import React, { useState } from 'react'; import { InvestigationCase } from '../../types/forensics'; import { Globe, Cpu, Server, Activity, AlertTriangle, CheckCircle2, Layers, ArrowRight, Info, Sliders, ShieldCheck, Hash } from 'lucide-react'; interface NetworkForensicsTabProps { currentCase: InvestigationCase; } export const NetworkForensicsTab: React.FC = ({ currentCase, }) => { const telemetry = currentCase.networkTelemetry; const bgp = telemetry.bgpAnycast; const tls = telemetry.tlsFingerprint; const tcp = telemetry.tcpStack; const [testDistanceKm, setTestDistanceKm] = useState(3500); const [testRttMs, setTestRttMs] = useState(14); // Speed of light in fiber is c * 2/3 ≈ 200,000 km/s. // t_min = (2 * d) / 200,000 km/s * 1000 ms/s = (2 * d) / 200 ms = d / 100 ms. const theoreticalFiberMinMs = (2 * testDistanceKm) / 200; const isCustomViolation = testRttMs < theoreticalFiberMinMs; return (
{/* Top Banner: Anycast Triangulation Physics Verdict */}

Anycast BGP Speed-of-Light Triangulation Engine

{bgp.speedOfLightViolation ? 'SPEED-OF-LIGHT VIOLATION DETECTED' : 'NOMINAL LATENCY CURVE'}

{bgp.formulaExplanation}

CLAIMED EGRESS IP {telemetry.claimedGeo.ip} ({telemetry.claimedGeo.city}, {telemetry.claimedGeo.country})
PHYSICALLY TRIANGULATED LOCATION {bgp.physicalOriginInference}
MAX LATENCY DELTA {bgp.propagationDeltaMs} ms anomaly
{/* Global PoP Latency Measurement Matrix */}
GLOBAL ANYCAST EDGE POP RTT LATENCY MATRIX
Formula: t ≥ (2d) / (c · ⅔)
{bgp.popLatencies.map((pop, idx) => ( ))}
PoP Node Location Distance from Claimed IP Measured TCP RTT Physical Fiber Min RTT Physics Verdict
{pop.pop} {pop.city}, {pop.country} {pop.physicalDistanceKm.toLocaleString()} km {pop.measuredRttMs.toFixed(1)} ms {pop.expectedPhysicalMinRttMs.toFixed(1)} ms {pop.anomalous ? ( Impossibility / Proxy ) : ( Speed-of-Light Compliant )}
{/* Interactive Speed-of-Light Fiber Propagation Calculator */}
INTERACTIVE PROPAGATION FORMULA SANDBOX: t ≥ (2d) / (c · ⅔)
Distance Between Nodes (d): {testDistanceKm} km
setTestDistanceKm(Number(e.target.value))} className="w-full accent-cyan-500 cursor-pointer" />
Measured Round-Trip Time (RTT): {testRttMs} ms
setTestRttMs(Number(e.target.value))} className="w-full accent-amber-500 cursor-pointer" />
Theoretical Fiber Min RTT: {theoreticalFiberMinMs.toFixed(2)} ms
Measured Input RTT: {testRttMs} ms
Propagation Verdict: {isCustomViolation ? ( PHYSICALLY IMPOSSIBLE (Proxy Evasion) ) : ( PHYSICALLY PLAUSIBLE )}
{/* Layer 1.2 & 1.3: TLS JA4/JA3 Fingerprinting & TCP/IP Stack */}
{/* TLS Fingerprint Card */}
TLS CLIENTHELLO (JA3 / JA4) DISASSEMBLER
{tls.isKnownEvasionStack && ( EVASION ENGINE MATCH )}
JA4 SIGNATURE HASH {tls.ja4}
JA3 HASH {tls.ja3}
DETECTED CLIENT RUNTIME:
{tls.detectedClientEngine}
{tls.anomalyReason}
CIPHER SUITES NEGOTIATED:
{tls.cipherSuites.map((c, i) => ( {c} ))}
{/* TCP/IP Stack & OS Fingerprint Card */}
TCP/IP STACK & OS DISCREPANCY DETECTOR
{tcp.osMismatchDetected && ( OS MISMATCH DETECTED )}
INITIAL TCP TTL {tcp.initialTtl} (Linux=64, Win=128)
CLAIMED OS TTL {tcp.claimedOsTtl} (from User-Agent)
TCP WINDOW SIZE {tcp.windowSize}
MAX SEGMENT SIZE (MSS) {tcp.mss} bytes
OS PROFILE ANALYSIS:
{tcp.osMismatchDetails}
); };