Version 4610
Version 4610 is identified by a value between "4610" and "4749" for the key fw in the result.
Changes between 4570 and 4610
- Additional key "resultset" in DNS
- for TCP traceroute, "flags" field in the result and "TCP" in "proto" (actually from fw >= 4600)
Version 4610 Ping / v6 Ping
View changes since previous version.
A measurement result is a JSON object with the following fields:
- "af" -- address family, 4 or 6 (integer)
- "avg" -- average round-trip time (float)
- "dst_addr" -- IP address of the destination (string)
- "dst_name" -- name of the destination (string)
- "dup" -- number of duplicate packets (int)
- "from" -- IP address of the probe as known by the controller (string)
- "lts" -- last time synchronised. How long ago (in seconds) the clock of the probe was found to be in sync with that of a controller. The value -1 is used to indicate that the probe does not know whether it is in sync (int)
- "max" -- maximum round-trip time (float)
- "min" -- minimum round-trip time (float)
- "msm_id" -- measurement identifier (int)
- "name" -- name of the destination (deprecated) (string)
- "prb_id" -- source probe ID (int)
- "proto" -- "ICMP" (string)
- "rcvd" -- number of packets received (int)
- "result" -- variable content, depending on type of response (array of objects)
objects have the following fields:- Case: Timeout
- "x" -- "*" (string)
- Case: Error
- "error" -- description of error (string)
- Case: Reply
- "rtt" -- round-trip-time in milliseconds (float)
- "src_Addr" -- [optional] source address if different from the source address in first reply (string)
- "ttl" -- [optional] time-to-live reply if different from ttl in first reply (int)
- "dup" -- [optional] signals that the reply is a duplicate (int)
- Case: Timeout
- "sent" -- number of packets sent (int)
- "size" -- packet size (data part, not including IP and ICMP header) (int)
- "src_addr" -- source address used by probe (missing due to a bug)(string)
- "timestamp" -- Unix timestamp (int)
- "ttl" -- time-to-live field in the first reply (missing due to a bug)(int)
- "type" -- "ping" (string)
Example result:
json
{
"af": 6,
"avg": 2.640333333333333,
"dst_addr": "2001:7fd::1",
"dst_name": "2001:7fd::1",
"dup": 0,
"from": "2001:67c:2e8:13:220:4aff:fec6:cc9d",
"fw": 4570,
"lts": 69,
"max": 2.6539999999999999,
"min": 2.625,
"msm_id": 2001,
"prb_id": 9,
"proto": "ICMP",
"rcvd": 3,
"result": [
{ "rtt": 2.6539999999999999 },
{ "rtt": 2.6419999999999999 },
{ "rtt": 2.625 }
],
"sent": 3,
"size": 12,
"step": 240,
"timestamp": 1386590507,
"type": "ping"
}Version 4610 Traceroute / v6 Traceroute
View changes since previous version.
A measurement result is a JSON object with the following fields:
- "af" -- address family, 4 or 6 (integer)
- "dst_addr" -- IP address of the destination (string)
- "dst_name" -- name of the destination (string)
- "endtime" -- Unix timestamp for end of measurement (int)
- "from" -- IP address of the probe as know by controller (string)
- "lts" -- last time synchronised. How long ago (in seconds) the clock of the probe was found to be in sync with that of a controller. The value -1 is used to indicate that the probe does not know whether it is in sync (from 4650) (int)
- "msm_id" -- measurement identifier (int)
- "paris_id" -- variation for the Paris mode of traceroute (int)
- "prb_id" -- source probe ID (int)
- "proto" -- "UDP", "ICMP", or "TCP" (string)
- "destination_ip_responded" -- whether the last hop matches the destination address (boolean)
- "result" -- list of hop elements (array of objects)
objects have the following fields:- "hop" -- hop number (int)
- "error" -- [optional] when an error occurs trying to send a packet. In that case there will not be a result structure. (string)
- "result" -- variable content, depending on type of response (array of objects)
objects have the following fields:- Case: Timeout
- "x" -- "*" (string)
- Case: Reply
- "err" -- (optional) error ICMP: "N" (network unreachable,), "H" (destination unreachable), "A" (administratively prohibited), "P" (protocol unreachable), "p" (port unreachable) "h" (beyond scope, from fw 4650) (string) Unrecognized error codes are represented as integers
- "from" -- IPv4 or IPv6 source address in reply (string)
- "ittl" -- (optional) time-to-live in packet that triggered the error ICMP. Omitted if equal to 1 (int)
- "edst" -- (optional) destination address in the packet that triggered the error ICMP if different from the target of the measurement (string)
- "late" -- (optional) number of packets a reply is late, in this case rtt is not present (int)
- "mtu" -- (optional) path MTU from a packet too big ICMP (int)
- "rtt" -- round-trip-time of reply, not present when the response is late (float)
- "size" -- size of reply (int)
- "ttl" -- time-to-live in reply (int)
- "flags" -- (optional) TCP flags in the reply packet, for TCP traceroute, concatenated, in the order 'F' (FIN), 'S' (SYN), 'R' (RST), 'P' (PSH), 'A' (ACK), 'U' (URG) (string)
- "dstoptsize" -- (optional) size of destination options header (IPv6) (int)
- "hbhoptsize" -- (optional) size of hop-by-hop options header (IPv6) (int)
- "icmpext" -- [optional] information when icmp header is found in reply (object with the following fields:)
- "version" -- RFC4884 version (int)
- "rfc4884" -- "1" if length indication is present, "0" otherwise (int)
- "obj" -- elements of the object (array of objects)
objects have the following fields:- "class" -- RFC4884 class (int)
- "type" -- RFC4884 type (int)
- "mpls" -- [optional] MPLS data, RFC4950, shown when class is "1" and type is "1" (array of objects)
objects have the following fields:- "exp" -- for experimental use (int)
- "label" -- mpls label (int)
- "s" -- bottom of stack (int)
- "ttl" -- time to live value (int)
- Case: Timeout
- "size" -- packet size (int)
- "src_addr" -- source address used by probe (string)
- "timestamp" -- Unix timestamp for start of measurement (int)
- "type" -- "traceroute" (string)
Example result:
json
{
"af": 6,
"dst_addr": "2001:7fd::1",
"dst_name": "2001:7fd::1",
"endtime": 1386596919,
"from": "2001:67c:2e8:13:220:4aff:fec6:cc9d",
"fw": 4570,
"msm_id": 6001,
"paris_id": 4,
"prb_id": 9,
"proto": "UDP",
"result": [
{
"hop": 1,
"result": [
{
"from": "2001:67c:2e8:13::2",
"rtt": 4.7960000000000003,
"size": 88,
"ttl": 64
},
{
"from": "2001:67c:2e8:13::2",
"rtt": 3.4380000000000002,
"size": 88,
"ttl": 64
},
{
"from": "2001:67c:2e8:13::2",
"rtt": 3.149,
"size": 88,
"ttl": 64
}
]
},
{
"hop": 2,
"result": [
{ "x": "*" },
{
"from": "2001:7f8:1::a502:5152:1",
"rtt": 3.1800000000000002,
"size": 88,
"ttl": 63
},
{
"from": "2001:7f8:1::a502:5152:1",
"rtt": 3.3849999999999998,
"size": 88,
"ttl": 63
}
]
},
{
"hop": 3,
"result": [
{
"from": "2001:7fd::1",
"rtt": 3.359,
"size": 88,
"ttl": 62
},
{ "x": "*" },
{ "x": "*" }
]
}
],
"size": 40,
"src_addr": "2001:67c:2e8:13:220:4aff:fec6:cc9d",
"timestamp": 1386596906,
"type": "traceroute"
}Version 4610 DNS Lookup
View changes since previous version.
A measurement result is a JSON object with the following fields:
- "af" -- [optional] IP version: "4" or "6" (int)
- "dst_addr" -- [optional] IP address of the destination (string)
- "dst_name" -- [optional] hostname of the destination (string)
- "error" -- [optional] error message (object with the following fields:)
- "timeout" -- query timeout (int)
- "getaddrinfo" -- error message (string)
- "from" -- [optional] IP address of the source (string)
- "lts" -- last time synchronised. How long ago (in seconds) the clock of the probe was found to be in sync with that of a controller. The value -1 is used to indicate that the probe does not know whether it is in sync (from 4650) (int)
- "msm_id" -- measurement identifier (int)
- "prb_id" -- source probe ID (int)
- "proto" -- "TCP" or "UDP" (string)
- "qbuf" -- [optional] query payload buffer which was sent to the server, UU encoded (string)
See example code for decoding the value - "result" -- [optional] response from the DNS server (object with the following fields:)
- "ANCOUNT" -- answer count, RFC 1035 4.1.1 (int)
- "ARCOUNT" -- additional record count, RFC 1035, 4.1.1 (int)
- "ID" -- query ID, RFC 1035 4.1.1 (int)
- "NSCOUNT" -- name server count (int)
- "QDCOUNT" -- number of queries (int)
- "abuf" -- answer payload buffer from the server, UU encoded (string)
See example code for decoding the value - "answers" -- first two records from the response decoded by the probe, if they are TXT or SOA; other RR can be decoded from "abuf" (array of objects)
objects have the following fields:- "MNAME" -- domain name, RFC 1035, 3.1.13 (string)
- "NAME" -- domain name. (string)
- "RDATA" -- [type TXT] txt value (from 4710, list of strings, before it was a single string)
- "RNAME" -- [if type SOA] mailbox, RFC 1035 3.3.13 (string)
- "SERIAL" -- [type SOA] zone serial number, RFC 1035 3.3.13 (int)
- "TTL" -- [type SOA] time to live, RFC 1035 4.1.3 (int)
- "TYPE" -- RR "SOA" or "TXT" (string), RFC 1035
- "rt" -- [optional] response time in milli seconds (float)
- "size" -- [optional] response size (int)
- "src_addr" -- [optional] the source IP address added by the probe (string).
- "subid" -- [optional] sequence number of this result within a group of results, available if the resolution is done by the probe's local resolver
- "submax" -- [optional] total number of results within a group (int)
- resultset - [optional] an array of objects containing all the fields of a DNS result object, except for the fields: fw, from, msm_id, prb_id, and type. Available for queries sent to each local resolver.
- "retry" -- [optional] retry count (int)
- "timestamp" -- start time, in Unix timestamp (int)
- "type" -- "dns" (string)
Notes:
- If a hostname was provided, both the hostname (dst_name) and the IP address (dst_addr) will be in the response.
- If an IP address was provided, the name field will not be filled, unless the address which was given differs from the probe's resolution of the address. For instance, if "2001:0DB8:0:0::1" was provided, and the probe resolves it to "2001:0DB8::1", the first value will be returned as the name and the second as the address.
- The dst_addr field will always be present, except when there is an error.
Example result:
json
{
"af": 6,
"dst_addr": "2001:7fd::1",
"from": "2001:67c:2e8:13:220:4aff:fec6:cd06",
"fw": 4460,
"msm_id": 11001,
"prb_id": 114,
"proto": "UDP",
"result": {
"ANCOUNT": 1,
"ARCOUNT": 13,
"ID": 14016,
"NSCOUNT": 13,
"QDCOUNT": 1,
"abuf": "NsCEAAABAAEADQANAAAGAAEAAAYAAQABUYAAQAFhDHJvb3Qtc2VydmVycwNuZXQABW5zdGxkDHZlcmlzaWduLWdycwNjb20Ad+2e2AAABwgAAAOEAAk6gAABUYAAAAIAAQAH6QAAAsAcAAACAAEAB+kAAAQBYsAeAAACAAEAB+kAAAQBY8AeAAACAAEAB+kAAAQBZMAeAAACAAEAB+kAAAQBZcAeAAACAAEAB+kAAAQBZsAeAAACAAEAB+kAAAQBZ8AeAAACAAEAB+kAAAQBaMAeAAACAAEAB+kAAAQBacAeAAACAAEAB+kAAAQBasAeAAACAAEAB+kAAAQBa8AeAAACAAEAB+kAAAQBbMAeAAACAAEAB+kAAAQBbcAewBwAAQABAAfpAAAExikABMB0AAEAAQAH6QAABMDkT8nAgwABAAEAB+kAAATAIQQMwJIAAQABAAfpAAAEgAgKWsChAAEAAQAH6QAABMDL5grAsAABAAEAB+kAAATABQXxwL8AAQABAAfpAAAEwHAkBMDOAAEAAQAH6QAABIA/AjXA3QABAAEAB+kAAATAJJQRwOwAAQABAAfpAAAEwDqAHsD7AAEAAQAH6QAABMEADoHBCgABAAEAB+kAAATHB1MqwRkAAQABAAfpAAAEygwbIQ==",
"answers": [
{
"MNAME": "a.root-servers.net.",
"NAME": ".",
"RDLENGTH": 64,
"RNAME": "nstld.verisign-grs.com.",
"SERIAL": 2012061400,
"TTL": 86400,
"TYPE": "SOA"
}
],
"rt": 3.4279999999999999,
"size": 493
},
"timestamp": 1339664565,
"type": "dns"
}Example with resultset:
json
{
"from": "193.0.10.135",
"fw": 4610,
"msm_id": 1004049,
"msm_name": "Tdig",
"prb_id": 9,
"resultset": [
{
"af": 4,
"dst_addr": "193.0.19.101",
"proto": "UDP",
"result": {
"ANCOUNT": 2,
"ARCOUNT": 1,
"ID": 31604,
"NSCOUNT": 0,
"QDCOUNT": 1,
"abuf": "e3SBoAABAAIAAAABA3d3dwRyaXBlA25ldAAAAQABwAwAAQABAAA9dwAEwQAGi8AMAC4AAQAAPXcAnAABBQMAAFRgUz7fqVMXRJlypgRyaXBlA25ldABjtIscm9iFKQJ7XqvACunZM/dSi/NGJ20WNaBXqxiP6/MgxyKs93dl5W6cqdUavqODdx9PK10iBt/aIpX/qo7UcY+hWPisOXRayrZl2HYsw4sK+4i5JoL7n2cjpsjuaC89IBKNR1Wl66clq7zrC+3YtGadruHkhwD7h8DJxI1kkQAAKRAAAACAAAAA",
"rt": 9.319,
"size": 225
},
"src_addr": "193.0.10.135",
"subid": 1,
"submax": 2,
"time": 1394064205
},
{
"af": 4,
"dst_addr": "193.0.19.102",
"proto": "UDP",
"result": {
"ANCOUNT": 2,
"ARCOUNT": 1,
"ID": 22376,
"NSCOUNT": 0,
"QDCOUNT": 1,
"abuf": "V2iBoAABAAIAAAABA3d3dwRyaXBlA25ldAAAAQABwAwAAQABAAA+2QAEwQAGi8AMAC4AAQAAPtkAnAABBQMAAFRgUz7fqVMXRJlypgRyaXBlA25ldABjtIscm9iFKQJ7XqvACunZM/dSi/NGJ20WNaBXqxiP6/MgxyKs93dl5W6cqdUavqODdx9PK10iBt/aIpX/qo7UcY+hWPisOXRayrZl2HYsw4sK+4i5JoL7n2cjpsjuaC89IBKNR1Wl66clq7zrC+3YtGadruHkhwD7h8DJxI1kkQAAKRAAAACAAAAA",
"rt": 10.111,
"size": 225
},
"src_addr": "193.0.10.135",
"subid": 2,
"submax": 2,
"time": 1394064206
}
],
"timestamp": 1394064205,
"type": "dns"
}Version 4610 HTTP
View changes since previous version.
A measurement result is a JSON object with the following fields:
- "from" -- IP address of the probe as known by controller (string)
- "lts" -- last time synchronised. How long ago (in seconds) the clock of the probe was found to be in sync with that of a controller. The value -1 is used to indicate that the probe does not know whether it is in sync (from 4650) (int)
- "msm_id" -- measurement identifier (int)
- "prb_id" -- source probe ID (int)
- "result" -- results of query (array of objects)
objects have the following fields:- "af" -- address family, 4 or 6 (integer)
- "bsize" -- size of body in octets (int)
- "dnserr" -- [optional] DNS resolution failed (string)
- "dst_addr" -- target address (string)
- "err" -- [optional] other failure (string)
- "header" -- [optional] elements are strings. The last string can be empty to indicate the end of enders or end with "[...]" to indicate truncation (array)
- "hsize" -- header size in octets (int)
- "method" -- "GET", "HEAD", or "POST" (string)
- "readtiming" -- [optional] timing results for reply data (array of objects)
objects have the following fields:- "t" -- time since starting to connect when data is received (in milli seconds) (float)
- "o" -- offset in stream of reply data (string) Due to a bug in the code this is currently a string. It will be changed to an integer in a future version.
- "res" -- HTTP result code (int)
- "rt" -- time to execute request excluding DNS (float)
- "src_addr" -- source address used by probe (string)
- "subid" -- [optional] sequence number of this result within a group of results, when the 'all' option is used without the 'combine' option (int)
- "submax" -- [optional] total number of results within a group (int)
- "time" -- [optional] Unix timestamp, when the 'all' option is used with the 'combine' option (int)
- "ttc" -- [optional] time to connect to the target (in milli seconds) (float)
- "ttfb" -- [optional] time to first response byte received by measurent code after starting to connect (in milli seconds) (float)
- "ttr" -- [optional] time to resolve the DNS name (in milli seconds) (float)
- "ver" -- major, minor version of http server (string)
- "timestamp" -- Unix timestamp (int)
- "type" -- "http" (string)
- "uri" -- request uri (string)
Example result:
json
{
"from": "2001:67c:2e8:13:220:4aff:fec6:cc9d",
"msm_id": 1013948,
"fw": 4540,
"timestamp": 1374759270,
"uri": "http://www.ripe.net/",
"prb_id": 9,
"result": [
{
"rt": 51.857999999999997,
"src_addr": "2001:67c:2e8:13:220:4aff:fec6:cc9d",
"hsize": 279,
"af": 6,
"bsize": 39851,
"res": 200,
"dst_addr": "2001:67c:2e8:22::c100:68b",
"readtiming": [
{
"t": 28.552,
"o": "0"
},
{
"t": 31.466000000000001,
"o": "4096"
},
{
"t": 33.752000000000002,
"o": "8192"
},
{
"t": 36.012,
"o": "12288"
},
{
"t": 38.866,
"o": "16384"
},
{
"t": 42.146000000000001,
"o": "20480"
},
{
"t": 44.302,
"o": "24576"
},
{
"t": 46.579999999999998,
"o": "28672"
},
{
"t": 48.886000000000003,
"o": "32768"
},
{
"t": 50.896999999999998,
"o": "36864"
}
],
"ttr": 3.2080000000000002,
"ttc": 3.1840000000000002,
"ver": "1.1",
"ttfb": 28.417999999999999,
"method": "GET"
}
],
"type": "http"
}Version 4610 NTP
(first introduced in firmware 4660)
A measurement result is a JSON object with the following fields:
"af" -- address family, 4 or 6 (integer)
"dst_name" -- name of the destination (string)
"dst_port" -- port name (string)
"from" -- IP address of the probe as known by controller (string)
"li" -- leap indicator, values "no", "61", "59", or "unknown" (string)
"lts" -- last time synchronised. How long ago (in seconds) the clock of the probe was found to be in sync with that of a controller. The value -1 is used to indicate that the probe does not know whether it is in sync (int)
"mode" -- "server" (string)
"msm_id" -- measurement identifier (int)
"poll" -- poll interval in seconds (float)
"prb_id" -- source probe ID (int)
"precision" -- precision of the server's clock in seconds (float)
"proto" -- "UDP" (string)
"ref-id" -- server's reference clock (string)
"ref-ts" -- server's reference timestamp in NTP seconds (float)
"result" -- results of query (array of objects)
objects have the following fields:"final-ts" -- NTP time the response from the server is received (float)
"offset" -- clock offset between client and server in seconds (float)
"origin-ts" -- NTP time the request was sent (float)
"receive-ts" -- NTP time the server received the request (float)
"rtt" -- round trip time between client and server in seconds (float)
"transmit-ts" -- NTP time the server sent the response (float)
"root-delay" -- round-trip delay from server to stratum 0 time source in seconds (float)
"root-dispersion" -- total dispersion to stratum 0 time source in seconds (float)
"src_addr" -- source address used by probe (string)
"stratum" -- distance in hops from server to primary time source (int)
"timestamp" -- Unix timestamp (int)
"type" -- "ntp" (string)
"version" -- NTP protocol version (int)
Example result:
json
{
"af": 4,
"dst_addr": "193.0.0.229",
"dst_name": "193.0.0.229",
"from": "193.0.10.127",
"fw": 4661,
"group_id": 1020238,
"li": "no",
"lts": 35,
"mode": "server",
"msm_id": 1020238,
"msm_name": "Ntp",
"poll": 1,
"prb_id": 100,
"precision": 0.0000019074,
"proto": "UDP",
"ref-id": "GPS",
"ref-ts": 3627199554.7434468269,
"result": [
{
"final-ts": 3627199583.5645947456,
"offset": -0.026271,
"origin-ts": 3627199583.5634074211,
"receive-ts": 3627199583.5902590752,
"rtt": 0.001161,
"transmit-ts": 3627199583.5902853012
},
{
"final-ts": 3627199583.5661029816,
"offset": -0.026314,
"origin-ts": 3627199583.5650439262,
"receive-ts": 3627199583.59187603,
"rtt": 0.001035,
"transmit-ts": 3627199583.5918998718
},
{
"final-ts": 3627199583.5675640106,
"offset": -0.026291,
"origin-ts": 3627199583.5665426254,
"receive-ts": 3627199583.5933327675,
"rtt": 0.000998,
"transmit-ts": 3627199583.5933551788
}
],
"root-delay": 0,
"root-dispersion": 0.00137329,
"src_addr": "193.0.10.127",
"stratum": 1,
"timestamp": 1418210783,
"type": "ntp",
"version": 4
}Version 4610 TLS (SSL) GET Cert
View changes since previous version.
A measurement result is a JSON object with the following fields:
"af" -- address family, 4 or 6 (integer)
"alert" -- [optional] error sent by server (see RFC 5246, Section 7.2) (from firmware 4720) (object with the following fields:)
"level" -- AlertLevel (integer)
"description" -- AlertDescription (integer)
"cert" -- [optional] results of query, not present if "alert" is present (array of strings)
Each string contains a base 64 encoded certificate. Newlines are replaced with "\n""dst_addr" -- IP address of the destination (string)
"dst_name" -- name of the destination (string)
"dst_port" -- port name (string)
"from" -- IP address of the probe as known by controller (string)
"lts" -- last time synchronised. How long ago (in seconds) the clock of the probe was found to be in sync with that of a controller. The value -1 is used to indicate that the probe does not know whether it is in sync (from 4650) (int)
"method" -- "SSL" (string)
"msm_id" -- measurement identifier (int)
"prb_id" -- source probe ID (int)
"rt" -- [optional] response time in milli seconds from starting to connect to receving the certificates (float)
"src_addr" -- source address used by probe (string)
"ttc" -- [optional] time in milli seconds that it took to connect (over TCP) to the target (float)
"timestamp" -- Unix timestamp (int)
"type" -- "sslcert" (string)
"ver" -- (SSL) protocol version (string)
Example result:
json
{
"af": 6,
"cert": [
"-----BEGIN
CERTIFICATE-----\\nMIIGqjCCBZKgAwIBAgIQBNu6PYaCJaYpd2g1kzNSJTANBgkqhkiG9w0BAQUFADBm\\nMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3\\nd3cuZGlnaWNlcnQuY29tMSUwIwYDVQQDExxEaWdpQ2VydCBIaWdoIEFzc3VyYW5j\\nZSBDQS0zMB4XDTEzMDMxODAwMDAwMFoXDTE0MDYxMDEyMDAwMFowbjELMAkGA1UE\\nBhMCTkwxFjAUBgNVBAgTDU5vb3JkLUhvbGxhbmQxEjAQBgNVBAcTCUFtc3RlcmRh\\nbTERMA8GA1UEChMIUklQRSBOQ0MxCzAJBgNVBAsTAklUMRMwEQYDVQQDDAoqLnJp\\ncGUubmV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6d0G7rz55lcy\\n1gxB6p5eMwwz2Pra2vF7wf3+IclV5RhTAErZmq7yhDCWwRYbgl0g2mHoCxWUd2bO\\nRn9bFZO+3c3b5IWzU9kjcEALOumdIvKa1Gw0EPIaJgJGPIYYO7YpNtpxyL4o+ENL\\nNxplATdIjVTvGpb6oiM5Cf7umBReODnSDmUDpFLCwoHrPzOlQMStBW96oZoTXDW4\\nWPkTgN+JoeV0Di03fwrNGMPY9ePzLEtiinfTXaEgvme4uajiOdB5cf9kIXms141q\\nvFaAnC5EIXW7RSwD+wEAbEtMYS1hzfMsrI5WRnJATdwSt9mXe8NrmsnZLbPxl03D\\n127U86FdZwIDAQABo4IDSjCCA0YwHwYDVR0jBBgwFoAUUOpzidsp+xCPnuUBINTe\\neZlIg/cwHQYDVR0OBBYEFGhAxyPew9BsnnEbDKExdS7m9jlIMB8GA1UdEQQYMBaC\\nCioucmlwZS5uZXSCCHJpcGUubmV0MA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAU\\nBggrBgEFBQcDAQYIKwYBBQUHAwIwYQYDVR0fBFowWDAqoCigJoYkaHR0cDovL2Ny\\nbDMuZGlnaWNlcnQuY29tL2NhMy1nMjAuY3JsMCqgKKAmhiRodHRwOi8vY3JsNC5k\\naWdpY2VydC5jb20vY2EzLWcyMC5jcmwwggHEBgNVHSAEggG7MIIBtzCCAbMGCWCG\\nSAGG/WwBATCCAaQwOgYIKwYBBQUHAgEWLmh0dHA6Ly93d3cuZGlnaWNlcnQuY29t\\nL3NzbC1jcHMtcmVwb3NpdG9yeS5odG0wggFkBggrBgEFBQcCAjCCAVYeggFSAEEA\\nbgB5ACAAdQBzAGUAIABvAGYAIAB0AGgAaQBzACAAQwBlAHIAdABpAGYAaQBjAGEA\\ndABlACAAYwBvAG4AcwB0AGkAdAB1AHQAZQBzACAAYQBjAGMAZQBwAHQAYQBuAGMA\\nZQAgAG8AZgAgAHQAaABlACAARABpAGcAaQBDAGUAcgB0ACAAQwBQAC8AQwBQAFMA\\nIABhAG4AZAAgAHQAaABlACAAUgBlAGwAeQBpAG4AZwAgAFAAYQByAHQAeQAgAEEA\\nZwByAGUAZQBtAGUAbgB0ACAAdwBoAGkAYwBoACAAbABpAG0AaQB0ACAAbABpAGEA\\nYgBpAGwAaQB0AHkAIABhAG4AZAAgAGEAcgBlACAAaQBuAGMAbwByAHAAbwByAGEA\\ndABlAGQAIABoAGUAcgBlAGkAbgAgAGIAeQAgAHIAZQBmAGUAcgBlAG4AYwBlAC4w\\newYIKwYBBQUHAQEEbzBtMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2Vy\\ndC5jb20wRQYIKwYBBQUHMAKGOWh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9E\\naWdpQ2VydEhpZ2hBc3N1cmFuY2VDQS0zLmNydDAMBgNVHRMBAf8EAjAAMA0GCSqG\\nSIb3DQEBBQUAA4IBAQB46sTrH1CPFA9nWSHH7zyysBuA0G62ey1ps5GNTP3TEmyp\\n+XCrzp13IoVuxFCT39b/XfbztkpGpIwqeIhIxBEH/jdMeBw6QXonbCrK4bBVY1Lj\\nwEiV4/Ev4Y1uho9FC9DRHOmTr5X4TDpAfiuF+P/h62WAL9XE12luZOAaef/Afxap\\nZ2u+DZHbckDmDZLrMl9/b0XvYJYE7s11SQiR1Bz8kI1rvAodpOeTcn4pp3b70IAq\\nk1XB+floX9aodmfFQm+hgO/QrpbBuqvsjYhnXGnAGhxAYnyqN2ruD0s+oWBTEWLP\\nGPzXQ8m49Ipx20t4UKEXWsNHfMYfnyeodoTpA2mU\\n-----END
CERTIFICATE-----",
"-----BEGIN
CERTIFICATE-----\\nMIIGWDCCBUCgAwIBAgIQCl8RTQNbF5EX0u/UA4w/OzANBgkqhkiG9w0BAQUFADBs\\nMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3\\nd3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j\\nZSBFViBSb290IENBMB4XDTA4MDQwMjEyMDAwMFoXDTIyMDQwMzAwMDAwMFowZjEL\\nMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3\\nLmRpZ2ljZXJ0LmNvbTElMCMGA1UEAxMcRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug\\nQ0EtMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL9hCikQH17+NDdR\\nCPge+yLtYb4LDXBMUGMmdRW5QYiXtvCgFbsIYOBC6AUpEIc2iihlqO8xB3RtNpcv\\nKEZmBMcqeSZ6mdWOw21PoF6tvD2Rwll7XjZswFPPAAgyPhBkWBATaccM7pxCUQD5\\nBUTuJM56H+2MEb0SqPMV9Bx6MWkBG6fmXcCabH4JnudSREoQOiPkm7YDr6ictFuf\\n1EutkozOtREqqjcYjbTCuNhcBoz4/yO9NV7UfD5+gw6RlgWYw7If48hl66l7XaAs\\nzPw82W3tzPpLQ4zJ1LilYRyyQLYoEt+5+F/+07LJ7z20Hkt8HEyZNp496+ynaF4d\\n32duXvsCAwEAAaOCAvowggL2MA4GA1UdDwEB/wQEAwIBhjCCAcYGA1UdIASCAb0w\\nggG5MIIBtQYLYIZIAYb9bAEDAAIwggGkMDoGCCsGAQUFBwIBFi5odHRwOi8vd3d3\\nLmRpZ2ljZXJ0LmNvbS9zc2wtY3BzLXJlcG9zaXRvcnkuaHRtMIIBZAYIKwYBBQUH\\nAgIwggFWHoIBUgBBAG4AeQAgAHUAcwBlACAAbwBmACAAdABoAGkAcwAgAEMAZQBy\\nAHQAaQBmAGkAYwBhAHQAZQAgAGMAbwBuAHMAdABpAHQAdQB0AGUAcwAgAGEAYwBj\\nAGUAcAB0AGEAbgBjAGUAIABvAGYAIAB0AGgAZQAgAEQAaQBnAGkAQwBlAHIAdAAg\\nAEMAUAAvAEMAUABTACAAYQBuAGQAIAB0AGgAZQAgAFIAZQBsAHkAaQBuAGcAIABQ\\nAGEAcgB0AHkAIABBAGcAcgBlAGUAbQBlAG4AdAAgAHcAaABpAGMAaAAgAGwAaQBt\\nAGkAdAAgAGwAaQBhAGIAaQBsAGkAdAB5ACAAYQBuAGQAIABhAHIAZQAgAGkAbgBj\\nAG8AcgBwAG8AcgBhAHQAZQBkACAAaABlAHIAZQBpAG4AIABiAHkAIAByAGUAZgBl\\nAHIAZQBuAGMAZQAuMBIGA1UdEwEB/wQIMAYBAf8CAQAwNAYIKwYBBQUHAQEEKDAm\\nMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wgY8GA1UdHwSB\\nhzCBhDBAoD6gPIY6aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0SGln\\naEFzc3VyYW5jZUVWUm9vdENBLmNybDBAoD6gPIY6aHR0cDovL2NybDQuZGlnaWNl\\ncnQuY29tL0RpZ2lDZXJ0SGlnaEFzc3VyYW5jZUVWUm9vdENBLmNybDAfBgNVHSME\\nGDAWgBSxPsNpA/i/RwHUmCYaCALvY2QrwzAdBgNVHQ4EFgQUUOpzidsp+xCPnuUB\\nINTeeZlIg/cwDQYJKoZIhvcNAQEFBQADggEBAB7ipUiebNtTOA/vphoqrOIDQ+2a\\nvD6OdRvw/S4iWawTwGHi5/rpmc2HCXVUKL9GYNy+USyS8xuRfDEIcOI3ucFbqL2j\\nCwD7GhX9A61YasXHJJlIR0YxHpLvtF9ONMeQvzHB+LGEhtCcAarfilYGzjrpDq6X\\ndF3XcZpCdF/ejUN83ulV7WkAywXgemFhM9EZTfkI7qA5xSU1tyvED7Ld8aW3DiTE\\nJiiNeXf1L/BXunwH1OH8zVowV36GEEfdMR/X/KLCvzB8XSSq6PmuX2p0ws5rs0bY\\nIb4p1I5eFdZCSucyb6Sxa1GDWL4/bcf72gMhy2oWGU4K8K2Eyl2Us1p292E=\\n-----END
CERTIFICATE-----",
"-----BEGIN
CERTIFICATE-----\\nMIIEQjCCA6ugAwIBAgIEQodApTANBgkqhkiG9w0BAQUFADCBwzELMAkGA1UEBhMC\\nVVMxFDASBgNVBAoTC0VudHJ1c3QubmV0MTswOQYDVQQLEzJ3d3cuZW50cnVzdC5u\\nZXQvQ1BTIGluY29ycC4gYnkgcmVmLiAobGltaXRzIGxpYWIuKTElMCMGA1UECxMc\\nKGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDE6MDgGA1UEAxMxRW50cnVzdC5u\\nZXQgU2VjdXJlIFNlcnZlciBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNjEw\\nMDEwNTAwMDBaFw0xNDA3MjYxODE1MTVaMGwxCzAJBgNVBAYTAlVTMRUwEwYDVQQK\\nEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xKzApBgNV\\nBAMTIkRpZ2lDZXJ0IEhpZ2ggQXNzdXJhbmNlIEVWIFJvb3QgQ0EwggEiMA0GCSqG\\nSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDGzOVz5vvUu+UtLTKm3+WBP8nNJUm2cSrD\\n1ZQ0Z6IKHLBfaaZAscS3so/QmKSpQVk609yU1jzbdDikSsxNJYL3SqVTEjju80lt\\ncZF+Y7arpl/DpIT4T2JRvvjF7Ns4kuMG5QiRDMQoQVX7y1qJFX5x6DW/TXIJPb46\\nOFBbdzEbjbPHJEWap6xtABRaBLe6E+tRCphBQSJOZWGHgUFQpnlcid4ZSlfVLuZd\\nHFMsfpjNGgYWpGhz0DQEE1yhcdNafFXbXmThN4cwVgTlEbQpgBLxeTmIogIRfCdm\\nt4i3ePLKCqg4qwpkwr9mXZWEwaElHoddGlALIBLMQbtuC1E4uEvLAgMBAAGjggET\\nMIIBDzASBgNVHRMBAf8ECDAGAQH/AgEBMCcGA1UdJQQgMB4GCCsGAQUFBwMBBggr\\nBgEFBQcDAgYIKwYBBQUHAwQwMwYIKwYBBQUHAQEEJzAlMCMGCCsGAQUFBzABhhdo\\ndHRwOi8vb2NzcC5lbnRydXN0Lm5ldDAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8v\\nY3JsLmVudHJ1c3QubmV0L3NlcnZlcjEuY3JsMB0GA1UdDgQWBBSxPsNpA/i/RwHU\\nmCYaCALvY2QrwzALBgNVHQ8EBAMCAQYwHwYDVR0jBBgwFoAU8BdiE1U9s/8KAGv7\\nUISX8+1i0BowGQYJKoZIhvZ9B0EABAwwChsEVjcuMQMCAIEwDQYJKoZIhvcNAQEF\\nBQADgYEASA4rbyBiTCiToyQ9WKshz4D4mpeQaiLtWnxHNpnneYR1qySPkgrVYQSu\\nw2pcsszZ5ESHb9uPOGL3RDadurxuB8TUjegf0Qtgo7WczmO+7Wfc+Lrebskly1u1\\nnXZwC99CcvhPQRFkpdLq/NWvEfQVOGecIKhLd1qRMkIy54Wz3zY=\\n-----END
CERTIFICATE-----"
],
"dst_addr": "2001:67c:2e8:22::c100:68b",
"dst_name": "www.ripe.net",
"dst_port": "443",
"from": "2001:67c:2e8:13:220:4aff:fec6:cc9d",
"fw": 4540,
"method": "SSL",
"msm_id": 15001,
"prb_id": 9,
"rt": 25.738,
"src_addr": "2001:67c:2e8:13:220:4aff:fec6:cc9d",
"timestamp": 1374753699,
"ttc": 3.867,
"type": "sslcert",
"ver": "3.0"
}