Or this single query:
with pcapDoc as (select PCAP from `infoset.json`),
packets as (select flatten(pcapDoc.PCAP.Packet) as packet from
pcapDoc),
ipv4Headers as (select
packets.packet.LinkLayer.Ethernet.NetworkLayer.IPv4.IPv4Header as hdr from
packets),
ipsrcs as (select ipv4headers.hdr.IPSrc.value as ip from ipv4Headers),
ipdests as (select ipv4headers.hdr.IPDest.value as ip from
ipv4Headers),
ips as (select ip from ipsrcs union select ip from ipdests)
select * from ips;
On Sun, Oct 8, 2023 at 2:47 PM Mike Beckerle <mbecke...@apache.org> wrote:
> Ok. It took some time but putting the infoset.json attachment into /tmp
> this SQL pulls out all the IP addresses from the PCAP data:
>
> use dfs.tmp;
>
> create or replace view pcapDoc as select PCAP from `infoset.json`;
>
> create or replace view packets as select flatten(pcapDoc.PCAP.Packet) as
> packet from pcapDoc;
>
> create or replace view ipv4Headers as select
> packets.packet.LinkLayer.Ethernet.NetworkLayer.IPv4.IPv4Header as hdr from
> packets ;
>
> create or replace view ipsrcs as select ipv4headers.hdr.IPSrc.value as ip
> from ipv4Headers;
>
> create or replace view ipdests as select ipv4headers.hdr.IPDest.value as
> ip from ipv4Headers;
>
> create or replace view ips as select ip from ipsrcs union select ip from
> ipdests;
>
> select * from ips;
>
> On Wed, Sep 13, 2023 at 9:43 AM Mike Beckerle <mbecke...@apache.org>
> wrote:
>
>> ... sound of crickets on a summer night .....
>>
>> It would really help me if I could get a response to this inquiry, to
>> help me better understand Drill.
>>
>> I do realize people are busy, and also this was originally sent Aug 25,
>> which is the wrong time of year to get timely response to anything.
>> Hence, this re-up of the message.
>>
>>
>> On Fri, Aug 25, 2023 at 7:39 PM Mike Beckerle <mbecke...@apache.org>
>> wrote:
>>
>>> Below is a small JSON output from Daffodil and below that is the same
>>> Infoset output as XML.
>>> (They're inline in this message, but I also attached them as files)
>>>
>>> This is just a parse of a small PCAP file with a few ICMP packets in it.
>>> It's an example DFDL schema used to illustrate binary file parsing.
>>>
>>> (The schema is here https://github.com/DFDLSchemas/PCAP which uses this
>>> component schema: https://github.com/DFDLSchemas/ethernetIP)
>>>
>>> My theory is that Drill queries against these should be identical to
>>> obtain the same output row contents.
>>> That is, since this data has the same schema, whether it is JSON or XML
>>> shouldn't affect how you query it.
>>> To do that the XML Reader will need the XML schema (or some
>>> hand-provided metadata) so it knows what is an array. (Specifically
>>> PCAP.Packet is the array.)
>>>
>>> E.g., if you wanted to get the IPSrc and IPDest fields in a table from
>>> all ICMP packets in this file, that query should be the same for the JSON
>>> and the XML data.
>>>
>>> First question: Does that make sense? I want to make sure I'm
>>> understanding this right.
>>>
>>> Second question, since I don't really understand Drill SQL yet.
>>>
>>> What is a query that would pluck the IPSrc.value and IPDest.value from
>>> this data and make a row of each pair of those?
>>>
>>> The top level is a map with a single element named PCAP.
>>> The "table" is PCAP.Packet which is an array (of maps).
>>> And within each array item's map the fields of interest are within
>>> LinkLayer.Ethernet.NetworkLayer.IPv4.IPv4Header
>>> (so maybe IPv4Header is the table?)
>>> The two fields within there are IPSrc.value (AS src) and IPDest.value
>>> (AS dest)
>>>
>>> I'm lost on how to tell the query that the table is the array
>>> PCAP.Packet, or the ....IPv4Header within those maybe?
>>>
>>> Maybe this is easy, but I'm just not grokking it yet so I could use some
>>> help here.
>>>
>>> Thanks in advance.
>>>
>>> {
>>> "PCAP": {
>>> "PCAPHeader": {
>>> "MagicNumber": "D4C3B2A1",
>>> "Version": {
>>> "Major": "2",
>>> "Minor": "4"
>>> },
>>> "Zone": "0",
>>> "SigFigs": "0",
>>> "SnapLen": "65535",
>>> "Network": "1"
>>> },
>>> "Packet": [
>>> {
>>> "PacketHeader": {
>>> "Seconds": "1371631556",
>>> "USeconds": "838904",
>>> "InclLen": "74",
>>> "OrigLen": "74"
>>> },
>>> "LinkLayer": {
>>> "Ethernet": {
>>> "MACDest": "005056E01449",
>>> "MACSrc": "000C29340BDE",
>>> "Ethertype": "2048",
>>> "NetworkLayer": {
>>> "IPv4": {
>>> "IPv4Header": {
>>> "Version": "4",
>>> "IHL": "5",
>>> "DSCP": "0",
>>> "ECN": "0",
>>> "Length": "60",
>>> "Identification": "55107",
>>> "Flags": "0",
>>> "FragmentOffset": "0",
>>> "TTL": "128",
>>> "Protocol": "1",
>>> "Checksum": "11123",
>>> "IPSrc": {
>>> "value": "192.168.158.139"
>>> },
>>> "IPDest": {
>>> "value": "174.137.42.77"
>>> },
>>> "ComputedChecksum": "11123"
>>> },
>>> "Protocol": "1",
>>> "ICMPv4": {
>>> "Type": "8",
>>> "Code": "0",
>>> "Checksum": "10844",
>>> "EchoRequest": {
>>> "Identifier": "512",
>>> "SequenceNumber": "8448",
>>> "Payload":
>>> "6162636465666768696A6B6C6D6E6F7071727374757677616263646566676869"
>>> }
>>> }
>>> }
>>> }
>>> }
>>> }
>>> },
>>> {
>>> "PacketHeader": {
>>> "Seconds": "1371631557",
>>> "USeconds": "55699",
>>> "InclLen": "74",
>>> "OrigLen": "74"
>>> },
>>> "LinkLayer": {
>>> "Ethernet": {
>>> "MACDest": "000C29340BDE",
>>> "MACSrc": "005056E01449",
>>> "Ethertype": "2048",
>>> "NetworkLayer": {
>>> "IPv4": {
>>> "IPv4Header": {
>>> "Version": "4",
>>> "IHL": "5",
>>> "DSCP": "0",
>>> "ECN": "0",
>>> "Length": "60",
>>> "Identification": "30433",
>>> "Flags": "0",
>>> "FragmentOffset": "0",
>>> "TTL": "128",
>>> "Protocol": "1",
>>> "Checksum": "35797",
>>> "IPSrc": {
>>> "value": "174.137.42.77"
>>> },
>>> "IPDest": {
>>> "value": "192.168.158.139"
>>> },
>>> "ComputedChecksum": "35797"
>>> },
>>> "Protocol": "1",
>>> "ICMPv4": {
>>> "Type": "0",
>>> "Code": "0",
>>> "Checksum": "12892",
>>> "EchoReply": {
>>> "Identifier": "512",
>>> "SequenceNumber": "8448",
>>> "Payload":
>>> "6162636465666768696A6B6C6D6E6F7071727374757677616263646566676869"
>>> }
>>> }
>>> }
>>> }
>>> }
>>> }
>>> },
>>> {
>>> "PacketHeader": {
>>> "Seconds": "1371631557",
>>> "USeconds": "840049",
>>> "InclLen": "74",
>>> "OrigLen": "74"
>>> },
>>> "LinkLayer": {
>>> "Ethernet": {
>>> "MACDest": "005056E01449",
>>> "MACSrc": "000C29340BDE",
>>> "Ethertype": "2048",
>>> "NetworkLayer": {
>>> "IPv4": {
>>> "IPv4Header": {
>>> "Version": "4",
>>> "IHL": "5",
>>> "DSCP": "0",
>>> "ECN": "0",
>>> "Length": "60",
>>> "Identification": "55110",
>>> "Flags": "0",
>>> "FragmentOffset": "0",
>>> "TTL": "128",
>>> "Protocol": "1",
>>> "Checksum": "11120",
>>> "IPSrc": {
>>> "value": "192.168.158.139"
>>> },
>>> "IPDest": {
>>> "value": "174.137.42.77"
>>> },
>>> "ComputedChecksum": "11120"
>>> },
>>> "Protocol": "1",
>>> "ICMPv4": {
>>> "Type": "8",
>>> "Code": "0",
>>> "Checksum": "10588",
>>> "EchoRequest": {
>>> "Identifier": "512",
>>> "SequenceNumber": "8704",
>>> "Payload":
>>> "6162636465666768696A6B6C6D6E6F7071727374757677616263646566676869"
>>> }
>>> }
>>> }
>>> }
>>> }
>>> }
>>> },
>>> {
>>> "PacketHeader": {
>>> "Seconds": "1371631558",
>>> "USeconds": "44196",
>>> "InclLen": "74",
>>> "OrigLen": "74"
>>> },
>>> "LinkLayer": {
>>> "Ethernet": {
>>> "MACDest": "000C29340BDE",
>>> "MACSrc": "005056E01449",
>>> "Ethertype": "2048",
>>> "NetworkLayer": {
>>> "IPv4": {
>>> "IPv4Header": {
>>> "Version": "4",
>>> "IHL": "5",
>>> "DSCP": "0",
>>> "ECN": "0",
>>> "Length": "60",
>>> "Identification": "30436",
>>> "Flags": "0",
>>> "FragmentOffset": "0",
>>> "TTL": "128",
>>> "Protocol": "1",
>>> "Checksum": "35794",
>>> "IPSrc": {
>>> "value": "174.137.42.77"
>>> },
>>> "IPDest": {
>>> "value": "192.168.158.139"
>>> },
>>> "ComputedChecksum": "35794"
>>> },
>>> "Protocol": "1",
>>> "ICMPv4": {
>>> "Type": "0",
>>> "Code": "0",
>>> "Checksum": "12636",
>>> "EchoReply": {
>>> "Identifier": "512",
>>> "SequenceNumber": "8704",
>>> "Payload":
>>> "6162636465666768696A6B6C6D6E6F7071727374757677616263646566676869"
>>> }
>>> }
>>> }
>>> }
>>> }
>>> }
>>> },
>>> {
>>> "PacketHeader": {
>>> "Seconds": "1371631558",
>>> "USeconds": "841168",
>>> "InclLen": "74",
>>> "OrigLen": "74"
>>> },
>>> "LinkLayer": {
>>> "Ethernet": {
>>> "MACDest": "005056E01449",
>>> "MACSrc": "000C29340BDE",
>>> "Ethertype": "2048",
>>> "NetworkLayer": {
>>> "IPv4": {
>>> "IPv4Header": {
>>> "Version": "4",
>>> "IHL": "5",
>>> "DSCP": "0",
>>> "ECN": "0",
>>> "Length": "60",
>>> "Identification": "55113",
>>> "Flags": "0",
>>> "FragmentOffset": "0",
>>> "TTL": "128",
>>> "Protocol": "1",
>>> "Checksum": "11117",
>>> "IPSrc": {
>>> "value": "192.168.158.139"
>>> },
>>> "IPDest": {
>>> "value": "174.137.42.77"
>>> },
>>> "ComputedChecksum": "11117"
>>> },
>>> "Protocol": "1",
>>> "ICMPv4": {
>>> "Type": "8",
>>> "Code": "0",
>>> "Checksum": "10332",
>>> "EchoRequest": {
>>> "Identifier": "512",
>>> "SequenceNumber": "8960",
>>> "Payload":
>>> "6162636465666768696A6B6C6D6E6F7071727374757677616263646566676869"
>>> }
>>> }
>>> }
>>> }
>>> }
>>> }
>>> },
>>> {
>>> "PacketHeader": {
>>> "Seconds": "1371631559",
>>> "USeconds": "85428",
>>> "InclLen": "74",
>>> "OrigLen": "74"
>>> },
>>> "LinkLayer": {
>>> "Ethernet": {
>>> "MACDest": "000C29340BDE",
>>> "MACSrc": "005056E01449",
>>> "Ethertype": "2048",
>>> "NetworkLayer": {
>>> "IPv4": {
>>> "IPv4Header": {
>>> "Version": "4",
>>> "IHL": "5",
>>> "DSCP": "0",
>>> "ECN": "0",
>>> "Length": "60",
>>> "Identification": "30448",
>>> "Flags": "0",
>>> "FragmentOffset": "0",
>>> "TTL": "128",
>>> "Protocol": "1",
>>> "Checksum": "35782",
>>> "IPSrc": {
>>> "value": "174.137.42.77"
>>> },
>>> "IPDest": {
>>> "value": "192.168.158.139"
>>> },
>>> "ComputedChecksum": "35782"
>>> },
>>> "Protocol": "1",
>>> "ICMPv4": {
>>> "Type": "0",
>>> "Code": "0",
>>> "Checksum": "12380",
>>> "EchoReply": {
>>> "Identifier": "512",
>>> "SequenceNumber": "8960",
>>> "Payload":
>>> "6162636465666768696A6B6C6D6E6F7071727374757677616263646566676869"
>>> }
>>> }
>>> }
>>> }
>>> }
>>> }
>>> },
>>> {
>>> "PacketHeader": {
>>> "Seconds": "1371631559",
>>> "USeconds": "841775",
>>> "InclLen": "74",
>>> "OrigLen": "74"
>>> },
>>> "LinkLayer": {
>>> "Ethernet": {
>>> "MACDest": "005056E01449",
>>> "MACSrc": "000C29340BDE",
>>> "Ethertype": "2048",
>>> "NetworkLayer": {
>>> "IPv4": {
>>> "IPv4Header": {
>>> "Version": "4",
>>> "IHL": "5",
>>> "DSCP": "0",
>>> "ECN": "0",
>>> "Length": "60",
>>> "Identification": "55118",
>>> "Flags": "0",
>>> "FragmentOffset": "0",
>>> "TTL": "128",
>>> "Protocol": "1",
>>> "Checksum": "11112",
>>> "IPSrc": {
>>> "value": "192.168.158.139"
>>> },
>>> "IPDest": {
>>> "value": "174.137.42.77"
>>> },
>>> "ComputedChecksum": "11112"
>>> },
>>> "Protocol": "1",
>>> "ICMPv4": {
>>> "Type": "8",
>>> "Code": "0",
>>> "Checksum": "10076",
>>> "EchoRequest": {
>>> "Identifier": "512",
>>> "SequenceNumber": "9216",
>>> "Payload":
>>> "6162636465666768696A6B6C6D6E6F7071727374757677616263646566676869"
>>> }
>>> }
>>> }
>>> }
>>> }
>>> }
>>> },
>>> {
>>> "PacketHeader": {
>>> "Seconds": "1371631560",
>>> "USeconds": "42354",
>>> "InclLen": "74",
>>> "OrigLen": "74"
>>> },
>>> "LinkLayer": {
>>> "Ethernet": {
>>> "MACDest": "000C29340BDE",
>>> "MACSrc": "005056E01449",
>>> "Ethertype": "2048",
>>> "NetworkLayer": {
>>> "IPv4": {
>>> "IPv4Header": {
>>> "Version": "4",
>>> "IHL": "5",
>>> "DSCP": "0",
>>> "ECN": "0",
>>> "Length": "60",
>>> "Identification": "30453",
>>> "Flags": "0",
>>> "FragmentOffset": "0",
>>> "TTL": "128",
>>> "Protocol": "1",
>>> "Checksum": "35777",
>>> "IPSrc": {
>>> "value": "174.137.42.77"
>>> },
>>> "IPDest": {
>>> "value": "192.168.158.139"
>>> },
>>> "ComputedChecksum": "35777"
>>> },
>>> "Protocol": "1",
>>> "ICMPv4": {
>>> "Type": "0",
>>> "Code": "0",
>>> "Checksum": "12124",
>>> "EchoReply": {
>>> "Identifier": "512",
>>> "SequenceNumber": "9216",
>>> "Payload":
>>> "6162636465666768696A6B6C6D6E6F7071727374757677616263646566676869"
>>> }
>>> }
>>> }
>>> }
>>> }
>>> }
>>> }
>>> ]
>>> }
>>> }
>>>
>>> <?xml version="1.0" encoding="UTF-8"?>
>>> <tns:PCAP xmlns:tns="urn:pcap:2.4">
>>> <PCAPHeader>
>>> <MagicNumber>D4C3B2A1</MagicNumber>
>>> <Version>
>>> <Major>2</Major>
>>> <Minor>4</Minor>
>>> </Version>
>>> <Zone>0</Zone>
>>> <SigFigs>0</SigFigs>
>>> <SnapLen>65535</SnapLen>
>>> <Network>1</Network>
>>> </PCAPHeader>
>>> <Packet>
>>> <PacketHeader>
>>> <Seconds>1371631556</Seconds>
>>> <USeconds>838904</USeconds>
>>> <InclLen>74</InclLen>
>>> <OrigLen>74</OrigLen>
>>> </PacketHeader>
>>> <LinkLayer>
>>> <Ethernet>
>>> <MACDest>005056E01449</MACDest>
>>> <MACSrc>000C29340BDE</MACSrc>
>>> <Ethertype>2048</Ethertype>
>>> <NetworkLayer>
>>> <IPv4>
>>> <IPv4Header>
>>> <Version>4</Version>
>>> <IHL>5</IHL>
>>> <DSCP>0</DSCP>
>>> <ECN>0</ECN>
>>> <Length>60</Length>
>>> <Identification>55107</Identification>
>>> <Flags>0</Flags>
>>> <FragmentOffset>0</FragmentOffset>
>>> <TTL>128</TTL>
>>> <Protocol>1</Protocol>
>>> <Checksum>11123</Checksum>
>>> <IPSrc>
>>> <value>192.168.158.139</value>
>>> </IPSrc>
>>> <IPDest>
>>> <value>174.137.42.77</value>
>>> </IPDest>
>>> <ComputedChecksum>11123</ComputedChecksum>
>>> </IPv4Header>
>>> <Protocol>1</Protocol>
>>> <ICMPv4>
>>> <Type>8</Type>
>>> <Code>0</Code>
>>> <Checksum>10844</Checksum>
>>> <EchoRequest>
>>> <Identifier>512</Identifier>
>>> <SequenceNumber>8448</SequenceNumber>
>>> <Payload>
>>> 6162636465666768696A6B6C6D6E6F7071727374757677616263646566676869
>>> </Payload>
>>> </EchoRequest>
>>> </ICMPv4>
>>> </IPv4>
>>> </NetworkLayer>
>>> </Ethernet>
>>> </LinkLayer>
>>> </Packet>
>>> <Packet>
>>> <PacketHeader>
>>> <Seconds>1371631557</Seconds>
>>> <USeconds>55699</USeconds>
>>> <InclLen>74</InclLen>
>>> <OrigLen>74</OrigLen>
>>> </PacketHeader>
>>> <LinkLayer>
>>> <Ethernet>
>>> <MACDest>000C29340BDE</MACDest>
>>> <MACSrc>005056E01449</MACSrc>
>>> <Ethertype>2048</Ethertype>
>>> <NetworkLayer>
>>> <IPv4>
>>> <IPv4Header>
>>> <Version>4</Version>
>>> <IHL>5</IHL>
>>> <DSCP>0</DSCP>
>>> <ECN>0</ECN>
>>> <Length>60</Length>
>>> <Identification>30433</Identification>
>>> <Flags>0</Flags>
>>> <FragmentOffset>0</FragmentOffset>
>>> <TTL>128</TTL>
>>> <Protocol>1</Protocol>
>>> <Checksum>35797</Checksum>
>>> <IPSrc>
>>> <value>174.137.42.77</value>
>>> </IPSrc>
>>> <IPDest>
>>> <value>192.168.158.139</value>
>>> </IPDest>
>>> <ComputedChecksum>35797</ComputedChecksum>
>>> </IPv4Header>
>>> <Protocol>1</Protocol>
>>> <ICMPv4>
>>> <Type>0</Type>
>>> <Code>0</Code>
>>> <Checksum>12892</Checksum>
>>> <EchoReply>
>>> <Identifier>512</Identifier>
>>> <SequenceNumber>8448</SequenceNumber>
>>> <Payload>
>>> 6162636465666768696A6B6C6D6E6F7071727374757677616263646566676869
>>> </Payload>
>>> </EchoReply>
>>> </ICMPv4>
>>> </IPv4>
>>> </NetworkLayer>
>>> </Ethernet>
>>> </LinkLayer>
>>> </Packet>
>>> <Packet>
>>> <PacketHeader>
>>> <Seconds>1371631557</Seconds>
>>> <USeconds>840049</USeconds>
>>> <InclLen>74</InclLen>
>>> <OrigLen>74</OrigLen>
>>> </PacketHeader>
>>> <LinkLayer>
>>> <Ethernet>
>>> <MACDest>005056E01449</MACDest>
>>> <MACSrc>000C29340BDE</MACSrc>
>>> <Ethertype>2048</Ethertype>
>>> <NetworkLayer>
>>> <IPv4>
>>> <IPv4Header>
>>> <Version>4</Version>
>>> <IHL>5</IHL>
>>> <DSCP>0</DSCP>
>>> <ECN>0</ECN>
>>> <Length>60</Length>
>>> <Identification>55110</Identification>
>>> <Flags>0</Flags>
>>> <FragmentOffset>0</FragmentOffset>
>>> <TTL>128</TTL>
>>> <Protocol>1</Protocol>
>>> <Checksum>11120</Checksum>
>>> <IPSrc>
>>> <value>192.168.158.139</value>
>>> </IPSrc>
>>> <IPDest>
>>> <value>174.137.42.77</value>
>>> </IPDest>
>>> <ComputedChecksum>11120</ComputedChecksum>
>>> </IPv4Header>
>>> <Protocol>1</Protocol>
>>> <ICMPv4>
>>> <Type>8</Type>
>>> <Code>0</Code>
>>> <Checksum>10588</Checksum>
>>> <EchoRequest>
>>> <Identifier>512</Identifier>
>>> <SequenceNumber>8704</SequenceNumber>
>>> <Payload>
>>> 6162636465666768696A6B6C6D6E6F7071727374757677616263646566676869
>>> </Payload>
>>> </EchoRequest>
>>> </ICMPv4>
>>> </IPv4>
>>> </NetworkLayer>
>>> </Ethernet>
>>> </LinkLayer>
>>> </Packet>
>>> <Packet>
>>> <PacketHeader>
>>> <Seconds>1371631558</Seconds>
>>> <USeconds>44196</USeconds>
>>> <InclLen>74</InclLen>
>>> <OrigLen>74</OrigLen>
>>> </PacketHeader>
>>> <LinkLayer>
>>> <Ethernet>
>>> <MACDest>000C29340BDE</MACDest>
>>> <MACSrc>005056E01449</MACSrc>
>>> <Ethertype>2048</Ethertype>
>>> <NetworkLayer>
>>> <IPv4>
>>> <IPv4Header>
>>> <Version>4</Version>
>>> <IHL>5</IHL>
>>> <DSCP>0</DSCP>
>>> <ECN>0</ECN>
>>> <Length>60</Length>
>>> <Identification>30436</Identification>
>>> <Flags>0</Flags>
>>> <FragmentOffset>0</FragmentOffset>
>>> <TTL>128</TTL>
>>> <Protocol>1</Protocol>
>>> <Checksum>35794</Checksum>
>>> <IPSrc>
>>> <value>174.137.42.77</value>
>>> </IPSrc>
>>> <IPDest>
>>> <value>192.168.158.139</value>
>>> </IPDest>
>>> <ComputedChecksum>35794</ComputedChecksum>
>>> </IPv4Header>
>>> <Protocol>1</Protocol>
>>> <ICMPv4>
>>> <Type>0</Type>
>>> <Code>0</Code>
>>> <Checksum>12636</Checksum>
>>> <EchoReply>
>>> <Identifier>512</Identifier>
>>> <SequenceNumber>8704</SequenceNumber>
>>> <Payload>
>>> 6162636465666768696A6B6C6D6E6F7071727374757677616263646566676869
>>> </Payload>
>>> </EchoReply>
>>> </ICMPv4>
>>> </IPv4>
>>> </NetworkLayer>
>>> </Ethernet>
>>> </LinkLayer>
>>> </Packet>
>>> <Packet>
>>> <PacketHeader>
>>> <Seconds>1371631558</Seconds>
>>> <USeconds>841168</USeconds>
>>> <InclLen>74</InclLen>
>>> <OrigLen>74</OrigLen>
>>> </PacketHeader>
>>> <LinkLayer>
>>> <Ethernet>
>>> <MACDest>005056E01449</MACDest>
>>> <MACSrc>000C29340BDE</MACSrc>
>>> <Ethertype>2048</Ethertype>
>>> <NetworkLayer>
>>> <IPv4>
>>> <IPv4Header>
>>> <Version>4</Version>
>>> <IHL>5</IHL>
>>> <DSCP>0</DSCP>
>>> <ECN>0</ECN>
>>> <Length>60</Length>
>>> <Identification>55113</Identification>
>>> <Flags>0</Flags>
>>> <FragmentOffset>0</FragmentOffset>
>>> <TTL>128</TTL>
>>> <Protocol>1</Protocol>
>>> <Checksum>11117</Checksum>
>>> <IPSrc>
>>> <value>192.168.158.139</value>
>>> </IPSrc>
>>> <IPDest>
>>> <value>174.137.42.77</value>
>>> </IPDest>
>>> <ComputedChecksum>11117</ComputedChecksum>
>>> </IPv4Header>
>>> <Protocol>1</Protocol>
>>> <ICMPv4>
>>> <Type>8</Type>
>>> <Code>0</Code>
>>> <Checksum>10332</Checksum>
>>> <EchoRequest>
>>> <Identifier>512</Identifier>
>>> <SequenceNumber>8960</SequenceNumber>
>>> <Payload>
>>> 6162636465666768696A6B6C6D6E6F7071727374757677616263646566676869
>>> </Payload>
>>> </EchoRequest>
>>> </ICMPv4>
>>> </IPv4>
>>> </NetworkLayer>
>>> </Ethernet>
>>> </LinkLayer>
>>> </Packet>
>>> <Packet>
>>> <PacketHeader>
>>> <Seconds>1371631559</Seconds>
>>> <USeconds>85428</USeconds>
>>> <InclLen>74</InclLen>
>>> <OrigLen>74</OrigLen>
>>> </PacketHeader>
>>> <LinkLayer>
>>> <Ethernet>
>>> <MACDest>000C29340BDE</MACDest>
>>> <MACSrc>005056E01449</MACSrc>
>>> <Ethertype>2048</Ethertype>
>>> <NetworkLayer>
>>> <IPv4>
>>> <IPv4Header>
>>> <Version>4</Version>
>>> <IHL>5</IHL>
>>> <DSCP>0</DSCP>
>>> <ECN>0</ECN>
>>> <Length>60</Length>
>>> <Identification>30448</Identification>
>>> <Flags>0</Flags>
>>> <FragmentOffset>0</FragmentOffset>
>>> <TTL>128</TTL>
>>> <Protocol>1</Protocol>
>>> <Checksum>35782</Checksum>
>>> <IPSrc>
>>> <value>174.137.42.77</value>
>>> </IPSrc>
>>> <IPDest>
>>> <value>192.168.158.139</value>
>>> </IPDest>
>>> <ComputedChecksum>35782</ComputedChecksum>
>>> </IPv4Header>
>>> <Protocol>1</Protocol>
>>> <ICMPv4>
>>> <Type>0</Type>
>>> <Code>0</Code>
>>> <Checksum>12380</Checksum>
>>> <EchoReply>
>>> <Identifier>512</Identifier>
>>> <SequenceNumber>8960</SequenceNumber>
>>> <Payload>
>>> 6162636465666768696A6B6C6D6E6F7071727374757677616263646566676869
>>> </Payload>
>>> </EchoReply>
>>> </ICMPv4>
>>> </IPv4>
>>> </NetworkLayer>
>>> </Ethernet>
>>> </LinkLayer>
>>> </Packet>
>>> <Packet>
>>> <PacketHeader>
>>> <Seconds>1371631559</Seconds>
>>> <USeconds>841775</USeconds>
>>> <InclLen>74</InclLen>
>>> <OrigLen>74</OrigLen>
>>> </PacketHeader>
>>> <LinkLayer>
>>> <Ethernet>
>>> <MACDest>005056E01449</MACDest>
>>> <MACSrc>000C29340BDE</MACSrc>
>>> <Ethertype>2048</Ethertype>
>>> <NetworkLayer>
>>> <IPv4>
>>> <IPv4Header>
>>> <Version>4</Version>
>>> <IHL>5</IHL>
>>> <DSCP>0</DSCP>
>>> <ECN>0</ECN>
>>> <Length>60</Length>
>>> <Identification>55118</Identification>
>>> <Flags>0</Flags>
>>> <FragmentOffset>0</FragmentOffset>
>>> <TTL>128</TTL>
>>> <Protocol>1</Protocol>
>>> <Checksum>11112</Checksum>
>>> <IPSrc>
>>> <value>192.168.158.139</value>
>>> </IPSrc>
>>> <IPDest>
>>> <value>174.137.42.77</value>
>>> </IPDest>
>>> <ComputedChecksum>11112</ComputedChecksum>
>>> </IPv4Header>
>>> <Protocol>1</Protocol>
>>> <ICMPv4>
>>> <Type>8</Type>
>>> <Code>0</Code>
>>> <Checksum>10076</Checksum>
>>> <EchoRequest>
>>> <Identifier>512</Identifier>
>>> <SequenceNumber>9216</SequenceNumber>
>>> <Payload>
>>> 6162636465666768696A6B6C6D6E6F7071727374757677616263646566676869
>>> </Payload>
>>> </EchoRequest>
>>> </ICMPv4>
>>> </IPv4>
>>> </NetworkLayer>
>>> </Ethernet>
>>> </LinkLayer>
>>> </Packet>
>>> <Packet>
>>> <PacketHeader>
>>> <Seconds>1371631560</Seconds>
>>> <USeconds>42354</USeconds>
>>> <InclLen>74</InclLen>
>>> <OrigLen>74</OrigLen>
>>> </PacketHeader>
>>> <LinkLayer>
>>> <Ethernet>
>>> <MACDest>000C29340BDE</MACDest>
>>> <MACSrc>005056E01449</MACSrc>
>>> <Ethertype>2048</Ethertype>
>>> <NetworkLayer>
>>> <IPv4>
>>> <IPv4Header>
>>> <Version>4</Version>
>>> <IHL>5</IHL>
>>> <DSCP>0</DSCP>
>>> <ECN>0</ECN>
>>> <Length>60</Length>
>>> <Identification>30453</Identification>
>>> <Flags>0</Flags>
>>> <FragmentOffset>0</FragmentOffset>
>>> <TTL>128</TTL>
>>> <Protocol>1</Protocol>
>>> <Checksum>35777</Checksum>
>>> <IPSrc>
>>> <value>174.137.42.77</value>
>>> </IPSrc>
>>> <IPDest>
>>> <value>192.168.158.139</value>
>>> </IPDest>
>>> <ComputedChecksum>35777</ComputedChecksum>
>>> </IPv4Header>
>>> <Protocol>1</Protocol>
>>> <ICMPv4>
>>> <Type>0</Type>
>>> <Code>0</Code>
>>> <Checksum>12124</Checksum>
>>> <EchoReply>
>>> <Identifier>512</Identifier>
>>> <SequenceNumber>9216</SequenceNumber>
>>> <Payload>
>>> 6162636465666768696A6B6C6D6E6F7071727374757677616263646566676869
>>> </Payload>
>>> </EchoReply>
>>> </ICMPv4>
>>> </IPv4>
>>> </NetworkLayer>
>>> </Ethernet>
>>> </LinkLayer>
>>> </Packet>
>>> </tns:PCAP>
>>>
>>> Mike Beckerle
>>> Apache Daffodil PMC | daffodil.apache.org
>>> OGF DFDL Workgroup Co-Chair |
>>> www.ogf.org/ogf/doku.php/standards/dfdl/dfdl
>>> Owl Cyber Defense | www.owlcyberdefense.com
>>>
>>>
>>>
