { - "time": 2090, + "time": 2086, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 49357, + "sourcePort": 58347, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -172,13 +172,13 @@ "acknowledgement": 1003001 }, { - "time": 2145, + "time": 2142, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 49357, + "sourcePort": 58347, "destinationPort": 80, "payload": null, "tcpFlags": "F", @@ -186,41 +186,41 @@ "acknowledgement": 0 }, { - "time": 2145, + "time": 2142, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 49357, + "destinationPort": 58347, "payload": null, "tcpFlags": "A", "sequence": 1003001, "acknowledgement": 2000007 }, { - "time": 2201, + "time": 2198, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 49357, + "destinationPort": 58347, "payload": null, "tcpFlags": "F", "sequence": 1003001, "acknowledgement": 0 }, { - "time": 2423, + "time": 2420, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 49357, + "sourcePort": 58347, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -238,7 +238,7 @@ "targetIp": "192.168.0.10" }, { - "time": 968, + "time": 964, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "arp": 2, @@ -246,13 +246,13 @@ "targetIp": "192.168.0.20" }, { - "time": 971, + "time": 967, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 49357, + "sourcePort": 58347, "destinationPort": 80, "payload": null, "tcpFlags": "S", @@ -260,27 +260,27 @@ "acknowledgement": 0 }, { - "time": 1197, + "time": 1194, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 49357, + "destinationPort": 58347, "payload": null, "tcpFlags": "SA", "sequence": 1000000, "acknowledgement": 2000001 }, { - "time": 1198, + "time": 1195, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 49357, + "sourcePort": 58347, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -288,13 +288,13 @@ "acknowledgement": 1000001 }, { - "time": 1253, + "time": 1250, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 49357, + "sourcePort": 58347, "destinationPort": 80, "payload": "GET /", "tcpFlags": "P", @@ -302,41 +302,41 @@ "acknowledgement": 0 }, { - "time": 1476, + "time": 1473, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 49357, + "destinationPort": 58347, "payload": null, "tcpFlags": "A", "sequence": 1000001, "acknowledgement": 2000006 }, { - "time": 1532, + "time": 1529, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 49357, + "destinationPort": 58347, "payload": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "tcpFlags": "", "sequence": 1000001, "acknowledgement": 0 }, { - "time": 1532, + "time": 1529, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 49357, + "sourcePort": 58347, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -344,27 +344,27 @@ "acknowledgement": 1001461 }, { - "time": 1755, + "time": 1752, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 49357, + "destinationPort": 58347, "payload": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "tcpFlags": "", "sequence": 1001461, "acknowledgement": 0 }, { - "time": 1756, + "time": 1752, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 49357, + "sourcePort": 58347, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -372,27 +372,27 @@ "acknowledgement": 1002921 }, { - "time": 1978, + "time": 1975, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 49357, + "destinationPort": 58347, "payload": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "tcpFlags": "P", "sequence": 1002921, "acknowledgement": 0 }, { - "time": 1979, + "time": 1975, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 49357, + "sourcePort": 58347, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -400,13 +400,13 @@ "acknowledgement": 1003001 }, { - "time": 2034, + "time": 2031, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 49357, + "sourcePort": 58347, "destinationPort": 80, "payload": null, "tcpFlags": "F", @@ -414,41 +414,41 @@ "acknowledgement": 0 }, { - "time": 2256, + "time": 2253, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 49357, + "destinationPort": 58347, "payload": null, "tcpFlags": "A", "sequence": 1003001, "acknowledgement": 2000007 }, { - "time": 2312, + "time": 2309, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 49357, + "destinationPort": 58347, "payload": null, "tcpFlags": "F", "sequence": 1003001, "acknowledgement": 0 }, { - "time": 2312, + "time": 2309, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 49357, + "sourcePort": 58347, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -458,7 +458,7 @@ ], "00000000-0000-0000-0000-000000000103": [ { - "time": 856, + "time": 851, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -467,118 +467,1850 @@ } ] }, + "rows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:11 [op=REPLY, sender=02:00:00:00:01:11|192.168.0.10, target=02:00:00:00:01:12|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "192.168.0.20:58347", + "192.168.0.10:80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "192.168.0.10:80", + "192.168.0.20:58347", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "192.168.0.20:58347", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "192.168.0.20:58347", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "6", + "192.168.0.20:58347", + "192.168.0.10:80", + "", + "Anwendung", + "GET /" + ], + [ + "7", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "7", + "192.168.0.10:80", + "192.168.0.20:58347", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.006" + ], + [ + "8", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "8", + "192.168.0.10:80", + "192.168.0.20:58347", + "TCP", + "Transport", + "SEQ: 1.000.001" + ], + [ + "8", + "192.168.0.10:80", + "192.168.0.20:58347", + "HTTP", + "Anwendung", + "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" + ], + [ + "9", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "9", + "192.168.0.20:58347", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.006, ACK: 1.001.461" + ], + [ + "10", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "10", + "192.168.0.10:80", + "192.168.0.20:58347", + "TCP", + "Transport", + "SEQ: 1.001.461" + ], + [ + "10", + "192.168.0.10:80", + "192.168.0.20:58347", + "HTTP", + "Anwendung", + "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" + ], + [ + "11", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "11", + "192.168.0.20:58347", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.006, ACK: 1.002.921" + ], + [ + "12", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "12", + "192.168.0.10:80", + "192.168.0.20:58347", + "TCP", + "Transport", + "SEQ: 1.002.921" + ], + [ + "12", + "192.168.0.10:80", + "192.168.0.20:58347", + "HTTP", + "Anwendung", + "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" + ], + [ + "13", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "13", + "192.168.0.20:58347", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.006, ACK: 1.003.001" + ], + [ + "14", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "14", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "14", + "192.168.0.20:58347", + "192.168.0.10:80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.006" + ], + [ + "15", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "15", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "15", + "192.168.0.10:80", + "192.168.0.20:58347", + "TCP", + "Transport", + "SEQ: 1.003.001, ACK: 2.000.007" + ], + [ + "16", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "16", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "16", + "192.168.0.10:80", + "192.168.0.20:58347", + "TCP", + "Transport", + "FIN, SEQ: 1.003.001" + ], + [ + "17", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "17", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "17", + "192.168.0.20:58347", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.007, ACK: 1.003.002" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:11 [op=REPLY, sender=02:00:00:00:01:11|192.168.0.10, target=02:00:00:00:01:12|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "192.168.0.20:58347", + "192.168.0.10:80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "192.168.0.10:80", + "192.168.0.20:58347", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "192.168.0.20:58347", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "192.168.0.20:58347", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "6", + "192.168.0.20:58347", + "192.168.0.10:80", + "", + "Anwendung", + "GET /" + ], + [ + "7", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "7", + "192.168.0.10:80", + "192.168.0.20:58347", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.006" + ], + [ + "8", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "8", + "192.168.0.10:80", + "192.168.0.20:58347", + "TCP", + "Transport", + "SEQ: 1.000.001" + ], + [ + "8", + "192.168.0.10:80", + "192.168.0.20:58347", + "HTTP", + "Anwendung", + "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" + ], + [ + "9", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "9", + "192.168.0.20:58347", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.006, ACK: 1.001.461" + ], + [ + "10", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "10", + "192.168.0.10:80", + "192.168.0.20:58347", + "TCP", + "Transport", + "SEQ: 1.001.461" + ], + [ + "10", + "192.168.0.10:80", + "192.168.0.20:58347", + "HTTP", + "Anwendung", + "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" + ], + [ + "11", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "11", + "192.168.0.20:58347", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.006, ACK: 1.002.921" + ], + [ + "12", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "12", + "192.168.0.10:80", + "192.168.0.20:58347", + "TCP", + "Transport", + "SEQ: 1.002.921" + ], + [ + "12", + "192.168.0.10:80", + "192.168.0.20:58347", + "HTTP", + "Anwendung", + "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" + ], + [ + "13", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "13", + "192.168.0.20:58347", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.006, ACK: 1.003.001" + ], + [ + "14", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "14", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "14", + "192.168.0.20:58347", + "192.168.0.10:80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.006" + ], + [ + "15", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "15", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "15", + "192.168.0.10:80", + "192.168.0.20:58347", + "TCP", + "Transport", + "SEQ: 1.003.001, ACK: 2.000.007" + ], + [ + "16", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "16", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "16", + "192.168.0.10:80", + "192.168.0.20:58347", + "TCP", + "Transport", + "FIN, SEQ: 1.003.001" + ], + [ + "17", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "17", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "17", + "192.168.0.20:58347", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.007, ACK: 1.003.002" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:11 [op=REPLY, sender=02:00:00:00:01:11|192.168.0.10, target=02:00:00:00:01:12|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "58347", + "80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "80", + "58347", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "58347", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "58347", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "6", + null, + null, + "", + "Anwendung", + "GET /" + ], + [ + "7", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "7", + "80", + "58347", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.006" + ], + [ + "8", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "8", + "80", + "58347", + "TCP", + "Transport", + "SEQ: 1.000.001" + ], + [ + "8", + null, + null, + "HTTP", + "Anwendung", + "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" + ], + [ + "9", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "9", + "58347", + "80", + "TCP", + "Transport", + "SEQ: 2.000.006, ACK: 1.001.461" + ], + [ + "10", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "10", + "80", + "58347", + "TCP", + "Transport", + "SEQ: 1.001.461" + ], + [ + "10", + null, + null, + "HTTP", + "Anwendung", + "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" + ], + [ + "11", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "11", + "58347", + "80", + "TCP", + "Transport", + "SEQ: 2.000.006, ACK: 1.002.921" + ], + [ + "12", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "12", + "80", + "58347", + "TCP", + "Transport", + "SEQ: 1.002.921" + ], + [ + "12", + null, + null, + "HTTP", + "Anwendung", + "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" + ], + [ + "13", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "13", + "58347", + "80", + "TCP", + "Transport", + "SEQ: 2.000.006, ACK: 1.003.001" + ], + [ + "14", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "14", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "14", + "58347", + "80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.006" + ], + [ + "15", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "15", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "15", + "80", + "58347", + "TCP", + "Transport", + "SEQ: 1.003.001, ACK: 2.000.007" + ], + [ + "16", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "16", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "16", + "80", + "58347", + "TCP", + "Transport", + "FIN, SEQ: 1.003.001" + ], + [ + "17", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "17", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "17", + "58347", + "80", + "TCP", + "Transport", + "SEQ: 2.000.007, ACK: 1.003.002" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:11 [op=REPLY, sender=02:00:00:00:01:11|192.168.0.10, target=02:00:00:00:01:12|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "58347", + "80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "80", + "58347", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "58347", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "58347", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "6", + null, + null, + "", + "Anwendung", + "GET /" + ], + [ + "7", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "7", + "80", + "58347", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.006" + ], + [ + "8", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "8", + "80", + "58347", + "TCP", + "Transport", + "SEQ: 1.000.001" + ], + [ + "8", + null, + null, + "HTTP", + "Anwendung", + "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" + ], + [ + "9", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "9", + "58347", + "80", + "TCP", + "Transport", + "SEQ: 2.000.006, ACK: 1.001.461" + ], + [ + "10", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "10", + "80", + "58347", + "TCP", + "Transport", + "SEQ: 1.001.461" + ], + [ + "10", + null, + null, + "HTTP", + "Anwendung", + "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" + ], + [ + "11", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "11", + "58347", + "80", + "TCP", + "Transport", + "SEQ: 2.000.006, ACK: 1.002.921" + ], + [ + "12", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "12", + "80", + "58347", + "TCP", + "Transport", + "SEQ: 1.002.921" + ], + [ + "12", + null, + null, + "HTTP", + "Anwendung", + "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" + ], + [ + "13", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "13", + "58347", + "80", + "TCP", + "Transport", + "SEQ: 2.000.006, ACK: 1.003.001" + ], + [ + "14", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "14", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "14", + "58347", + "80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.006" + ], + [ + "15", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "15", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "15", + "80", + "58347", + "TCP", + "Transport", + "SEQ: 1.003.001, ACK: 2.000.007" + ], + [ + "16", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "16", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "16", + "80", + "58347", + "TCP", + "Transport", + "FIN, SEQ: 1.003.001" + ], + [ + "17", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "17", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "17", + "58347", + "80", + "TCP", + "Transport", + "SEQ: 2.000.007, ACK: 1.003.002" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ] + ] + }, "events": [ [ - 215, + 214, "server oeffnen called" ], [ - 716, + 715, "client verbinden called" ], [ - 1217, + 1216, "client verbinden returned" ], [ - 1217, + 1216, "client senden called" ], [ - 1318, + 1317, "server oeffnen returned" ], [ - 1318, + 1317, "server empfangen called" ], [ - 1365, + 1362, "server empfangen returned 5 characters" ], [ - 1365, + 1362, "server senden called" ], [ - 1476, + 1474, "client senden returned" ], [ - 1476, + 1474, "client empfangen called" ], [ - 1979, + 1975, "client empfangen returned 3000 characters" ], [ - 1979, + 1975, "client schliessen called" ], [ - 1979, + 1975, "client schliessen returned" ], [ - 2090, + 2087, "server senden returned" - ], - [ - 3146, - "server schliessen called" - ], - [ - 3146, - "server schliessen returned" ] ], "states": { "client": [ [ - 716, + 715, "CLOSED" ], [ - 727, + 726, "SYN_SENT" ], [ - 1199, + 1195, "ESTABLISHED" ], [ - 1981, + 1977, "FIN_WAIT_1" ], [ - 2256, + 2255, "FIN_WAIT_2" ], [ - 2312, + 2310, "TIME_WAIT" ], [ - 10562, + 10560, "CLOSED" ] ], "server": [ [ - 1318, + 1317, "ESTABLISHED" ], [ - 2145, - "CLOSE_WAIT" - ], - [ - 2147, + 2144, "LAST_ACK" ], [ - 2423, + 2421, "CLOSED" ] ] diff --git a/packages/core/test/scenarios/tcp-java-lostData.java.json b/packages/core/test/scenarios/tcp-java-lostData.java.json index 29d9a69..2dde795 100644 --- a/packages/core/test/scenarios/tcp-java-lostData.java.json +++ b/packages/core/test/scenarios/tcp-java-lostData.java.json @@ -18,13 +18,13 @@ "targetIp": "192.168.0.20" }, { - "time": 1083, + "time": 1082, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 51723, + "sourcePort": 51011, "destinationPort": 80, "payload": null, "tcpFlags": "S", @@ -32,27 +32,27 @@ "acknowledgement": 0 }, { - "time": 1085, + "time": 1084, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 51723, + "destinationPort": 51011, "payload": null, "tcpFlags": "SA", "sequence": 1000000, "acknowledgement": 2000001 }, { - "time": 1308, + "time": 1307, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 51723, + "sourcePort": 51011, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -60,13 +60,13 @@ "acknowledgement": 1000001 }, { - "time": 26578, + "time": 26580, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 51723, + "sourcePort": 51011, "destinationPort": 80, "payload": null, "tcpFlags": "F", @@ -74,41 +74,41 @@ "acknowledgement": 0 }, { - "time": 26578, + "time": 26581, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 51723, + "destinationPort": 51011, "payload": null, "tcpFlags": "A", "sequence": 1000001, "acknowledgement": 2000010 }, { - "time": 26634, + "time": 26636, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 51723, + "destinationPort": 51011, "payload": null, "tcpFlags": "F", "sequence": 1000001, "acknowledgement": 0 }, { - "time": 26856, + "time": 26859, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 51723, + "sourcePort": 51011, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -118,7 +118,7 @@ ], "00000000-0000-0000-0000-000000000102": [ { - "time": 729, + "time": 731, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -134,13 +134,13 @@ "targetIp": "192.168.0.20" }, { - "time": 969, + "time": 968, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 51723, + "sourcePort": 51011, "destinationPort": 80, "payload": null, "tcpFlags": "S", @@ -148,27 +148,27 @@ "acknowledgement": 0 }, { - "time": 1196, + "time": 1195, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 51723, + "destinationPort": 51011, "payload": null, "tcpFlags": "SA", "sequence": 1000000, "acknowledgement": 2000001 }, { - "time": 1197, + "time": 1196, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 51723, + "sourcePort": 51011, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -176,13 +176,13 @@ "acknowledgement": 1000001 }, { - "time": 1716, + "time": 1718, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 51723, + "sourcePort": 51011, "destinationPort": 80, "payload": "verloren", "tcpFlags": "P", @@ -190,13 +190,13 @@ "acknowledgement": 0 }, { - "time": 9966, + "time": 9969, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 51723, + "sourcePort": 51011, "destinationPort": 80, "payload": "verloren", "tcpFlags": "P", @@ -204,13 +204,13 @@ "acknowledgement": 0 }, { - "time": 18216, + "time": 18219, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 51723, + "sourcePort": 51011, "destinationPort": 80, "payload": "verloren", "tcpFlags": "P", @@ -218,13 +218,13 @@ "acknowledgement": 0 }, { - "time": 26467, + "time": 26469, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 51723, + "sourcePort": 51011, "destinationPort": 80, "payload": null, "tcpFlags": "F", @@ -232,41 +232,41 @@ "acknowledgement": 0 }, { - "time": 26690, + "time": 26692, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 51723, + "destinationPort": 51011, "payload": null, "tcpFlags": "A", "sequence": 1000001, "acknowledgement": 2000010 }, { - "time": 26745, + "time": 26747, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 51723, + "destinationPort": 51011, "payload": null, "tcpFlags": "F", "sequence": 1000001, "acknowledgement": 0 }, { - "time": 26745, + "time": 26748, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 51723, + "sourcePort": 51011, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -284,13 +284,13 @@ "targetIp": "192.168.0.10" }, { - "time": 26578, + "time": 26580, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 51723, + "sourcePort": 51011, "destinationPort": 80, "payload": null, "tcpFlags": "F", @@ -299,48 +299,1136 @@ } ] }, + "rows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:11 [op=REPLY, sender=02:00:00:00:01:11|192.168.0.10, target=02:00:00:00:01:12|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "192.168.0.20:51011", + "192.168.0.10:80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "192.168.0.10:80", + "192.168.0.20:51011", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "192.168.0.20:51011", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "192.168.0.20:51011", + "192.168.0.10:80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.009" + ], + [ + "7", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "7", + "192.168.0.10:80", + "192.168.0.20:51011", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.010" + ], + [ + "8", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "8", + "192.168.0.10:80", + "192.168.0.20:51011", + "TCP", + "Transport", + "FIN, SEQ: 1.000.001" + ], + [ + "9", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "9", + "192.168.0.20:51011", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.010, ACK: 1.000.002" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:11 [op=REPLY, sender=02:00:00:00:01:11|192.168.0.10, target=02:00:00:00:01:12|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "192.168.0.20:51011", + "192.168.0.10:80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "192.168.0.10:80", + "192.168.0.20:51011", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "192.168.0.20:51011", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "192.168.0.20:51011", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "6", + "192.168.0.20:51011", + "192.168.0.10:80", + "", + "Anwendung", + "verloren" + ], + [ + "7", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "7", + "192.168.0.20:51011", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "7", + "192.168.0.20:51011", + "192.168.0.10:80", + "", + "Anwendung", + "verloren" + ], + [ + "8", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "8", + "192.168.0.20:51011", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "8", + "192.168.0.20:51011", + "192.168.0.10:80", + "", + "Anwendung", + "verloren" + ], + [ + "9", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "9", + "192.168.0.20:51011", + "192.168.0.10:80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.009" + ], + [ + "10", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "10", + "192.168.0.10:80", + "192.168.0.20:51011", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.010" + ], + [ + "11", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "11", + "192.168.0.10:80", + "192.168.0.20:51011", + "TCP", + "Transport", + "FIN, SEQ: 1.000.001" + ], + [ + "12", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "12", + "192.168.0.20:51011", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.010, ACK: 1.000.002" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "2", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "2", + "192.168.0.20:51011", + "192.168.0.10:80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.009" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:11 [op=REPLY, sender=02:00:00:00:01:11|192.168.0.10, target=02:00:00:00:01:12|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "51011", + "80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "80", + "51011", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "51011", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "51011", + "80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.009" + ], + [ + "7", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "7", + "80", + "51011", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.010" + ], + [ + "8", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "8", + "80", + "51011", + "TCP", + "Transport", + "FIN, SEQ: 1.000.001" + ], + [ + "9", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "9", + "51011", + "80", + "TCP", + "Transport", + "SEQ: 2.000.010, ACK: 1.000.002" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:11 [op=REPLY, sender=02:00:00:00:01:11|192.168.0.10, target=02:00:00:00:01:12|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "51011", + "80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "80", + "51011", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "51011", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "51011", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "6", + null, + null, + "", + "Anwendung", + "verloren" + ], + [ + "7", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "7", + "51011", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "7", + null, + null, + "", + "Anwendung", + "verloren" + ], + [ + "8", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "8", + "51011", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "8", + null, + null, + "", + "Anwendung", + "verloren" + ], + [ + "9", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "9", + "51011", + "80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.009" + ], + [ + "10", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "10", + "80", + "51011", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.010" + ], + [ + "11", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "11", + "80", + "51011", + "TCP", + "Transport", + "FIN, SEQ: 1.000.001" + ], + [ + "12", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "12", + "51011", + "80", + "TCP", + "Transport", + "SEQ: 2.000.010, ACK: 1.000.002" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "2", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "2", + "51011", + "80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.009" + ] + ] + }, "events": [ [ - 214, + 216, "server oeffnen called" ], [ - 715, + 717, "client verbinden called" ], [ - 1215, + 1217, "client verbinden returned" ], [ - 1316, + 1319, "server oeffnen returned" ], [ - 1715, + 1717, "loss on" ], [ - 1716, + 1718, "client senden called" ], [ - 26467, + 26469, "client senden failed TimeOutException" ], [ - 26467, + 26469, "loss off" ] ], "states": { "client": [ [ - 714, + 717, "CLOSED" ], [ - 725, + 728, "SYN_SENT" ], [ @@ -348,37 +1436,37 @@ "ESTABLISHED" ], [ - 26467, + 26469, "FIN_WAIT_1" ], [ - 26692, + 26694, "FIN_WAIT_2" ], [ - 26747, + 26748, "TIME_WAIT" ], [ - 34997, + 34999, "CLOSED" ] ], "server": [ [ - 1316, + 1319, "ESTABLISHED" ], [ - 26578, + 26581, "CLOSE_WAIT" ], [ - 26580, + 26583, "LAST_ACK" ], [ - 26858, + 26860, "CLOSED" ] ] diff --git a/packages/core/test/scenarios/tcp-java-lostFin.java.json b/packages/core/test/scenarios/tcp-java-lostFin.java.json index b45a8d4..cd9f379 100644 --- a/packages/core/test/scenarios/tcp-java-lostFin.java.json +++ b/packages/core/test/scenarios/tcp-java-lostFin.java.json @@ -2,7 +2,7 @@ "frames": { "00000000-0000-0000-0000-000000000101": [ { - "time": 855, + "time": 853, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -10,7 +10,7 @@ "targetIp": "192.168.0.10" }, { - "time": 857, + "time": 854, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "arp": 2, @@ -18,13 +18,13 @@ "targetIp": "192.168.0.20" }, { - "time": 1086, + "time": 1081, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 63329, + "sourcePort": 49334, "destinationPort": 80, "payload": null, "tcpFlags": "S", @@ -32,27 +32,27 @@ "acknowledgement": 0 }, { - "time": 1088, + "time": 1083, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 63329, + "destinationPort": 49334, "payload": null, "tcpFlags": "SA", "sequence": 1000000, "acknowledgement": 2000001 }, { - "time": 1311, + "time": 1306, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 63329, + "sourcePort": 49334, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -62,7 +62,7 @@ ], "00000000-0000-0000-0000-000000000102": [ { - "time": 733, + "time": 728, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -70,7 +70,7 @@ "targetIp": "192.168.0.10" }, { - "time": 969, + "time": 966, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "arp": 2, @@ -78,13 +78,13 @@ "targetIp": "192.168.0.20" }, { - "time": 972, + "time": 968, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 63329, + "sourcePort": 49334, "destinationPort": 80, "payload": null, "tcpFlags": "S", @@ -92,27 +92,27 @@ "acknowledgement": 0 }, { - "time": 1199, + "time": 1194, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 63329, + "destinationPort": 49334, "payload": null, "tcpFlags": "SA", "sequence": 1000000, "acknowledgement": 2000001 }, { - "time": 1200, + "time": 1195, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 63329, + "sourcePort": 49334, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -120,13 +120,13 @@ "acknowledgement": 1000001 }, { - "time": 1719, + "time": 1715, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 63329, + "sourcePort": 49334, "destinationPort": 80, "payload": null, "tcpFlags": "F", @@ -136,7 +136,7 @@ ], "00000000-0000-0000-0000-000000000103": [ { - "time": 855, + "time": 853, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -145,58 +145,570 @@ } ] }, + "rows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:11 [op=REPLY, sender=02:00:00:00:01:11|192.168.0.10, target=02:00:00:00:01:12|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "192.168.0.20:49334", + "192.168.0.10:80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "192.168.0.10:80", + "192.168.0.20:49334", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "192.168.0.20:49334", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:11 [op=REPLY, sender=02:00:00:00:01:11|192.168.0.10, target=02:00:00:00:01:12|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "192.168.0.20:49334", + "192.168.0.10:80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "192.168.0.10:80", + "192.168.0.20:49334", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "192.168.0.20:49334", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "192.168.0.20:49334", + "192.168.0.10:80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.001" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:11 [op=REPLY, sender=02:00:00:00:01:11|192.168.0.10, target=02:00:00:00:01:12|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "49334", + "80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "80", + "49334", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "49334", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:11 [op=REPLY, sender=02:00:00:00:01:11|192.168.0.10, target=02:00:00:00:01:12|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "49334", + "80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "80", + "49334", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "49334", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "49334", + "80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.001" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ] + ] + }, "events": [ [ - 216, + 213, "server oeffnen called" ], [ - 718, + 714, "client verbinden called" ], [ - 1218, + 1215, "client verbinden returned" ], [ - 1319, + 1316, "server oeffnen returned" ], [ - 1719, + 1715, "client schliessen called" ], [ - 1719, + 1715, "client schliessen returned" ], [ - 1719, + 1715, "lost FIN" ] ], "states": { "client": [ [ - 717, + 714, "CLOSED" ], [ - 729, + 724, "SYN_SENT" ], [ - 1201, + 1195, "ESTABLISHED" ], [ - 1719, + 1716, "FIN_WAIT_1" ] ], "server": [ [ - 1319, + 1316, "ESTABLISHED" ] ] diff --git a/packages/core/test/scenarios/tcp-java-lostLastFin.java.json b/packages/core/test/scenarios/tcp-java-lostLastFin.java.json index 4a8b4c5..2be93f0 100644 --- a/packages/core/test/scenarios/tcp-java-lostLastFin.java.json +++ b/packages/core/test/scenarios/tcp-java-lostLastFin.java.json @@ -2,7 +2,7 @@ "frames": { "00000000-0000-0000-0000-000000000101": [ { - "time": 849, + "time": 862, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -10,7 +10,7 @@ "targetIp": "192.168.0.10" }, { - "time": 850, + "time": 863, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "arp": 2, @@ -18,13 +18,13 @@ "targetIp": "192.168.0.20" }, { - "time": 1078, + "time": 1091, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 59631, + "sourcePort": 58231, "destinationPort": 80, "payload": null, "tcpFlags": "S", @@ -32,27 +32,27 @@ "acknowledgement": 0 }, { - "time": 1079, + "time": 1094, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 59631, + "destinationPort": 58231, "payload": null, "tcpFlags": "SA", "sequence": 1000000, "acknowledgement": 2000001 }, { - "time": 1303, + "time": 1318, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 59631, + "sourcePort": 58231, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -60,13 +60,13 @@ "acknowledgement": 1000001 }, { - "time": 1827, + "time": 1839, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 59631, + "sourcePort": 58231, "destinationPort": 80, "payload": null, "tcpFlags": "F", @@ -74,28 +74,28 @@ "acknowledgement": 0 }, { - "time": 1828, + "time": 1839, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 59631, + "destinationPort": 58231, "payload": null, "tcpFlags": "A", "sequence": 1000001, "acknowledgement": 2000002 }, { - "time": 1883, + "time": 1895, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 59631, + "destinationPort": 58231, "payload": null, "tcpFlags": "F", "sequence": 1000001, @@ -104,7 +104,7 @@ ], "00000000-0000-0000-0000-000000000102": [ { - "time": 729, + "time": 740, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -112,7 +112,7 @@ "targetIp": "192.168.0.10" }, { - "time": 962, + "time": 975, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "arp": 2, @@ -120,13 +120,13 @@ "targetIp": "192.168.0.20" }, { - "time": 964, + "time": 978, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 59631, + "sourcePort": 58231, "destinationPort": 80, "payload": null, "tcpFlags": "S", @@ -134,27 +134,27 @@ "acknowledgement": 0 }, { - "time": 1191, + "time": 1206, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 59631, + "destinationPort": 58231, "payload": null, "tcpFlags": "SA", "sequence": 1000000, "acknowledgement": 2000001 }, { - "time": 1191, + "time": 1206, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 59631, + "sourcePort": 58231, "destinationPort": 80, "payload": null, "tcpFlags": "A", @@ -162,13 +162,13 @@ "acknowledgement": 1000001 }, { - "time": 1716, + "time": 1728, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 59631, + "sourcePort": 58231, "destinationPort": 80, "payload": null, "tcpFlags": "F", @@ -176,14 +176,14 @@ "acknowledgement": 0 }, { - "time": 1939, + "time": 1950, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 59631, + "destinationPort": 58231, "payload": null, "tcpFlags": "A", "sequence": 1000001, @@ -192,7 +192,7 @@ ], "00000000-0000-0000-0000-000000000103": [ { - "time": 849, + "time": 862, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -201,66 +201,770 @@ } ] }, + "rows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:11 [op=REPLY, sender=02:00:00:00:01:11|192.168.0.10, target=02:00:00:00:01:12|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "192.168.0.20:58231", + "192.168.0.10:80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "192.168.0.10:80", + "192.168.0.20:58231", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "192.168.0.20:58231", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "192.168.0.20:58231", + "192.168.0.10:80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.001" + ], + [ + "7", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "7", + "192.168.0.10:80", + "192.168.0.20:58231", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.002" + ], + [ + "8", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "8", + "192.168.0.10:80", + "192.168.0.20:58231", + "TCP", + "Transport", + "FIN, SEQ: 1.000.001" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:11 [op=REPLY, sender=02:00:00:00:01:11|192.168.0.10, target=02:00:00:00:01:12|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "192.168.0.20:58231", + "192.168.0.10:80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "192.168.0.10:80", + "192.168.0.20:58231", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "192.168.0.20:58231", + "192.168.0.10:80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "192.168.0.20:58231", + "192.168.0.10:80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.001" + ], + [ + "7", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "7", + "192.168.0.10:80", + "192.168.0.20:58231", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.002" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:11 [op=REPLY, sender=02:00:00:00:01:11|192.168.0.10, target=02:00:00:00:01:12|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "58231", + "80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "80", + "58231", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "58231", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "58231", + "80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.001" + ], + [ + "7", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "7", + "80", + "58231", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.002" + ], + [ + "8", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "8", + "80", + "58231", + "TCP", + "Transport", + "FIN, SEQ: 1.000.001" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:11 [op=REPLY, sender=02:00:00:00:01:11|192.168.0.10, target=02:00:00:00:01:12|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "58231", + "80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "80", + "58231", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "58231", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "58231", + "80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.001" + ], + [ + "7", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "7", + "80", + "58231", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.002" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ] + ] + }, "events": [ [ - 214, + 226, "server oeffnen called" ], [ - 714, + 727, "client verbinden called" ], [ - 1215, + 1227, "client verbinden returned" ], [ - 1317, + 1329, "server oeffnen returned" ], [ - 1715, + 1728, "client schliessen called" ], [ - 1715, + 1728, "client schliessen returned" ], [ - 1883, + 1895, "lost FIN" ] ], "states": { "client": [ [ - 714, + 726, "CLOSED" ], [ - 724, + 736, "SYN_SENT" ], [ - 1191, + 1208, "ESTABLISHED" ], [ - 1716, + 1728, "FIN_WAIT_1" ], [ - 1940, + 1951, "FIN_WAIT_2" ] ], "server": [ [ - 1317, + 1329, "ESTABLISHED" ], [ - 1829, + 1840, "LAST_ACK" ] ] diff --git a/packages/core/test/scenarios/tcp-java-lostSynAck.java.json b/packages/core/test/scenarios/tcp-java-lostSynAck.java.json index a0ea244..0b46a67 100644 --- a/packages/core/test/scenarios/tcp-java-lostSynAck.java.json +++ b/packages/core/test/scenarios/tcp-java-lostSynAck.java.json @@ -2,7 +2,7 @@ "frames": { "00000000-0000-0000-0000-000000000101": [ { - "time": 850, + "time": 854, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -10,7 +10,7 @@ "targetIp": "192.168.0.10" }, { - "time": 852, + "time": 855, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "arp": 2, @@ -18,13 +18,13 @@ "targetIp": "192.168.0.20" }, { - "time": 1079, + "time": 1083, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 52891, + "sourcePort": 52105, "destinationPort": 80, "payload": null, "tcpFlags": "S", @@ -32,28 +32,28 @@ "acknowledgement": 0 }, { - "time": 1081, + "time": 1085, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 52891, + "destinationPort": 52105, "payload": null, "tcpFlags": "SA", "sequence": 1000000, "acknowledgement": 2000001 }, { - "time": 17582, + "time": 17585, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 52891, + "destinationPort": 52105, "payload": null, "tcpFlags": "F", "sequence": 1000001, @@ -62,7 +62,7 @@ ], "00000000-0000-0000-0000-000000000102": [ { - "time": 728, + "time": 733, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -70,7 +70,7 @@ "targetIp": "192.168.0.10" }, { - "time": 963, + "time": 967, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "arp": 2, @@ -78,13 +78,13 @@ "targetIp": "192.168.0.20" }, { - "time": 966, + "time": 969, "source": "02:00:00:00:01:12", "destination": "02:00:00:00:01:11", "sourceIp": "192.168.0.20", "destinationIp": "192.168.0.10", "protocol": 6, - "sourcePort": 52891, + "sourcePort": 52105, "destinationPort": 80, "payload": null, "tcpFlags": "S", @@ -92,14 +92,14 @@ "acknowledgement": 0 }, { - "time": 17694, + "time": 17697, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 52891, + "destinationPort": 52105, "payload": null, "tcpFlags": "F", "sequence": 1000001, @@ -108,7 +108,7 @@ ], "00000000-0000-0000-0000-000000000103": [ { - "time": 850, + "time": 854, "source": "02:00:00:00:01:12", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -116,14 +116,14 @@ "targetIp": "192.168.0.10" }, { - "time": 17696, + "time": 17697, "source": "02:00:00:00:01:11", "destination": "02:00:00:00:01:12", "sourceIp": "192.168.0.10", "destinationIp": "192.168.0.20", "protocol": 6, "sourcePort": 80, - "destinationPort": 52891, + "destinationPort": 52105, "payload": null, "tcpFlags": "F", "sequence": 1000001, @@ -131,9 +131,473 @@ } ] }, + "rows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:11 [op=REPLY, sender=02:00:00:00:01:11|192.168.0.10, target=02:00:00:00:01:12|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "192.168.0.20:52105", + "192.168.0.10:80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "192.168.0.10:80", + "192.168.0.20:52105", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "192.168.0.10:80", + "192.168.0.20:52105", + "TCP", + "Transport", + "FIN, SEQ: 1.000.001" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:11 [op=REPLY, sender=02:00:00:00:01:11|192.168.0.10, target=02:00:00:00:01:12|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "192.168.0.20:52105", + "192.168.0.10:80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "192.168.0.10:80", + "192.168.0.20:52105", + "TCP", + "Transport", + "FIN, SEQ: 1.000.001" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "2", + "192.168.0.10:80", + "192.168.0.20:52105", + "TCP", + "Transport", + "FIN, SEQ: 1.000.001" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000101": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:11 [op=REPLY, sender=02:00:00:00:01:11|192.168.0.10, target=02:00:00:00:01:12|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "52105", + "80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "80", + "52105", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "80", + "52105", + "TCP", + "Transport", + "FIN, SEQ: 1.000.001" + ] + ], + "00000000-0000-0000-0000-000000000102": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:01:11 [op=REPLY, sender=02:00:00:00:01:11|192.168.0.10, target=02:00:00:00:01:12|192.168.0.20]" + ], + [ + "3", + "02:00:00:00:01:12", + "02:00:00:00:01:11", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.0.20", + "192.168.0.10", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "52105", + "80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "80", + "52105", + "TCP", + "Transport", + "FIN, SEQ: 1.000.001" + ] + ], + "00000000-0000-0000-0000-000000000103": [ + [ + "1", + "02:00:00:00:01:12", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.0.20", + "192.168.0.10", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.0.10 [op=REQUEST, sender=02:00:00:00:01:12|192.168.0.20, target=FF:FF:FF:FF:FF:FF|192.168.0.10]" + ], + [ + "2", + "02:00:00:00:01:11", + "02:00:00:00:01:12", + "", + "Netzzugang", + "0x800" + ], + [ + "2", + "192.168.0.10", + "192.168.0.20", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "2", + "80", + "52105", + "TCP", + "Transport", + "FIN, SEQ: 1.000.001" + ] + ] + }, "events": [ [ - 213, + 214, "server oeffnen called" ], [ @@ -141,48 +605,44 @@ "client verbinden called" ], [ - 1081, + 1085, "lost SYN+ACK" ], [ - 9019, + 9020, "client verbinden failed TimeOutException" ], [ - 17626, + 17628, "server oeffnen returned" ] ], "states": { "server": [ [ - 215, - "CLOSED" - ], - [ - 217, + 216, "LISTEN" ], [ - 1081, + 1086, "SYN_RCVD" ], [ - 17582, + 17586, "FIN_WAIT_1" ] ], "client": [ [ - 713, + 714, "CLOSED" ], [ - 724, + 728, "SYN_SENT" ], [ - 8974, + 8979, "CLOSED" ] ] diff --git a/packages/core/test/scenarios/wlan-java-pingFromWithoutCable.java.json b/packages/core/test/scenarios/wlan-java-pingFromWithoutCable.java.json index cc904ce..89b55e2 100644 --- a/packages/core/test/scenarios/wlan-java-pingFromWithoutCable.java.json +++ b/packages/core/test/scenarios/wlan-java-pingFromWithoutCable.java.json @@ -5,7 +5,7 @@ "00000000-0000-0000-0000-000000000603": [], "00000000-0000-0000-0000-000000000605": [ { - "time": 717, + "time": 718, "source": "02:00:00:00:06:15", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -22,6 +22,84 @@ } ] }, + "rows": { + "00000000-0000-0000-0000-000000000601": [], + "00000000-0000-0000-0000-000000000602": [], + "00000000-0000-0000-0000-000000000603": [], + "00000000-0000-0000-0000-000000000605": [ + [ + "1", + "02:00:00:00:06:15", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.1.14", + "192.168.1.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.1.11 [op=REQUEST, sender=02:00:00:00:06:15|192.168.1.14, target=FF:FF:FF:FF:FF:FF|192.168.1.11]" + ], + [ + "2", + "02:00:00:00:06:15", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.1.14", + "192.168.1.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.1.11 [op=REQUEST, sender=02:00:00:00:06:15|192.168.1.14, target=FF:FF:FF:FF:FF:FF|192.168.1.11]" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000601": [], + "00000000-0000-0000-0000-000000000602": [], + "00000000-0000-0000-0000-000000000603": [], + "00000000-0000-0000-0000-000000000605": [ + [ + "1", + "02:00:00:00:06:15", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.1.14", + "192.168.1.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.1.11 [op=REQUEST, sender=02:00:00:00:06:15|192.168.1.14, target=FF:FF:FF:FF:FF:FF|192.168.1.11]" + ], + [ + "2", + "02:00:00:00:06:15", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.1.14", + "192.168.1.11", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.1.11 [op=REQUEST, sender=02:00:00:00:06:15|192.168.1.14, target=FF:FF:FF:FF:FF:FF|192.168.1.11]" + ] + ] + }, "events": [ [ 713, diff --git a/packages/core/test/scenarios/wlan-java-pingWired.java.json b/packages/core/test/scenarios/wlan-java-pingWired.java.json index de55df2..a07bb24 100644 --- a/packages/core/test/scenarios/wlan-java-pingWired.java.json +++ b/packages/core/test/scenarios/wlan-java-pingWired.java.json @@ -2,7 +2,7 @@ "frames": { "00000000-0000-0000-0000-000000000601": [ { - "time": 724, + "time": 718, "source": "02:00:00:00:06:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -10,7 +10,7 @@ "targetIp": "192.168.1.13" }, { - "time": 960, + "time": 956, "source": "02:00:00:00:06:13", "destination": "02:00:00:00:06:11", "arp": 2, @@ -18,7 +18,7 @@ "targetIp": "192.168.1.11" }, { - "time": 964, + "time": 961, "source": "02:00:00:00:06:11", "destination": "02:00:00:00:06:13", "icmp": 8, @@ -28,7 +28,7 @@ "sequence": 1 }, { - "time": 1189, + "time": 1186, "source": "02:00:00:00:06:13", "destination": "02:00:00:00:06:11", "icmp": 0, @@ -40,7 +40,7 @@ ], "00000000-0000-0000-0000-000000000602": [ { - "time": 846, + "time": 843, "source": "02:00:00:00:06:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -50,7 +50,7 @@ ], "00000000-0000-0000-0000-000000000603": [ { - "time": 846, + "time": 843, "source": "02:00:00:00:06:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -58,7 +58,7 @@ "targetIp": "192.168.1.13" }, { - "time": 848, + "time": 845, "source": "02:00:00:00:06:13", "destination": "02:00:00:00:06:11", "arp": 2, @@ -66,7 +66,7 @@ "targetIp": "192.168.1.11" }, { - "time": 1077, + "time": 1074, "source": "02:00:00:00:06:11", "destination": "02:00:00:00:06:13", "icmp": 8, @@ -76,7 +76,7 @@ "sequence": 1 }, { - "time": 1077, + "time": 1074, "source": "02:00:00:00:06:13", "destination": "02:00:00:00:06:11", "icmp": 0, @@ -88,13 +88,319 @@ ], "00000000-0000-0000-0000-000000000605": [] }, + "rows": { + "00000000-0000-0000-0000-000000000601": [ + [ + "1", + "02:00:00:00:06:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.1.11", + "192.168.1.13", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.1.13 [op=REQUEST, sender=02:00:00:00:06:11|192.168.1.11, target=FF:FF:FF:FF:FF:FF|192.168.1.13]" + ], + [ + "2", + "02:00:00:00:06:13", + "02:00:00:00:06:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.1.13", + "192.168.1.11", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:06:13 [op=REPLY, sender=02:00:00:00:06:13|192.168.1.13, target=02:00:00:00:06:11|192.168.1.11]" + ], + [ + "3", + "02:00:00:00:06:11", + "02:00:00:00:06:13", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.1.11", + "192.168.1.13", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:06:13", + "02:00:00:00:06:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.1.13", + "192.168.1.11", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 1" + ] + ], + "00000000-0000-0000-0000-000000000602": [ + [ + "1", + "02:00:00:00:06:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.1.11", + "192.168.1.13", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.1.13 [op=REQUEST, sender=02:00:00:00:06:11|192.168.1.11, target=FF:FF:FF:FF:FF:FF|192.168.1.13]" + ] + ], + "00000000-0000-0000-0000-000000000603": [ + [ + "1", + "02:00:00:00:06:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.1.11", + "192.168.1.13", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.1.13 [op=REQUEST, sender=02:00:00:00:06:11|192.168.1.11, target=FF:FF:FF:FF:FF:FF|192.168.1.13]" + ], + [ + "2", + "02:00:00:00:06:13", + "02:00:00:00:06:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.1.13", + "192.168.1.11", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:06:13 [op=REPLY, sender=02:00:00:00:06:13|192.168.1.13, target=02:00:00:00:06:11|192.168.1.11]" + ], + [ + "3", + "02:00:00:00:06:11", + "02:00:00:00:06:13", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.1.11", + "192.168.1.13", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:06:13", + "02:00:00:00:06:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.1.13", + "192.168.1.11", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 1" + ] + ], + "00000000-0000-0000-0000-000000000605": [] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000601": [ + [ + "1", + "02:00:00:00:06:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.1.11", + "192.168.1.13", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.1.13 [op=REQUEST, sender=02:00:00:00:06:11|192.168.1.11, target=FF:FF:FF:FF:FF:FF|192.168.1.13]" + ], + [ + "2", + "02:00:00:00:06:13", + "02:00:00:00:06:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.1.13", + "192.168.1.11", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:06:13 [op=REPLY, sender=02:00:00:00:06:13|192.168.1.13, target=02:00:00:00:06:11|192.168.1.11]" + ], + [ + "3", + "02:00:00:00:06:11", + "02:00:00:00:06:13", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.1.11", + "192.168.1.13", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:06:13", + "02:00:00:00:06:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.1.13", + "192.168.1.11", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 1" + ] + ], + "00000000-0000-0000-0000-000000000602": [ + [ + "1", + "02:00:00:00:06:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.1.11", + "192.168.1.13", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.1.13 [op=REQUEST, sender=02:00:00:00:06:11|192.168.1.11, target=FF:FF:FF:FF:FF:FF|192.168.1.13]" + ] + ], + "00000000-0000-0000-0000-000000000603": [ + [ + "1", + "02:00:00:00:06:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.1.11", + "192.168.1.13", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.1.13 [op=REQUEST, sender=02:00:00:00:06:11|192.168.1.11, target=FF:FF:FF:FF:FF:FF|192.168.1.13]" + ], + [ + "2", + "02:00:00:00:06:13", + "02:00:00:00:06:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.1.13", + "192.168.1.11", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:06:13 [op=REPLY, sender=02:00:00:00:06:13|192.168.1.13, target=02:00:00:00:06:11|192.168.1.11]" + ], + [ + "3", + "02:00:00:00:06:11", + "02:00:00:00:06:13", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.1.11", + "192.168.1.13", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:06:13", + "02:00:00:00:06:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.1.13", + "192.168.1.11", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 1" + ] + ], + "00000000-0000-0000-0000-000000000605": [] + }, "events": [ [ - 719, + 713, "sendProbe 192.168.1.13 called" ], [ - 1190, + 1187, "sendProbe 192.168.1.13 returned ICMP 0/0 from 192.168.1.13" ] ] diff --git a/packages/core/test/scenarios/wlan-java-pingWireless.java.json b/packages/core/test/scenarios/wlan-java-pingWireless.java.json index 950af3c..39424d1 100644 --- a/packages/core/test/scenarios/wlan-java-pingWireless.java.json +++ b/packages/core/test/scenarios/wlan-java-pingWireless.java.json @@ -2,7 +2,7 @@ "frames": { "00000000-0000-0000-0000-000000000601": [ { - "time": 720, + "time": 718, "source": "02:00:00:00:06:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -10,7 +10,7 @@ "targetIp": "192.168.1.12" }, { - "time": 955, + "time": 952, "source": "02:00:00:00:06:12", "destination": "02:00:00:00:06:11", "arp": 2, @@ -18,7 +18,7 @@ "targetIp": "192.168.1.11" }, { - "time": 959, + "time": 956, "source": "02:00:00:00:06:11", "destination": "02:00:00:00:06:12", "icmp": 8, @@ -28,7 +28,7 @@ "sequence": 1 }, { - "time": 1184, + "time": 1181, "source": "02:00:00:00:06:12", "destination": "02:00:00:00:06:11", "icmp": 0, @@ -40,7 +40,7 @@ ], "00000000-0000-0000-0000-000000000602": [ { - "time": 842, + "time": 839, "source": "02:00:00:00:06:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -48,7 +48,7 @@ "targetIp": "192.168.1.12" }, { - "time": 843, + "time": 841, "source": "02:00:00:00:06:12", "destination": "02:00:00:00:06:11", "arp": 2, @@ -56,7 +56,7 @@ "targetIp": "192.168.1.11" }, { - "time": 1072, + "time": 1069, "source": "02:00:00:00:06:11", "destination": "02:00:00:00:06:12", "icmp": 8, @@ -66,7 +66,7 @@ "sequence": 1 }, { - "time": 1072, + "time": 1069, "source": "02:00:00:00:06:12", "destination": "02:00:00:00:06:11", "icmp": 0, @@ -78,7 +78,7 @@ ], "00000000-0000-0000-0000-000000000603": [ { - "time": 842, + "time": 839, "source": "02:00:00:00:06:11", "destination": "FF:FF:FF:FF:FF:FF", "arp": 1, @@ -88,13 +88,319 @@ ], "00000000-0000-0000-0000-000000000605": [] }, + "rows": { + "00000000-0000-0000-0000-000000000601": [ + [ + "1", + "02:00:00:00:06:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.1.11", + "192.168.1.12", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.1.12 [op=REQUEST, sender=02:00:00:00:06:11|192.168.1.11, target=FF:FF:FF:FF:FF:FF|192.168.1.12]" + ], + [ + "2", + "02:00:00:00:06:12", + "02:00:00:00:06:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.1.12", + "192.168.1.11", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:06:12 [op=REPLY, sender=02:00:00:00:06:12|192.168.1.12, target=02:00:00:00:06:11|192.168.1.11]" + ], + [ + "3", + "02:00:00:00:06:11", + "02:00:00:00:06:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.1.11", + "192.168.1.12", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:06:12", + "02:00:00:00:06:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.1.12", + "192.168.1.11", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 1" + ] + ], + "00000000-0000-0000-0000-000000000602": [ + [ + "1", + "02:00:00:00:06:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.1.11", + "192.168.1.12", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.1.12 [op=REQUEST, sender=02:00:00:00:06:11|192.168.1.11, target=FF:FF:FF:FF:FF:FF|192.168.1.12]" + ], + [ + "2", + "02:00:00:00:06:12", + "02:00:00:00:06:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.1.12", + "192.168.1.11", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:06:12 [op=REPLY, sender=02:00:00:00:06:12|192.168.1.12, target=02:00:00:00:06:11|192.168.1.11]" + ], + [ + "3", + "02:00:00:00:06:11", + "02:00:00:00:06:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.1.11", + "192.168.1.12", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:06:12", + "02:00:00:00:06:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.1.12", + "192.168.1.11", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 1" + ] + ], + "00000000-0000-0000-0000-000000000603": [ + [ + "1", + "02:00:00:00:06:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.1.11", + "192.168.1.12", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.1.12 [op=REQUEST, sender=02:00:00:00:06:11|192.168.1.11, target=FF:FF:FF:FF:FF:FF|192.168.1.12]" + ] + ], + "00000000-0000-0000-0000-000000000605": [] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000601": [ + [ + "1", + "02:00:00:00:06:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.1.11", + "192.168.1.12", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.1.12 [op=REQUEST, sender=02:00:00:00:06:11|192.168.1.11, target=FF:FF:FF:FF:FF:FF|192.168.1.12]" + ], + [ + "2", + "02:00:00:00:06:12", + "02:00:00:00:06:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.1.12", + "192.168.1.11", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:06:12 [op=REPLY, sender=02:00:00:00:06:12|192.168.1.12, target=02:00:00:00:06:11|192.168.1.11]" + ], + [ + "3", + "02:00:00:00:06:11", + "02:00:00:00:06:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.1.11", + "192.168.1.12", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:06:12", + "02:00:00:00:06:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.1.12", + "192.168.1.11", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 1" + ] + ], + "00000000-0000-0000-0000-000000000602": [ + [ + "1", + "02:00:00:00:06:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.1.11", + "192.168.1.12", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.1.12 [op=REQUEST, sender=02:00:00:00:06:11|192.168.1.11, target=FF:FF:FF:FF:FF:FF|192.168.1.12]" + ], + [ + "2", + "02:00:00:00:06:12", + "02:00:00:00:06:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.1.12", + "192.168.1.11", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:06:12 [op=REPLY, sender=02:00:00:00:06:12|192.168.1.12, target=02:00:00:00:06:11|192.168.1.11]" + ], + [ + "3", + "02:00:00:00:06:11", + "02:00:00:00:06:12", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "192.168.1.11", + "192.168.1.12", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:06:12", + "02:00:00:00:06:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "192.168.1.12", + "192.168.1.11", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 1" + ] + ], + "00000000-0000-0000-0000-000000000603": [ + [ + "1", + "02:00:00:00:06:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.1.11", + "192.168.1.12", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.1.12 [op=REQUEST, sender=02:00:00:00:06:11|192.168.1.11, target=FF:FF:FF:FF:FF:FF|192.168.1.12]" + ] + ], + "00000000-0000-0000-0000-000000000605": [] + }, "events": [ [ - 715, + 713, "sendProbe 192.168.1.12 called" ], [ - 1185, + 1183, "sendProbe 192.168.1.12 returned ICMP 0/0 from 192.168.1.12" ] ] diff --git a/packages/core/test/scenarios/wlan-java-pingWithoutCable.java.json b/packages/core/test/scenarios/wlan-java-pingWithoutCable.java.json index d8663a0..4da8684 100644 --- a/packages/core/test/scenarios/wlan-java-pingWithoutCable.java.json +++ b/packages/core/test/scenarios/wlan-java-pingWithoutCable.java.json @@ -56,6 +56,216 @@ ], "00000000-0000-0000-0000-000000000605": [] }, + "rows": { + "00000000-0000-0000-0000-000000000601": [ + [ + "1", + "02:00:00:00:06:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.1.11", + "192.168.1.14", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.1.14 [op=REQUEST, sender=02:00:00:00:06:11|192.168.1.11, target=FF:FF:FF:FF:FF:FF|192.168.1.14]" + ], + [ + "2", + "02:00:00:00:06:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.1.11", + "192.168.1.14", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.1.14 [op=REQUEST, sender=02:00:00:00:06:11|192.168.1.11, target=FF:FF:FF:FF:FF:FF|192.168.1.14]" + ] + ], + "00000000-0000-0000-0000-000000000602": [ + [ + "1", + "02:00:00:00:06:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.1.11", + "192.168.1.14", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.1.14 [op=REQUEST, sender=02:00:00:00:06:11|192.168.1.11, target=FF:FF:FF:FF:FF:FF|192.168.1.14]" + ], + [ + "2", + "02:00:00:00:06:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.1.11", + "192.168.1.14", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.1.14 [op=REQUEST, sender=02:00:00:00:06:11|192.168.1.11, target=FF:FF:FF:FF:FF:FF|192.168.1.14]" + ] + ], + "00000000-0000-0000-0000-000000000603": [ + [ + "1", + "02:00:00:00:06:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.1.11", + "192.168.1.14", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.1.14 [op=REQUEST, sender=02:00:00:00:06:11|192.168.1.11, target=FF:FF:FF:FF:FF:FF|192.168.1.14]" + ], + [ + "2", + "02:00:00:00:06:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.1.11", + "192.168.1.14", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.1.14 [op=REQUEST, sender=02:00:00:00:06:11|192.168.1.11, target=FF:FF:FF:FF:FF:FF|192.168.1.14]" + ] + ], + "00000000-0000-0000-0000-000000000605": [] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000601": [ + [ + "1", + "02:00:00:00:06:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.1.11", + "192.168.1.14", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.1.14 [op=REQUEST, sender=02:00:00:00:06:11|192.168.1.11, target=FF:FF:FF:FF:FF:FF|192.168.1.14]" + ], + [ + "2", + "02:00:00:00:06:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.1.11", + "192.168.1.14", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.1.14 [op=REQUEST, sender=02:00:00:00:06:11|192.168.1.11, target=FF:FF:FF:FF:FF:FF|192.168.1.14]" + ] + ], + "00000000-0000-0000-0000-000000000602": [ + [ + "1", + "02:00:00:00:06:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.1.11", + "192.168.1.14", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.1.14 [op=REQUEST, sender=02:00:00:00:06:11|192.168.1.11, target=FF:FF:FF:FF:FF:FF|192.168.1.14]" + ], + [ + "2", + "02:00:00:00:06:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.1.11", + "192.168.1.14", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.1.14 [op=REQUEST, sender=02:00:00:00:06:11|192.168.1.11, target=FF:FF:FF:FF:FF:FF|192.168.1.14]" + ] + ], + "00000000-0000-0000-0000-000000000603": [ + [ + "1", + "02:00:00:00:06:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "192.168.1.11", + "192.168.1.14", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.1.14 [op=REQUEST, sender=02:00:00:00:06:11|192.168.1.11, target=FF:FF:FF:FF:FF:FF|192.168.1.14]" + ], + [ + "2", + "02:00:00:00:06:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "192.168.1.11", + "192.168.1.14", + "ARP", + "Vermittlung", + "Suche nach MAC für 192.168.1.14 [op=REQUEST, sender=02:00:00:00:06:11|192.168.1.11, target=FF:FF:FF:FF:FF:FF|192.168.1.14]" + ] + ], + "00000000-0000-0000-0000-000000000605": [] + }, "events": [ [ 711, diff --git a/packages/core/test/tcpJava.test.ts b/packages/core/test/tcpJava.test.ts index 6868a71..7afc496 100644 --- a/packages/core/test/tcpJava.test.ts +++ b/packages/core/test/tcpJava.test.ts @@ -20,7 +20,7 @@ import { fileURLToPath } from 'node:url'; import { describe, expect, it } from 'vitest'; import { TCP_FLAG, type Id, type NetworkRuntimeEngine, type TcpSegment } from '../src/index.js'; import { loseFirst } from './fixtures.js'; -import { expectSameCaptures, GAP_TOLERANCE_MILLISECONDS, gaps, javaFrames, watchedEngine, withClientPortText, type JavaFrame, type SeenFrame } from './javaRun.js'; +import { expectSameCaptures, GAP_TOLERANCE_MILLISECONDS, gaps, javaFrames, watchedEngine, withClientPortText, type JavaFrame, type SeenFrame, type JavaTables } from './javaRun.js'; import type { Scenario } from './scenario.js'; const scenarioDirectory = join(dirname(fileURLToPath(import.meta.url)), 'scenarios'); @@ -34,7 +34,7 @@ const SERVER = '00000000-0000-0000-0000-000000000101'; const CLIENT = '00000000-0000-0000-0000-000000000102'; const OTHER_CLIENT = '00000000-0000-0000-0000-000000000103'; -interface JavaRun { +interface JavaRun extends JavaTables { frames: Record; events: [number, string][]; states: Record; @@ -299,7 +299,7 @@ describe('TCP as Java FILIUS runs it', () => { ); } - expectSameCaptures(engine, scenario, java.frames, { text: withClientPortText, until: CAPTURE_UNTIL[name]?.(measured) }); + expectSameCaptures(engine, scenario, java.frames, { text: withClientPortText, until: CAPTURE_UNTIL[name]?.(measured), tables: measured }); const shift = (states: [number, string][], syn: number): [number, string][] => before(states.map(([time, state]) => [time - syn, state])); // From SYN_SENT: Java's first CLOSED is when the socket was made. diff --git a/packages/core/test/wlanJava.test.ts b/packages/core/test/wlanJava.test.ts index d0b47be..8032d12 100644 --- a/packages/core/test/wlanJava.test.ts +++ b/packages/core/test/wlanJava.test.ts @@ -17,14 +17,14 @@ import { dirname, join } from 'node:path'; import { fileURLToPath } from 'node:url'; import { describe, expect, it } from 'vitest'; import type { Id, NetworkRuntimeEngine } from '../src/index.js'; -import { expectSameCaptures, GAP_TOLERANCE_MILLISECONDS, gaps, javaFrames, watchedEngine, type JavaFrame } from './javaRun.js'; +import { expectSameCaptures, GAP_TOLERANCE_MILLISECONDS, gaps, javaFrames, watchedEngine, type JavaFrame, type JavaTables } from './javaRun.js'; import type { Scenario } from './scenario.js'; const scenarioDirectory = join(dirname(fileURLToPath(import.meta.url)), 'scenarios'); const NOTEBOOK = '00000000-0000-0000-0000-000000000601'; const UNCABLED = '00000000-0000-0000-0000-000000000605'; -interface JavaRun { +interface JavaRun extends JavaTables { frames: Record; events: [number, string][]; } @@ -76,7 +76,7 @@ describe('WLAN as Java FILIUS runs it', () => { expect(actual[index]?.text, `frame #${index + 1}`).toBe(expected[index]?.text); expect(Math.abs(actual[index]!.gap - expected[index]!.gap), `gap before frame #${index + 1}`).toBeLessThanOrEqual(GAP_TOLERANCE_MILLISECONDS); } - expectSameCaptures(engine, scenario, java.frames); + expectSameCaptures(engine, scenario, java.frames, { tables: java }); }); } }); diff --git a/tools/java-oracle/README.md b/tools/java-oracle/README.md index 14fa3ee..0337d30 100644 --- a/tools/java-oracle/README.md +++ b/tools/java-oracle/README.md @@ -476,3 +476,33 @@ Javas Switch prüft seine Tabelle einmal je Sekunde ab dem Start nach der Lernzeit; der Kern genau bei ihr. Das ist gewollt und wird nicht gemessen: Wo Java nur in einem Takt nachsieht, macht der Kern es genauer (Entscheidung 01.10.2026; dasselbe für die NAT-Einträge des Heimrouters). + +## Tabelle des Mitschnitts + +Seit F2.8b schreibt `ScenarioNetwork.writeFrames` neben den Frames Javas +fertige Tabelle jeder Karte (`Lauscher.getDaten`): `rows` mit Adresse:Port +(das Fenster „Datenaustausch"), `layeredRows` nur mit Ports (die +Schichtenansicht); je Zeile Nummer, Quelle, Ziel, Protokoll, Schicht, +Bemerkung, ohne die Uhrzeit. Java läuft dabei mit `Locale.GERMANY` +(`Information.getLocaleOrDefault`): deutsche Wörter, Tausenderpunkte. Alle +Laufzeit-Läufe sind dafür neu aufgenommen (bis auf `dhcp-lan`, s. oben); +`NatRun` hat den Ablauf `ttlOut` (Ping mit TTL 1 aus dem LAN: der Heimrouter +meldet „Zeit überschritten"). + +Gemessen (01.10.2026), wo der Kern abwich: + +* Eine ARP-Anfrage trägt als Ziel-MAC `FF:FF:FF:FF:FF:FF` + (`ARP.sendeARPBroadcast`), der Kern trug Nullen (wie Swift). +* Eine ICMP-Fehlermeldung trägt Identifier und Sequenznummer 0, der Kern + kopierte die des Echos (wie Swift). +* „Host nicht erreichbar" vom Router trägt das Paket mit gesenkter TTL (wie + er es weitergeleitet hat), der Kern das angekommene. + +Bewusst nicht übernommen: Javas Antwort an `0.0.0.0` schreibt die +Broadcast-Adresse klein (`ARP.sendArpReply`), der Kern immer groß; „ICMP +Time Exeeded" ist ein Tippfehler. + +RIP: Der Anlauf entscheidet, wie viele Zufallspausen jeder Router zieht +(jede Nachricht zieht eine), und der hängt an Javas Startreihenfolge. Eine +Aufnahme, deren Anlauf von dem des Kerns (alle Router zugleich) abweicht, +liegt danach in allen Zeiten daneben; das Werkzeug wird dann wiederholt. diff --git a/tools/java-oracle/run.sh b/tools/java-oracle/run.sh index f14024d..9db1446 100755 --- a/tools/java-oracle/run.sh +++ b/tools/java-oracle/run.sh @@ -154,7 +154,7 @@ done # NAT as Java FILIUS runs it: nat-home's home router between a LAN PC and two # WAN hosts (NatRun); frames, calls and the router's NAT table at the end. -for run in pingOut:10000 udpOut:10000 udpTwoRemotes:25000 tcpOut:20000 forward:20000 pingWan:15000; do +for run in pingOut:10000 udpOut:10000 udpTwoRemotes:25000 tcpOut:20000 forward:20000 pingWan:15000 ttlOut:10000; do story="${run%%:*}" output="$root/packages/core/test/scenarios/nat-java-$story.java.json" rm -f "$output" diff --git a/tools/java-oracle/src/NatRun.java b/tools/java-oracle/src/NatRun.java index 6ca8be4..d0fb5f2 100644 --- a/tools/java-oracle/src/NatRun.java +++ b/tools/java-oracle/src/NatRun.java @@ -15,6 +15,7 @@ // forward 42.0.0.20 connects to 42.0.0.10:8080, forwarded to // 192.168.0.10:80; sends, receives, closes // pingWan 42.0.0.20 pings 42.0.0.10, then 192.168.0.10 +// ttlOut 192.168.0.10 pings 42.0.0.20 with TTL 1: time exceeded import filius.software.nat.NatEntry; import filius.software.nat.NatGateway; @@ -194,6 +195,9 @@ public class NatRun { Thread.sleep(200); tcpClient(SERVER, "42.0.0.10", 8080); break; + case "ttlOut": + call("sendProbe 42.0.0.20", () -> icmp(os(LAN_PC).holeICMP().sendProbe("42.0.0.20", 1, 1, 1))); + break; case "pingWan": call("sendProbe 42.0.0.10", () -> icmp(os(SERVER).holeICMP().sendProbe("42.0.0.10", 64, 1, 1))); call("sendProbe 192.168.0.10", () -> icmp(os(SERVER).holeICMP().sendProbe("192.168.0.10", 64, 1, 2))); diff --git a/tools/java-oracle/src/ScenarioNetwork.java b/tools/java-oracle/src/ScenarioNetwork.java index 394f678..c578e62 100644 --- a/tools/java-oracle/src/ScenarioNetwork.java +++ b/tools/java-oracle/src/ScenarioNetwork.java @@ -242,6 +242,32 @@ public class ScenarioNetwork { out.close(']'); } out.close('}'); + writeRows(out, "rows", true); + writeRows(out, "layeredRows", false); + } + + /** + * The packet capture's table of each card as FILIUS shows it + * (Lauscher.getDaten): with addresses and ports (`rows`, the data exchange + * window) or ports only (`layeredRows`, the layered view). Each row: number, + * source, destination, protocol, layer, comment — its time (the wall clock) + * left out. + */ + void writeRows(Json out, String key, boolean withAddresses) { + out.key(key).open('{'); + for (Map.Entry entry : macByNode.entrySet()) { + out.key(entry.getKey()).open('['); + for (Object[] row : Lauscher.getLauscher().getDaten(entry.getValue(), withAddresses, 1)) { + out.open('['); + for (int column = 0; column < row.length; column++) { + if (column == 1) continue; + out.string(row[column] == null ? null : String.valueOf(row[column])); + } + out.close(']'); + } + out.close(']'); + } + out.close('}'); } /** Each host's address, mask, gateway and DNS server. */