A network event.

JSON representation

JSON representation
{ "sent_bytes": string, "received_bytes": string, "sent_packets": string, "received_packets": string, "session_duration": string, "session_id": string, "parent_session_id": string, "application_protocol_version": string, "community_id": string, "direction": enum (`Direction`), "ip_protocol": enum (`IpProtocol`), "application_protocol": enum (`ApplicationProtocol`), "ftp": { object (`Ftp`) }, "email": { object (`Email`) }, "dns": { object (`Dns`) }, "dhcp": { object (`Dhcp`) }, "http": { object (`Http`) }, "tls": { object (`Tls`) }, "smtp": { object (`Smtp`) }, "asn": string, "dns_domain": string, "carrier_name": string, "organization_name": string, "ip_subnet_range": string }

{
  "sent_bytes": string,
  "received_bytes": string,
  "sent_packets": string,
  "received_packets": string,
  "session_duration": string,
  "session_id": string,
  "parent_session_id": string,
  "application_protocol_version": string,
  "community_id": string,
  "direction": enum (Direction),
  "ip_protocol": enum (IpProtocol),
  "application_protocol": enum (ApplicationProtocol),
  "ftp": {
    object (Ftp)
  },
  "email": {
    object (Email)
  },
  "dns": {
    object (Dns)
  },
  "dhcp": {
    object (Dhcp)
  },
  "http": {
    object (Http)
  },
  "tls": {
    object (Tls)
  },
  "smtp": {
    object (Smtp)
  },
  "asn": string,
  "dns_domain": string,
  "carrier_name": string,
  "organization_name": string,
  "ip_subnet_range": string
}

Fields
`sent_bytes`	`string` The number of bytes sent.
`received_bytes`	`string` The number of bytes received.
`sent_packets`	`string (int64 format)` The number of packets sent.
`received_packets`	`string (int64 format)` The number of packets received.
`session_duration`	`string (Duration format)` The duration of the session as the number of seconds and nanoseconds. For seconds, network.session_duration.seconds, the type is a 64-bit integer. For nanoseconds, network.session_duration.nanos, the type is a 32-bit integer. A duration in seconds with up to nine fractional digits, ending with '`s`'. Example: `"3.5s"`.
`session_id`	`string` The ID of the network session.
`parent_session_id`	`string` The ID of the parent network session.
`application_protocol_version`	`string` The version of the application protocol. e.g. "1.1, 2.0"
`community_id`	`string` Community ID network flow value.
`direction`	`enum (Direction)` The direction of network traffic.
`ip_protocol`	`enum (IpProtocol)` The IP protocol.
`application_protocol`	`enum (ApplicationProtocol)` The application protocol.
`ftp`	`object (Ftp)` FTP info.
`email`	`object (Email)` Email info for the sender/recipient.
`dns`	`object (Dns)` DNS info.
`dhcp`	`object (Dhcp)` DHCP info.
`http`	`object (Http)` HTTP info.
`tls`	`object (Tls)` TLS info.
`smtp`	`object (Smtp)` SMTP info. Store fields specific to SMTP not covered by Email.
`asn`	`string` Autonomous system number.
`dns_domain`	`string` DNS domain name.
`carrier_name`	`string` Carrier identification.
`organization_name`	`string` Organization name (e.g Google).
`ip_subnet_range`	`string` Associated human-readable IP subnet range (e.g. 10.1.2.0/24).

Direction

A network traffic direction.

Enums
`UNKNOWN_DIRECTION`	The default direction.
`INBOUND`	An inbound request.
`OUTBOUND`	An outbound request.
`BROADCAST`	A broadcast.

IpProtocol

An IP protocol.

Enums
`UNKNOWN_IP_PROTOCOL`	The default protocol.
`ICMP`	ICMP.
`IGMP`	IGMP
`TCP`	TCP.
`UDP`	UDP.
`IP6IN4`	IPv6 Encapsulation
`GRE`	Generic Routing Encapsulation
`ESP`	Encapsulating Security Payload
`ICMP6`	ICMPv6
`EIGRP`	Enhanced Interior Gateway Routing
`ETHERIP`	Ethernet-within-IP Encapsulation
`PIM`	Protocol Independent Multicast
`VRRP`	Virtual Router Redundancy Protocol
`SCTP`	Stream Control Transmission Protocol

ApplicationProtocol

A network application protocol.

Enums
`UNKNOWN_APPLICATION_PROTOCOL`	The default application protocol.
`AFP`	Apple Filing Protocol.
`APPC`	Advanced Program-to-Program Communication.
`AMQP`	Advanced Message Queuing Protocol.
`ATOM`	Publishing Protocol.
`BEEP`	Block Extensible Exchange Protocol.
`BITCOIN`	Crypto currency protocol.
`BIT_TORRENT`	Peer-to-peer file sharing.
`CFDP`	Coherent File Distribution Protocol.
`CIP`	Common Industrial Protocol.
`COAP`	Constrained Application Protocol.
`COTP`	Connection Oriented Transport Protocol.
`DCERPC`	DCE/RPC.
`DDS`	Data Distribution Service.
`DEVICE_NET`	Automation industry protocol.
`DHCP`	DHCP.
`DICOM`	Digital Imaging and Communications in Medicine Protocol.
`DNP3`	Distributed Network Protocol 3 (DNP3)
`DNS`	DNS.
`E_DONKEY`	Classic file sharing protocol.
`ENRP`	Endpoint Handlespace Redundancy Protocol.
`FAST_TRACK`	Filesharing peer-to-peer protocol.
`FINGER`	User Information Protocol.
`FREENET`	Censorship resistant peer-to-peer network.
`FTAM`	File Transfer Access and Management.
`GOOSE`	GOOSE Protocol.
`GOPHER`	Gopher protocol.
`GRPC`	gRPC Remote Procedure Call.
`HL7`	Health Level Seven.
`H323`	Packet-based multimedia communications system.
`HTTP`	HTTP.
`HTTPS`	HTTPS.
`IEC104`	IEC 60870-5-104 (IEC 104) Protocol.
`IRCP`	Internet Relay Chat Protocol.
`KADEMLIA`	Peer-to-peer hashtables.
`KRB5`	Kerberos 5.
`LDAP`	Lightweight Directory Access Protocol.
`LPD`	Line Printer Daemon Protocol.
`MIME`	Multipurpose Internet Mail Extensions and Secure MIME.
`MMS`	Multimedia Messaging Service.
`MODBUS`	Serial communications protocol.
`MQTT`	Message Queuing Telemetry Transport.
`NETCONF`	Network Configuration.
`NFS`	Network File System.
`NIS`	Network Information Service.
`NNTP`	Network News Transfer Protocol.
`NTCIP`	National Transportation Communications for Intelligent Transportation System.
`NTP`	Network Time Protocol.
`OSCAR`	AOL Instant Messenger Protocol.
`PNRP`	Peer Name Resolution Protocol.
`PTP`	Precision Time Protocol.
`QUIC`	QUIC.
`RDP`	Remote Desktop Protocol.
`RELP`	Reliable Event Logging Protocol.
`RIP`	Routing Information Protocol.
`RLOGIN`	Remote Login in UNIX Systems.
`RPC`	Remote Procedure Call.
`RTMP`	Real Time Messaging Protocol.
`RTP`	Real-time Transport Protocol.
`RTPS`	Real Time Publish Subscribe.
`RTSP`	Real Time Streaming Protocol.
`SAP`	Session Announcement Protocol.
`SDP`	Session Description Protocol.
`SIP`	Session Initiation Protocol.
`SLP`	Service Location Protocol.
`SMB`	Server Message Block.
`SMTP`	Simple Mail Transfer Protocol.
`SNMP`	Simple Network Management Protocol.
`SNTP`	Simple Network Time Protocol.
`SSH`	Secure Shell.
`SSMS`	Secure SMS Messaging Protocol.
`STYX`	Styx/9P - Plan 9 from Bell Labs distributed file system protocol.
`SV`	Sampled Values Protocol.
`TCAP`	Transaction Capabilities Application Part.
`TDS`	Tabular Data Stream.
`TOR`	Anonymity network.
`TSP`	Time Stamp Protocol.
`VTP`	Virtual Terminal Protocol.
`WHOIS`	Remote Directory Access Protocol.
`WEB_DAV`	Web Distributed Authoring and Versioning.
`X400`	Message Handling Service Protocol.
`X500`	Directory Access Protocol (DAP).
`XMPP`	Extensible Messaging and Presence Protocol.

Ftp

FTP info.

JSON representation
{ "command": string }

Fields

Fields
`command`	`string` The FTP command.

command

string

The FTP command.

Email

Email info.

JSON representation
{ "from": string, "reply_to": string, "to": [ string ], "cc": [ string ], "bcc": [ string ], "mail_id": string, "subject": [ string ], "bounce_address": string }

Fields
`from`	`string` The 'from' address.
`reply_to`	`string` The 'reply to' address.
`to[]`	`string` A list of 'to' addresses.
`cc[]`	`string` A list of 'cc' addresses.
`bcc[]`	`string` A list of 'bcc' addresses.
`mail_id`	`string` The mail (or message) ID.
`subject[]`	`string` The subject line(s) of the email.
`bounce_address`	`string` The envelope from address. https://en.wikipedia.org/wiki/Bounce_address

Dns

DNS information.

JSON representation

JSON representation
{ "id": integer, "response": boolean, "opcode": integer, "authoritative": boolean, "truncated": boolean, "recursion_desired": boolean, "recursion_available": boolean, "response_code": integer, "questions": [ { object (`Question`) } ], "answers": [ { object (`ResourceRecord`) } ], "authority": [ { object (`ResourceRecord`) } ], "additional": [ { object (`ResourceRecord`) } ] }

{
  "id": integer,
  "response": boolean,
  "opcode": integer,
  "authoritative": boolean,
  "truncated": boolean,
  "recursion_desired": boolean,
  "recursion_available": boolean,
  "response_code": integer,
  "questions": [
    {
      object (Question)
    }
  ],
  "answers": [
    {
      object (ResourceRecord)
    }
  ],
  "authority": [
    {
      object (ResourceRecord)
    }
  ],
  "additional": [
    {
      object (ResourceRecord)
    }
  ]
}

Fields
`id`	`integer (uint32 format)` DNS query id.
`response`	`boolean` Set to true if the event is a DNS response. See QR field from RFC1035.
`opcode`	`integer (uint32 format)` The DNS OpCode used to specify the type of DNS query (for example, QUERY, IQUERY, or STATUS).
`authoritative`	`boolean` Other DNS header flags. See RFC1035, section 4.1.1.
`truncated`	`boolean` Whether the DNS response was truncated.
`recursion_desired`	`boolean` Whether a recursive DNS lookup is desired.
`recursion_available`	`boolean` Whether a recursive DNS lookup is available.
`response_code`	`integer (uint32 format)` Response code. See RCODE from RFC1035.
`questions[]`	`object (Question)` A list of domain protocol message questions.
`answers[]`	`object (ResourceRecord)` A list of answers to the domain name query.
`authority[]`	`object (ResourceRecord)` A list of domain name servers which verified the answers to the domain name queries.
`additional[]`	`object (ResourceRecord)` A list of additional domain name servers that can be used to verify the answer to the domain.

Question

DNS Questions. See RFC1035, section 4.1.2.

JSON representation
{ "name": string, "type": integer, "class": integer, "prevalence": { object (`Prevalence`) } }

Fields
`name`	`string` The domain name.
`type`	`integer (uint32 format)` The code specifying the type of the query.
`class`	`integer (uint32 format)` The code specifying the class of the query.
`prevalence`	`object (Prevalence)` The prevalence of the domain within the customer's environment.

ResourceRecord

DNS Resource Records. See RFC1035, section 4.1.3.

JSON representation
{ "name": string, "type": integer, "class": integer, "ttl": integer, "data": string, "binary_data": string }

Fields
`name`	`string` The name of the owner of the resource record.
`type`	`integer (uint32 format)` The code specifying the type of the resource record.
`class`	`integer (uint32 format)` The code specifying the class of the resource record.
`ttl`	`integer (uint32 format)` The time interval for which the resource record can be cached before the source of the information should again be queried.
`data`	`string` The payload or response to the DNS question for all responses encoded in UTF-8 format
`binary_data`	`string (bytes format)` The raw bytes of any non-UTF8 strings that might be included as part of a DNS response. A base64-encoded string.

Dhcp

DHCP information.

JSON representation

JSON representation
{ "opcode": enum (`OpCode`), "htype": integer, "hlen": integer, "hops": integer, "transaction_id": integer, "seconds": integer, "flags": integer, "ciaddr": string, "yiaddr": string, "siaddr": string, "giaddr": string, "chaddr": string, "sname": string, "file": string, "options": [ { object (`Option`) } ], "type": enum (`MessageType`), "lease_time_seconds": integer, "client_hostname": string, "client_identifier": string, "requested_address": string }

{
  "opcode": enum (OpCode),
  "htype": integer,
  "hlen": integer,
  "hops": integer,
  "transaction_id": integer,
  "seconds": integer,
  "flags": integer,
  "ciaddr": string,
  "yiaddr": string,
  "siaddr": string,
  "giaddr": string,
  "chaddr": string,
  "sname": string,
  "file": string,
  "options": [
    {
      object (Option)
    }
  ],
  "type": enum (MessageType),
  "lease_time_seconds": integer,
  "client_hostname": string,
  "client_identifier": string,
  "requested_address": string
}

Fields
`opcode`	`enum (OpCode)` The BOOTP op code.
`htype`	`integer (uint32 format)` Hardware address type.
`hlen`	`integer (uint32 format)` Hardware address length.
`hops`	`integer (uint32 format)` Hardware ops.
`transaction_id`	`integer (uint32 format)` Transaction ID.
`seconds`	`integer (uint32 format)` Seconds elapsed since client began address acquisition/renewal process.
`flags`	`integer (uint32 format)` Flags.
`ciaddr`	`string` Client IP address (ciaddr).
`yiaddr`	`string` Your IP address (yiaddr).
`siaddr`	`string` IP address of the next bootstrap server.
`giaddr`	`string` Relay agent IP address (giaddr).
`chaddr`	`string` Client hardware address (chaddr).
`sname`	`string` Server name that the client wishes to boot from.
`file`	`string` Boot image filename.
`options[]`	`object (Option)` List of DHCP options.
`type`	`enum (MessageType)` DHCP message type.
`lease_time_seconds`	`integer (uint32 format)` Lease time in seconds. See RFC2132, section 9.2.
`client_hostname`	`string` Client hostname. See RFC2132, section 3.14.
`client_identifier`	`string (bytes format)` Client identifier. See RFC2132, section 9.14. A base64-encoded string.
`requested_address`	`string` Requested IP address. See RFC2132, section 9.1.

OpCode

BOOTP op code. See RFC951, section 3.

Enums
`UNKNOWN_OPCODE`	Default opcode.
`BOOTREQUEST`	Request.
`BOOTREPLY`	Reply.

Option

DHCP options.

JSON representation
{ "code": integer, "data": string }

Fields

Fields
`code`	`integer (uint32 format)` Code. See RFC1533.
`data`	`string (bytes format)` Data. A base64-encoded string.

code

integer (uint32 format)

Code. See RFC1533.

data

string (bytes format)

Data.

A base64-encoded string.

MessageType

DHCP message type. See RFC2131, section 3.1.

Enums
`UNKNOWN_MESSAGE_TYPE`	Default message type.
`DISCOVER`	DHCPDISCOVER.
`OFFER`	DHCPOFFER.
`REQUEST`	DHCPREQUEST.
`DECLINE`	DHCPDECLINE.
`ACK`	DHCPACK.
`NAK`	DHCPNAK.
`RELEASE`	DHCPRELEASE.
`INFORM`	DHCPINFORM.
`WIN_DELETED`	Microsoft Windows DHCP "lease deleted".
`WIN_EXPIRED`	Microsoft Windows DHCP "lease expired".

Http

Specify the full URL of the HTTP request within "target". Also specify any uploaded or downloaded file information within "source" or "target".

JSON representation
{ "method": string, "referral_url": string, "user_agent": string, "response_code": integer, "parsed_user_agent": { object (`UserAgentProto`) } }

Fields
`method`	`string` The HTTP request method (e.g. "GET", "POST", "PATCH", "DELETE").
`referral_url`	`string` The URL for the HTTP referer.
`user_agent`	`string` The User-Agent request header which includes the application type, operating system, software vendor or software version of the requesting software user agent.
`response_code`	`integer` The response status code, for example 200, 302, 404, or 500.
`parsed_user_agent`	`object (UserAgentProto)` The parsed user_agent string.

UserAgentProto

JSON representation

JSON representation
{ "family": enum (`Family`), "sub_family": string, "platform": string, "device": string, "device_version": string, "carrier": string, "security": string, "locale": string, "os": string, "os_variant": string, "browser": string, "browser_version": string, "browser_engine_version": string, "google_toolbar_version": string, "java_profile": string, "java_profile_version": string, "java_configuration": string, "java_configuration_version": string, "messaging": string, "messaging_version": string, "annotation": [ { object (`Annotation`) } ] }

{
  "family": enum (Family),
  "sub_family": string,
  "platform": string,
  "device": string,
  "device_version": string,
  "carrier": string,
  "security": string,
  "locale": string,
  "os": string,
  "os_variant": string,
  "browser": string,
  "browser_version": string,
  "browser_engine_version": string,
  "google_toolbar_version": string,
  "java_profile": string,
  "java_profile_version": string,
  "java_configuration": string,
  "java_configuration_version": string,
  "messaging": string,
  "messaging_version": string,
  "annotation": [
    {
      object (Annotation)
    }
  ]
}

Fields
`family`	`enum (Family)` User agent family captures the type of browser/app at a high-level e.g. MSIE, Gecko, Safari etc..
`sub_family`	`string` Sub-family identifies individual regexps when a family has more than 1. This is used to generate the right UA string from a protobuf. Examples in the AppleWebKit family: Chrome and Safari. Can also be an arbitrary identifier.
`platform`	`string` The platform describes the environment in which the browser or app runs. For desktop user agents, Platform is a string describing the OS family e.g. Windows, Macintosh, Linux. For mobile user agents, Platform either describes the OS family (if available) or the hardware maker. e.g. Linux, or HTC, LG, Palm.
`device`	`string` (Usually) Mobile specific: name of hardware device, may or may not contain the full model name. e.g. iPhone, Palm750, SPH-M800. Reduced to "K" for Android devices with reduced User-Agent and no client hints.
`device_version`	`string` (Usually) Mobile specific: version of hardware device Unavailable with reduced User-Agent and no client hints.
`carrier`	`string` Mobile specific: name of mobile carrier
`security`	`string` Security level reported by user agent, either U, I or N. Unavailable with reduced User-Agent and no client hints.
`locale`	`string` Locale in which the browser is running as country code and optionally language pair. Unavailable with reduced User-Agent and no client hints.
`os`	`string` Full name of the operating system e.g. "Darwin/9.7.0", "Android 1.5", "Windows 98" Version is reduced, and other data might also be missing, for reduced User-Agent and no client hints.
`os_variant`	`string` Extra qualifier for the OS e.g. "(i386)", "Build/CUPCAKE", "PalmSource/Palm-D061" Unavailable with reduced User-Agent and no client hints.
`browser`	`string` Product brand within the family: Firefox, Netscape, Camino etc.. Or Earth, Windows-Media-Player etc.. for non-browser user agents.
`browser_version`	`string` Minor and lower versions unavailable with reduced User-Agent and no client hints.
`browser_engine_version`	`string` Version of the rendering engine e.g. "8.01" for "Opera/8.01"
`google_toolbar_version`	`string` Version number of GoogleToolbar, if installed. Applies only to MSIE and Firefox at this time.
`java_profile`	`string` Mobile specific: e.g. Profile/MIDP-2.0
`java_profile_version`	`string`
`java_configuration`	`string` Mobile specific: e.g. Configuration/CLDC-1.1
`java_configuration_version`	`string`
`messaging`	`string` Mobile specific: e.g. MMP/2.0
`messaging_version`	`string`
`annotation[]`	`object (Annotation)`

Family

LINT.IfChange

Enums
`USER_DEFINED`	Used to represent new families supported by user-defined parsers
`MSIE`	Desktop user agent families
`GECKO`
`APPLEWEBKIT`	WebKit based browsers e.g. Safari
`OPERA`
`KHTML`	e.g. Konqueror
`OTHER`	Mobile and non-browser user agent families UA's w/o enough data to fit into a family
`APPLE`	Apple apps e.g. YouTube on iPhone
`BLACKBERRY`
`DOCOMO`
`GOOGLE`	Google Earth, Sketchup, UpdateChecker etc...
`OPENWAVE`	UP.Browser
`POLARIS`
`OBIGO`
`TELECA`
`MICROSOFT`	Windows Media Player, RSS platform etc...
`NOKIA`
`NETFRONT`
`SEMC`	Sony Ericsson Mobile Communications
`SMIT`
`KOREAN`	SKT, LGT
`CLIENT_HINTS`	Constructed from UA-CH instead of UserAgent string.

Annotation

Extra parameters that don't fit anywhere else, captured as key/value. For example "VendorID/42" in BlackBerry user agents.

The following keys are modified with reduced User-Agent and no client hints: * "Chrome" (see browser_version) * "ChromiumBrowser" (unavailable) * "ChromeWebview" (unavailable) * "OS_VERSION" (see os) * "Rest" (unavailable) * "misc" (see device)

JSON representation
{ "key": string, "value": string }

Fields
`key`	`string`
`value`	`string`

Tls

Transport Layer Security (TLS) information.

JSON representation

JSON representation
{ "client": { object (`Client`) }, "server": { object (`Server`) }, "cipher": string, "curve": string, "version": string, "version_protocol": string, "established": boolean, "next_protocol": string, "resumed": boolean }

{
  "client": {
    object (Client)
  },
  "server": {
    object (Server)
  },
  "cipher": string,
  "curve": string,
  "version": string,
  "version_protocol": string,
  "established": boolean,
  "next_protocol": string,
  "resumed": boolean
}

Fields
`client`	`object (Client)` Certificate information for the client certificate.
`server`	`object (Server)` Certificate information for the server certificate.
`cipher`	`string` Cipher used during the connection.
`curve`	`string` Elliptical curve used for a given cipher.
`version`	`string` TLS version.
`version_protocol`	`string` Protocol.
`established`	`boolean` Indicates whether the TLS negotiation was successful.
`next_protocol`	`string` Protocol to be used for tunnel.
`resumed`	`boolean` Indicates whether the TLS connection was resumed from a previous TLS negotiation.

Client

Transport Layer Security (TLS) information associated with the client (for example, Certificate or JA3 hash).

JSON representation
{ "certificate": { object (`Certificate`) }, "ja3": string, "server_name": string, "supported_ciphers": [ string ] }

Fields
`certificate`	`object (Certificate)` Client certificate.
`ja3`	`string` JA3 hash from the TLS ClientHello, as a hex-encoded string.
`server_name`	`string` Host name of the server, that the client is connecting to.
`supported_ciphers[]`	`string` Ciphers supported by the client during client hello.

Certificate

Certificate information

JSON representation
{ "version": string, "serial": string, "subject": string, "issuer": string, "md5": string, "sha1": string, "sha256": string, "not_before": string, "not_after": string }

Fields
`version`	`string` Certificate version.
`serial`	`string` Certificate serial number.
`subject`	`string` Subject of the certificate.
`issuer`	`string` Issuer of the certificate.
`md5`	`string` The MD5 hash of the certificate, as a hex-encoded string.
`sha1`	`string` The SHA1 hash of the certificate, as a hex-encoded string.
`sha256`	`string` The SHA256 hash of the certificate, as a hex-encoded string.
`not_before`	`string (Timestamp format)` Indicates when the certificate is first valid. Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted.Examples: `"2014-10-02T15:01:23Z"`, `"2014-10-02T15:01:23.045123456Z"` or `"2014-10-02T15:01:23+05:30"`.
`not_after`	`string (Timestamp format)` Indicates when the certificate is no longer valid. Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted.Examples: `"2014-10-02T15:01:23Z"`, `"2014-10-02T15:01:23.045123456Z"` or `"2014-10-02T15:01:23+05:30"`.

Server

Transport Layer Security (TLS) information associated with the server (for example, Certificate or JA3 hash).

JSON representation
{ "certificate": { object (`Certificate`) }, "ja3s": string }

Fields

Fields
`certificate`	`object (Certificate)` Server certificate.
`ja3s`	`string` JA3 hash from the TLS ServerHello, as a hex-encoded string.

certificate

object (Certificate)

Server certificate.

ja3s

string

JA3 hash from the TLS ServerHello, as a hex-encoded string.

Smtp

SMTP info. See RFC 2821.

JSON representation
{ "helo": string, "mail_from": string, "rcpt_to": [ string ], "server_response": [ string ], "message_path": string, "is_webmail": boolean, "is_tls": boolean }

Fields
`helo`	`string` The client's 'HELO'/'EHLO' string.
`mail_from`	`string` The client's 'MAIL FROM' string.
`rcpt_to[]`	`string` The client's 'RCPT TO' string(s).
`server_response[]`	`string` The server's response(s) to the client.
`message_path`	`string` The message's path (extracted from the headers).
`is_webmail`	`boolean` If the message was sent via a webmail client.
`is_tls`	`boolean` If the connection switched to TLS.

Network

Direction

IpProtocol

ApplicationProtocol

Ftp

Email

Dns

Question

ResourceRecord

Dhcp

OpCode

Option

MessageType

Http

UserAgentProto

Family

Annotation

Tls

Client

Certificate

Server

Smtp