wader/fq
1
1
Fork 0
mirror of https://github.com/wader/fq.git synced 2024-12-25 06:12:30 +03:00
Code Issues Projects Releases Wiki Activity
377af133e0
fq/format/inet/testdata/flow_missing_synack.fqtest

140 lines
13 KiB
Plaintext
Raw Normal View History

tcp,flow: By default allow missing syn/ack for now Is probably what you usually want
2022-01-07 14:02:38 +03:00
# ssl_test.pcap from https://www.cloudshark.org/captures/a9718e5fdb28
$ fq '.tcp_connections | d' flow_missing_synack.pcap
interp: Refactor dump and revert #259 for now Causes address bar to not be shown in some cases. Will have to rethink and redo the whole dump thing somehow.
2022-05-20 13:38:43 +03:00
|00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f|0123456789abcdef|.tcp_connections[0:8]:
interp: dump: Show field name for compound values in arrays mp3: Remove one level of struct for granales dump: Makes it a bit easier to understand array of arrays/structs. avro_ocf: Rename ocf.go -> avro_ocr.go to have same name of source file as format pcap,pcapng: Rename tcp flow struct to tcp_connection, makes more sense i think mp4: Add ISOBMFF to format description
2022-04-21 18:31:34 +03:00
| | | [0]{}: tcp_connection
tcp: Split into client/server structs and add skipped_bytes and has_start/end per direction Feels clenaer and removes _client/server field prefixes
2022-05-06 17:45:59 +03:00
| | | client{}:
| | | ip: "192.168.1.4"
| | | port: 2061
| | | has_start: false
| | | has_end: false
| | | skipped_bytes: 0
0x0000|16 03 01 00 9e 01 00 00 9a 03 01 50 83 9c fa fe|...........P....| stream: raw bits
tcp,flow: By default allow missing syn/ack for now Is probably what you usually want
2022-01-07 14:02:38 +03:00
* |until 0x177.7 (end) (376) | |
tcp: Split into client/server structs and add skipped_bytes and has_start/end per direction Feels clenaer and removes _client/server field prefixes
2022-05-06 17:45:59 +03:00
| | | server{}:
| | | ip: "192.168.1.3"
| | | port: "https" (443) (http protocol over TLS/SSL)
| | | has_start: false
| | | has_end: false
| | | skipped_bytes: 0
0x0000|16 03 01 00 35 02 00 00 31 03 01 50 83 9c 9f e3|....5...1..P....| stream: raw bits
tcp,flow: By default allow missing syn/ack for now Is probably what you usually want
2022-01-07 14:02:38 +03:00
* |until 0x42b.7 (end) (1068) | |
interp: dump: Show field name for compound values in arrays mp3: Remove one level of struct for granales dump: Makes it a bit easier to understand array of arrays/structs. avro_ocf: Rename ocf.go -> avro_ocr.go to have same name of source file as format pcap,pcapng: Rename tcp flow struct to tcp_connection, makes more sense i think mp4: Add ISOBMFF to format description
2022-04-21 18:31:34 +03:00
| | | [1]{}: tcp_connection
tcp: Split into client/server structs and add skipped_bytes and has_start/end per direction Feels clenaer and removes _client/server field prefixes
2022-05-06 17:45:59 +03:00
| | | client{}:
| | | ip: "192.168.1.4"
| | | port: 2068
| | | has_start: false
| | | has_end: false
| | | skipped_bytes: 0
0x0000|16 03 01 00 9e 01 00 00 9a 03 01 50 83 9d 00 a1|...........P....| stream: raw bits
tcp,flow: By default allow missing syn/ack for now Is probably what you usually want
2022-01-07 14:02:38 +03:00
* |until 0x177.7 (end) (376) | |
tcp: Split into client/server structs and add skipped_bytes and has_start/end per direction Feels clenaer and removes _client/server field prefixes
2022-05-06 17:45:59 +03:00
| | | server{}:
| | | ip: "192.168.1.3"
| | | port: "https" (443) (http protocol over TLS/SSL)
| | | has_start: false
| | | has_end: false
| | | skipped_bytes: 0
0x0000|16 03 01 00 35 02 00 00 31 03 01 50 83 9c a5 e5|....5...1..P....| stream: raw bits
tcp,flow: By default allow missing syn/ack for now Is probably what you usually want
2022-01-07 14:02:38 +03:00
* |until 0x42b.7 (end) (1068) | |
interp: dump: Show field name for compound values in arrays mp3: Remove one level of struct for granales dump: Makes it a bit easier to understand array of arrays/structs. avro_ocf: Rename ocf.go -> avro_ocr.go to have same name of source file as format pcap,pcapng: Rename tcp flow struct to tcp_connection, makes more sense i think mp4: Add ISOBMFF to format description
2022-04-21 18:31:34 +03:00
| | | [2]{}: tcp_connection
tcp: Split into client/server structs and add skipped_bytes and has_start/end per direction Feels clenaer and removes _client/server field prefixes
2022-05-06 17:45:59 +03:00
| | | client{}:
| | | ip: "192.168.1.4"
| | | port: 2070
| | | has_start: false
| | | has_end: false
| | | skipped_bytes: 0
0x0000|16 03 01 00 9e 01 00 00 9a 03 01 50 83 9d 03 f3|...........P....| stream: raw bits
tcp,flow: By default allow missing syn/ack for now Is probably what you usually want
2022-01-07 14:02:38 +03:00
* |until 0x2ad.7 (end) (686) | |
tcp: Split into client/server structs and add skipped_bytes and has_start/end per direction Feels clenaer and removes _client/server field prefixes
2022-05-06 17:45:59 +03:00
| | | server{}:
| | | ip: "192.168.1.3"
| | | port: "https" (443) (http protocol over TLS/SSL)
| | | has_start: false
| | | has_end: false
| | | skipped_bytes: 0
0x0000|16 03 01 00 35 02 00 00 31 03 01 50 83 9c a8 b2|....5...1..P....| stream: raw bits
tcp,flow: By default allow missing syn/ack for now Is probably what you usually want
2022-01-07 14:02:38 +03:00
* |until 0x53c.7 (end) (1341) | |
interp: dump: Show field name for compound values in arrays mp3: Remove one level of struct for granales dump: Makes it a bit easier to understand array of arrays/structs. avro_ocf: Rename ocf.go -> avro_ocr.go to have same name of source file as format pcap,pcapng: Rename tcp flow struct to tcp_connection, makes more sense i think mp4: Add ISOBMFF to format description
2022-04-21 18:31:34 +03:00
| | | [3]{}: tcp_connection
tcp: Split into client/server structs and add skipped_bytes and has_start/end per direction Feels clenaer and removes _client/server field prefixes
2022-05-06 17:45:59 +03:00
| | | client{}:
| | | ip: "192.168.1.4"
| | | port: 2071
| | | has_start: false
| | | has_end: false
| | | skipped_bytes: 0
0x0000|16 03 01 01 6e 01 00 01 6a 03 01 50 83 9d 03 d8|....n...j..P....| stream: raw bits
tcp,flow: By default allow missing syn/ack for now Is probably what you usually want
2022-01-07 14:02:38 +03:00
* |until 0x2df.7 (end) (736) | |
tcp: Split into client/server structs and add skipped_bytes and has_start/end per direction Feels clenaer and removes _client/server field prefixes
2022-05-06 17:45:59 +03:00
| | | server{}:
| | | ip: "192.168.1.3"
| | | port: "https" (443) (http protocol over TLS/SSL)
| | | has_start: false
| | | has_end: false
| | | skipped_bytes: 0
0x0000|16 03 01 00 51 02 00 00 4d 03 01 50 83 9c a8 fc|....Q...M..P....| stream: raw bits
tcp,flow: By default allow missing syn/ack for now Is probably what you usually want
2022-01-07 14:02:38 +03:00
* |until 0x1b7.7 (end) (440) | |
interp: dump: Show field name for compound values in arrays mp3: Remove one level of struct for granales dump: Makes it a bit easier to understand array of arrays/structs. avro_ocf: Rename ocf.go -> avro_ocr.go to have same name of source file as format pcap,pcapng: Rename tcp flow struct to tcp_connection, makes more sense i think mp4: Add ISOBMFF to format description
2022-04-21 18:31:34 +03:00
| | | [4]{}: tcp_connection
tcp: Split into client/server structs and add skipped_bytes and has_start/end per direction Feels clenaer and removes _client/server field prefixes
2022-05-06 17:45:59 +03:00
| | | client{}:
| | | ip: "192.168.1.4"
| | | port: 2072
| | | has_start: false
| | | has_end: false
| | | skipped_bytes: 0
0x0000|16 03 01 01 6e 01 00 01 6a 03 01 50 83 9d 03 94|....n...j..P....| stream: raw bits
tcp,flow: By default allow missing syn/ack for now Is probably what you usually want
2022-01-07 14:02:38 +03:00
* |until 0x2fd.7 (end) (766) | |
tcp: Split into client/server structs and add skipped_bytes and has_start/end per direction Feels clenaer and removes _client/server field prefixes
2022-05-06 17:45:59 +03:00
| | | server{}:
| | | ip: "192.168.1.3"
| | | port: "https" (443) (http protocol over TLS/SSL)
| | | has_start: false
| | | has_end: false
| | | skipped_bytes: 0
0x0000|16 03 01 00 51 02 00 00 4d 03 01 50 83 9c a8 d8|....Q...M..P....| stream: raw bits
tcp,flow: By default allow missing syn/ack for now Is probably what you usually want
2022-01-07 14:02:38 +03:00
* |until 0x1b7.7 (end) (440) | |
interp: dump: Show field name for compound values in arrays mp3: Remove one level of struct for granales dump: Makes it a bit easier to understand array of arrays/structs. avro_ocf: Rename ocf.go -> avro_ocr.go to have same name of source file as format pcap,pcapng: Rename tcp flow struct to tcp_connection, makes more sense i think mp4: Add ISOBMFF to format description
2022-04-21 18:31:34 +03:00
| | | [5]{}: tcp_connection
tcp: Split into client/server structs and add skipped_bytes and has_start/end per direction Feels clenaer and removes _client/server field prefixes
2022-05-06 17:45:59 +03:00
| | | client{}:
| | | ip: "192.168.1.4"
| | | port: 2073
| | | has_start: false
| | | has_end: false
| | | skipped_bytes: 0
0x0000|16 03 01 01 6e 01 00 01 6a 03 01 50 83 9d 0d 96|....n...j..P....| stream: raw bits
tcp,flow: By default allow missing syn/ack for now Is probably what you usually want
2022-01-07 14:02:38 +03:00
* |until 0x2fd.7 (end) (766) | |
tcp: Split into client/server structs and add skipped_bytes and has_start/end per direction Feels clenaer and removes _client/server field prefixes
2022-05-06 17:45:59 +03:00
| | | server{}:
| | | ip: "192.168.1.3"
| | | port: "https" (443) (http protocol over TLS/SSL)
| | | has_start: false
| | | has_end: true
| | | skipped_bytes: 0
0x0000|16 03 01 00 51 02 00 00 4d 03 01 50 83 9c b2 45|....Q...M..P...E| stream: raw bits
tcp,flow: By default allow missing syn/ack for now Is probably what you usually want
2022-01-07 14:02:38 +03:00
* |until 0x2d73.7 (end) (11636) | |
interp: dump: Show field name for compound values in arrays mp3: Remove one level of struct for granales dump: Makes it a bit easier to understand array of arrays/structs. avro_ocf: Rename ocf.go -> avro_ocr.go to have same name of source file as format pcap,pcapng: Rename tcp flow struct to tcp_connection, makes more sense i think mp4: Add ISOBMFF to format description
2022-04-21 18:31:34 +03:00
| | | [6]{}: tcp_connection
tcp: Split into client/server structs and add skipped_bytes and has_start/end per direction Feels clenaer and removes _client/server field prefixes
2022-05-06 17:45:59 +03:00
| | | client{}:
| | | ip: "192.168.1.4"
| | | port: 2078
| | | has_start: false
| | | has_end: false
| | | skipped_bytes: 0
0x0000|16 03 01 01 6e 01 00 01 6a 03 01 50 83 9d d7 3a|....n...j..P...:| stream: raw bits
tcp,flow: By default allow missing syn/ack for now Is probably what you usually want
2022-01-07 14:02:38 +03:00
* |until 0x38c.7 (end) (909) | |
tcp: Split into client/server structs and add skipped_bytes and has_start/end per direction Feels clenaer and removes _client/server field prefixes
2022-05-06 17:45:59 +03:00
| | | server{}:
| | | ip: "192.168.1.3"
| | | port: "https" (443) (http protocol over TLS/SSL)
| | | has_start: false
| | | has_end: false
| | | skipped_bytes: 0
0x0000|16 03 01 00 51 02 00 00 4d 03 01 50 83 9d 7c ac|....Q...M..P..|.| stream: raw bits
tcp,flow: By default allow missing syn/ack for now Is probably what you usually want
2022-01-07 14:02:38 +03:00
* |until 0x2d5.7 (end) (726) | |
interp: dump: Show field name for compound values in arrays mp3: Remove one level of struct for granales dump: Makes it a bit easier to understand array of arrays/structs. avro_ocf: Rename ocf.go -> avro_ocr.go to have same name of source file as format pcap,pcapng: Rename tcp flow struct to tcp_connection, makes more sense i think mp4: Add ISOBMFF to format description
2022-04-21 18:31:34 +03:00
| | | [7]{}: tcp_connection
tcp: Split into client/server structs and add skipped_bytes and has_start/end per direction Feels clenaer and removes _client/server field prefixes
2022-05-06 17:45:59 +03:00
| | | client{}:
| | | ip: "192.168.1.4"
| | | port: 2085
| | | has_start: false
| | | has_end: false
| | | skipped_bytes: 0
0x0000|16 03 01 01 6e 01 00 01 6a 03 01 50 83 9e 02 2b|....n...j..P...+| stream: raw bits
tcp,flow: By default allow missing syn/ack for now Is probably what you usually want
2022-01-07 14:02:38 +03:00
* |until 0x4a0.7 (end) (1185) | |
tcp: Split into client/server structs and add skipped_bytes and has_start/end per direction Feels clenaer and removes _client/server field prefixes
2022-05-06 17:45:59 +03:00
| | | server{}:
| | | ip: "192.168.1.3"
| | | port: "https" (443) (http protocol over TLS/SSL)
| | | has_start: false
| | | has_end: false
| | | skipped_bytes: 0
0x0000|16 03 01 00 51 02 00 00 4d 03 01 50 83 9d a7 8b|....Q...M..P....| stream: raw bits
tcp,flow: By default allow missing syn/ack for now Is probably what you usually want
2022-01-07 14:02:38 +03:00
* |until 0x4f3.7 (end) (1268) | |
Reference in New Issue Copy Permalink