2cIP

The 2cIP architecture is composed of three main components: the Capture Engine, the Analysis Engine, and the Reporting Module. The Capture Engine interfaces directly with the z/OS network stack, utilizing system-level APIs to capture raw network packets. This component supports various network interfaces and protocols, including TCP/IP and SNA.

The Analysis Engine processes the captured packets, decoding and interpreting the protocol data. It provides detailed analysis of packet headers, payloads, and protocol interactions. The Reporting Module generates summaries, reports, and visualizations of the network traffic.

It allows users to filter and analyze data based on various criteria, such as source and destination IP addresses, ports, and protocols. The tool uses a command-line interface for all operations. Configuration files are not used; instead, configuration parameters are set directly through commands.

For example, the `CONFIG` command is used to set capture parameters, `FILTER` to define filtering rules, and `DISPLAY` to view the captured data. Communication relies on standard TCP/IP protocols for network interactions. 2cIP supports RBAC for access control, and audit logs track user actions and system events.

The tool does not expose any APIs.