Echo in the Rain

The telemetry stream contains routine measurements, elevated readings, and a record that appears at the gateway more than once. Identify the replayed message and support the finding with multiple properties of the records—not with the measurement's severity alone.

Objective

By completing this module, you will be able to:

distinguish sensor event time from gateway receipt time;
detect replay by comparing identifiers, sequence numbers, payload fields, and authentication tags; and
explain why an unusual measurement is not, by itself, evidence of replay.

Before you begin

Open Echo in the Rain and download the telemetry file. Each line is a complete JSON object. Review JSON and JSON Lines and keep a copy of the original file unchanged.

Concepts

A sensor time records when a device says it created a measurement. A receipt time records when another component observed the message. Network delay can make those times differ without indicating an attack.

A replay is the reuse of a previously valid message. Strong replay evidence comes from stable message properties appearing again—such as the same identifier, sequence, authenticated payload, and sensor time—while the receipt event is new. A high or surprising reading may deserve investigation, but its magnitude does not prove how the message entered the system.

Sensor time, receipt time, and a local clock are preserved separately and converted to UTC. A later receipt of the same event may indicate replay or delay, not a fresh event.

Keep event time, receipt time, source identifier, time-zone offset, and any known clock error in separate columns. In this synthetic example, the sensor's 10:00Z event is received at 10:04Z; a local log at 12:02+02:00 corresponds to 10:02Z. A second receipt of the same event at 10:09Z is not proof of a new event. Time-zone conversion does not correct clock drift; preserve uncertainty and corroborate replay before concluding it.

Suggested tools

Text editor: Search repeated identifiers, sequence numbers, or MAC values and compare matching lines side by side.
JSON Lines viewer: jq -c . telemetry.jsonl, an editor extension, or a short local script can validate and format each record. Do not send automated requests to the board; analyze the downloaded file locally.

Tool practice

Rehearse the worked tool exercise before using challenge data.

Use jq -c . to keep one readable object per line or compare candidate lines in a text editor. Search an exact quoted message ID and keep every matching row. Compare sensor time, receipt time, sequence, payload, and MAC side by side.

Investigation

Observe

Identify fields that describe message identity, generation order, measurement payload, authentication, and receipt. Follow the normal pattern for several adjacent records before looking for an exception. Note whether identifiers and sequence numbers normally advance together.

Form a hypothesis

Which record appears more than once? For the candidate pair, which fields remain identical and which field changes? Does the evidence support a newly generated measurement, delayed delivery, duplicate processing, or reuse of an earlier authenticated message?

Test carefully

Search for duplicates using stable fields rather than sorting only by the largest measurement. Compare the candidate rows field by field. Select at least two observations that establish reuse of the same message and reject any option that relies only on the reading being extreme.

Submit the repeated message identifier exactly as recorded. If your viewer reformats numeric values, rely on identifiers, sequence, timestamps, payload, and MAC fields from the original lines.

Progressive hints

Hint 1

Search for an identifier or sequence number that occurs twice. Most records advance in a regular pattern.

Hint 2

Compare sensor time with receipt time for the duplicate pair. A replay can keep the original generation fields while arriving again later.

Hint 3

Use two or more of these categories: repeated sequence, identical authenticated payload or MAC, and the same sensor time at different receipt times. The size of the sensor reading alone is not replay evidence.

Troubleshooting and reset

If a JSON viewer tries to parse the whole file as one array, use a JSON Lines mode or inspect one line at a time. Search exact quoted identifiers to avoid partial matches. If the finding is rejected, confirm that your chosen evidence describes duplicate message properties and that you did not select the extreme reading as proof by itself.

Completing the finding reveals a seal; file it on the River Station incident board to record progress.