viewer9 documentation

Network PML Operations

TCPAccept UDPAccept
TCPConnect UDPConnect
TCPDisconnect UDPDisconnect
TCPReceive UDPReceive
TCPReconnect UDPReconnect
TCPRetransmit UDPRetransmit
TCPSend UDPSend
TCPTCPCopy UDPTCPCopy

These network operations all have the same fields. The opcode= query for these is only shared by the similar TCP and UDP operations (for example, TCPSend and UDPSend are opcode=5,2, while TCPReceive and UDPReceive are opcode=5,3).

Length is 32-bit, IpFrom IpTo are 32-bit, and PortFrom PortTo are 16-bit. Path is a string composed as "IpFrom:PortFrom -> IpTo:PortTo" where each ip and port is replaced with a corresponding dns domain lookup or port name recorded at the time of capture if available. These domain names and port names are stored in tables in the PML file, not in the data of the network events. So querying the Path is much slower than querying the ip and port fields.

Additional fields depend on the operation and, although a dynamic string name-value pair format is used in the data, they are all unsigned integers. Here is a list of the viewer9 conformant field names and the dynamic names in the PML:

StartTime "startime" (PML has startime with single t) EndTime "endtime" MaxSegSize "mss" SelAckOption "sackopt" TimestampOption "tsopt" WinScaleOption "wsopt" ReceiveWindow "rcvwin" ReceiveWinScale "rcvwinscale" SendWinScale "sndwinscale" SeqNum "seqnum" ConnId "connid"

Example of TCPConnect from 64-bit PML

Hover over field values like Time, ResultCode, IpFrom, IpTo, and bytes of evdata in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.

TCPConnect opcode=5,5

ev=141946

Time:2022-05-17 19:41:59.3742057
Duration:0.0000000
ResultCode:SUCCESS
Tid:0
Path:WIN10X64-VM.localdomain:63471 -> yt-in-f94.1e100.net:https
Length:0
IpFrom:192.168.125.132
IpTo:142.250.105.94
PortFrom:63471
PortTo:443
MaxSegSize:1460
SelAckOption:0
TimestampOption:0
WinScaleOption:0
ReceiveWindow:64240
ReceiveWinScale:0
SendWinScale:0
SeqNum:0
ConnId:0

evdata[0-239] file offset 68409204

007 00 26 3b 00 00 00 00 ..&;....
8c0 a8 7d 84 00 00 00 00 ........
1600 00 00 00 00 00 00 00 ........
248e fa 69 5e 00 00 00 00 ..i^....
3200 00 00 00 00 00 00 00 ........
40ef f7 bb 01 6d 00 73 00 ....m.s.
4873 00 00 00 31 00 34 00 s...1.4.
5636 00 30 00 00 00 73 00 6.0...s.
6461 00 63 00 6b 00 6f 00 a.c.k.o.
7270 00 74 00 00 00 30 00 p.t...0.
8000 00 74 00 73 00 6f 00 ..t.s.o.
8870 00 74 00 00 00 30 00 p.t...0.
9600 00 77 00 73 00 6f 00 ..w.s.o.
10470 00 74 00 00 00 30 00 p.t...0.
11200 00 72 00 63 00 76 00 ..r.c.v.
12077 00 69 00 6e 00 00 00 w.i.n...
12836 00 34 00 32 00 34 00 6.4.2.4.
13630 00 00 00 72 00 63 00 0...r.c.
14476 00 77 00 69 00 6e 00 v.w.i.n.
15273 00 63 00 61 00 6c 00 s.c.a.l.
16065 00 00 00 30 00 00 00 e...0...
16873 00 6e 00 64 00 77 00 s.n.d.w.
17669 00 6e 00 73 00 63 00 i.n.s.c.
18461 00 6c 00 65 00 00 00 a.l.e...
19230 00 00 00 73 00 65 00 0...s.e.
20071 00 6e 00 75 00 6d 00 q.n.u.m.
20800 00 30 00 00 00 63 00 ..0...c.
2166f 00 6e 00 6e 00 69 00 o.n.n.i.
22464 00 00 00 30 00 00 00 d...0...
23200 00 00 00 04 f8 ff ff ........

Call Stack stacksize=32

StackAddressmodModNameModPath
0xfffff80437fa403b174ntoskrnl.exe + 0x5a403bC:\WINDOWS\system32\ntoskrnl.exe
0xfffff8043b9bd3df234tcpip.sys + 0xbd3dfC:\WINDOWS\System32\drivers\tcpip.sys
0xfffff8043b95ca81234tcpip.sys + 0x5ca81C:\WINDOWS\System32\drivers\tcpip.sys
0xfffff8043b91b385234tcpip.sys + 0x1b385C:\WINDOWS\System32\drivers\tcpip.sys
0xfffff8043b9158fe234tcpip.sys + 0x158feC:\WINDOWS\System32\drivers\tcpip.sys
0xfffff8043b914b1f234tcpip.sys + 0x14b1fC:\WINDOWS\System32\drivers\tcpip.sys
0xfffff8043b913ba8234tcpip.sys + 0x13ba8C:\WINDOWS\System32\drivers\tcpip.sys
0xfffff8043b979b42234tcpip.sys + 0x79b42C:\WINDOWS\System32\drivers\tcpip.sys
0xfffff8043b93a711234tcpip.sys + 0x3a711C:\WINDOWS\System32\drivers\tcpip.sys
0xfffff8043b93705b234tcpip.sys + 0x3705bC:\WINDOWS\System32\drivers\tcpip.sys
0xfffff8043b9365df234tcpip.sys + 0x365dfC:\WINDOWS\System32\drivers\tcpip.sys
0xfffff8043b9338ec234tcpip.sys + 0x338ecC:\WINDOWS\System32\drivers\tcpip.sys
0xfffff8043b980140234tcpip.sys + 0x80140C:\WINDOWS\System32\drivers\tcpip.sys
0xfffff8043b97f73c234tcpip.sys + 0x7f73cC:\WINDOWS\System32\drivers\tcpip.sys
0xfffff80437d54518174ntoskrnl.exe + 0x354518C:\WINDOWS\system32\ntoskrnl.exe
0xfffff80437d5448d174ntoskrnl.exe + 0x35448dC:\WINDOWS\system32\ntoskrnl.exe
0xfffff8043b9726dd234tcpip.sys + 0x726ddC:\WINDOWS\System32\drivers\tcpip.sys
0xfffff8043b971dbd234tcpip.sys + 0x71dbdC:\WINDOWS\System32\drivers\tcpip.sys
0xfffff8043b6b1eb1231ndis.sys + 0x1eb1C:\WINDOWS\system32\drivers\ndis.sys
0xfffff8043b6b1ccb231ndis.sys + 0x1ccbC:\WINDOWS\system32\drivers\ndis.sys
0xfffff8043b6b7ef1231ndis.sys + 0x7ef1C:\WINDOWS\system32\drivers\ndis.sys
0xfffff8043b6edd73231ndis.sys + 0x3dd73C:\WINDOWS\system32\drivers\ndis.sys
0xfffff8043b6b4a94231ndis.sys + 0x4a94C:\WINDOWS\system32\drivers\ndis.sys
0xfffff8043d1783b3280e1i65x64.sys + 0x183b3C:\WINDOWS\System32\drivers\e1i65x64.sys
0xfffff8043d17947a280e1i65x64.sys + 0x1947aC:\WINDOWS\System32\drivers\e1i65x64.sys
0xfffff8043d180c14280e1i65x64.sys + 0x20c14C:\WINDOWS\System32\drivers\e1i65x64.sys
0xfffff8043d18108f280e1i65x64.sys + 0x2108fC:\WINDOWS\System32\drivers\e1i65x64.sys
0xfffff8043d180668280e1i65x64.sys + 0x20668C:\WINDOWS\System32\drivers\e1i65x64.sys
0xfffff8043b6b7887231ndis.sys + 0x7887C:\WINDOWS\system32\drivers\ndis.sys
0xfffff80437c0781e174ntoskrnl.exe + 0x20781eC:\WINDOWS\system32\ntoskrnl.exe
0xfffff80437c06b04174ntoskrnl.exe + 0x206b04C:\WINDOWS\system32\ntoskrnl.exe
0xfffff80437df99ae174ntoskrnl.exe + 0x3f99aeC:\WINDOWS\system32\ntoskrnl.exe

In Procmon, the network operation names all have spaces in them: TCP Accept, UDP Accept, TCP Connect, UDP Connect, TCP Disconnect, UDP Disconnect, TCP Receive, UDP Receive, TCP Reconnect, UDP Reconnect, TCP Retransmit, UDP Retransmit, TCP Send, UDP Send, TCP TCPCopy, UDP TCPCopy.

See also

Posted 4 Jul 2022 last updated 15 Nov 2022   As viewer9 is just starting out, discussion is invited via email. Please send questions and comments to forum@viewer9.com directly. Threads that might be valuable to other users will be posted as part of the documentation. Posted messages will not include your address or your full name, and might be shortened for brevity.

Copyright 2022, bryantlite, Inc.