viewer9 documentation | Index Home |
Network PML Operations
TCPAccept UDPAccept
TCPConnect UDPConnect
TCPDisconnect UDPDisconnect
TCPReceive UDPReceive
TCPReconnect UDPReconnect
TCPRetransmit UDPRetransmit
TCPSend UDPSend
TCPTCPCopy UDPTCPCopy
These network operations all have the same fields. The opcode= query for these is only shared by the similar TCP and UDP operations (for example, TCPSend and UDPSend are opcode=5,2, while TCPReceive and UDPReceive are opcode=5,3).
Length is 32-bit, IpFrom IpTo are 32-bit, and PortFrom PortTo are 16-bit. Path is a string composed as "IpFrom:PortFrom -> IpTo:PortTo" where each ip and port is replaced with a corresponding dns domain lookup or port name recorded at the time of capture if available. These domain names and port names are stored in tables in the PML file, not in the data of the network events. So querying the Path is much slower than querying the ip and port fields.
Additional fields depend on the operation and, although a dynamic string name-value pair format is used in the data, they are all unsigned integers. Here is a list of the viewer9 conformant field names and the dynamic names in the PML:
StartTime "startime" (PML has startime with single t) EndTime "endtime" MaxSegSize "mss" SelAckOption "sackopt" TimestampOption "tsopt" WinScaleOption "wsopt" ReceiveWindow "rcvwin" ReceiveWinScale "rcvwinscale" SendWinScale "sndwinscale" SeqNum "seqnum" ConnId "connid"
Example of TCPConnect from 64-bit PML
Hover over field values like Time, ResultCode, IpFrom, IpTo, and bytes of evdata in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.
TCPConnect opcode=5,5
ev=141946
Time: | 2022-05-17 19:41:59.3742057 |
Duration: | 0.0000000 |
ResultCode: | SUCCESS |
Tid: | 0 |
Path: | WIN10X64-VM.localdomain:63471 -> yt-in-f94.1e100.net:https |
Length: | 0 |
IpFrom: | 192.168.125.132 |
IpTo: | 142.250.105.94 |
PortFrom: | 63471 |
PortTo: | 443 |
MaxSegSize: | 1460 |
SelAckOption: | 0 |
TimestampOption: | 0 |
WinScaleOption: | 0 |
ReceiveWindow: | 64240 |
ReceiveWinScale: | 0 |
SendWinScale: | 0 |
SeqNum: | 0 |
ConnId: | 0 |
evdata[0-239] file offset 68409204
0 | 07 00 26 3b 00 00 00 00 | ..&;.... |
8 | c0 a8 7d 84 00 00 00 00 | ........ |
16 | 00 00 00 00 00 00 00 00 | ........ |
24 | 8e fa 69 5e 00 00 00 00 | ..i^.... |
32 | 00 00 00 00 00 00 00 00 | ........ |
40 | ef f7 bb 01 6d 00 73 00 | ....m.s. |
48 | 73 00 00 00 31 00 34 00 | s...1.4. |
56 | 36 00 30 00 00 00 73 00 | 6.0...s. |
64 | 61 00 63 00 6b 00 6f 00 | a.c.k.o. |
72 | 70 00 74 00 00 00 30 00 | p.t...0. |
80 | 00 00 74 00 73 00 6f 00 | ..t.s.o. |
88 | 70 00 74 00 00 00 30 00 | p.t...0. |
96 | 00 00 77 00 73 00 6f 00 | ..w.s.o. |
104 | 70 00 74 00 00 00 30 00 | p.t...0. |
112 | 00 00 72 00 63 00 76 00 | ..r.c.v. |
120 | 77 00 69 00 6e 00 00 00 | w.i.n... |
128 | 36 00 34 00 32 00 34 00 | 6.4.2.4. |
136 | 30 00 00 00 72 00 63 00 | 0...r.c. |
144 | 76 00 77 00 69 00 6e 00 | v.w.i.n. |
152 | 73 00 63 00 61 00 6c 00 | s.c.a.l. |
160 | 65 00 00 00 30 00 00 00 | e...0... |
168 | 73 00 6e 00 64 00 77 00 | s.n.d.w. |
176 | 69 00 6e 00 73 00 63 00 | i.n.s.c. |
184 | 61 00 6c 00 65 00 00 00 | a.l.e... |
192 | 30 00 00 00 73 00 65 00 | 0...s.e. |
200 | 71 00 6e 00 75 00 6d 00 | q.n.u.m. |
208 | 00 00 30 00 00 00 63 00 | ..0...c. |
216 | 6f 00 6e 00 6e 00 69 00 | o.n.n.i. |
224 | 64 00 00 00 30 00 00 00 | d...0... |
232 | 00 00 00 00 04 f8 ff ff | ........ |
Call Stack stacksize=32
StackAddress | mod | ModName | ModPath |
---|---|---|---|
0xfffff80437fa403b | 174 | ntoskrnl.exe + 0x5a403b | C:\WINDOWS\system32\ntoskrnl.exe |
0xfffff8043b9bd3df | 234 | tcpip.sys + 0xbd3df | C:\WINDOWS\System32\drivers\tcpip.sys |
0xfffff8043b95ca81 | 234 | tcpip.sys + 0x5ca81 | C:\WINDOWS\System32\drivers\tcpip.sys |
0xfffff8043b91b385 | 234 | tcpip.sys + 0x1b385 | C:\WINDOWS\System32\drivers\tcpip.sys |
0xfffff8043b9158fe | 234 | tcpip.sys + 0x158fe | C:\WINDOWS\System32\drivers\tcpip.sys |
0xfffff8043b914b1f | 234 | tcpip.sys + 0x14b1f | C:\WINDOWS\System32\drivers\tcpip.sys |
0xfffff8043b913ba8 | 234 | tcpip.sys + 0x13ba8 | C:\WINDOWS\System32\drivers\tcpip.sys |
0xfffff8043b979b42 | 234 | tcpip.sys + 0x79b42 | C:\WINDOWS\System32\drivers\tcpip.sys |
0xfffff8043b93a711 | 234 | tcpip.sys + 0x3a711 | C:\WINDOWS\System32\drivers\tcpip.sys |
0xfffff8043b93705b | 234 | tcpip.sys + 0x3705b | C:\WINDOWS\System32\drivers\tcpip.sys |
0xfffff8043b9365df | 234 | tcpip.sys + 0x365df | C:\WINDOWS\System32\drivers\tcpip.sys |
0xfffff8043b9338ec | 234 | tcpip.sys + 0x338ec | C:\WINDOWS\System32\drivers\tcpip.sys |
0xfffff8043b980140 | 234 | tcpip.sys + 0x80140 | C:\WINDOWS\System32\drivers\tcpip.sys |
0xfffff8043b97f73c | 234 | tcpip.sys + 0x7f73c | C:\WINDOWS\System32\drivers\tcpip.sys |
0xfffff80437d54518 | 174 | ntoskrnl.exe + 0x354518 | C:\WINDOWS\system32\ntoskrnl.exe |
0xfffff80437d5448d | 174 | ntoskrnl.exe + 0x35448d | C:\WINDOWS\system32\ntoskrnl.exe |
0xfffff8043b9726dd | 234 | tcpip.sys + 0x726dd | C:\WINDOWS\System32\drivers\tcpip.sys |
0xfffff8043b971dbd | 234 | tcpip.sys + 0x71dbd | C:\WINDOWS\System32\drivers\tcpip.sys |
0xfffff8043b6b1eb1 | 231 | ndis.sys + 0x1eb1 | C:\WINDOWS\system32\drivers\ndis.sys |
0xfffff8043b6b1ccb | 231 | ndis.sys + 0x1ccb | C:\WINDOWS\system32\drivers\ndis.sys |
0xfffff8043b6b7ef1 | 231 | ndis.sys + 0x7ef1 | C:\WINDOWS\system32\drivers\ndis.sys |
0xfffff8043b6edd73 | 231 | ndis.sys + 0x3dd73 | C:\WINDOWS\system32\drivers\ndis.sys |
0xfffff8043b6b4a94 | 231 | ndis.sys + 0x4a94 | C:\WINDOWS\system32\drivers\ndis.sys |
0xfffff8043d1783b3 | 280 | e1i65x64.sys + 0x183b3 | C:\WINDOWS\System32\drivers\e1i65x64.sys |
0xfffff8043d17947a | 280 | e1i65x64.sys + 0x1947a | C:\WINDOWS\System32\drivers\e1i65x64.sys |
0xfffff8043d180c14 | 280 | e1i65x64.sys + 0x20c14 | C:\WINDOWS\System32\drivers\e1i65x64.sys |
0xfffff8043d18108f | 280 | e1i65x64.sys + 0x2108f | C:\WINDOWS\System32\drivers\e1i65x64.sys |
0xfffff8043d180668 | 280 | e1i65x64.sys + 0x20668 | C:\WINDOWS\System32\drivers\e1i65x64.sys |
0xfffff8043b6b7887 | 231 | ndis.sys + 0x7887 | C:\WINDOWS\system32\drivers\ndis.sys |
0xfffff80437c0781e | 174 | ntoskrnl.exe + 0x20781e | C:\WINDOWS\system32\ntoskrnl.exe |
0xfffff80437c06b04 | 174 | ntoskrnl.exe + 0x206b04 | C:\WINDOWS\system32\ntoskrnl.exe |
0xfffff80437df99ae | 174 | ntoskrnl.exe + 0x3f99ae | C:\WINDOWS\system32\ntoskrnl.exe |
In Procmon, the network operation names all have spaces in them: TCP Accept, UDP Accept, TCP Connect, UDP Connect, TCP Disconnect, UDP Disconnect, TCP Receive, UDP Receive, TCP Reconnect, UDP Reconnect, TCP Retransmit, UDP Retransmit, TCP Send, UDP Send, TCP TCPCopy, UDP TCPCopy.
See also
Posted 4 Jul 2022 last updated 15 Nov 2022 As viewer9 is just starting out, discussion is invited via email. Please send questions and comments to forum@viewer9.com directly. Threads that might be valuable to other users will be posted as part of the documentation. Posted messages will not include your address or your full name, and might be shortened for brevity.
Copyright 2022, bryantlite, Inc.