{
  "_what_this_is": "A DEMONSTRATION capture built from the test fixtures in sais/tests/fixtures, not a recording of anyone's network. The device names and addresses are documentation examples (RFC 5737 address ranges). It exists so the console can be seen displaying a collated ledger before you have run a capture of your own.",
  "generated": "2026-08-15T11:16:31+00:00",
  "source": "collated",
  "collated_from": [
    {
      "file": "sensor.json",
      "viewpoint": "sensor",
      "host": "studio-mac",
      "generated": "2026-08-15T10:05:00+00:00",
      "rows": 4
    },
    {
      "file": "resolver.json",
      "viewpoint": "resolver",
      "host": "gateway-pi",
      "generated": "2026-08-15T10:05:00+00:00",
      "rows": 4
    }
  ],
  "pairing": {
    "window_seconds": 300,
    "paired": 1,
    "ambiguous": 1,
    "unpaired": 1,
    "cross_device": 1,
    "note": "A connection is attributed to a lookup only when exactly one name answered that address inside the window. Several names, or none, and the row stays an address and says why."
  },
  "disagreements": [
    "sensor says allow, resolver says review \u2014 the more restrictive is applied"
  ],
  "blind_spots": [
    "devices using DNS-over-HTTPS to a hardcoded resolver are not visible here",
    "connections made directly to an IP with no lookup are not visible here"
  ],
  "note": "Connection metadata and DNS names only. No payload is read by either sensor. Jurisdiction is established by address range or reverse DNS; anything unresolved is recorded as undisclosed, never guessed.",
  "flows": [
    {
      "dev": "studio-mac",
      "dest": "192.0.2.55",
      "ip": "192.0.2.55",
      "kind": "tcp:443",
      "j": "UNK",
      "basis": "no reverse DNS, no matching range",
      "data": "not observed",
      "calls": 41,
      "bytes": "\u2014",
      "state": "deny",
      "reason": "jurisdiction could not be established",
      "owner": "unassigned",
      "child": false,
      "first_seen": "2026-08-15T10:03:00+00:00",
      "last_seen": "2026-08-15T10:05:00+00:00",
      "seen_by": [
        "sensor"
      ],
      "sources": {
        "sensor": {
          "file": "sensor.json",
          "calls": 41,
          "first_seen": "2026-08-15T10:03:00+00:00",
          "last_seen": "2026-08-15T10:05:00+00:00",
          "kind": "tcp:443",
          "state": "deny",
          "j": "UNK",
          "basis": "no reverse DNS, no matching range"
        }
      },
      "disagreements": [],
      "proc": "telemetryd",
      "pid": "902",
      "pairing": {
        "outcome": "unpaired",
        "why": "no lookup in any capture answered 192.0.2.55 \u2014 this connection was made straight to an address"
      },
      "reads": "studio-mac \u2014 telemetryd \u2192 192.0.2.55"
    },
    {
      "dev": "studio-mac",
      "dest": "203.0.113.9",
      "ip": "203.0.113.9",
      "kind": "tcp:443",
      "j": "UNK",
      "basis": "no reverse DNS, no matching range",
      "data": "not observed",
      "calls": 12,
      "bytes": "\u2014",
      "state": "deny",
      "reason": "jurisdiction could not be established",
      "owner": "unassigned",
      "child": false,
      "first_seen": "2026-08-15T10:01:30+00:00",
      "last_seen": "2026-08-15T10:04:00+00:00",
      "seen_by": [
        "sensor"
      ],
      "sources": {
        "sensor": {
          "file": "sensor.json",
          "calls": 12,
          "first_seen": "2026-08-15T10:01:30+00:00",
          "last_seen": "2026-08-15T10:04:00+00:00",
          "kind": "tcp:443",
          "state": "deny",
          "j": "UNK",
          "basis": "no reverse DNS, no matching range"
        }
      },
      "disagreements": [],
      "proc": "Safari",
      "pid": "501",
      "pairing": {
        "outcome": "cross_device",
        "why": "the only lookup that answered 203.0.113.9 inside the window came from living room TV, a different device \u2014 attributing this connection to it would be a guess",
        "candidates": [
          "metrics.vendor.example"
        ],
        "asked_elsewhere_by": [
          "living room TV"
        ]
      },
      "reads": "studio-mac \u2014 Safari \u2192 203.0.113.9"
    },
    {
      "dev": "living room TV",
      "dest": "metrics.vendor.example",
      "ip": "203.0.113.9",
      "kind": "dns lookup",
      "j": "UNK",
      "basis": "name did not resolve to a listed range",
      "data": "names only",
      "calls": 4,
      "bytes": "\u2014",
      "state": "deny",
      "reason": "jurisdiction could not be established",
      "owner": "unassigned",
      "child": false,
      "first_seen": "2026-08-15T10:01:00+00:00",
      "last_seen": "2026-08-15T10:04:00+00:00",
      "seen_by": [
        "resolver"
      ],
      "sources": {
        "resolver": {
          "file": "resolver.json",
          "calls": 4,
          "first_seen": "2026-08-15T10:01:00+00:00",
          "last_seen": "2026-08-15T10:04:00+00:00",
          "kind": "dns lookup",
          "state": "deny",
          "j": "UNK",
          "basis": "name did not resolve to a listed range"
        }
      },
      "disagreements": [],
      "asked_by": "living room TV",
      "client_ip": "192.168.1.42",
      "answers": [
        "203.0.113.9"
      ],
      "reads": "living room TV \u2192 metrics.vendor.example"
    },
    {
      "dev": "studio-mac",
      "dest": "198.51.100.7",
      "ip": "198.51.100.7",
      "kind": "tcp:443",
      "j": "UNK",
      "basis": "no reverse DNS",
      "data": "not observed",
      "calls": 3,
      "bytes": "\u2014",
      "state": "deny",
      "reason": "jurisdiction could not be established",
      "owner": "unassigned",
      "child": false,
      "first_seen": "2026-08-15T10:02:00+00:00",
      "last_seen": "2026-08-15T10:02:30+00:00",
      "seen_by": [
        "sensor"
      ],
      "sources": {
        "sensor": {
          "file": "sensor.json",
          "calls": 3,
          "first_seen": "2026-08-15T10:02:00+00:00",
          "last_seen": "2026-08-15T10:02:30+00:00",
          "kind": "tcp:443",
          "state": "deny",
          "j": "UNK",
          "basis": "no reverse DNS"
        }
      },
      "disagreements": [],
      "proc": "Safari",
      "pid": "501",
      "pairing": {
        "outcome": "ambiguous",
        "why": "2 names answered 198.51.100.7 inside the window; which one this connection belongs to cannot be established from metadata alone",
        "candidates": [
          "cdn-a.example",
          "cdn-b.example"
        ]
      },
      "reads": "studio-mac \u2014 Safari \u2192 198.51.100.7"
    },
    {
      "dev": "studio-mac",
      "dest": "cdn-b.example",
      "ip": "198.51.100.7",
      "kind": "dns lookup",
      "j": "UNK",
      "basis": "shared CDN address",
      "data": "names only",
      "calls": 1,
      "bytes": "\u2014",
      "state": "deny",
      "reason": "foreign destination, not authorized",
      "owner": "unassigned",
      "child": false,
      "first_seen": "2026-08-15T10:01:52+00:00",
      "last_seen": "2026-08-15T10:01:52+00:00",
      "seen_by": [
        "resolver"
      ],
      "sources": {
        "resolver": {
          "file": "resolver.json",
          "calls": 1,
          "first_seen": "2026-08-15T10:01:52+00:00",
          "last_seen": "2026-08-15T10:01:52+00:00",
          "kind": "dns lookup",
          "state": "deny",
          "j": "UNK",
          "basis": "shared CDN address"
        }
      },
      "disagreements": [],
      "asked_by": "studio-mac",
      "client_ip": "192.168.1.10",
      "answers": [
        "198.51.100.7"
      ],
      "reads": "studio-mac \u2192 cdn-b.example"
    },
    {
      "dev": "studio-mac \u2014 Safari",
      "dest": "github.com",
      "ip": "140.82.114.4",
      "kind": "tcp:443",
      "j": "US",
      "basis": "reverse DNS github.com matches github.com",
      "data": "connection metadata and DNS names only \u2014 neither sensor reads contents",
      "calls": 13,
      "bytes": "\u2014",
      "state": "review",
      "reason": "domestic, but not on the allow list",
      "owner": "unassigned",
      "child": false,
      "first_seen": "2026-08-15T09:40:00+00:00",
      "last_seen": "2026-08-15T10:04:50+00:00",
      "seen_by": [
        "sensor",
        "resolver"
      ],
      "sources": {
        "sensor": {
          "file": "sensor.json",
          "calls": 8,
          "first_seen": "2026-08-15T10:00:10+00:00",
          "last_seen": "2026-08-15T10:04:50+00:00",
          "kind": "tcp:443",
          "state": "allow",
          "j": "US",
          "basis": "reverse DNS github.com matches github.com"
        },
        "resolver": {
          "file": "resolver.json",
          "calls": 5,
          "first_seen": "2026-08-15T09:40:00+00:00",
          "last_seen": "2026-08-15T10:04:40+00:00",
          "kind": "dns lookup",
          "state": "review",
          "j": "US",
          "basis": "reverse DNS github.com matches github.com"
        }
      },
      "disagreements": [
        "sensor says allow, resolver says review \u2014 the more restrictive is applied"
      ],
      "proc": "Safari",
      "pid": "501",
      "pairing": {
        "outcome": "paired",
        "name": "github.com",
        "asked_by": "studio-mac",
        "gap_seconds": 5.0,
        "why": "github.com answered 140.82.114.4 5 seconds before this connection"
      },
      "asked_by": "studio-mac",
      "client_ip": "192.168.1.10",
      "answers": [
        "140.82.114.4"
      ],
      "reads": "studio-mac \u2014 Safari \u2192 github.com (140.82.114.4)"
    },
    {
      "dev": "studio-mac",
      "dest": "cdn-a.example",
      "ip": "198.51.100.7",
      "kind": "dns lookup",
      "j": "UNK",
      "basis": "shared CDN address",
      "data": "names only",
      "calls": 2,
      "bytes": "\u2014",
      "state": "review",
      "reason": "domestic, but not on the allow list",
      "owner": "unassigned",
      "child": false,
      "first_seen": "2026-08-15T10:01:50+00:00",
      "last_seen": "2026-08-15T10:01:55+00:00",
      "seen_by": [
        "resolver"
      ],
      "sources": {
        "resolver": {
          "file": "resolver.json",
          "calls": 2,
          "first_seen": "2026-08-15T10:01:50+00:00",
          "last_seen": "2026-08-15T10:01:55+00:00",
          "kind": "dns lookup",
          "state": "review",
          "j": "UNK",
          "basis": "shared CDN address"
        }
      },
      "disagreements": [],
      "asked_by": "studio-mac",
      "client_ip": "192.168.1.10",
      "answers": [
        "198.51.100.7"
      ],
      "reads": "studio-mac \u2192 cdn-a.example"
    }
  ]
}