Network PML Operations

TCPAccept UDPAccept
TCPConnect UDPConnect
TCPDisconnect UDPDisconnect
TCPReceive UDPReceive
TCPReconnect UDPReconnect
TCPRetransmit UDPRetransmit
TCPSend UDPSend
TCPTCPCopy UDPTCPCopy

These network operations all have the same fields. The opcode= query for these is only shared by the similar TCP and UDP operations (for example, TCPSend and UDPSend are opcode=5,2, while TCPReceive and UDPReceive are opcode=5,3).

Length is 32-bit, IpFrom IpTo are 32-bit, and PortFrom PortTo are 16-bit. Path is a string composed as "IpFrom:PortFrom -> IpTo:PortTo" where each ip and port is replaced with a corresponding dns domain lookup or port name recorded at the time of capture if available. These domain names and port names are stored in tables in the PML file, not in the data of the network events. So querying the Path is much slower than querying the ip and port fields.

Additional fields depend on the operation and, although a dynamic string name-value pair format is used in the data, they are all unsigned integers. Here is a list of the viewer9 conformant field names and the dynamic names in the PML:

StartTime "startime" (PML has startime with single t) EndTime "endtime" MaxSegSize "mss" SelAckOption "sackopt" TimestampOption "tsopt" WinScaleOption "wsopt" ReceiveWindow "rcvwin" ReceiveWinScale "rcvwinscale" SendWinScale "sndwinscale" SeqNum "seqnum" ConnId "connid"

Example of TCPConnect from 64-bit PML

Hover over field values like Time, ResultCode, IpFrom, IpTo, and bytes of evdata in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.

In Procmon, the network operation names all have spaces in them: TCP Accept, UDP Accept, TCP Connect, UDP Connect, TCP Disconnect, UDP Disconnect, TCP Receive, UDP Receive, TCP Reconnect, UDP Reconnect, TCP Retransmit, UDP Retransmit, TCP Send, UDP Send, TCP TCPCopy, UDP TCPCopy.

See also

• PML Operations