wader/fq
1
1
Fork 0
mirror of https://github.com/wader/fq.git synced 2024-12-01 02:30:32 +03:00
Code Issues Projects Releases Wiki Activity
c233215aba
fq/format/inet/testdata/tcp_segment.fqtest

50 lines
5.2 KiB
Plaintext
Raw Normal View History

inet: Add tcp and ipv4 reassembly Also add tcp_stream and udp_payload to decode content
2021-11-24 23:20:46 +03:00
# fq 'first(.. | select(format=="tcp")) | tobytes' many_interfaces.pcapng > tcp_segment
fqtest: Cleanup path usage Make cwd for a test script the directory where the script is. Use relative paths
2022-05-21 20:33:52 +03:00
$ fq -d tcp_segment dv tcp_segment
|00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f|0123456789abcdef|.{}: tcp_segment (tcp_segment) 0x0-0x2b.7 (44)
inet: Add tcp and ipv4 reassembly Also add tcp_stream and udp_payload to decode content
2021-11-24 23:20:46 +03:00
0x00|c7 25 |.% | source_port: 50981 0x0-0x1.7 (2)
0x00| 01 bb | .. | destination_port: "https" (443) (http protocol over TLS/SSL) 0x2-0x3.7 (2)
0x00| 2b ce 2e 8a | +... | sequence_number: 734932618 0x4-0x7.7 (4)
0x00| 00 00 00 00 | .... | acknowledgment_number: 0 0x8-0xb.7 (4)
0x00| b0 | . | data_offset: 11 0xc-0xc.3 (0.4)
0x00| b0 | . | reserved: 0 0xc.4-0xc.6 (0.3)
0x00| b0 | . | ns: false 0xc.7-0xc.7 (0.1)
0x00| 02 | . | cwr: false 0xd-0xd (0.1)
0x00| 02 | . | ece: false 0xd.1-0xd.1 (0.1)
0x00| 02 | . | urg: false 0xd.2-0xd.2 (0.1)
0x00| 02 | . | ack: false 0xd.3-0xd.3 (0.1)
0x00| 02 | . | psh: false 0xd.4-0xd.4 (0.1)
0x00| 02 | . | rst: false 0xd.5-0xd.5 (0.1)
0x00| 02 | . | syn: true 0xd.6-0xd.6 (0.1)
0x00| 02 | . | fin: false 0xd.7-0xd.7 (0.1)
0x00| ff ff| ..| window_size: 65535 0xe-0xf.7 (2)
0x10|45 e4 |E. | checksum: 0x45e4 0x10-0x11.7 (2)
0x10| 00 00 | .. | urgent_pointer: 0 0x12-0x13.7 (2)
interp: dump: Indicate arrays using jq-syntax Related to #16
2021-12-08 18:20:37 +03:00
| | | options[0:9]: 0x14-0x2b.7 (24)
| | | [0]{}: option 0x14-0x17.7 (4)
inet: Add tcp and ipv4 reassembly Also add tcp_stream and udp_payload to decode content
2021-11-24 23:20:46 +03:00
0x10| 02 | . | kind: "maxseg" (2) (Maximum segment size) 0x14-0x14.7 (1)
0x10| 04 | . | length: 4 0x15-0x15.7 (1)
0x10| 05 b4 | .. | data: raw bits 0x16-0x17.7 (2)
interp: dump: Indicate arrays using jq-syntax Related to #16
2021-12-08 18:20:37 +03:00
| | | [1]{}: option 0x18-0x18.7 (1)
inet: Add tcp and ipv4 reassembly Also add tcp_stream and udp_payload to decode content
2021-11-24 23:20:46 +03:00
0x10| 01 | . | kind: "nop" (1) (No operation) 0x18-0x18.7 (1)
interp: dump: Indicate arrays using jq-syntax Related to #16
2021-12-08 18:20:37 +03:00
| | | [2]{}: option 0x19-0x1b.7 (3)
inet: Add tcp and ipv4 reassembly Also add tcp_stream and udp_payload to decode content
2021-11-24 23:20:46 +03:00
0x10| 03 | . | kind: "winscale" (3) (Window scale) 0x19-0x19.7 (1)
0x10| 03 | . | length: 3 0x1a-0x1a.7 (1)
0x10| 05 | . | data: raw bits 0x1b-0x1b.7 (1)
interp: dump: Indicate arrays using jq-syntax Related to #16
2021-12-08 18:20:37 +03:00
| | | [3]{}: option 0x1c-0x1c.7 (1)
inet: Add tcp and ipv4 reassembly Also add tcp_stream and udp_payload to decode content
2021-11-24 23:20:46 +03:00
0x10| 01 | . | kind: "nop" (1) (No operation) 0x1c-0x1c.7 (1)
interp: dump: Indicate arrays using jq-syntax Related to #16
2021-12-08 18:20:37 +03:00
| | | [4]{}: option 0x1d-0x1d.7 (1)
inet: Add tcp and ipv4 reassembly Also add tcp_stream and udp_payload to decode content
2021-11-24 23:20:46 +03:00
0x10| 01 | . | kind: "nop" (1) (No operation) 0x1d-0x1d.7 (1)
interp: dump: Indicate arrays using jq-syntax Related to #16
2021-12-08 18:20:37 +03:00
| | | [5]{}: option 0x1e-0x27.7 (10)
inet: Add tcp and ipv4 reassembly Also add tcp_stream and udp_payload to decode content
2021-11-24 23:20:46 +03:00
0x10| 08 | . | kind: "timestamp" (8) (Timestamp and echo of previous timestamp) 0x1e-0x1e.7 (1)
0x10| 0a| .| length: 10 0x1f-0x1f.7 (1)
0x20|4b 2a 91 21 00 00 00 00 |K*.!.... | data: raw bits 0x20-0x27.7 (8)
interp: dump: Indicate arrays using jq-syntax Related to #16
2021-12-08 18:20:37 +03:00
| | | [6]{}: option 0x28-0x29.7 (2)
inet: Add tcp and ipv4 reassembly Also add tcp_stream and udp_payload to decode content
2021-11-24 23:20:46 +03:00
0x20| 04 | . | kind: "sack_permitted" (4) (Selective Acknowledgement permitted) 0x28-0x28.7 (1)
0x20| 02 | . | length: 2 0x29-0x29.7 (1)
| | | data: raw bits 0x2a-NA (0)
interp: dump: Indicate arrays using jq-syntax Related to #16
2021-12-08 18:20:37 +03:00
| | | [7]{}: option 0x2a-0x2a.7 (1)
inet: Add tcp and ipv4 reassembly Also add tcp_stream and udp_payload to decode content
2021-11-24 23:20:46 +03:00
0x20| 00 | . | kind: "end" (0) (End of options list) 0x2a-0x2a.7 (1)
interp: dump: Indicate arrays using jq-syntax Related to #16
2021-12-08 18:20:37 +03:00
| | | [8]{}: option 0x2b-0x2b.7 (1)
inet: Add tcp and ipv4 reassembly Also add tcp_stream and udp_payload to decode content
2021-11-24 23:20:46 +03:00
0x20| 00| | .| | kind: "end" (0) (End of options list) 0x2b-0x2b.7 (1)
ipv6,icmpv6: Add decoder Refactor to use groups between network layers to make them less coupled and reusable: link_frame (ethernet etc) inet_packet (ipv4,ipv6 etc) ip_packet (tcp packet (not stream), udp segment etc) Rename data to payload as i think it makes more sense for network data
2022-04-01 17:31:55 +03:00
| | | payload: raw bits 0x2c-NA (0)
Reference in New Issue Copy Permalink