kelvosd/Packet.json at main · kelvos-linux/kelvosd · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
{
  "timestamp": "2026-07-30T15:30:10.123456Z",
  "interface": "eth0",
  "direction": "ingress",
  "packet_length": 1514,
  "capture_length": 1514,

  "ethernet": {
    "destination_mac": "AA:BB:CC:DD:EE:FF",
    "source_mac": "11:22:33:44:55:66",
    "ethertype": "0x0800",
    "vlan": {
      "enabled": false,
      "id": null,
      "priority": null
    }
  },

  "network": {
    "protocol": "IPv4",
    "version": 4,
    "header_length": 20,
    "total_length": 1500,
    "identification": 12345,
    "flags": {
      "df": true,
      "mf": false
    },
    "fragment_offset": 0,
    "ttl": 64,
    "protocol_number": 6,
    "checksum": "0x9f4c",
    "source_ip": "192.168.1.10",
    "destination_ip": "142.250.190.78"
  },

  "transport": {
    "protocol": "TCP",
    "source_port": 51432,
    "destination_port": 443,
    "sequence_number": 325234523,
    "acknowledgement_number": 94823423,
    "header_length": 32,
    "flags": {
      "syn": false,
      "ack": true,
      "fin": false,
      "rst": false,
      "psh": true,
      "urg": false,
      "ece": false,
      "cwr": false
    },
    "window_size": 64240,
    "checksum": "0x2345",
    "urgent_pointer": 0,
    "options": [
      {
        "kind": "Timestamp",
        "value": {
          "tsval": 123456789,
          "tsecr": 987654321
        }
      }
    ]
  },

  "services": {
    "protocol": "https"
  },

  "payload": {
    "length": 1428,
    "encoding": "hex",
    "data": "16030102ab0100..."
  },

  "flow": {
    "flow_id": "b51f9c7d",
    "stream_id": 1,
    "session_id": "session-001"
  },

  "metadata": {
    "capture_method": "AF_PACKET",
    "kernel_timestamp": true,
    "rss_queue": 2,
    "cpu": 3,
    "process": null,
    "user": null
  }
}