/home/jdanek/NoCredentialsWithoutGuestLoginModule.pcap

Capture Filename: /home/jdanek/NoCredentialsWithoutGuestLoginModule.pcap
Generated from PDML on Thu Oct 18 17:21:43 2018
User ports decoded as AMQP (in addition to 5672): 32945 50298

Page controls

Link to analysis statistics.

View post-run analysis statistics

Show/Hide frames per connection

◊ 127.0.0.1:50298-127.0.0.1:32945- (nFrames=11)

AMQP frames

◊ ◊◊ 0.113713 Frame 4 127.0.0.1:50298 -> 127.0.0.1:32945 -> init SASL (3): (1.0.0)

◊ ◊◊ 0.205381 Frame 6 127.0.0.1:50298 <- 127.0.0.1:32945 <- init SASL (3): (1.0.0), method Method:

◊ ◊◊ 0.223594 Frame 8 127.0.0.1:50298 -> 127.0.0.1:32945 -> method Method:

◊ ◊◊ 0.227009 Frame 10 127.0.0.1:50298 <- 127.0.0.1:32945 <- method Method:

◊ ◊◊ 0.227115 Frame 11 127.0.0.1:50298 <- 127.0.0.1:32945 <- init AMQP (0): (1.0.0)

◊ ◊◊ 0.233142 Frame 13 127.0.0.1:50298 -> 127.0.0.1:32945 -> init AMQP (0): (1.0.0)

◊ ◊◊ 0.274729 Frame 15 127.0.0.1:50298 -> 127.0.0.1:32945 -> open [0]

◊ ◊◊ 0.277839 Frame 17 127.0.0.1:50298 <- 127.0.0.1:32945 <- open [0]

◊ ◊◊ 0.294913 Frame 18 127.0.0.1:50298 -> 127.0.0.1:32945 -> begin [0,null]

◊ ◊◊ 0.480050 Frame 20 127.0.0.1:50298 <- 127.0.0.1:32945 <- close [0]

◊ ◊◊ 0.484355 Frame 21 127.0.0.1:50298 -> 127.0.0.1:32945 -> close [0]

Post-run Analysis Statistics

*Analysis Statistics*
Count	Description
0	Wireshark TCP Expert Info
1	AMQP In-Band Detach/End/Close Errors
0	AMQP Disposition state Accepted
0	AMQP Disposition state Rejected
0	AMQP Disposition state Released
0	AMQP Disposition state Modified
0	AMQP Disposition state Not Specified
0	Link Events
0	Malformed AMQP frames

Decode Legend

The decode web page default view shows information about the capture, a view of all the connections with the number frames associated with that connection, and a summary of every AMQP frame. The summary includes:

The capture file frame number. Note that not all frames from the capture file are AMQP frames and that there are normally gaps in the frame number sequence.
The TCP/IP source and destination addresses of the hosts with an arrow indicating the direction of the frame. The frames from the broker to the client have the direction arrow highlighted with a light gray background.
The AMQP 'server' port (either 5672, or one of the decode-as ports) is always on the right
The frame timestamp in seconds relative to the beginning of the capture
The AMQP 1.0 performative(s) and important details:
- open [0] always channel 0
- close [0] always channel 0
- begin [channel,remoteChannel]
- end [channel]
- attach [channel,handle] role name (source: src, target: tgt)
- detach [channel, handle]
- flow [channel,handle](deliveryCount, linkCredit)
- transfer [channel,handle] (id)|(id..id)
- disposition [channel] (role first-last)
AMQP version-independent init details
AMQP 0.x method(s)
Names of links, sources, and targets longer than 25 characters are shortened to the form "name_XX". Generated temporary names may exceed 150 characters and contribute little to understanding the protocol. You can hover over the shortened names in the displayed frames to see the full text in a popup and you may refer to a table of shortened names that appears after the AMQP Frames display to see all the translated names.

Protocol frame expansion

The single lozenge expands to show each performative on a separate line
The double lozenge expands each performative in the frame to expose the full details of the decoded Wireshark trace.

Notes

Close, End, or Detach performatives that indicate errors are highlighted in yellow.
Note that the [channel,handle] fields are highlighted with background colors to make protocol exchanges easier to see.
Wireshark generally displays hex data for AMQP message payloads. Adverb attempts to show transfer frame AMQP-value fields in readable ascii.

Notes on searching

You may use your browser's Ctrl-F search feature to search for text on the screen. However, this search does not find any of the hidden text. You may use the Expand-all page view Page control to expand all the details in every frame. Then use the Ctrl-F to search for text anywhere in the details of each frame.

Indexed content

Frame, Time, Src, Dst, Channel, Handle, DeliveryId, DeliveryTag, Data