D-2004-direct.pcapng - Adverb Analysis

Capture Filename: D-2004-direct.pcapng
Generated from PDML on Wed Jun 27 15:09:09 2018
User ports decoded as AMQP (in addition to 5672): 5672 10010

Page controls

Link to analysis statistics.

View post-run analysis statistics

Show/Hide frames per connection

◊ 10.3.116.47:41238-10.3.116.47:10010- (nFrames=10)
◊ 10.3.116.47:41280-10.3.116.47:10010- (nFrames=58)

             ◊ Connection-based Performatives
      ◊ Session 1: Channels: client: 0, server: 0; Time: start 9.375729, end 9.376658; Counts: frames: 2, performatives: 2
      ◊ Session 2: Channels: client: 1, server: 1; Time: start 9.480880, end 9.481726; Counts: frames: 46, performatives: 51

◊ Session-based Performatives

                  ◊ Frame: 71 9.480880   -> begin [1,null]
                  ◊ Frame: 72 9.481726 <-   begin [1,1]
                  ◊ Frame: 77 9.498357 <-   disposition [1] (receiver 0-0)
                  ◊ Frame: 86 9.549646 <-   disposition [1] (receiver 1-1)
                  ◊ Frame: 87 9.550203 <-   disposition [1] (receiver 2-2)
                  ◊ Frame: 106 14.560475 <-   disposition [1] (receiver 3-3)
                  ◊ Frame: 107 14.560570 <-   disposition [1] (receiver 4-4)
                  ◊ Frame: 112 14.565229   -> disposition [1] (receiver 0-0)
                  ◊ Frame: 117 14.572013 <-   disposition [1] (receiver 5-5)
                  ◊ Frame: 118 14.572091 <-   disposition [1] (receiver 6-6)
                  ◊ Frame: 120 14.572769   -> disposition [1] (receiver 1-1)
                  ◊ Frame: 124 14.574319   -> disposition [1] (receiver 2-2)
                  ◊ Frame: 126 14.582697   -> disposition [1] (receiver 3-3)
                  ◊ Frame: 157 19.591029 <-   disposition [1] (receiver 7-7)
                  ◊ Frame: 158 19.591098 <-   disposition [1] (receiver 8-8)
                  ◊ Frame: 182 24.594417 <-   disposition [1] (receiver 9-9)

          ◊ Link 1: link_0 client sender undefined; Time: start 9.488284, end 24.593992; SettleModes snd: unsettled (modified?), rcv: first; Counts: frames: 7, performatives: 11
          ◊ Link 2: link_1 client sender abc.LB.1.testQueue; Time: start 9.504585, end 9.549285; SettleModes snd: unsettled, rcv: first; Counts: frames: 4, performatives: 5
          ◊ Link 3: link_2 client receiver abc.LB.1.testQueue; Time: start 9.527289, end 24.593280; SettleModes snd: unsettled, rcv: first; Counts: frames: 19, performatives: 19

AMQP frames

◊ ◊◊ 1.302480 Frame 5 10.3.116.47:41238 -> 10.3.116.47:10010 -> ??? Undecoded frame

◊ ◊◊ 2.317966 Frame 7 10.3.116.47:41238 <- 10.3.116.47:10010 <- ??? Undecoded frame

◊ ◊◊ 6.318134 Frame 13 10.3.116.47:41238 <- 10.3.116.47:10010 <- ??? Undecoded frame

◊ ◊◊ 9.348699 Frame 56 10.3.116.47:41280 -> 10.3.116.47:10010 -> init SASL (3): (1.0.0)

◊ ◊◊ 9.349998 Frame 58 10.3.116.47:41280 <- 10.3.116.47:10010 <- init SASL (3): (1.0.0), method Method:

◊ ◊◊ 9.359907 Frame 60 10.3.116.47:41280 -> 10.3.116.47:10010 -> method Method:

◊ ◊◊ 9.360497 Frame 61 10.3.116.47:41280 <- 10.3.116.47:10010 <- method Method:

◊ ◊◊ 9.360547 Frame 62 10.3.116.47:41280 <- 10.3.116.47:10010 <- init AMQP (0): (1.0.0)

◊ ◊◊ 9.362407 Frame 64 10.3.116.47:41280 -> 10.3.116.47:10010 -> init AMQP (0): (1.0.0)

◊ ◊◊ 9.370061 Frame 65 10.3.116.47:41280 -> 10.3.116.47:10010 -> open [0]

◊ ◊◊ 9.371182 Frame 67 10.3.116.47:41280 <- 10.3.116.47:10010 <- open [0]

◊ ◊◊ 9.375729 Frame 68 10.3.116.47:41280 -> 10.3.116.47:10010 -> begin [0,null]

◊ ◊◊ 9.376658 Frame 69 10.3.116.47:41280 <- 10.3.116.47:10010 <- begin [0,0]

◊ ◊◊ 9.480880 Frame 71 10.3.116.47:41280 -> 10.3.116.47:10010 -> begin [1,null]

◊ ◊◊ 9.481726 Frame 72 10.3.116.47:41280 <- 10.3.116.47:10010 <- begin [1,1]

◊ ◊◊ 9.488284 Frame 74 10.3.116.47:41280 -> 10.3.116.47:10010 -> attach [1,0] sender link_0 (source: null, target: null)

◊ ◊◊ 9.489358 Frame 75 10.3.116.47:41280 <- 10.3.116.47:10010 <- attach [1,0] receiver link_0 (source: null, target: null), flow [1,0] (0,1000)

◊ attach [1,0] receiver link_0 (source: null, target: null)

◊ flow [1,0] (0,1000)

◊ ◊◊ 9.497250 Frame 76 10.3.116.47:41280 -> 10.3.116.47:10010 -> transfer [1,0] (0)

◊ ◊◊ 9.498357 Frame 77 10.3.116.47:41280 <- 10.3.116.47:10010 <- disposition [1] (receiver 0-0)

◊ ◊◊ 9.504585 Frame 78 10.3.116.47:41280 -> 10.3.116.47:10010 -> attach [1,1] sender link_1 (source: endpoint_1, target: abc.LB.1.testQueue)

◊ ◊◊ 9.517593 Frame 79 10.3.116.47:41280 <- 10.3.116.47:10010 <- attach [1,1] receiver link_1 (source: endpoint_1, target: abc.LB.1.testQueue), flow [1,1] (0,1000)

◊ attach [1,1] receiver link_1 (source: endpoint_1, target: abc.LB.1.testQueue)

◊ flow [1,1] (0,1000)

◊ ◊◊ 9.527289 Frame 80 10.3.116.47:41280 -> 10.3.116.47:10010 -> attach [1,2] receiver link_2 (source: abc.LB.1.testQueue, target: null)

◊ ◊◊ 9.529215 Frame 81 10.3.116.47:41280 <- 10.3.116.47:10010 <- attach [1,2] sender link_2 (source: abc.LB.1.testQueue, target: null)

◊ ◊◊ 9.531546 Frame 82 10.3.116.47:41280 -> 10.3.116.47:10010 -> flow [1,2] (0,1000)

◊ ◊◊ 9.548615 Frame 83 10.3.116.47:41280 -> 10.3.116.47:10010 -> transfer [1,1] (1)

◊ ◊◊ 9.549285 Frame 85 10.3.116.47:41280 -> 10.3.116.47:10010 -> transfer [1,1] (2)

◊ ◊◊ 9.549646 Frame 86 10.3.116.47:41280 <- 10.3.116.47:10010 <- disposition [1] (receiver 1-1)

◊ ◊◊ 9.550203 Frame 87 10.3.116.47:41280 <- 10.3.116.47:10010 <- disposition [1] (receiver 2-2)

◊ ◊◊ 10.317092 Frame 89 10.3.116.47:41238 <- 10.3.116.47:10010 <- ??? Undecoded frame

◊ ◊◊ 14.317319 Frame 99 10.3.116.47:41238 <- 10.3.116.47:10010 <- ??? Undecoded frame

◊ ◊◊ 14.551106 Frame 101 10.3.116.47:41280 -> 10.3.116.47:10010 -> flow [1,2] (0,1000)

◊ ◊◊ 14.551735 Frame 102 10.3.116.47:41280 <- 10.3.116.47:10010 <- flow [1,2] (1000,0)

◊ ◊◊ 14.552396 Frame 103 10.3.116.47:41280 -> 10.3.116.47:10010 -> flow [1,2] (1000,1000)

◊ ◊◊ 14.555357 Frame 104 10.3.116.47:41280 -> 10.3.116.47:10010 -> transfer [1,0] (3..4)

◊ ◊◊ 14.560475 Frame 106 10.3.116.47:41280 <- 10.3.116.47:10010 <- disposition [1] (receiver 3-3)

◊ ◊◊ 14.560570 Frame 107 10.3.116.47:41280 <- 10.3.116.47:10010 <- disposition [1] (receiver 4-4)

◊ ◊◊ 14.560968 Frame 109 10.3.116.47:41280 <- 10.3.116.47:10010 <- transfer [1,2] (0)

◊ ◊◊ 14.561197 Frame 110 10.3.116.47:41280 <- 10.3.116.47:10010 <- transfer [1,2] (1)

◊ ◊◊ 14.565229 Frame 112 10.3.116.47:41280 -> 10.3.116.47:10010 -> disposition [1] (receiver 0-0)

◊ ◊◊ 14.566051 Frame 113 10.3.116.47:41280 -> 10.3.116.47:10010 -> flow [1,2] (1002,998)

◊ ◊◊ 14.566888 Frame 115 10.3.116.47:41280 <- 10.3.116.47:10010 <- flow [1,2] (2000,0)

◊ ◊◊ 14.568259 Frame 116 10.3.116.47:41280 -> 10.3.116.47:10010 -> transfer [1,0] (5..6)

◊ ◊◊ 14.572013 Frame 117 10.3.116.47:41280 <- 10.3.116.47:10010 <- disposition [1] (receiver 5-5)

◊ ◊◊ 14.572091 Frame 118 10.3.116.47:41280 <- 10.3.116.47:10010 <- disposition [1] (receiver 6-6)

◊ ◊◊ 14.572769 Frame 120 10.3.116.47:41280 -> 10.3.116.47:10010 -> disposition [1] (receiver 1-1)

◊ ◊◊ 14.572935 Frame 121 10.3.116.47:41280 -> 10.3.116.47:10010 -> flow [1,2] (2000,1000)

◊ ◊◊ 14.573527 Frame 123 10.3.116.47:41280 <- 10.3.116.47:10010 <- transfer [1,2] (2)

◊ ◊◊ 14.574319 Frame 124 10.3.116.47:41280 -> 10.3.116.47:10010 -> disposition [1] (receiver 2-2)

◊ ◊◊ 14.580994 Frame 125 10.3.116.47:41280 <- 10.3.116.47:10010 <- transfer [1,2] (3)

◊ ◊◊ 14.582697 Frame 126 10.3.116.47:41280 -> 10.3.116.47:10010 -> disposition [1] (receiver 3-3)

◊ ◊◊ 16.302457 Frame 131 10.3.116.47:41238 -> 10.3.116.47:10010 -> ??? Undecoded frame

◊ ◊◊ 18.317559 Frame 142 10.3.116.47:41238 <- 10.3.116.47:10010 <- ??? Undecoded frame

◊ ◊◊ 19.582974 Frame 151 10.3.116.47:41280 -> 10.3.116.47:10010 -> flow [1,2] (2002,998)

◊ ◊◊ 19.583526 Frame 153 10.3.116.47:41280 <- 10.3.116.47:10010 <- flow [1,2] (3000,0)

◊ ◊◊ 19.585890 Frame 154 10.3.116.47:41280 -> 10.3.116.47:10010 -> flow [1,2] (3000,1000)

◊ ◊◊ 19.586187 Frame 155 10.3.116.47:41280 -> 10.3.116.47:10010 -> transfer [1,0] (7..8)

◊ ◊◊ 19.591029 Frame 157 10.3.116.47:41280 <- 10.3.116.47:10010 <- disposition [1] (receiver 7-7)

◊ ◊◊ 19.591098 Frame 158 10.3.116.47:41280 <- 10.3.116.47:10010 <- disposition [1] (receiver 8-8)

◊ ◊◊ 22.317791 Frame 168 10.3.116.47:41238 <- 10.3.116.47:10010 <- ??? Undecoded frame

◊ ◊◊ 24.592062 Frame 177 10.3.116.47:41280 -> 10.3.116.47:10010 -> flow [1,2] (3000,1000)

◊ ◊◊ 24.592603 Frame 178 10.3.116.47:41280 <- 10.3.116.47:10010 <- flow [1,2] (4000,0)

◊ ◊◊ 24.593280 Frame 179 10.3.116.47:41280 -> 10.3.116.47:10010 -> flow [1,2] (4000,1000)

◊ ◊◊ 24.593992 Frame 180 10.3.116.47:41280 -> 10.3.116.47:10010 -> transfer [1,0] (9)

◊ ◊◊ 24.594417 Frame 182 10.3.116.47:41280 <- 10.3.116.47:10010 <- disposition [1] (receiver 9-9)

◊ ◊◊ 24.602533 Frame 183 10.3.116.47:41280 -> 10.3.116.47:10010 -> close [0]

◊ ◊◊ 24.610681 Frame 184 10.3.116.47:41280 <- 10.3.116.47:10010 <- close [0]

◊ ◊◊ 26.318085 Frame 199 10.3.116.47:41238 <- 10.3.116.47:10010 <- ??? Undecoded frame

◊ ◊◊ 30.318274 Frame 228 10.3.116.47:41238 <- 10.3.116.47:10010 <- ??? Undecoded frame

Post-run Analysis Statistics

*Analysis Statistics*
Count	Description
0	Wireshark TCP Expert Info
0	AMQP In-Band Detach/End/Close Errors
4	AMQP Disposition state Accepted
0	AMQP Disposition state Rejected
1	AMQP Disposition state Released
0	AMQP Disposition state Modified
9	AMQP Disposition state Not Specified
0	Link Events
0	Malformed AMQP frames

link Name Index

link_0 - qpid-jms:coordinator:ID:bd433128-9eaf-474e-a0e0-fa4db7ff876a:1:1
link_1 - qpid-jms:sender:ID:bd433128-9eaf-474e-a0e0-fa4db7ff876a:1:1:1:abc.LB.1.testQueue
link_2 - qpid-jms:receiver:ID:bd433128-9eaf-474e-a0e0-fa4db7ff876a:1:1:1:abc.LB.1.testQueue

endpoint Name Index

endpoint_0 - null
endpoint_1 - ID:bd433128-9eaf-474e-a0e0-fa4db7ff876a:1:1:1
endpoint_2 - abc.LB.1.testQueue

message_data Name Index

message_data_0 - This is a text message1
message_data_1 - This is a text message2

Decode Legend

The decode web page default view shows information about the capture, a view of all the connections with the number frames associated with that connection, and a summary of every AMQP frame. The summary includes:

The capture file frame number. Note that not all frames from the capture file are AMQP frames and that there are normally gaps in the frame number sequence.
The TCP/IP source and destination addresses of the hosts with an arrow indicating the direction of the frame. The frames from the broker to the client have the direction arrow highlighted with a light gray background.
The AMQP 'server' port (either 5672, or one of the decode-as ports) is always on the right
The frame timestamp in seconds relative to the beginning of the capture
The AMQP 1.0 performative(s) and important details:
- open [0] always channel 0
- close [0] always channel 0
- begin [channel,remoteChannel]
- end [channel]
- attach [channel,handle] role name (source: src, target: tgt)
- detach [channel, handle]
- flow [channel,handle](deliveryCount, linkCredit)
- transfer [channel,handle] (id)|(id..id)
- disposition [channel] (role first-last)
AMQP version-independent init details
AMQP 0.x method(s)
Names of links, sources, and targets longer than 25 characters are shortened to the form "name_XX". Generated temporary names may exceed 150 characters and contribute little to understanding the protocol. You can hover over the shortened names in the displayed frames to see the full text in a popup and you may refer to a table of shortened names that appears after the AMQP Frames display to see all the translated names.

Protocol frame expansion

The single lozenge expands to show each performative on a separate line
The double lozenge expands each performative in the frame to expose the full details of the decoded Wireshark trace.

Notes

Close, End, or Detach performatives that indicate errors are highlighted in yellow.
Note that the [channel,handle] fields are highlighted with background colors to make protocol exchanges easier to see.
Wireshark generally displays hex data for AMQP message payloads. Adverb attempts to show transfer frame AMQP-value fields in readable ascii.

Notes on searching

You may use your browser's Ctrl-F search feature to search for text on the screen. However, this search does not find any of the hidden text. You may use the Expand-all page view Page control to expand all the details in every frame. Then use the Ctrl-F to search for text anywhere in the details of each frame.