No. Time Source Destination Protocol Info 2678 819.220788 zen1 soth1 TCP 4605 > 1677 [SYN] Seq=0 Ack=0 Win=16384 Len=0 MSS=1460 Frame 2678 (62 bytes on wire, 62 bytes captured) Arrival Time: Nov 11, 2005 16:43:47.979292000 Time delta from previous packet: 819.220788000 seconds Time since reference or first frame: 819.220788000 seconds Frame Number: 2678 Packet Length: 62 bytes Capture Length: 62 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 48 Identification: 0x419d (16797) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x34e7] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 0, Ack: 0, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 0 (relative sequence number) Header length: 28 bytes Flags: 0x0002 (SYN) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...0 .... = Acknowledgment: Not set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..1. = Syn: Set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0xddb1 [correct] Options: (8 bytes) Maximum segment size: 1460 bytes NOP NOP SACK permitted No. Time Source Destination Protocol Info 2679 819.220952 soth1 zen1 TCP 1677 > 4605 [SYN, ACK] Seq=0 Ack=1 Win=6144 Len=0 MSS=1460 Frame 2679 (62 bytes on wire, 62 bytes captured) Arrival Time: Nov 11, 2005 16:43:47.979456000 Time delta from previous packet: 0.000164000 seconds Time since reference or first frame: 819.220952000 seconds Frame Number: 2679 Packet Length: 62 bytes Capture Length: 62 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 48 Identification: 0x4a52 (19026) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x2c32 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 0, Ack: 1, Len: 0 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 0 (relative sequence number) Acknowledgement number: 1 (relative ack number) Header length: 28 bytes Flags: 0x0012 (SYN, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..1. = Syn: Set .... ...0 = Fin: Not set Window size: 6144 Checksum: 0x59b6 [correct] Options: (8 bytes) Maximum segment size: 1460 bytes SACK permitted NOP NOP SEQ/ACK analysis This is an ACK to the segment in frame: 2678 The RTT to ACK the segment was: 0.000164000 seconds No. Time Source Destination Protocol Info 2680 819.220995 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=1 Ack=1 Win=17520 [TCP CHECKSUM INCORRECT] Len=0 Frame 2680 (54 bytes on wire, 54 bytes captured) Arrival Time: Nov 11, 2005 16:43:47.979499000 Time delta from previous packet: 0.000043000 seconds Time since reference or first frame: 819.220995000 seconds Frame Number: 2680 Packet Length: 54 bytes Capture Length: 54 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x419e (16798) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x34ee] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 1, Ack: 1, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 1 (relative sequence number) Acknowledgement number: 1 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x845e [incorrect, should be 0x5a0a] SEQ/ACK analysis This is an ACK to the segment in frame: 2679 The RTT to ACK the segment was: 0.000043000 seconds No. Time Source Destination Protocol Info 2687 819.318650 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=1 Ack=1 Win=17520 [TCP CHECKSUM INCORRECT] Len=32 Frame 2687 (86 bytes on wire, 86 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.077154000 Time delta from previous packet: 0.097655000 seconds Time since reference or first frame: 819.318650000 seconds Frame Number: 2687 Packet Length: 86 bytes Capture Length: 86 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 72 Identification: 0x41a6 (16806) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x34c6] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 1, Ack: 1, Len: 32 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 1 (relative sequence number) Next sequence number: 33 (relative sequence number) Acknowledgement number: 1 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x847e [incorrect, should be 0x0a7a] Data (32 bytes) 0000 bc ef 20 00 b5 fe 18 00 06 00 00 20 8b 17 32 0a .. ........ ..2. 0010 ff ff ff ff ff ff 00 01 fe fe c0 a8 01 8f 20 00 .............. . No. Time Source Destination Protocol Info 2688 819.318860 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=1 Ack=33 Win=7604 Len=0 Frame 2688 (60 bytes on wire, 60 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.077364000 Time delta from previous packet: 0.000210000 seconds Time since reference or first frame: 819.318860000 seconds Frame Number: 2688 Packet Length: 60 bytes Capture Length: 60 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Trailer: 000000000000 Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x4c52 (19538) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x2a3a [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 1, Ack: 33, Len: 0 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 1 (relative sequence number) Acknowledgement number: 33 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7604 Checksum: 0x80a6 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2687 The RTT to ACK the segment was: 0.000210000 seconds No. Time Source Destination Protocol Info 2689 819.318884 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=1 Ack=33 Win=7604 Len=28 Frame 2689 (82 bytes on wire, 82 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.077388000 Time delta from previous packet: 0.000024000 seconds Time since reference or first frame: 819.318884000 seconds Frame Number: 2689 Packet Length: 82 bytes Capture Length: 82 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 68 Identification: 0x4d52 (19794) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x291e [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 1, Ack: 33, Len: 28 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 1 (relative sequence number) Next sequence number: 29 (relative sequence number) Acknowledgement number: 33 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7604 Checksum: 0x909d [correct] Data (28 bytes) 0000 bc ef 1c 00 b5 fe 18 00 02 00 00 20 ba 57 32 0a ........... .W2. 0010 04 00 3c 2a 71 43 00 00 8d 06 1c 00 ..<*qC...... No. Time Source Destination Protocol Info 2690 819.319250 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=33 Ack=29 Win=17492 [TCP CHECKSUM INCORRECT] Len=262 Frame 2690 (316 bytes on wire, 316 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.077754000 Time delta from previous packet: 0.000366000 seconds Time since reference or first frame: 819.319250000 seconds Frame Number: 2690 Packet Length: 316 bytes Capture Length: 316 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 302 Identification: 0x41a7 (16807) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x33df] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 33, Ack: 29, Len: 262 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 33 (relative sequence number) Next sequence number: 295 (relative sequence number) Acknowledgement number: 29 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17492 Checksum: 0x8564 [incorrect, should be 0x01a2] SEQ/ACK analysis This is an ACK to the segment in frame: 2689 The RTT to ACK the segment was: 0.000366000 seconds Data (262 bytes) 0000 bc ef 06 01 b5 fe 18 00 ea 00 02 21 ef ad 32 0a ...........!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 74 b4 05 9a e5 bc 85 aa 3b b1 21 76 a.elt.......;.!v 0030 73 90 8f 8c 7e 94 0c f5 8c 4b 06 ee 5e 96 e3 20 s...~....K..^.. 0040 73 14 07 c8 9d 84 77 3e 82 6b f1 0f c5 4e 2c 74 s.....w>.k...N,t 0050 f0 92 19 2e 6d 94 17 d1 9d 4b f2 57 b7 32 1f 41 ....m....K.W.2.A 0060 69 14 67 2a b3 aa 44 d2 b4 6b 3e 42 d0 4e dc 09 i.g*..D..k>B.N.. 0070 af 9c 60 27 d1 32 07 75 81 4b 17 6e b3 32 64 a0 ..`'.2.u.K.n.2d. 0080 43 14 16 48 bf 84 8d 1a ef 6b 81 8f b9 4e 45 f4 C..H.....k...NE. 0090 33 34 79 ae 34 94 8e 7f bd 4b c4 d5 a7 32 1f c1 34y.4....K...2.. 00a0 7b 14 57 aa ff e8 1c 15 e9 07 cc 16 f2 3d bf fd {.W..........=.. 00b0 07 51 23 5c 36 fa 73 f5 37 ee 3a ee 89 32 ed 20 .Q#\6.s.7.:..2. 00c0 ec f6 3f c8 b8 84 85 9a 85 6b 8e 0f a7 4e 6d 74 ..?......k...Nmt 00d0 7f 34 92 8b 5d 94 f0 ff 9d 4b 42 f1 9b 96 04 41 .4..]....KB....A 00e0 65 14 20 2a b5 20 6d fc 8f 6b 1b e4 b9 4e cc 09 e. *. m..k...N.. 00f0 63 34 61 a8 49 94 1c d1 f0 4b 37 6e 9b 32 c8 a1 c4a.I....K7n.2.. 0100 03 b0 33 48 06 01 ..3H.. No. Time Source Destination Protocol Info 2691 819.323342 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=29 Ack=295 Win=7342 Len=1460 Frame 2691 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.081846000 Time delta from previous packet: 0.004092000 seconds Time since reference or first frame: 819.323342000 seconds Frame Number: 2691 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x4f52 (20306) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x2186 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 29, Ack: 295, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 29 (relative sequence number) Next sequence number: 1489 (relative sequence number) Acknowledgement number: 295 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7342 Checksum: 0x6941 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2690 The RTT to ACK the segment was: 0.004092000 seconds Data (1460 bytes) 0000 bc ef ae 0b b5 fe 18 00 d6 20 13 21 cc d8 32 0a ......... .!..2. 0010 04 00 3c 2a 71 43 00 00 70 1a 0f f0 5b bf 76 40 ..<*qC..p...[.v@ 0020 6f 01 75 22 75 b0 7d 60 8b bc 0c f0 3a 31 2f 94 o.u"u.}`....:1/. 0030 6f 3f e5 1c 99 94 9e ff ad cb 0f 90 a1 ca e4 cb o?.............. 0040 f5 5d ba 2a 12 1e 40 e1 1f 99 d5 93 58 46 d3 20 .].*..@.....XF. 0050 19 38 b5 c6 00 75 72 a8 1c 47 5a 83 42 3c 84 c4 .8...ur..GZ.B<.. 0060 59 e5 6f 1b 89 8e 63 2d 30 2d b0 76 ce 62 73 59 Y.o...c-0-.v.bsY 0070 63 94 62 18 c1 94 1d bf 8b 8b 17 20 b3 12 e4 57 c.b........ ...W 0080 5f 12 83 2f 1a ac 6f 72 55 6b 33 f1 e3 2c bd 21 _../..orUk3..,.! 0090 84 49 bb 4e 67 94 7c 9e 0a 7d 72 8b 4b 2c d1 66 .I.Ng.|..}r.K,.f 00a0 ad f5 1b b6 c1 a0 7d a5 03 18 10 22 1e 27 e6 9c ......}....".'.. 00b0 5f 8d dd 22 df 67 6e e6 b5 50 f7 aa 0f 20 8e 50 _..".gn..P... .P 00c0 4e 04 a5 1c 9f 88 85 93 84 03 1d 99 d1 6c cd 3e N............l.> 00d0 75 19 04 3d 49 50 9d f7 c8 53 4f bf 05 06 da 4b u..=IP...SO....K 00e0 00 22 65 a8 ef 8b 42 58 67 43 61 f0 d9 55 de bd ."e...BXgCa..U.. 00f0 b0 d8 d1 5d 22 98 11 7e 19 64 5a b1 99 5b af ca ...]"..~.dZ..[.. 0100 fb ba 58 eb 67 6a 49 e0 73 5b ff be dd ac bb b7 ..X.gjI.s[...... 0110 67 92 04 6e 1b 59 2b be cf 15 1c 32 4c b8 47 7a g..n.Y+....2L.Gz 0120 a4 98 f0 04 61 34 d7 db c1 3d 45 1b 76 3c d0 9a ....a4...=E.v<.. 0130 7b f0 8a 11 9f cd 29 3b 8d 72 5a fe 05 a1 fd d6 {.....);.rZ..... 0140 c7 67 f4 b6 53 03 fe ff 4f 43 1f a2 41 e9 8e f6 .g..S...OC..A... 0150 7d 00 2c 83 21 d7 71 02 1c 5f d3 40 27 3a 3e 87 }.,.!.q.._.@':>. 0160 4f a4 a5 29 24 0e 65 70 29 ab 13 d4 6a 0b fc bc O..)$.ep)...j... 0170 8d 0c e0 c9 17 84 e2 c7 c8 c3 99 08 d6 fa 14 d9 ................ 0180 4e d6 af e8 ea 90 0c 93 ab 73 3d a7 ec 03 4d b3 N........s=...M. 0190 1d 36 c1 e8 01 51 e4 8c 6e c0 73 05 99 f5 ce 60 .6...Q..n.s....` 01a0 5f 37 3a 28 64 0f 35 1f eb 48 e9 e8 9b 90 33 d8 _7:(d.5..H....3. 01b0 cc c7 81 35 1b 0d 55 04 15 2a b6 eb 95 50 c6 58 ...5..U..*...P.X 01c0 1a 11 59 fb 03 a7 bd d4 16 7a 56 43 e3 67 dd 08 ..Y......zVC.g.. 01d0 c4 f0 96 c0 10 59 b8 8e 95 8f 4f 53 88 f8 a3 05 .....Y....OS.... 01e0 6b 7f e1 b7 04 8d 00 5b 0d 09 70 25 00 19 db 82 k......[..p%.... 01f0 7a bb 7d db d5 51 78 61 3a 07 50 71 95 4b a4 e1 z.}..Qxa:.Pq.K.. 0200 8d 53 f8 a6 6d ce cb f1 f4 53 b2 9f 8e e0 6a f8 .S..m....S....j. 0210 a0 1e 39 f1 80 77 f6 7e 59 c0 5b 28 4b bc 01 b0 ..9..w.~Y.[(K... 0220 4e e7 90 01 31 16 0d 89 9a 10 8e 2a f5 c1 c9 13 N...1......*.... 0230 bf c9 8d df 3a 3d 0d 78 94 9c 70 e1 5b 2f 33 13 ....:=.x..p.[/3. 0240 5c 30 ef 54 fc 53 e3 68 73 9e e0 89 c3 0f 11 21 \0.T.S.hs......! 0250 bf b3 19 e8 69 83 6a eb 35 27 1d 0e 35 4a f1 ca ....i.j.5'..5J.. 0260 27 a1 58 3e ee 3c 3f 1f 73 31 f1 10 01 87 24 30 '.X>.U.4..zBH.;O3s 0330 39 28 71 41 7d f4 a2 73 b1 65 7e 60 04 fa 59 8f 9(qA}..s.e~`..Y. 0340 38 f6 4f d0 f5 b7 0b 05 00 25 23 a7 70 87 ac 6a 8.O......%#.p..j 0350 80 c4 0c 49 ad 98 72 c2 9a fe fa 7f 64 09 2b 47 ...I..r.....d.+G 0360 67 ca ba 00 89 c4 74 98 19 cc 1c 5e 62 32 dc 6c g.....t....^b2.l 0370 90 c4 a4 77 c8 e7 7e 44 82 99 2e 9c 50 6e 97 2a ...w..~D....Pn.* 0380 6d e2 af cd dd 1d 92 bf e6 38 57 e1 5d 75 14 a6 m........8W.]u.. 0390 5d 69 c3 66 b3 ce 9e 1e 55 07 df d3 a7 e4 e7 f6 ]i.f....U....... 03a0 5f 6f f9 01 00 14 e4 81 8c 1b 04 0f ac 7d 21 85 _o...........}!. 03b0 0d 39 74 6f 12 02 f4 18 ed ff 56 36 d0 a1 1a 21 .9to......V6...! 03c0 0e 6d fd 28 c1 50 18 b0 0d b7 18 2c ea 2b e9 8c .m.(.P.....,.+.. 03d0 66 bd 46 29 36 d1 f8 03 f4 c9 ea 9f 85 1b a0 83 f.F)6........... 03e0 00 cd 0d ba 42 e2 93 88 a8 b5 4b e7 d4 20 97 f5 ....B.....K.. .. 03f0 6b 76 38 00 1a fc 72 2e ef 65 d8 00 ff db b2 55 kv8...r..e.....U 0400 88 07 90 0d bf 5f 42 8b 06 fa c5 72 2b 25 5c a2 ....._B....r+%\. 0410 07 2a 9a d3 94 43 5d ab 78 fc e5 c9 f5 b4 db b1 .*...C].x....... 0420 f8 43 f1 44 b9 d8 9c c2 77 c2 3a 65 63 22 a4 b5 .C.D....w.:ec".. 0430 90 c5 f2 61 7c 98 10 76 cb a4 ff 83 ab fd fa 10 ...a|..v........ 0440 5d d4 ba b0 a1 b5 5c 79 f3 b2 7f eb c8 f1 33 4d ].....\y......3M 0450 39 19 b5 33 4b fa 83 ff 62 b4 ef fa 37 f7 da 25 9..3K...b...7..% 0460 4d a6 e8 4e 96 2c d3 2a 0d 5e 1b 4a 11 1f c0 df M..N.,.*.^.J.... 0470 4c 38 2c 60 a3 f4 c6 f9 c0 ba 23 02 a1 d0 16 a2 L8,`......#..... 0480 4c e3 be 36 ad f9 31 4c 87 a4 3b 8a e4 77 d0 1d L..6..1L..;..w.. 0490 d1 1f 55 43 63 b1 bf 8c 71 72 16 d1 85 9b a6 3b ..UCc...qr.....; 04a0 a0 e6 99 a1 92 4b 52 73 a4 5c d2 6a 74 ee a3 e4 .....KRs.\.jt... 04b0 76 60 25 b6 3b b5 c0 60 93 9b 62 6c 13 2b 34 02 v`%.;..`..bl.+4. 04c0 80 05 a1 2f ac a5 e8 36 79 9d 27 69 ec 88 ac f3 .../...6y.'i.... 04d0 80 c9 e1 75 4e 8d 4c 83 51 75 bf 69 cc f4 29 5b ...uN.L.Qu.i..)[ 04e0 f5 f5 3e a3 85 35 e3 ee 8b fd a5 f0 5a 5d d8 1e ..>..5......Z].. 04f0 95 36 ac 29 19 fc 20 a0 05 31 a4 75 77 c5 33 e1 .6.).. ..1.uw.3. 0500 12 70 bf 93 24 06 67 d5 b4 a1 46 2c 86 9c 42 94 .p..$.g...F,..B. 0510 0e 2d 3d cd 0d 09 b5 f2 ca 5a 56 7e 5e 5a 04 5e .-=......ZV~^Z.^ 0520 6f ee 48 0d aa 35 c7 77 0a 9b 73 d3 8d bb 18 60 o.H..5.w..s....` 0530 63 a8 08 2f fc 86 03 9f 72 90 2f 05 ef ca dd 27 c../....r./....' 0540 f7 8b 7d 18 f6 b1 3f 76 94 cf a6 56 8c 6e df bf ..}...?v...V.n.. 0550 7b 46 c3 29 24 b1 57 58 39 17 3d e5 09 43 dd 3a {F.)$.WX9.=..C.: 0560 c5 8b 78 04 69 e2 79 5e 90 5f 8b 32 f4 1c 22 32 ..x.i.y^._.2.."2 0570 45 d6 8e a7 bc 7d 72 38 ef 44 49 99 16 7d bb b2 E....}r8.DI..}.. 0580 27 74 f4 b3 d4 de fb 14 33 9e 32 8e 1a 3d cc 95 't......3.2..=.. 0590 a0 c5 8f 66 39 fd 34 89 a2 6f f0 b7 63 6b 8d 2c ...f9.4..o..ck., 05a0 c3 1e 12 92 13 d5 b1 97 a4 32 11 64 ed e9 77 80 .........2.d..w. 05b0 88 29 1c 4b .).K No. Time Source Destination Protocol Info 2692 819.323421 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=1489 Ack=295 Win=7342 Len=1460 Frame 2692 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.081925000 Time delta from previous packet: 0.000079000 seconds Time since reference or first frame: 819.323421000 seconds Frame Number: 2692 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x5052 (20562) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x2086 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 1489, Ack: 295, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 1489 (relative sequence number) Next sequence number: 2949 (relative sequence number) Acknowledgement number: 295 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7342 Checksum: 0xad87 [correct] Data (1460 bytes) 0000 49 41 8d 27 9c b8 36 56 d7 1a 84 70 bb 8b c9 c0 IA.'..6V...p.... 0010 63 f5 de 79 67 03 bc 7d bc 39 ff 88 4c 38 73 fa c..yg..}.9..L8s. 0020 1d de b8 71 ee 6c 47 2d cc fc aa 5e 30 32 77 ad ...q.lG-...^02w. 0030 f5 77 98 93 06 42 f8 08 5a 3b d9 62 77 5b e6 91 .w...B..Z;.bw[.. 0040 21 c3 0d ef ac bb 46 57 a7 e3 d1 db 60 04 73 72 !.....FW....`.sr 0050 6c 92 f5 ae 5e ae 82 c5 f3 8c 46 33 0b 09 54 d7 l...^.....F3..T. 0060 d9 65 fb fe 78 4a 10 4c 96 d2 37 5b 3d 04 89 d7 .e..xJ.L..7[=... 0070 08 17 52 a4 03 13 19 f1 df e8 f8 57 b6 b1 7c 61 ..R........W..|a 0080 1b 39 9d 57 72 80 05 e7 b3 6c c6 39 5d 97 32 e7 .9.Wr....l.9].2. 0090 ad 2d f9 6b ae a3 46 87 cc c6 5f b7 87 00 8f 26 .-.k..F..._....& 00a0 4a 62 fd fa 7e f6 7c ce 37 9f 61 f2 61 a0 9a 94 Jb..~.|.7.a.a... 00b0 8d c6 10 07 81 56 7f 5c 5c c1 17 aa 8c 38 eb 28 .....V.\\....8.( 00c0 15 57 a1 fc b6 0f 99 73 2e 12 21 fc 50 e3 62 3e .W.....s..!.P.b> 00d0 2a 29 b5 87 06 69 4e 7c ab 48 f7 6e 67 40 f5 ae *)...iN|.H.ng@.. 00e0 15 bb 08 73 0f 60 23 e9 e9 e7 41 cf be fc aa 6b ...s.`#...A....k 00f0 cc 4a 0a a5 f3 ce d6 50 91 3c 52 7b 88 5f ec 35 .J.....P.gd.l.l3...u.x 0160 90 fe 6c f4 f4 1e 5b 8f 02 0e 78 85 16 63 c7 b7 ..l...[...x..c.. 0170 53 99 90 21 09 c7 39 bd 1e 8c 88 7d a3 32 5d fb S..!..9....}.2]. 0180 b1 c6 d4 4b 6f e3 b5 ee 9c 12 dc d9 1f 3f c1 d3 ...Ko........?.. 0190 02 a3 61 8f ad 7f 9d 32 5f b9 9b aa f7 f3 90 b5 ..a....2_....... 01a0 7d 5a ec bb 8b ba b5 b5 92 b7 39 c5 38 3f c5 a3 }Z........9.8?.. 01b0 27 b8 ff 5a 3b fc 9b d0 9c 67 44 11 5a fe a4 a5 '..Z;....gD.Z... 01c0 18 fb bf 1c d6 86 2d 09 f7 ff 8b 16 cb 75 5c 8f ......-......u\. 01d0 ec b2 2b 67 98 5d 1c 54 1b 85 ca 59 58 83 59 3e ..+g.].T...YX.Y> 01e0 d9 bb b4 70 42 6f d0 df 33 f0 bf ec ab e7 c9 b8 ...pBo..3....... 01f0 5e a2 17 aa 40 0d ee cf 18 f8 10 34 6a 5b 6f 86 ^...@......4j[o. 0200 ba b5 dd 7b 9d b9 e1 d1 cc 64 ed d9 22 34 f8 fa ...{.....d.."4.. 0210 48 d7 6e 54 9c 20 e0 71 db a2 c7 95 0f aa ed f8 H.nT. .q........ 0220 a2 db 53 c9 e0 f4 f0 af a9 14 80 db d0 dd a8 04 ..S............. 0230 e0 f2 0c 16 7a 14 89 9a 34 fd ab 15 13 3b 37 6c ....z...4....;7l 0240 b8 ac cc e1 a2 6e 0a e1 52 db 88 fd f8 b2 b6 79 .....n..R......y 0250 9f c0 58 c4 14 ac fd 10 11 b8 85 6d af 5a b2 a2 ..X........m.Z.. 0260 93 d4 b9 68 2e 79 e6 02 17 9d ec ed e5 85 f2 5a ...h.y.........Z 0270 f7 18 d0 9a 25 ae c1 29 1d 71 3b d0 24 20 a2 47 ....%..).q;.$ .G 0280 b7 ad 38 d5 07 8e 57 f0 1f a3 80 8d 6c d6 57 43 ..8...W.....l.WC 0290 71 d0 b7 f1 81 8c 1d 33 15 3c 32 57 d9 a4 d2 c3 q......3.<2W.... 02a0 d2 bf e6 c1 1c ed 2a 91 e7 f4 cf cf 64 ed 05 25 ......*.....d..% 02b0 fa 49 0c 68 91 a3 3a fb 5d e6 b5 7d 8a 13 db 1b .I.h..:.]..}.... 02c0 4a b6 df 4b 9c b3 d6 54 8c 28 14 ef 58 cb 1d d1 J..K...T.(..X... 02d0 63 72 00 a8 c4 72 e3 48 e2 77 50 5e 2e 60 15 72 cr...r.H.wP^.`.r 02e0 33 00 ea 93 27 07 5e 00 ab 25 a9 40 5c bb e8 7b 3...'.^..%.@\..{ 02f0 55 49 3f 08 c9 ae d6 f1 c4 34 63 4a 48 08 10 db UI?......4cJH... 0300 eb e8 fb a7 a4 1f 27 33 39 c9 39 99 f2 10 e8 be ......'39.9..... 0310 c2 a7 eb 86 44 37 38 05 c7 28 0b ec 40 be a1 3b ....D78..(..@..; 0320 a3 bf b5 88 e4 d9 02 33 25 b4 06 34 a8 ce e7 e7 .......3%..4.... 0330 6b ca b0 8e 36 bc 7d 39 b5 35 ce 55 40 2f 6b 1e k...6.}9.5.U@/k. 0340 e8 57 03 9f 72 81 12 32 bd 4d 9f 76 87 7f c8 ee .W..r..2.M.v.... 0350 a3 ad d3 d3 f3 9c cb 0b f0 ca 70 6d ff 3c 33 69 ..........pm.<3i 0360 35 36 dd e0 0b 91 72 0a c7 93 f7 e8 49 82 2e a2 56....r.....I... 0370 69 89 a1 b3 9d 2d f2 ed d8 45 2d 43 23 63 dc 43 i....-...E-C#c.C 0380 12 15 0e 92 f2 85 1c ae 7b 7e 45 99 7c fb 9b 3d ........{~E.|..= 0390 83 8a 3c 6e c1 60 ac 06 8c a9 52 f3 51 d1 5c 32 ......2..*E. 0500 4c c8 8d 64 c3 eb ac 33 f6 71 9b 3b 0a 37 4e e7 L..d...3.q.;.7N. 0510 3d ab 91 cb 41 9d 6e 97 7c 2d 0b 33 94 91 6e 0e =...A.n.|-.3..n. 0520 87 96 db 2c d6 3b 02 09 bc c8 fa 31 74 f6 fa c9 ...,.;.....1t... 0530 32 aa 3e 68 c6 fb db 48 14 b8 33 bc a0 0b 16 3a 2.>h...H..3....: 0540 d8 3e c0 2c 1b d5 7a 6e 73 ac ca b4 56 b9 82 83 .>.,..zns...V... 0550 e4 07 73 bb 85 0f 63 ee 7c d7 ae 80 0e 9b 7f 5c ..s...c.|......\ 0560 7f 94 6a 31 a8 5f 3e fa 04 88 e4 e1 9b e3 75 10 ..j1._>.......u. 0570 55 f1 1d a2 a4 4e 89 de e2 9d ae 60 e5 26 3d ca U....N.....`.&=. 0580 90 de 9e fc 3c 89 8a 32 bb b5 ad 34 39 e3 6d 2d ....<..2...49.m- 0590 ec 36 db 89 26 6a 35 00 73 31 f7 aa a9 21 9a a5 .6..&j5.s1...!.. 05a0 ab 6b 78 c2 25 0c 52 5a 38 ac 28 44 61 c0 a8 30 .kx.%.RZ8.(Da..0 05b0 1e 50 6d 78 .Pmx No. Time Source Destination Protocol Info 2693 819.323465 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=295 Ack=2949 Win=17520 [TCP CHECKSUM INCORRECT] Len=0 Frame 2693 (54 bytes on wire, 54 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.081969000 Time delta from previous packet: 0.000044000 seconds Time since reference or first frame: 819.323465000 seconds Frame Number: 2693 Packet Length: 54 bytes Capture Length: 54 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x41a8 (16808) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x34e4] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 295, Ack: 2949, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 295 (relative sequence number) Acknowledgement number: 2949 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x845e [incorrect, should be 0x4d60] SEQ/ACK analysis This is an ACK to the segment in frame: 2692 The RTT to ACK the segment was: 0.000044000 seconds No. Time Source Destination Protocol Info 2694 819.323577 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=2949 Ack=295 Win=7342 Len=70 Frame 2694 (124 bytes on wire, 124 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.082081000 Time delta from previous packet: 0.000112000 seconds Time since reference or first frame: 819.323577000 seconds Frame Number: 2694 Packet Length: 124 bytes Capture Length: 124 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 110 Identification: 0x5252 (21074) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x23f4 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 2949, Ack: 295, Len: 70 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 2949 (relative sequence number) Next sequence number: 3019 (relative sequence number) Acknowledgement number: 295 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7342 Checksum: 0x30e7 [correct] Data (70 bytes) 0000 04 3f b7 9a c6 56 cb 1e 3e 3b 57 e5 6f 77 ab b5 .?...V..>;W.ow.. 0010 3c a7 b2 53 12 61 ef e7 e3 77 26 84 b3 92 ca b6 <..S.a...w&..... 0020 a0 b1 7c ec 02 8c 5f 9d 39 07 1d d2 35 1d ec 45 ..|..._.9...5..E 0030 b7 31 c3 fc 58 e5 5a 2d ac fc ba 57 bf 6e 78 91 .1..X.Z-...W.nx. 0040 85 c9 d2 57 ae 0b ...W.. No. Time Source Destination Protocol Info 2695 819.325916 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=295 Ack=3019 Win=17450 [TCP CHECKSUM INCORRECT] Len=130 Frame 2695 (184 bytes on wire, 184 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.084420000 Time delta from previous packet: 0.002339000 seconds Time since reference or first frame: 819.325916000 seconds Frame Number: 2695 Packet Length: 184 bytes Capture Length: 184 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 170 Identification: 0x41a9 (16809) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3461] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 295, Ack: 3019, Len: 130 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 295 (relative sequence number) Next sequence number: 425 (relative sequence number) Acknowledgement number: 3019 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17450 Checksum: 0x84e0 [incorrect, should be 0x38bb] SEQ/ACK analysis This is an ACK to the segment in frame: 2694 The RTT to ACK the segment was: 0.002339000 seconds Data (130 bytes) 0000 bc ef 82 00 b5 fe 18 00 68 00 00 21 d8 71 32 0a ........h..!.q2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9c bc 30 aa 3b b1 29 76 a.elr.....0.;.)v 0030 47 94 71 28 3b 30 07 f5 87 4b 06 ee db 96 e3 20 G.q(;0...K..... 0040 6e 14 79 4a 9d 84 8e 9a 85 6b fd 0f bc cc 2b 74 n.yJ.....k....+t 0050 7c 34 05 2e 61 94 85 7d 9d 4b 6e f1 ab 32 18 41 |4..a..}.Kn..2.A 0060 6e 14 67 2a 89 84 71 fc 85 6b 85 40 b5 ea d7 09 n.g*..q..k.@.... 0070 65 34 63 a9 75 30 7d 75 8c 4b 1e 6e 9f 33 f8 04 e4c.u0}u.K.n.3.. 0080 82 00 .. No. Time Source Destination Protocol Info 2696 819.326255 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=3019 Ack=425 Win=7212 Len=190 Frame 2696 (244 bytes on wire, 244 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.084759000 Time delta from previous packet: 0.000339000 seconds Time since reference or first frame: 819.326255000 seconds Frame Number: 2696 Packet Length: 244 bytes Capture Length: 244 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 230 Identification: 0x5352 (21330) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x227c [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 3019, Ack: 425, Len: 190 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 3019 (relative sequence number) Next sequence number: 3209 (relative sequence number) Acknowledgement number: 425 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7212 Checksum: 0xb0be [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2695 The RTT to ACK the segment was: 0.000339000 seconds Data (190 bytes) 0000 bc ef be 00 b5 fe 18 00 a2 00 02 21 1f e8 32 0a ...........!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6c 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.l.].....#T;.+t 0030 18 90 76 2e 77 94 7a 7d 91 4b 05 f0 8b 32 e4 42 ..v.w.z}.K...2.B 0040 7f 14 03 1f d5 86 8f f0 85 6b fd f1 8c 06 64 3a .........k....d: 0050 37 7c 4d 30 61 96 fc 99 9d 4b 62 0f ab 32 18 43 7|M0a....Kb..2.C 0060 6f 9c 65 28 85 84 71 ee fd e9 85 96 cf 4e ca 8b o.e(..q......N.. 0070 6f 34 61 2e 69 a5 48 fd 8f 4b 16 f0 b3 32 ac 0a o4a.i.H..K...2.. 0080 17 5c 5b 66 e5 84 8d f2 85 6b ed f1 ad cc 30 72 .\[f.....k....0r 0090 53 34 3c 30 51 94 fd 99 a1 4b 5e 0f aa 32 18 43 S4<0Q....K^..2.C 00a0 73 b0 7f 8c 92 84 75 ee ad cf ae 96 d8 4e a2 2f s.....u......N./ 00b0 6e 34 5d 2e 59 94 00 ff 91 ef d1 5a be 00 n4].Y......Z.. No. Time Source Destination Protocol Info 2699 819.384993 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=425 Ack=3209 Win=17260 [TCP CHECKSUM INCORRECT] Len=130 Frame 2699 (184 bytes on wire, 184 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.143497000 Time delta from previous packet: 0.058738000 seconds Time since reference or first frame: 819.384993000 seconds Frame Number: 2699 Packet Length: 184 bytes Capture Length: 184 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 170 Identification: 0x41ab (16811) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x345f] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 425, Ack: 3209, Len: 130 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 425 (relative sequence number) Next sequence number: 555 (relative sequence number) Acknowledgement number: 3209 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17260 Checksum: 0x84e0 [incorrect, should be 0x3839] SEQ/ACK analysis This is an ACK to the segment in frame: 2696 The RTT to ACK the segment was: 0.058738000 seconds Data (130 bytes) 0000 bc ef 82 00 b5 fe 18 00 68 00 00 21 d8 71 32 0a ........h..!.q2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9c bc 30 aa 3b b1 29 76 a.elr.....0.;.)v 0030 47 94 71 28 3b 30 07 f5 87 4b 06 ee db 96 e3 20 G.q(;0...K..... 0040 6e 14 79 4a 9d 84 8e 9a 85 6b fd 0f bc cc 2b 74 n.yJ.....k....+t 0050 7c 34 05 2e 61 94 85 7d 9d 4b 6e f1 ab 32 18 41 |4..a..}.Kn..2.A 0060 6e 14 67 2a 89 84 71 fc 85 6b 85 40 b5 ea d7 09 n.g*..q..k.@.... 0070 65 34 63 a9 75 30 7d 75 8c 4b 1e 6e 9f 33 f8 04 e4c.u0}u.K.n.3.. 0080 82 00 .. No. Time Source Destination Protocol Info 2700 819.385395 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=3209 Ack=555 Win=7604 Len=190 Frame 2700 (244 bytes on wire, 244 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.143899000 Time delta from previous packet: 0.000402000 seconds Time since reference or first frame: 819.385395000 seconds Frame Number: 2700 Packet Length: 244 bytes Capture Length: 244 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 230 Identification: 0x5652 (22098) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x1f7c [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 3209, Ack: 555, Len: 190 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 3209 (relative sequence number) Next sequence number: 3399 (relative sequence number) Acknowledgement number: 555 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7604 Checksum: 0x6656 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2699 The RTT to ACK the segment was: 0.000402000 seconds Data (190 bytes) 0000 bc ef be 00 b5 fe 18 00 a2 00 02 21 41 38 32 0a ...........!A82. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6c 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.l.].....#T;.+t 0030 18 90 76 2e 77 94 7a 7d 91 4b 05 f0 8b 32 e4 42 ..v.w.z}.K...2.B 0040 7f 14 03 1f d5 86 8f f0 85 6b fd f1 8c 06 64 3a .........k....d: 0050 37 7c 4d 30 61 96 fc 99 9d 4b 62 0f ab 32 18 43 7|M0a....Kb..2.C 0060 6f 9c 65 28 85 84 71 ee fd e9 85 96 cf 4e ca 8b o.e(..q......N.. 0070 6f 34 61 2e 69 a5 48 fd 8f 4b 16 f0 b3 32 ac 0a o4a.i.H..K...2.. 0080 17 5c 5b 66 e5 84 8d f2 85 6b ed f1 ad cc 30 72 .\[f.....k....0r 0090 53 34 3c 30 51 94 fd 99 a1 4b 5e 0f aa 32 18 43 S4<0Q....K^..2.C 00a0 73 b0 7f 8c 92 84 75 ee ad cf ae 96 d8 4e a2 2f s.....u......N./ 00b0 6e 34 5d 2e 59 94 00 ff 91 ef f7 aa be 00 n4].Y......... No. Time Source Destination Protocol Info 2701 819.387469 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=555 Ack=3399 Win=17070 [TCP CHECKSUM INCORRECT] Len=130 Frame 2701 (184 bytes on wire, 184 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.145973000 Time delta from previous packet: 0.002074000 seconds Time since reference or first frame: 819.387469000 seconds Frame Number: 2701 Packet Length: 184 bytes Capture Length: 184 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 170 Identification: 0x41ac (16812) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x345e] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 555, Ack: 3399, Len: 130 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 555 (relative sequence number) Next sequence number: 685 (relative sequence number) Acknowledgement number: 3399 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17070 Checksum: 0x84e0 [incorrect, should be 0x37b7] SEQ/ACK analysis This is an ACK to the segment in frame: 2700 The RTT to ACK the segment was: 0.002074000 seconds Data (130 bytes) 0000 bc ef 82 00 b5 fe 18 00 68 00 00 21 d8 71 32 0a ........h..!.q2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9c bc 30 aa 3b b1 29 76 a.elr.....0.;.)v 0030 47 94 71 28 3b 30 07 f5 87 4b 06 ee db 96 e3 20 G.q(;0...K..... 0040 6e 14 79 4a 9d 84 8e 9a 85 6b fd 0f bc cc 2b 74 n.yJ.....k....+t 0050 7c 34 05 2e 61 94 85 7d 9d 4b 6e f1 ab 32 18 41 |4..a..}.Kn..2.A 0060 6e 14 67 2a 89 84 71 fc 85 6b 85 40 b5 ea d7 09 n.g*..q..k.@.... 0070 65 34 63 a9 75 30 7d 75 8c 4b 1e 6e 9f 33 f8 04 e4c.u0}u.K.n.3.. 0080 82 00 .. No. Time Source Destination Protocol Info 2702 819.387748 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=3399 Ack=685 Win=7474 Len=190 Frame 2702 (244 bytes on wire, 244 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.146252000 Time delta from previous packet: 0.000279000 seconds Time since reference or first frame: 819.387748000 seconds Frame Number: 2702 Packet Length: 244 bytes Capture Length: 244 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 230 Identification: 0x5852 (22610) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x1d7c [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 3399, Ack: 685, Len: 190 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 3399 (relative sequence number) Next sequence number: 3589 (relative sequence number) Acknowledgement number: 685 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7474 Checksum: 0xad38 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2701 The RTT to ACK the segment was: 0.000279000 seconds Data (190 bytes) 0000 bc ef be 00 b5 fe 18 00 a2 00 02 21 1f e8 32 0a ...........!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6c 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.l.].....#T;.+t 0030 18 90 76 2e 77 94 7a 7d 91 4b 05 f0 8b 32 e4 42 ..v.w.z}.K...2.B 0040 7f 14 03 1f d5 86 8f f0 85 6b fd f1 8c 06 64 3a .........k....d: 0050 37 7c 4d 30 61 96 fc 99 9d 4b 62 0f ab 32 18 43 7|M0a....Kb..2.C 0060 6f 9c 65 28 85 84 71 ee fd e9 85 96 cf 4e ca 8b o.e(..q......N.. 0070 6f 34 61 2e 69 a5 48 fd 8f 4b 16 f0 b3 32 ac 0a o4a.i.H..K...2.. 0080 17 5c 5b 66 e5 84 8d f2 85 6b ed f1 ad cc 30 72 .\[f.....k....0r 0090 53 34 3c 30 51 94 fd 99 a1 4b 5e 0f aa 32 18 43 S4<0Q....K^..2.C 00a0 73 b0 7f 8c 92 84 75 ee ad cf ae 96 d8 4e a2 2f s.....u......N./ 00b0 6e 34 5d 2e 59 94 00 ff 91 ef d1 5a be 00 n4].Y......Z.. No. Time Source Destination Protocol Info 2703 819.389722 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=685 Ack=3589 Win=16880 [TCP CHECKSUM INCORRECT] Len=130 Frame 2703 (184 bytes on wire, 184 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.148226000 Time delta from previous packet: 0.001974000 seconds Time since reference or first frame: 819.389722000 seconds Frame Number: 2703 Packet Length: 184 bytes Capture Length: 184 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 170 Identification: 0x41ad (16813) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x345d] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 685, Ack: 3589, Len: 130 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 685 (relative sequence number) Next sequence number: 815 (relative sequence number) Acknowledgement number: 3589 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16880 Checksum: 0x84e0 [incorrect, should be 0x3735] SEQ/ACK analysis This is an ACK to the segment in frame: 2702 The RTT to ACK the segment was: 0.001974000 seconds Data (130 bytes) 0000 bc ef 82 00 b5 fe 18 00 68 00 00 21 d8 71 32 0a ........h..!.q2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9c bc 30 aa 3b b1 29 76 a.elr.....0.;.)v 0030 47 94 71 28 3b 30 07 f5 87 4b 06 ee db 96 e3 20 G.q(;0...K..... 0040 6e 14 79 4a 9d 84 8e 9a 85 6b fd 0f bc cc 2b 74 n.yJ.....k....+t 0050 7c 34 05 2e 61 94 85 7d 9d 4b 6e f1 ab 32 18 41 |4..a..}.Kn..2.A 0060 6e 14 67 2a 89 84 71 fc 85 6b 85 40 b5 ea d7 09 n.g*..q..k.@.... 0070 65 34 63 a9 75 30 7d 75 8c 4b 1e 6e 9f 33 f8 04 e4c.u0}u.K.n.3.. 0080 82 00 .. No. Time Source Destination Protocol Info 2704 819.390010 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=3589 Ack=815 Win=7344 Len=190 Frame 2704 (244 bytes on wire, 244 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.148514000 Time delta from previous packet: 0.000288000 seconds Time since reference or first frame: 819.390010000 seconds Frame Number: 2704 Packet Length: 244 bytes Capture Length: 244 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 230 Identification: 0x5a52 (23122) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x1b7c [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 3589, Ack: 815, Len: 190 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 3589 (relative sequence number) Next sequence number: 3779 (relative sequence number) Acknowledgement number: 815 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7344 Checksum: 0x64da [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2703 The RTT to ACK the segment was: 0.000288000 seconds Data (190 bytes) 0000 bc ef be 00 b5 fe 18 00 a2 00 02 21 41 38 32 0a ...........!A82. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6c 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.l.].....#T;.+t 0030 18 90 76 2e 77 94 7a 7d 91 4b 05 f0 8b 32 e4 42 ..v.w.z}.K...2.B 0040 7f 14 03 1f d5 86 8f f0 85 6b fd f1 8c 06 64 3a .........k....d: 0050 37 7c 4d 30 61 96 fc 99 9d 4b 62 0f ab 32 18 43 7|M0a....Kb..2.C 0060 6f 9c 65 28 85 84 71 ee fd e9 85 96 cf 4e ca 8b o.e(..q......N.. 0070 6f 34 61 2e 69 a5 48 fd 8f 4b 16 f0 b3 32 ac 0a o4a.i.H..K...2.. 0080 17 5c 5b 66 e5 84 8d f2 85 6b ed f1 ad cc 30 72 .\[f.....k....0r 0090 53 34 3c 30 51 94 fd 99 a1 4b 5e 0f aa 32 18 43 S4<0Q....K^..2.C 00a0 73 b0 7f 8c 92 84 75 ee ad cf ae 96 d8 4e a2 2f s.....u......N./ 00b0 6e 34 5d 2e 59 94 00 ff 91 ef f7 aa be 00 n4].Y......... No. Time Source Destination Protocol Info 2705 819.391942 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=815 Ack=3779 Win=16690 [TCP CHECKSUM INCORRECT] Len=130 Frame 2705 (184 bytes on wire, 184 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.150446000 Time delta from previous packet: 0.001932000 seconds Time since reference or first frame: 819.391942000 seconds Frame Number: 2705 Packet Length: 184 bytes Capture Length: 184 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 170 Identification: 0x41ae (16814) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x345c] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 815, Ack: 3779, Len: 130 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 815 (relative sequence number) Next sequence number: 945 (relative sequence number) Acknowledgement number: 3779 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16690 Checksum: 0x84e0 [incorrect, should be 0x36b3] SEQ/ACK analysis This is an ACK to the segment in frame: 2704 The RTT to ACK the segment was: 0.001932000 seconds Data (130 bytes) 0000 bc ef 82 00 b5 fe 18 00 68 00 00 21 d8 71 32 0a ........h..!.q2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9c bc 30 aa 3b b1 29 76 a.elr.....0.;.)v 0030 47 94 71 28 3b 30 07 f5 87 4b 06 ee db 96 e3 20 G.q(;0...K..... 0040 6e 14 79 4a 9d 84 8e 9a 85 6b fd 0f bc cc 2b 74 n.yJ.....k....+t 0050 7c 34 05 2e 61 94 85 7d 9d 4b 6e f1 ab 32 18 41 |4..a..}.Kn..2.A 0060 6e 14 67 2a 89 84 71 fc 85 6b 85 40 b5 ea d7 09 n.g*..q..k.@.... 0070 65 34 63 a9 75 30 7d 75 8c 4b 1e 6e 9f 33 f8 04 e4c.u0}u.K.n.3.. 0080 82 00 .. No. Time Source Destination Protocol Info 2706 819.392220 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=3779 Ack=945 Win=7214 Len=190 Frame 2706 (244 bytes on wire, 244 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.150724000 Time delta from previous packet: 0.000278000 seconds Time since reference or first frame: 819.392220000 seconds Frame Number: 2706 Packet Length: 244 bytes Capture Length: 244 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 230 Identification: 0x5c52 (23634) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x197c [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 3779, Ack: 945, Len: 190 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 3779 (relative sequence number) Next sequence number: 3969 (relative sequence number) Acknowledgement number: 945 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7214 Checksum: 0xabbc [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2705 The RTT to ACK the segment was: 0.000278000 seconds Data (190 bytes) 0000 bc ef be 00 b5 fe 18 00 a2 00 02 21 1f e8 32 0a ...........!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6c 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.l.].....#T;.+t 0030 18 90 76 2e 77 94 7a 7d 91 4b 05 f0 8b 32 e4 42 ..v.w.z}.K...2.B 0040 7f 14 03 1f d5 86 8f f0 85 6b fd f1 8c 06 64 3a .........k....d: 0050 37 7c 4d 30 61 96 fc 99 9d 4b 62 0f ab 32 18 43 7|M0a....Kb..2.C 0060 6f 9c 65 28 85 84 71 ee fd e9 85 96 cf 4e ca 8b o.e(..q......N.. 0070 6f 34 61 2e 69 a5 48 fd 8f 4b 16 f0 b3 32 ac 0a o4a.i.H..K...2.. 0080 17 5c 5b 66 e5 84 8d f2 85 6b ed f1 ad cc 30 72 .\[f.....k....0r 0090 53 34 3c 30 51 94 fd 99 a1 4b 5e 0f aa 32 18 43 S4<0Q....K^..2.C 00a0 73 b0 7f 8c 92 84 75 ee ad cf ae 96 d8 4e a2 2f s.....u......N./ 00b0 6e 34 5d 2e 59 94 00 ff 91 ef d1 5a be 00 n4].Y......Z.. No. Time Source Destination Protocol Info 2707 819.393703 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=945 Ack=3969 Win=16500 [TCP CHECKSUM INCORRECT] Len=110 Frame 2707 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.152207000 Time delta from previous packet: 0.001483000 seconds Time since reference or first frame: 819.393703000 seconds Frame Number: 2707 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0x41af (16815) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x346f] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 945, Ack: 3969, Len: 110 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 945 (relative sequence number) Next sequence number: 1055 (relative sequence number) Acknowledgement number: 3969 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16500 Checksum: 0x84cc [incorrect, should be 0x13f0] SEQ/ACK analysis This is an ACK to the segment in frame: 2706 The RTT to ACK the segment was: 0.001483000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 54 00 00 21 88 49 32 0a ..n.....T..!.I2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a a5 bc 77 aa 3b b1 3e 76 a.elr.....w.;.>v 0030 73 90 2d 28 7e 94 06 f5 8d 4b 06 ee de 96 e3 20 s.-(~....K..... 0040 73 14 03 d8 9d 84 f3 3e 82 6b f7 0f c4 4e a6 d0 s......>.k...N.. 0050 78 34 15 2e 61 94 cf 59 9a 4b 6e f1 ab 32 18 41 x4..a..Y.Kn..2.A 0060 73 b0 1a 2a 84 84 79 fc a9 6a 85 40 6e 00 s..*..y..j.@n. No. Time Source Destination Protocol Info 2708 819.396508 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=3969 Ack=1055 Win=7104 Len=1460 Frame 2708 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.155012000 Time delta from previous packet: 0.002805000 seconds Time since reference or first frame: 819.396508000 seconds Frame Number: 2708 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x5e52 (24146) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x1286 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 3969, Ack: 1055, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 3969 (relative sequence number) Next sequence number: 5429 (relative sequence number) Acknowledgement number: 1055 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7104 Checksum: 0xe844 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2707 The RTT to ACK the segment was: 0.002805000 seconds Data (1460 bytes) 0000 bc ef 3e 0b b5 fe 18 00 19 20 12 21 29 0b 32 0a ..>...... .!).2. 0010 04 00 3c 2a 71 43 00 00 70 1a 0f f0 5b bf 76 4c ..<*qC..p...[.vL 0020 6f 01 75 2a 75 b5 49 d1 87 dd b3 0b ba f0 b6 c3 o.u*u.I......... 0030 69 2b c2 f6 66 94 22 4e 83 77 4f f0 a3 0b d7 4a i+..f."N.wO....J 0040 ec 14 02 e3 99 86 4c 68 06 6f 95 f1 f4 4e 95 fa ......Lh.o...N.. 0050 0f f2 03 27 86 a3 fe 12 ae d2 ad 1b 2b 2e 58 5b ...'........+.X[ 0060 6f 12 15 60 06 86 f8 5e 35 e3 5c 10 48 4c cc bd o..`...^5.\.HL.. 0070 0f 75 69 09 3f 16 00 fb 8d 4a 75 e0 46 bf 4e 42 .ui.?....Ju.F.NB 0080 7a 0f de ec af ed 29 28 e9 59 71 78 74 62 8c 7f z.....)(.Yqxtb.. 0090 5f 09 d8 d9 30 4b 18 5c a0 f9 42 7f 40 85 88 cc _...0K.\..B.@... 00a0 6c 9e 1b 08 d2 4c 4a ac 95 50 35 37 e7 bf 51 b1 l....LJ..P57..Q. 00b0 b4 d4 61 0f 55 57 d1 f2 4b 08 2f 38 e6 a0 2c 32 ..a.UW..K./8..,2 00c0 46 3b 32 2f b1 5a e0 c6 67 e8 79 da 98 cb af d3 F;2/.Z..g.y..... 00d0 c6 b8 72 39 ab 81 54 69 cd 61 75 4d 3c 3e e0 73 ..r9..Ti.auM<>.s 00e0 2c 1d 5a 46 b5 d7 61 7f 65 75 0c 12 63 ce 37 b3 ,.ZF..a.eu..c.7. 00f0 99 74 3f 67 6d 00 08 3d 6f 42 f6 10 fc 06 11 4c .t?gm..=oB.....L 0100 db 9c e3 94 5d 75 14 86 a1 49 4d f9 7b 44 af a2 ....]u...IM.{D.. 0110 24 03 6f 72 01 56 fe 39 fc 5b e0 7c a3 29 94 64 $.or.V.9.[.|.).d 0120 fe 10 94 ea d5 04 a3 9c b7 f0 87 f0 9e 6e 71 3d .............nq= 0130 bf 51 a1 cd f5 24 a1 f3 f4 5b 8e d0 d0 29 a9 c4 .Q...$...[...).. 0140 37 93 c1 c1 36 4c 8b f6 84 7f 9d 27 db 9e 70 6a 7...6L.....'..pj 0150 37 34 e2 05 22 1a 0c a8 4e 52 c0 41 ee 5a 84 20 74.."...NR.A.Z. 0160 e1 c7 33 5d 49 8f 63 20 ee e3 a7 de e0 8d 40 13 ..3]I.c ......@. 0170 a7 87 a6 92 26 ec f6 6f 73 a3 f5 8f 0b df de 67 ....&..os......g 0180 c1 96 d2 b3 c6 48 86 e4 4a 29 03 e3 1d 29 af 4d .....H..J)...).M 0190 16 6c 43 b8 50 1d 9b 21 92 6f d6 bd 11 c6 1a f7 .lC.P..!.o...... 01a0 6f 34 12 5d ed 49 cb fa 90 b0 2c b8 bd 5e b4 8c o4.].I....,..^.. 01b0 5c 76 20 59 57 56 af 01 68 6a 0a 06 d6 0c a2 ba \v YWV..hj...... 01c0 31 c4 4a db d1 e4 45 a2 75 51 88 d0 4d 41 06 01 1.J...E.uQ..MA.. 01d0 4e 0c 3a d7 e3 87 2c 42 bd ae 8a 40 a7 4e f1 1a N.:...,B...@.N.. 01e0 68 47 16 93 d2 60 23 17 78 4d 5d e8 e1 e1 12 6a hG...`#.xM]....j 01f0 b5 1d de f4 65 8d 14 50 72 15 d1 b2 41 29 80 9e ....e..Pr...A).. 0200 56 07 dc 07 53 dd 60 09 70 77 6f 72 2a 2a 2f ea V...S.`.pwor**/. 0210 95 25 c7 e7 ce 52 f3 50 4d 2a 7b 68 98 bc e8 94 .%...R.PM*{h.... 0220 16 51 35 aa fc df 06 6b a6 7b 6b e1 13 61 ce 73 .Q5....k.{k..a.s 0230 7c f5 2a eb e8 38 0d 6c d0 aa be 8d ea da ec cd |.*..8.l........ 0240 1e 62 c7 fa 2f c6 72 5d bc 5c f5 15 85 77 b7 9c .b../.r].\...w.. 0250 4e f9 99 2e 80 b6 0c c5 a9 3a 48 b6 f7 dc d5 05 N........:H..... 0260 58 67 c7 fe e2 3c c3 cb b3 15 82 8b 0a 0b 13 45 Xg...<.........E 0270 a4 cf bb c8 21 e1 0c 4e 94 03 d1 ea 2a 95 08 90 ....!..N....*... 0280 d6 e2 e8 d9 4a db b9 99 3b e5 ec 3c 34 ff cc 0a ....J...;..<4... 0290 4a 37 32 84 88 4a 4c 3e e5 81 de fe bf c9 65 6d J72..JL>......em 02a0 b6 0d 3e f6 85 3f 10 07 9c 8e c2 1f ae 23 6c 72 ..>..?.......#lr 02b0 05 bf 40 e0 32 a8 be 2f 6f 30 5e 3b ff 40 5d 9b ..@.2../o0^;.@]. 02c0 d5 4f 81 0a 41 99 7b 18 86 ff 78 41 49 df ee 16 .O..A.{...xAI... 02d0 08 28 46 b5 da a7 4c c2 16 30 8a 73 2a e5 8c 1f .(F...L..0.s*... 02e0 7e 36 f6 95 d5 be f3 7e 81 99 c5 1e 25 77 17 17 ~6.....~....%w.. 02f0 16 63 37 e4 ef 95 36 24 7f d4 8a be 5a c2 89 42 .c7...6$....Z..B 0300 4a 6f 5f 46 4b 67 0d 63 85 56 cf 7b 40 c2 0d b0 Jo_FKg.c.V.{@... 0310 01 28 f5 b3 a1 85 50 00 a2 e0 eb 7b 6c 9d 5b 85 .(....P....{l.[. 0320 ce 71 c6 0c 20 5f 09 7d f9 f7 b2 4c 35 ef d1 c7 .q.. _.}...L5... 0330 84 df aa 79 06 7b 24 3b 22 82 e9 5f d9 14 67 42 ...y.{$;".._..gB 0340 f1 44 c3 c4 6d 3b 2c 4c 92 6a c0 9e 0d 42 2e f7 .D..m;,L.j...B.. 0350 c6 c2 b4 d3 0e 66 8d 3b d4 71 e5 6d 14 e5 a7 bc .....f.;.q.m.... 0360 ea 01 59 c3 6a 5f 5c 76 72 d2 5a ad 14 a5 17 d7 ..Y.j_\vr.Z..... 0370 fe f0 22 b7 9f d0 78 c8 11 76 da 6f 5f ca e8 5c .."...x..v.o_..\ 0380 5c 6e 93 ca 44 10 9e b5 73 c4 29 7f 8a ff a0 0a \n..D...s.)..... 0390 c6 bc fb 67 7b e9 ef f6 61 42 dc be 4b eb 63 83 ...g{...aB..K.c. 03a0 52 de 2b 47 f7 bf 4b f6 14 c9 ba ce 6d 39 68 fd R.+G..K.....m9h. 03b0 70 df cf 4f 7b 8b 4d 52 42 f4 1e 03 6f 14 6c 3f p..O{.MRB...o.l? 03c0 9e 92 88 b6 c3 61 73 9d 62 61 97 46 55 24 fc 42 .....as.ba.FU$.B 03d0 c6 5b 9b 0a 6b 1c df b6 d8 37 9b 8e cf a2 6d ae .[..k....7....m. 03e0 fd 88 82 7f 1d b1 e2 56 ad 5a 16 73 dc 10 6a 5d .......V.Z.s..j] 03f0 0d 26 db 3d f5 82 24 e8 f7 39 49 1c 26 16 ac 62 .&.=..$..9I.&..b 0400 0f 39 7c 70 da a9 b6 1c a8 88 ca 7c bc 15 55 86 .9|p.......|..U. 0410 3e ef 12 5b 5c cd 38 ca 75 07 62 f1 dc 5c e5 ca >..[\.8.u.b..\.. 0420 e3 9a a6 24 66 9a d0 97 9a fc 94 f5 4a 72 1b 42 ...$f.......Jr.B 0430 6f 7b 95 47 6a 0d f5 69 03 8e 5c 11 2c 73 f7 13 o{.Gj..i..\.,s.. 0440 df fe 8f 5e 6e ed 73 78 dd 52 cc c0 cd b8 dd ff ...^n.sx.R...... 0450 79 ba 07 0f 06 9c d2 e8 f2 65 f4 c2 fb b0 88 a1 y........e...... 0460 27 33 9a 69 41 39 64 31 43 31 30 59 6f bc 95 21 '3.iA9d1C10Yo..! 0470 8d 0a 42 28 01 f7 c9 16 7d 6f 77 9f 49 61 b6 fa ..B(....}ow.Ia.. 0480 dc a6 77 cc b3 20 82 ed 58 c1 fc 28 57 7f 85 e4 ..w.. ..X..(W... 0490 48 50 53 00 88 3a ee 73 b9 16 ac 54 09 ad 2f 80 HPS..:.s...T../. 04a0 5e 7f 4f 2c a1 18 bb 3c 97 6e 59 8e 8f d6 01 52 ^.O,...<.nY....R 04b0 51 0b e8 8b 13 9d 1d 40 eb 75 88 fd e6 17 fd b7 Q......@.u...... 04c0 ee 6d ac 8b 3c 56 5c 08 7a 42 20 0d eb 2c 49 4a .m..`^..i...s 0540 b9 fd 64 fa cf 27 e3 ce 24 05 13 89 7e 39 23 de ..d..'..$...~9#. 0550 29 05 b5 97 0e 75 bf 26 6f f2 5e d1 97 74 50 53 )....u.&o.^..tPS 0560 37 00 60 af b4 b1 35 89 f7 c3 3a 62 35 e7 db a1 7.`...5...:b5... 0570 5e a5 fc 49 25 95 3e b2 8a 15 77 a8 f8 a4 10 b2 ^..I%.>...w..... 0580 cf 4e 56 4c 44 34 52 98 79 8d 6d 26 20 48 af 1b .NVLD4R.y.m& H.. 0590 de 32 d3 bb 08 51 a7 3b c9 9b c1 f1 0a 43 f6 c7 .2...Q.;.....C.. 05a0 23 bc 6f 24 77 c4 4d b2 3b a2 5d ef 22 a7 f1 c5 #.o$w.M.;.]."... 05b0 de 7e 25 d2 .~%. No. Time Source Destination Protocol Info 2710 819.578562 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=1055 Ack=5429 Win=17520 [TCP CHECKSUM INCORRECT] Len=0 Frame 2710 (54 bytes on wire, 54 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.337066000 Time delta from previous packet: 0.182054000 seconds Time since reference or first frame: 819.578562000 seconds Frame Number: 2710 Packet Length: 54 bytes Capture Length: 54 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x41b2 (16818) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x34da] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 1055, Ack: 5429, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 1055 (relative sequence number) Acknowledgement number: 5429 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x845e [incorrect, should be 0x40b8] SEQ/ACK analysis This is an ACK to the segment in frame: 2708 The RTT to ACK the segment was: 0.182054000 seconds No. Time Source Destination Protocol Info 2711 819.578812 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=5429 Ack=1055 Win=7104 Len=1418 Frame 2711 (1472 bytes on wire, 1472 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.337316000 Time delta from previous packet: 0.000250000 seconds Time since reference or first frame: 819.578812000 seconds Frame Number: 2711 Packet Length: 1472 bytes Capture Length: 1472 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1458 Identification: 0x8d52 (36178) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xe3af [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 5429, Ack: 1055, Len: 1418 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 5429 (relative sequence number) Next sequence number: 6847 (relative sequence number) Acknowledgement number: 1055 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7104 Checksum: 0x48d9 [correct] Data (1418 bytes) 0000 0e 41 d8 68 dc 11 2a 39 92 85 9e a0 a8 4a 59 da .A.h..*9.....JY. 0010 bf de 91 d9 5b f9 8c 5a 36 f4 af 98 7c 1f 75 b7 ....[..Z6...|.u. 0020 e1 da ff 21 02 ad 08 d5 90 42 e5 19 4a 7e 04 4e ...!.....B..J~.N 0030 4e 0a 78 79 80 9f 88 f2 8c ad 18 32 3c da 0b 6d N.xy.......2<..m 0040 08 9e 6c c6 bc a3 2c 71 c8 9c 94 c7 aa 82 30 d1 ..l...,q......0. 0050 36 fa 71 95 df d3 80 7a 81 35 93 6e 9c 09 92 76 6.q....z.5.n...v 0060 bd bd 7c 89 5b 63 90 94 51 9d 18 c3 9d 94 4c a0 ..|.[c..Q.....L. 0070 d3 94 ae 9b 12 05 fb 6f 60 52 86 ed 4d 4b 48 00 .......o`R..MKH. 0080 2d a0 6c 02 26 80 4b 9c 81 43 f4 17 bd 2a ab 29 -.l.&.K..C...*.) 0090 95 14 f2 e7 03 ec 4b b2 0e 38 d1 97 1e 9f c1 3a ......K..8.....: 00a0 7d 3d 05 8a 7a 83 24 79 a1 0f 22 a0 39 3e 15 4a }=..z.$y..".9>.J 00b0 ad 70 82 65 52 40 18 68 ec ba cb d1 44 a5 69 4a .p.eR@.h....D.iJ 00c0 cb 3c 02 c6 be 62 96 1d b3 9c 2f f2 9d 30 da a7 .<...b..../..0.. 00d0 05 09 30 4c c8 2f 87 4e f9 a3 0c 6f d7 72 94 7a ..0L./.N...o.r.z 00e0 55 d8 03 c6 90 0b 89 cc 99 03 74 68 ad 2a 23 d6 U.........th.*#. 00f0 8f 51 a7 df 19 72 a6 e3 12 d3 9b 24 90 fb 72 51 .Q...r.....$..rQ 0100 9c 3a 52 7d 6d a3 fa b7 22 b3 c9 5e 4f df f5 ab .:R}m..."..^O... 0110 1e a2 de f3 16 27 6a 15 a7 06 e1 08 8b 0b a3 38 .....'j........8 0120 df f9 00 44 99 4c ec e4 a0 4b e1 53 87 8f ce f0 ...D.L...K.S.... 0130 42 8c 03 67 23 88 f7 6e 93 8c 29 92 00 12 a2 11 B..g#..n..)..... 0140 f4 9b bc e0 b3 36 0c 64 a5 6b de 16 da 4d cf ea .....6.d.k...M.. 0150 2e 89 bd 1d 89 4c f7 e1 2a db 79 4f 61 7d 17 1b .....L..*.yOa}.. 0160 e7 26 88 35 e5 f0 a9 64 4f 1c e6 5e 0e 93 7e 55 .&.5...dO..^..~U 0170 70 de 9a 00 6d fc 30 df 1f 81 9b 7d e6 2a 5b 75 p...m.0....}.*[u 0180 b2 18 3c 55 24 90 9f 07 bc e0 d1 65 03 78 37 f9 ...,.* 02a0 e7 ac 46 52 e9 d3 25 62 fa 12 15 9a a8 ee 60 ff ..FR..%b......`. 02b0 b9 40 55 1b b3 c0 a0 d5 8e 83 5a 49 6d 54 2f 61 .@U.......ZImT/a 02c0 3a 12 8d c8 0d f2 61 fd 4c a0 87 7a dc fc 2c 36 :.....a.L..z..,6 02d0 52 bc 4b a5 92 63 e4 6e f1 d0 4c ba f3 99 e8 ab R.K..c.n..L..... 02e0 5a cc 6d 06 b9 fa 75 0a 55 64 91 4c 51 df cd ff Z.m...u.Ud.LQ... 02f0 45 01 02 02 c4 3e 65 11 d7 1b 2c 93 9b 11 4d 9d E....>e...,...M. 0300 04 f9 28 e1 a7 3b 4a a8 7c f8 8e 06 7f ec 92 bd ..(..;J.|....... 0310 2f ba e6 79 89 09 69 03 34 30 5f ce 54 29 a2 d2 /..y..i.40_.T).. 0320 1e 6e a7 38 5f d8 38 bb 75 73 d7 4d ed c0 32 e8 .n.8_.8.us.M..2. 0330 c4 04 32 98 a7 a6 7c 19 a7 a4 b3 e4 0b c7 dc 1a ..2...|......... 0340 4f c5 db 9e 08 06 4c 70 8c 70 9b 6b 53 08 c8 43 O.....Lp.p.kS..C 0350 4a 04 57 ca 9c ca 71 49 e3 2a 17 b0 74 1e a6 74 J.W...qI.*..t..t 0360 11 03 92 43 8a 06 66 36 65 a5 fe 29 c0 00 fa 7c ...C..f6e..)...| 0370 7f af ac 61 ce 7e a4 1f 05 68 cb 18 76 66 cc ea ...a.~...h..vf.. 0380 27 a6 7a 50 c0 b6 02 0a 6d ba bf b7 35 fd cc 85 '.zP....m...5... 0390 91 3c 23 b8 97 f5 7b 07 22 dd 13 8f 23 1a 35 83 .<#...{."...#.5. 03a0 ba 71 1c 07 c1 7f f3 50 4f 58 f7 5a 7c 38 22 23 .q.....POX.Z|8"# 03b0 c4 9a f3 ce 26 76 ad 63 fa f7 93 ab e5 48 e7 bf ....&v.c.....H.. 03c0 c2 79 28 13 23 c0 d5 ca a8 47 67 61 23 db 79 33 .y(.#....Gga#.y3 03d0 16 ba 06 6e 6d d6 2b 6f 6a 9c 6d b3 a0 b5 4c 42 ...nm.+oj.m...LB 03e0 6e ce be ab 4c fe b5 94 05 90 de 85 0e 44 cd d0 n...L........D.. 03f0 fe c2 e6 1c a3 ec ae da de 6f c5 f2 e0 86 25 18 .........o....%. 0400 dd 9e de 39 b2 87 54 d3 51 21 67 8a 11 a8 07 33 ...9..T.Q!g....3 0410 c4 84 36 ba af ac d1 30 86 76 88 be 01 88 f6 4a ..6....0.v.....J 0420 fa ac 1c c8 d4 80 56 bd 47 e1 11 7b 9c fd e4 79 ......V.G..{...y 0430 f7 30 a0 98 4f 3a 02 83 90 46 ed fa f8 c7 06 8d .0..O:...F...... 0440 e9 4e b7 9f 5d c8 2a d0 8c 14 58 9a 0f fa 95 03 .N..].*...X..... 0450 71 c8 3c aa 24 98 70 e3 f9 77 43 9e 60 9b 3b f4 q.<.$.p..wC.`.;. 0460 62 8d a7 d8 b6 ae e6 01 1f f1 f3 47 28 e0 99 c4 b..........G(... 0470 1d 82 c2 1c b8 2b 14 a2 6f 34 d7 c8 40 13 cc c2 .....+..o4..@... 0480 58 66 1e 7e 4f 76 98 12 43 a1 59 5b 71 88 71 ba Xf.~Ov..C.Y[q.q. 0490 15 d2 e1 f6 51 55 13 f8 f4 de 44 8a 43 1e f2 0f ....QU....D.C... 04a0 28 97 f6 61 d9 63 53 bd 6b 60 28 44 7e 1a 36 4f (..a.cS.k`(D~.6O 04b0 02 ca 1d 87 16 25 a7 27 7f 47 48 74 af e3 fc 07 .....%.'.GHt.... 04c0 91 e7 55 72 e4 47 85 da a4 75 0a f1 c6 b4 dc 6b ..Ur.G...u.....k 04d0 ac 39 51 96 a7 c2 bc 4c 55 49 d5 22 ff b1 04 72 .9Q....LUI."...r 04e0 17 00 bf fd d7 b3 d0 70 b5 19 a9 96 76 19 18 30 .......p....v..0 04f0 7d aa 90 01 56 29 f7 1a 1c a4 fb 91 52 40 25 25 }...V)......R@%% 0500 a5 c5 7c e7 cb b8 80 97 95 68 e9 6e b6 37 3b c1 ..|......h.n.7;. 0510 ef 92 8d de 94 8d 7f d4 6f f1 ce 33 ae 1c e9 bf ........o..3.... 0520 e0 66 e6 32 87 7c 40 b3 35 8c db d4 eb 1d 2e bc .f.2.|@.5....... 0530 83 01 fb a6 0d 66 b0 b7 e5 12 5f b1 5b c6 2f d9 .....f...._.[./. 0540 cd c2 c2 e4 9c 6d 35 21 b4 83 90 15 e3 bb 18 02 .....m5!........ 0550 45 46 fb 0d fc fe e7 fb 53 27 ab e2 81 48 2b 94 EF......S'...H+. 0560 ed e1 f7 ba ed 8b 35 37 9d 4d d3 d5 ed d9 f5 70 ......57.M.....p 0570 b5 74 f0 bc b1 83 3b 1d fd 30 59 df 3e ad 43 05 .t....;..0Y.>.C. 0580 44 b4 e1 fe bd 7d 30 20 3e 0b D....}0 >. No. Time Source Destination Protocol Info 2712 819.580505 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=1055 Ack=6847 Win=16102 [TCP CHECKSUM INCORRECT] Len=174 Frame 2712 (228 bytes on wire, 228 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.339009000 Time delta from previous packet: 0.001693000 seconds Time since reference or first frame: 819.580505000 seconds Frame Number: 2712 Packet Length: 228 bytes Capture Length: 228 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 214 Identification: 0x41b3 (16819) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x342b] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 1055, Ack: 6847, Len: 174 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 1055 (relative sequence number) Next sequence number: 1229 (relative sequence number) Acknowledgement number: 6847 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16102 Checksum: 0x850c [incorrect, should be 0x289f] SEQ/ACK analysis This is an ACK to the segment in frame: 2711 The RTT to ACK the segment was: 0.001693000 seconds Data (174 bytes) 0000 bc ef ae 00 b5 fe 18 00 92 00 02 21 de 03 32 0a ...........!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9e bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 35 4f 28 7e 94 0a f5 8a 49 44 4a a4 32 ee 20 o5O(~....IDJ.2. 0040 6f 14 82 6c 9a 84 87 9a 15 6b 83 ab c3 4e 26 74 o..l.....k...N&t 0050 80 cb 8f 8a 66 94 ec ff 9d 4b 1f 55 ac 32 14 41 ....f....K.U.2.A 0060 6e 14 67 2a f2 20 76 fc 8b 6b af e4 ca 4e da 09 n.g*. v..k...N.. 0070 6c 34 4e a8 6f 94 0c 75 8f 4b 16 6e af 96 9b 04 l4N.o..u.K.n.... 0080 58 14 1d 48 93 84 91 1a 8f 6b ea 8d c8 ea ac 50 X..H.....k.....P 0090 58 34 1b ae 6f 94 e0 7f b7 4b 55 73 a7 96 04 65 X4..o....KUs...e 00a0 12 14 56 aa 9d 84 5d 7d 99 cf 35 c5 ae 00 ..V...]}..5... No. Time Source Destination Protocol Info 2713 819.581581 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=6847 Ack=1229 Win=7604 Len=994 Frame 2713 (1048 bytes on wire, 1048 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.340085000 Time delta from previous packet: 0.001076000 seconds Time since reference or first frame: 819.581581000 seconds Frame Number: 2713 Packet Length: 1048 bytes Capture Length: 1048 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1034 Identification: 0x8e52 (36434) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xe457 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 6847, Ack: 1229, Len: 994 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 6847 (relative sequence number) Next sequence number: 7841 (relative sequence number) Acknowledgement number: 1229 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7604 Checksum: 0x812e [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2712 The RTT to ACK the segment was: 0.001076000 seconds Data (994 bytes) 0000 bc ef e2 03 b5 fe 18 00 c8 03 00 21 12 57 32 0a ...........!.W2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6e 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.n.].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 dd 96 e3 42 G.v.}.([.K.....B 0040 75 14 07 2e 17 20 8a f0 95 6b fa f3 d3 4e 2c 72 u.... ...k...N,r 0050 7f 34 2a 30 7d 94 f0 99 9f 4b 62 0f a4 32 04 43 .4*0}....Kb..2.C 0060 6c 14 df 28 85 84 3d ee 89 6d 9d 96 cc 4e f3 2f l..(..=..m...N./ 0070 6c 35 42 8a 29 94 34 ff 88 5b 16 bf b3 73 e4 09 l5B.).4..[...s.. 0080 5f 4b 13 6a ad cb 8d bd 85 6b ed b6 d4 4b 22 72 _K.j.....k...K"r 0090 10 34 54 30 1a 94 a3 99 ed 4b 1d 0f bb 32 50 43 .4T0.....K...2PC 00a0 65 15 57 04 95 8e 71 ee a1 cf aa 92 dc 4e 07 3e e.W...q......N.> 00b0 6f 34 51 2e 59 94 24 5b ed 4b a6 f0 86 20 e4 28 o4Q.Y.$[.K... .( 00c0 7f 78 23 43 bd ed 8d 9c 85 07 dd 94 e4 3c 2c 72 .x#C.........<,r 00d0 7f 7d 81 3a 47 94 7d 99 97 4a 42 47 8b 38 19 43 .}.:G.}..JBG.8.C 00e0 16 b0 4d 28 a5 ab 71 e2 85 6b b9 96 c0 4e da 8a ..M(..q..k...N.. 00f0 6f 69 82 24 4b 94 4d 5b 81 3b 5b 9f 93 25 e5 40 oi.$K.M[.;[..%.@ 0100 18 14 7e 47 a1 e8 e8 82 85 7d cc f3 f0 4e 66 1d ..~G.....}...Nf. 0110 71 34 35 30 31 94 fc 99 fd 4b 32 0f 9b 32 ae 43 q4501....K2..2.C 0120 73 14 bd 29 b6 84 f0 e8 99 6b c3 88 fe 4e f4 ec s..).....k...N.. 0130 73 34 a9 d1 20 94 00 ff a1 71 62 86 94 12 44 62 s4.. ....qb...Db 0140 5f 36 a1 0f e1 ac a7 98 a4 4b 9d cf a4 79 8c 34 _6.......K...y.4 0150 5e 79 c7 d3 21 99 fc 6e f2 dd 19 0e eb 2e 98 4f ^y..!..n.......O 0160 6f 16 a7 29 c5 ba 71 f4 85 61 d9 8f 8e 52 f4 ea o..)..q..a...R.. 0170 6d 21 a1 d1 29 94 00 d0 8d 57 56 fc f3 30 64 42 m!..)....WV..0dB 0180 5f 1b d3 33 ed 87 8d 43 85 6b ad cc 94 46 aa 16 _..3...C.k...F.. 0190 7c 90 d6 ce 32 30 bc 99 89 4b 17 1f fb 7d 98 02 |...20...K...}.. 01a0 6f 5f 97 76 d5 c0 71 a7 85 26 e9 88 9c 09 50 e8 o_.v..q..&....P. 01b0 61 34 de d1 58 94 4b ff d2 4b 36 f0 8c 32 64 42 a4..X.K..K6..2dB 01c0 37 14 e9 2e fd a8 8d fc 85 6b b9 4b a7 4a ac 14 7........k.K.J.. 01d0 a8 81 e5 cf 01 94 fc 99 b9 ef 62 0f 4b 32 9d 51 ..........b.K2.Q 01e0 6f 7e 87 45 e5 e9 71 81 85 07 f9 e4 ac 2b 50 9f o~.E..q......+P. 01f0 6f 34 81 98 ad 9e 06 ff 0c 4b 7c f1 d3 7a 64 48 o4.......K|..zdH 0200 9e 13 8a 8b 07 8c 8d d9 85 79 8d ef b4 68 80 14 .........y...h.. 0210 95 dc f5 92 32 a0 ff 99 30 2e fd 7f b6 9a 64 55 ....2...0.....dU 0220 6e d9 0d 2f b8 3a 63 9b e0 e6 8a ff bd 4b 28 0a n../.:c......K(. 0230 25 54 e3 a8 f9 84 fc 60 8d 7d fa 10 23 eb 18 23 %T.....`.}..#..# 0240 49 fb e2 c8 17 b4 70 8f 04 bd 63 71 4e b7 51 f3 I.....p...cqN.Q. 0250 db 3a 19 b7 f9 84 65 00 9d 7d 4e cb 0f 9d ef 65 .:....e..}N....e 0260 4f db 46 15 67 94 cf a7 af d3 c6 50 6c 97 f3 c0 O.F.g......Pl... 0270 4f 1b bc e5 eb 98 fc 6d 8d 8a 85 86 08 ea 18 3f O......m.......? 0280 5f f7 ee ca 2d b4 73 b1 85 a1 6f 7b 54 b0 51 ef _...-.s...o{T.Q. 0290 fb 3c 17 a6 d1 84 7c 00 bd 52 52 ed 3b e7 98 47 .<....|..RR.;..G 02a0 6f fb 56 38 15 a8 f3 8c 85 ad d7 70 5c ac d2 ff o.V8.......p\... 02b0 78 c4 52 e4 d9 88 fa 60 cd 7d da 10 03 dd 18 3f x.R....`.}.....? 02c0 7f f1 de cb 3d 35 73 93 85 b7 5f 73 64 13 52 ef ....=5s..._sd.R. 02d0 7f 23 25 ae c1 84 7c 2c a7 59 34 86 2b cb b8 65 .#%...|,.Y4.+..e 02e0 4d 99 66 0b 0d 9e 9d ae a5 9d e7 50 5d 97 f3 d4 M.f........P]... 02f0 8a 3b a1 a8 c3 84 fe 60 c0 7f d6 10 1e eb ef 4c .;.....`.......L 0300 89 c0 cf c8 51 b4 7f 8f 87 bd 4f 71 4a b7 4f f3 ....Q.....OqJ.O. 0310 15 3b 32 b5 ad 20 7b 02 f2 7d 32 f1 1b eb 37 45 .;2.. {..}2...7E 0320 73 fb ba 36 37 b4 f3 89 8a bd ab 6e 7f b7 76 93 s..67......n..v. 0330 6f 3b f7 f3 b3 83 fd 60 6f 7f b8 07 68 eb d2 4c o;.....`o...h..L 0340 11 db 73 a0 31 d8 16 fb 85 07 9b 65 03 b5 d3 8e ..s.1......e.... 0350 7e 31 d2 b7 5e 84 7c 36 9d 61 22 fb 6b e8 18 c4 ~1..^.|6.a".k... 0360 6f e7 a6 3c 45 b6 f3 2d 84 a1 a7 76 0c ae 53 93 o.. 1677 [PSH, ACK] Seq=1229 Ack=7841 Win=17520 [TCP CHECKSUM INCORRECT] Len=58 Frame 2714 (112 bytes on wire, 112 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.341915000 Time delta from previous packet: 0.001830000 seconds Time since reference or first frame: 819.583411000 seconds Frame Number: 2714 Packet Length: 112 bytes Capture Length: 112 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 98 Identification: 0x41b4 (16820) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x349e] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 1229, Ack: 7841, Len: 58 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 1229 (relative sequence number) Next sequence number: 1287 (relative sequence number) Acknowledgement number: 7841 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x8498 [incorrect, should be 0x1319] SEQ/ACK analysis This is an ACK to the segment in frame: 2713 The RTT to ACK the segment was: 0.001830000 seconds Data (58 bytes) 0000 bc ef 3a 00 b5 fe 18 00 20 00 00 21 6d 45 32 0a ..:..... ..!mE2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 4b 99 e1 20 ..<*qC..f...K.. 0020 65 04 c3 c8 49 b4 08 9a 83 bc 0a 0e 3c b1 51 d2 e...I.......<.Q. 0030 68 34 7b 28 79 94 1c 51 3a 00 h4{(y..Q:. No. Time Source Destination Protocol Info 2715 819.583703 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=7841 Ack=1287 Win=7546 Len=122 Frame 2715 (176 bytes on wire, 176 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.342207000 Time delta from previous packet: 0.000292000 seconds Time since reference or first frame: 819.583703000 seconds Frame Number: 2715 Packet Length: 176 bytes Capture Length: 176 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 162 Identification: 0x9052 (36946) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xe5bf [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 7841, Ack: 1287, Len: 122 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 7841 (relative sequence number) Next sequence number: 7963 (relative sequence number) Acknowledgement number: 1287 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7546 Checksum: 0xf283 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2714 The RTT to ACK the segment was: 0.000292000 seconds Data (122 bytes) 0000 bc ef 7a 00 b5 fe 18 00 60 00 00 21 b6 72 32 0a ..z.....`..!.r2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 c3 2e 49 b4 08 f0 83 bc 0a f0 3c b1 51 d0 e...I.......<.Q. 0030 68 34 7b 2e 79 94 28 5b 8c 4b 02 f0 8b 96 e5 42 h4{.y.([.K.....B 0040 7b 14 2b 8a 9c 84 89 f0 ad cf fc f1 c0 4e 04 d6 {.+..........N.. 0050 7e 34 01 30 49 30 fd 99 99 4b 4a ab aa 32 1c 43 ~4.0I0...KJ..2.C 0060 47 b0 66 28 81 84 59 4a 82 6b 9d 96 be ea d1 8b G.f(..YJ.k...... 0070 63 34 61 2e 69 94 1c 5b 7a 00 c4a.i..[z. No. Time Source Destination Protocol Info 2716 819.584325 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=1287 Ack=7963 Win=17398 [TCP CHECKSUM INCORRECT] Len=162 Frame 2716 (216 bytes on wire, 216 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.342829000 Time delta from previous packet: 0.000622000 seconds Time since reference or first frame: 819.584325000 seconds Frame Number: 2716 Packet Length: 216 bytes Capture Length: 216 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 202 Identification: 0x41b5 (16821) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3435] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 1287, Ack: 7963, Len: 162 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 1287 (relative sequence number) Next sequence number: 1449 (relative sequence number) Acknowledgement number: 7963 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17398 Checksum: 0x8500 [incorrect, should be 0x38f8] SEQ/ACK analysis This is an ACK to the segment in frame: 2715 The RTT to ACK the segment was: 0.000622000 seconds Data (162 bytes) 0000 bc ef a2 00 b5 fe 18 00 88 00 00 21 ac a0 32 0a ...........!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9e bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 35 4f 28 7e 94 0a f5 8a 49 44 4a a4 32 ee 20 o5O(~....IDJ.2. 0040 6f 14 82 6c 9a 84 87 9a 15 6b 83 ab c3 4e 26 74 o..l.....k...N&t 0050 80 cb 8f 8a 66 94 ec ff 9d 4b 1f 55 ac 32 14 41 ....f....K.U.2.A 0060 6e 14 67 2a f2 20 76 fc 8b 6b af e4 ca 4e da 09 n.g*. v..k...N.. 0070 67 34 7d 0c 16 30 07 75 83 4b 28 6e af 32 ee a0 g4}..0.u.K(n.2.. 0080 58 16 0f ec 2d 20 8a 1a 8b 6b d3 8f c8 4e 26 f4 X...- ...k...N&. 0090 58 36 09 0a 4d 30 81 7f bc 4b 5a 71 97 33 04 65 X6..M0...KZq.3.e 00a0 a2 00 .. No. Time Source Destination Protocol Info 2717 819.584923 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=7963 Ack=1449 Win=7384 Len=502 Frame 2717 (556 bytes on wire, 556 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.343427000 Time delta from previous packet: 0.000598000 seconds Time since reference or first frame: 819.584923000 seconds Frame Number: 2717 Packet Length: 556 bytes Capture Length: 556 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 542 Identification: 0x9252 (37458) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xe243 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 7963, Ack: 1449, Len: 502 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 7963 (relative sequence number) Next sequence number: 8465 (relative sequence number) Acknowledgement number: 1449 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7384 Checksum: 0x1b58 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2716 The RTT to ACK the segment was: 0.000598000 seconds Data (502 bytes) 0000 bc ef f6 01 b5 fe 18 00 db 01 01 21 5f 0f 32 0a ...........!_.2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6e 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.n.].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 dd 96 e3 42 G.v.}.([.K.....B 0040 75 14 02 2e 17 20 8a f0 95 6b fa f3 6a 7f 2c 72 u.... ...k..j.,r 0050 7f 34 84 30 7d 94 f6 99 9d 4b e2 0c b7 32 1a 43 .4.0}....K...2.C 0060 7f 14 67 28 cb eb 07 8b e9 07 b9 d1 be 21 a5 fb ..g(.........!.. 0070 38 5d 12 4b dd 90 1c ff 81 4b d8 f3 a3 32 5d 46 8].K.....K...2]F 0080 43 14 19 2e 52 7b 3f f4 99 6b e7 f1 d5 4e 9f 76 C...R{?..k...N.v 0090 43 34 1f 30 59 94 c8 99 a1 4b 57 0f b5 32 18 43 C4.0Y....KW..2.C 00a0 20 14 16 28 de 84 2e ee c1 6b e6 96 91 4e 6d 8f ..(.....k...Nm. 00b0 73 34 5b 2e 5b 94 47 ff 91 4b 23 f0 8f 32 e4 42 s4[.[.G..K#..2.B 00c0 30 14 62 2e f6 84 d2 f0 d5 6b 92 f1 64 4e 30 72 0.b......k..dN0r 00d0 7a 34 35 30 41 94 96 99 f1 4b 2f 0f e2 32 74 43 z450A....K/..2tC 00e0 03 14 22 28 d7 84 1d eb 99 6b b3 96 ec 4e bd 8e .."(.....k...N.. 00f0 73 34 4b 2e 4e 94 b5 fb 91 4b 3c f0 93 32 ac 40 s4K.N....K<..2.@ 0100 03 14 36 2e f7 84 8d f0 ef 6b a1 f1 99 4e 45 72 ..6......k...NEr 0110 73 34 59 30 54 94 8e 99 bd 4b 41 0f f4 32 ec 43 s4Y0T....KA..2.C 0120 07 14 d2 29 c7 84 05 e8 ea 6b a7 88 8f 4e 7d ed ...).....k...N}. 0130 18 34 d0 d1 17 94 63 ff e2 4b 2b f0 cd 32 05 42 .4....c..K+..2.B 0140 0a 14 fe 2f c1 84 8f f6 8f 6b bd ef ce 21 c2 34 .../.....k...!.4 0150 32 5d a9 a3 44 e6 19 99 81 4b 28 0f 14 cd 27 47 2]..D....K(...'G 0160 73 14 ad 29 3a 7b 28 ed 99 6b d5 88 73 b1 af 12 s..):{(..k..s... 0170 59 34 bd d1 23 94 08 ff a2 4b 4a f0 ff 32 67 42 Y4..#....KJ..2gB 0180 5f 14 77 2e f1 84 95 f6 9c 6b ad ef b9 7f fc 35 _.w......k.....5 0190 0a 14 f5 ef 31 b6 9e b9 81 63 38 61 da 12 b8 62 ....1....c8a...b 01a0 29 67 b7 09 f4 c9 73 f4 85 66 e9 b9 36 50 12 ec )g....s..f..6P.. 01b0 6f 28 91 dd 19 96 00 ff 8d 75 66 ec c3 38 64 45 o(.......uf..8dE 01c0 7d 08 47 2f fd f9 29 f1 85 67 9d ee a4 4e ac 3c }.G/..)..g...N.< 01d0 db 33 e5 cb 01 bc 58 9e 9d 4f 02 27 6f 35 98 47 .3....X..O.'o5.G 01e0 6f 3c 23 2e e5 80 71 9a 21 6a f9 84 ac 4e 50 ed o<#...q.!j...NP. 01f0 6f 28 25 49 f6 01 o(%I.. No. Time Source Destination Protocol Info 2718 819.586055 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=1449 Ack=8465 Win=16896 [TCP CHECKSUM INCORRECT] Len=162 Frame 2718 (216 bytes on wire, 216 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.344559000 Time delta from previous packet: 0.001132000 seconds Time since reference or first frame: 819.586055000 seconds Frame Number: 2718 Packet Length: 216 bytes Capture Length: 216 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 202 Identification: 0x41b6 (16822) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3434] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 1449, Ack: 8465, Len: 162 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 1449 (relative sequence number) Next sequence number: 1611 (relative sequence number) Acknowledgement number: 8465 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16896 Checksum: 0x8500 [incorrect, should be 0x394e] SEQ/ACK analysis This is an ACK to the segment in frame: 2717 The RTT to ACK the segment was: 0.001132000 seconds Data (162 bytes) 0000 bc ef a2 00 b5 fe 18 00 88 00 00 21 ac a8 32 0a ...........!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9e bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 35 4f 28 7e 94 0a f5 8a 49 44 4a a4 32 ee 20 o5O(~....IDJ.2. 0040 6f 14 82 6c 9a 84 87 9a 15 6b 83 ab c3 4e 26 74 o..l.....k...N&t 0050 80 cb 8f 8a 66 94 ec ff 9d 4b 1f 55 ac 32 14 41 ....f....K.U.2.A 0060 6e 14 67 2a f2 20 76 fc 8b 6b af e4 ca 4e da 09 n.g*. v..k...N.. 0070 66 34 7d 0c 16 30 07 75 83 4b 28 6e af 32 ee a0 f4}..0.u.K(n.2.. 0080 58 16 0f ec 2d 20 8a 1a 8b 6b d3 8f c8 4e 26 f4 X...- ...k...N&. 0090 58 36 09 0a 4d 30 81 7f bc 4b 5a 71 97 33 04 65 X6..M0...KZq.3.e 00a0 a2 00 .. No. Time Source Destination Protocol Info 2719 819.586545 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=8465 Ack=1611 Win=7222 Len=126 Frame 2719 (180 bytes on wire, 180 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.345049000 Time delta from previous packet: 0.000490000 seconds Time since reference or first frame: 819.586545000 seconds Frame Number: 2719 Packet Length: 180 bytes Capture Length: 180 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 166 Identification: 0x9452 (37970) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xe1bb [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 8465, Ack: 1611, Len: 126 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 8465 (relative sequence number) Next sequence number: 8591 (relative sequence number) Acknowledgement number: 1611 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7222 Checksum: 0xd38f [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2718 The RTT to ACK the segment was: 0.000490000 seconds Data (126 bytes) 0000 bc ef 7e 00 b5 fe 18 00 62 00 02 21 cf f3 32 0a ..~.....b..!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6e 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.n.].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 dd 96 e3 42 G.v.}.([.K.....B 0040 75 14 03 2e 17 20 8a f0 95 6b fd f1 b9 ea 2b 72 u.... ...k....+r 0050 73 34 04 30 61 94 d4 3d 9a 4b 66 0f 83 96 1f 43 s4.0a..=.Kf....C 0060 6b 14 4f 8c 82 84 75 ee ad cf 9e 96 c8 4e a2 2f k.O...u......N./ 0070 6e 34 6d 2e 69 94 00 ff 91 ef 28 f0 7e 00 n4m.i.....(.~. No. Time Source Destination Protocol Info 2720 819.588740 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=1611 Ack=8591 Win=16770 [TCP CHECKSUM INCORRECT] Len=390 Frame 2720 (444 bytes on wire, 444 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.347244000 Time delta from previous packet: 0.002195000 seconds Time since reference or first frame: 819.588740000 seconds Frame Number: 2720 Packet Length: 444 bytes Capture Length: 444 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 430 Identification: 0x41b7 (16823) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x334f] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 1611, Ack: 8591, Len: 390 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 1611 (relative sequence number) Next sequence number: 2001 (relative sequence number) Acknowledgement number: 8591 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16770 Checksum: 0x85e4 [incorrect, should be 0xade9] SEQ/ACK analysis This is an ACK to the segment in frame: 2719 The RTT to ACK the segment was: 0.002195000 seconds Data (390 bytes) 0000 bc ef 86 01 b5 fe 18 00 6c 01 00 21 be 99 32 0a ........l..!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 cc 6c 69 b4 08 9a 75 bc 0b 0e 7b e6 79 21 a..li...u...{.y! 0030 5f 06 24 7b 57 dd 4e bc 8d 4b 06 ee a3 32 e4 20 _.${W.N..K...2. 0040 7f 14 03 c8 9d 84 8d 9a 85 6b fd 0f c4 4e 2c 74 .........k...N,t 0050 7f 34 05 2e 61 94 fc ff 9d 4b 62 f1 ab 32 18 41 .4..a....Kb..2.A 0060 6f 14 67 2a 85 84 71 fc 85 6b 99 e4 cc 4e d0 09 o.g*..q..k...N.. 0070 6f 34 61 a8 69 94 00 75 8d 4b 16 6e b3 32 e4 a0 o4a.i..u.K.n.2.. 0080 5f 14 13 48 ad 84 8d 1a 85 6b ed 8f d4 4e 2c f4 _..H.....k...N,. 0090 5f 34 15 ae 51 94 fc 7f bd 4b 52 71 bb 32 18 c1 _4..Q....KRq.2.. 00a0 6f 14 57 aa 95 84 71 7c 85 6b a9 64 dc 4e d0 89 o.W...q|.k.d.N.. 00b0 6f 34 51 28 59 94 00 f5 8d 4b 26 ee 83 32 e4 20 o4Q(Y....K&..2. 00c0 7f 14 23 c8 bd 84 8d 9a 85 6b dd 0f e4 4e 2c 74 ..#......k...N,t 00d0 7f 34 25 2e 41 94 fc ff 9d 4b 42 f1 8b 32 18 41 .4%.A....KB..2.A 00e0 6f 14 47 2a a5 84 71 fc 85 6b b9 e4 ec 4e d0 09 o.G*..q..k...N.. 00f0 6f 34 41 a8 49 94 00 75 8d 4b 36 6e 93 32 e4 a0 o4A.I..u.K6n.2.. 0100 1f 14 33 48 cd 84 8d 1a 85 6b cd 8f f4 4e 2c f4 ..3H.....k...N,. 0110 1f 34 35 ae 31 94 fc 7f fd 4b 32 71 28 96 84 c1 .45.1....K2q(... 0120 68 14 bf ab b5 84 1e 18 f3 02 ac 15 8f 4e e3 27 h............N.' 0130 73 34 b6 37 3d 94 00 95 fa 22 28 0e 4d 96 78 40 s4.7=...."(.M.x@ 0140 7c 14 d3 29 dd 84 ca af d3 3c 8d db d1 1d 82 57 |..).....<.....W 0150 31 7d c5 d1 21 94 67 5b 81 4b 28 f1 e7 32 06 e5 1}..!.g[.K(..2.. 0160 73 14 ab 2b 79 7e 63 fe 95 cf d8 e2 86 4e 05 03 s..+y~c......N.. 0170 e1 90 a6 b7 27 94 1c b1 91 ef 2b 8e f2 32 6c c0 ....'.....+..2l. 0180 73 15 cf 0d 86 01 s..... No. Time Source Destination Protocol Info 2721 819.589405 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=8591 Ack=2001 Win=7604 Len=390 Frame 2721 (444 bytes on wire, 444 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.347909000 Time delta from previous packet: 0.000665000 seconds Time since reference or first frame: 819.589405000 seconds Frame Number: 2721 Packet Length: 444 bytes Capture Length: 444 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 430 Identification: 0x9652 (38482) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xdeb3 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 8591, Ack: 2001, Len: 390 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 8591 (relative sequence number) Next sequence number: 8981 (relative sequence number) Acknowledgement number: 2001 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7604 Checksum: 0x4dbc [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2720 The RTT to ACK the segment was: 0.000665000 seconds Data (390 bytes) 0000 bc ef 86 01 b5 fe 18 00 6c 01 00 21 7d 5a 32 0a ........l..!}Z2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 e2 99 fa 42 ..<*qC..f......B 0020 68 04 85 2e 75 b4 48 a7 d3 eb 3b c2 69 e2 01 3d h...u.H...;.i..= 0030 21 7d 71 2e 79 94 00 ff 8d 4b 06 f0 a3 32 e4 42 !}q.y....K...2.B 0040 7f 14 03 2e 9d 84 8d f0 85 6b fd f1 c4 4e 2c 72 .........k...N,r 0050 7f 34 05 30 61 94 fc 99 9d 4b 62 0f ab 32 18 43 .4.0a....Kb..2.C 0060 6f 14 67 28 85 84 71 ee 85 6b 99 96 cc 4e d0 8b o.g(..q..k...N.. 0070 6f 34 61 2e 69 94 00 ff 8d 4b 16 f0 b3 32 e4 42 o4a.i....K...2.B 0080 5f 14 13 2e ad 84 8d f0 85 6b ed f1 d4 4e 2c 72 _........k...N,r 0090 5f 34 15 30 51 94 fc 99 bd 4b 52 0f bb 32 18 43 _4.0Q....KR..2.C 00a0 6f 14 57 28 95 84 71 ee 85 6b a9 96 dc 4e d0 8b o.W(..q..k...N.. 00b0 6f 34 51 2e 59 94 00 ff 8d 4b 26 f0 83 32 e4 42 o4Q.Y....K&..2.B 00c0 7f 14 23 2e bd 84 8d f0 85 6b dd f1 e4 4e 2c 72 ..#......k...N,r 00d0 7f 34 25 30 41 94 fc 99 9d 4b 42 0f 8b 32 18 43 .4%0A....KB..2.C 00e0 6f 14 47 28 a5 84 71 ee 85 6b b9 96 ec 4e d0 8b o.G(..q..k...N.. 00f0 6f 34 41 2e 49 94 00 ff 8d 4b 36 f0 93 32 e4 42 o4A.I....K6..2.B 0100 1f 14 33 2e cd 84 8d f0 85 6b cd f1 f4 4e 2c 72 ..3......k...N,r 0110 1f 34 35 30 31 94 4f 3d e1 4b 35 0f 93 32 98 43 .4501.O=.K5..2.C 0120 00 72 c1 40 d0 f3 02 e8 36 cf d5 88 fb 4e 54 ed .r.@....6....NT. 0130 6f 34 c6 b8 57 94 ae 5b 91 4b 45 f0 f3 32 64 42 o4..W..[.KE..2dB 0140 38 43 95 78 ed b6 d8 a5 ab 22 f3 a6 84 4e ac 14 8C.x....."...N.. 0150 e4 90 d9 cf 2b 94 f0 99 03 ef 3e 0f e7 32 24 b9 ....+.....>..2$. 0160 7d 14 b7 8d c4 84 7b e8 d0 6b 57 2c 8b 4e 5e ed }.....{..kW,.N^. 0170 73 90 89 75 2e 94 04 ff ff ef 57 f0 ff 32 6d 40 s..u......W..2m@ 0180 5f 14 cf 8b 86 01 _..... No. Time Source Destination Protocol Info 2722 819.591292 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=2001 Ack=8981 Win=16380 [TCP CHECKSUM INCORRECT] Len=390 Frame 2722 (444 bytes on wire, 444 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.349796000 Time delta from previous packet: 0.001887000 seconds Time since reference or first frame: 819.591292000 seconds Frame Number: 2722 Packet Length: 444 bytes Capture Length: 444 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 430 Identification: 0x41b8 (16824) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x334e] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 2001, Ack: 8981, Len: 390 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 2001 (relative sequence number) Next sequence number: 2391 (relative sequence number) Acknowledgement number: 8981 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16380 Checksum: 0x85e4 [incorrect, should be 0xac63] SEQ/ACK analysis This is an ACK to the segment in frame: 2721 The RTT to ACK the segment was: 0.001887000 seconds Data (390 bytes) 0000 bc ef 86 01 b5 fe 18 00 6c 01 00 21 be 99 32 0a ........l..!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 cc 6c 69 b4 08 9a 75 bc 0b 0e 7b e6 79 21 a..li...u...{.y! 0030 5f 06 24 7b 57 dd 4e bc 8d 4b 06 ee a3 32 e4 20 _.${W.N..K...2. 0040 7f 14 03 c8 9d 84 8d 9a 85 6b fd 0f c4 4e 2c 74 .........k...N,t 0050 7f 34 05 2e 61 94 fc ff 9d 4b 62 f1 ab 32 18 41 .4..a....Kb..2.A 0060 6f 14 67 2a 85 84 71 fc 85 6b 99 e4 cc 4e d0 09 o.g*..q..k...N.. 0070 6f 34 61 a8 69 94 00 75 8d 4b 16 6e b3 32 e4 a0 o4a.i..u.K.n.2.. 0080 5f 14 13 48 ad 84 8d 1a 85 6b ed 8f d4 4e 2c f4 _..H.....k...N,. 0090 5f 34 15 ae 51 94 fc 7f bd 4b 52 71 bb 32 18 c1 _4..Q....KRq.2.. 00a0 6f 14 57 aa 95 84 71 7c 85 6b a9 64 dc 4e d0 89 o.W...q|.k.d.N.. 00b0 6f 34 51 28 59 94 00 f5 8d 4b 26 ee 83 32 e4 20 o4Q(Y....K&..2. 00c0 7f 14 23 c8 bd 84 8d 9a 85 6b dd 0f e4 4e 2c 74 ..#......k...N,t 00d0 7f 34 25 2e 41 94 fc ff 9d 4b 42 f1 8b 32 18 41 .4%.A....KB..2.A 00e0 6f 14 47 2a a5 84 71 fc 85 6b b9 e4 ec 4e d0 09 o.G*..q..k...N.. 00f0 6f 34 41 a8 49 94 00 75 8d 4b 36 6e 93 32 e4 a0 o4A.I..u.K6n.2.. 0100 1f 14 33 48 cd 84 8d 1a 85 6b cd 8f f4 4e 2c f4 ..3H.....k...N,. 0110 1f 34 35 ae 31 94 fc 7f fd 4b 32 71 28 96 84 c1 .45.1....K2q(... 0120 68 14 bf ab b5 84 1e 18 f3 02 ac 15 8f 4e e3 27 h............N.' 0130 73 34 b6 37 3d 94 00 95 fa 22 28 0e 4d 96 78 40 s4.7=...."(.M.x@ 0140 7c 14 d3 29 dd 84 ca af d3 3c 8d db d1 1d 82 57 |..).....<.....W 0150 31 7d c5 d1 21 94 67 5b 81 4b 28 f1 e7 32 06 e5 1}..!.g[.K(..2.. 0160 73 14 ab 2b 79 7e 63 fe 95 cf d8 e2 86 4e 05 03 s..+y~c......N.. 0170 e1 90 a6 b7 27 94 1c b1 91 ef 2b 8e f2 32 6c c0 ....'.....+..2l. 0180 73 15 cf 0d 86 01 s..... No. Time Source Destination Protocol Info 2723 819.592184 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=8981 Ack=2391 Win=7214 Len=390 Frame 2723 (444 bytes on wire, 444 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.350688000 Time delta from previous packet: 0.000892000 seconds Time since reference or first frame: 819.592184000 seconds Frame Number: 2723 Packet Length: 444 bytes Capture Length: 444 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 430 Identification: 0x9852 (38994) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xdcb3 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 8981, Ack: 2391, Len: 390 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 8981 (relative sequence number) Next sequence number: 9371 (relative sequence number) Acknowledgement number: 2391 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7214 Checksum: 0x4c36 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2722 The RTT to ACK the segment was: 0.000892000 seconds Data (390 bytes) 0000 bc ef 86 01 b5 fe 18 00 6c 01 00 21 7d 5a 32 0a ........l..!}Z2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 e2 99 fa 42 ..<*qC..f......B 0020 68 04 85 2e 75 b4 48 a7 d3 eb 3b c2 69 e2 01 3d h...u.H...;.i..= 0030 21 7d 71 2e 79 94 00 ff 8d 4b 06 f0 a3 32 e4 42 !}q.y....K...2.B 0040 7f 14 03 2e 9d 84 8d f0 85 6b fd f1 c4 4e 2c 72 .........k...N,r 0050 7f 34 05 30 61 94 fc 99 9d 4b 62 0f ab 32 18 43 .4.0a....Kb..2.C 0060 6f 14 67 28 85 84 71 ee 85 6b 99 96 cc 4e d0 8b o.g(..q..k...N.. 0070 6f 34 61 2e 69 94 00 ff 8d 4b 16 f0 b3 32 e4 42 o4a.i....K...2.B 0080 5f 14 13 2e ad 84 8d f0 85 6b ed f1 d4 4e 2c 72 _........k...N,r 0090 5f 34 15 30 51 94 fc 99 bd 4b 52 0f bb 32 18 43 _4.0Q....KR..2.C 00a0 6f 14 57 28 95 84 71 ee 85 6b a9 96 dc 4e d0 8b o.W(..q..k...N.. 00b0 6f 34 51 2e 59 94 00 ff 8d 4b 26 f0 83 32 e4 42 o4Q.Y....K&..2.B 00c0 7f 14 23 2e bd 84 8d f0 85 6b dd f1 e4 4e 2c 72 ..#......k...N,r 00d0 7f 34 25 30 41 94 fc 99 9d 4b 42 0f 8b 32 18 43 .4%0A....KB..2.C 00e0 6f 14 47 28 a5 84 71 ee 85 6b b9 96 ec 4e d0 8b o.G(..q..k...N.. 00f0 6f 34 41 2e 49 94 00 ff 8d 4b 36 f0 93 32 e4 42 o4A.I....K6..2.B 0100 1f 14 33 2e cd 84 8d f0 85 6b cd f1 f4 4e 2c 72 ..3......k...N,r 0110 1f 34 35 30 31 94 4f 3d e1 4b 35 0f 93 32 98 43 .4501.O=.K5..2.C 0120 00 72 c1 40 d0 f3 02 e8 36 cf d5 88 fb 4e 54 ed .r.@....6....NT. 0130 6f 34 c6 b8 57 94 ae 5b 91 4b 45 f0 f3 32 64 42 o4..W..[.KE..2dB 0140 38 43 95 78 ed b6 d8 a5 ab 22 f3 a6 84 4e ac 14 8C.x....."...N.. 0150 e4 90 d9 cf 2b 94 f0 99 03 ef 3e 0f e7 32 24 b9 ....+.....>..2$. 0160 7d 14 b7 8d c4 84 7b e8 d0 6b 57 2c 8b 4e 5e ed }.....{..kW,.N^. 0170 73 90 89 75 2e 94 04 ff ff ef 57 f0 ff 32 6d 40 s..u......W..2m@ 0180 5f 14 cf 8b 86 01 _..... No. Time Source Destination Protocol Info 2724 819.592788 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=2391 Ack=9371 Win=17520 [TCP CHECKSUM INCORRECT] Len=390 Frame 2724 (444 bytes on wire, 444 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.351292000 Time delta from previous packet: 0.000604000 seconds Time since reference or first frame: 819.592788000 seconds Frame Number: 2724 Packet Length: 444 bytes Capture Length: 444 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 430 Identification: 0x41b9 (16825) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x334d] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 2391, Ack: 9371, Len: 390 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 2391 (relative sequence number) Next sequence number: 2781 (relative sequence number) Acknowledgement number: 9371 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x85e4 [incorrect, should be 0x23de] SEQ/ACK analysis This is an ACK to the segment in frame: 2723 The RTT to ACK the segment was: 0.000604000 seconds Data (390 bytes) 0000 bc ef 86 01 b5 fe 18 00 6c 01 00 21 09 5b 32 0a ........l..!.[2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 cc 6c 69 b4 08 9a 75 bc 0b 0e 7b e6 79 3f a..li...u...{.y? 0030 2a 63 24 7b 57 dd 4e bc 8d 4b 06 ee a3 32 e4 20 *c${W.N..K...2. 0040 7f 14 03 c8 9d 84 8d 9a 85 6b fd 0f c4 4e 2c 74 .........k...N,t 0050 7f 34 05 2e 61 94 fc ff 9d 4b 62 f1 ab 32 18 41 .4..a....Kb..2.A 0060 6f 14 67 2a 85 84 71 fc 85 6b 99 e4 cc 4e d0 09 o.g*..q..k...N.. 0070 6f 34 61 a8 69 94 00 75 8d 4b 16 6e b3 32 e4 a0 o4a.i..u.K.n.2.. 0080 5f 14 13 48 ad 84 8d 1a 85 6b ed 8f d4 4e 2c f4 _..H.....k...N,. 0090 5f 34 15 ae 51 94 fc 7f bd 4b 52 71 bb 32 18 c1 _4..Q....KRq.2.. 00a0 6f 14 57 aa 95 84 71 7c 85 6b a9 64 dc 4e d0 89 o.W...q|.k.d.N.. 00b0 6f 34 51 28 59 94 00 f5 8d 4b 26 ee 83 32 e4 20 o4Q(Y....K&..2. 00c0 7f 14 23 c8 bd 84 8d 9a 85 6b dd 0f e4 4e 2c 74 ..#......k...N,t 00d0 7f 34 25 2e 41 94 fc ff 9d 4b 42 f1 8b 32 18 41 .4%.A....KB..2.A 00e0 6f 14 47 2a a5 84 71 fc 85 6b b9 e4 ec 4e d0 09 o.G*..q..k...N.. 00f0 6f 34 41 a8 49 94 00 75 8d 4b 36 6e 93 32 e4 a0 o4A.I..u.K6n.2.. 0100 1f 14 33 48 cd 84 8d 1a 85 6b cd 8f f4 4e 2c f4 ..3H.....k...N,. 0110 1f 34 35 ae 31 94 fc 7f fd 4b 32 71 28 96 84 c1 .45.1....K2q(... 0120 68 14 bf ab b5 84 1e 18 f3 02 ac 15 8f 4e e3 27 h............N.' 0130 73 34 b6 37 3d 94 00 95 fa 22 28 0e 4d 96 78 40 s4.7=...."(.M.x@ 0140 7c 14 d3 29 dd 84 ca af d3 22 f8 be d1 1d 82 57 |..).....".....W 0150 31 7d c5 d1 21 94 67 5b 81 4b 28 f1 e7 32 06 e5 1}..!.g[.K(..2.. 0160 73 14 ab 2b 79 7e 63 fe 95 cf d8 e2 86 4e 05 03 s..+y~c......N.. 0170 e1 90 a6 b7 27 94 1c b1 91 ef 2b 8e f2 32 6c c0 ....'.....+..2l. 0180 73 15 cf 0d 86 01 s..... No. Time Source Destination Protocol Info 2725 819.593556 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=9371 Ack=2781 Win=7604 Len=438 Frame 2725 (492 bytes on wire, 492 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.352060000 Time delta from previous packet: 0.000768000 seconds Time since reference or first frame: 819.593556000 seconds Frame Number: 2725 Packet Length: 492 bytes Capture Length: 492 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 478 Identification: 0x9a52 (39506) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xda83 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 9371, Ack: 2781, Len: 438 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 9371 (relative sequence number) Next sequence number: 9809 (relative sequence number) Acknowledgement number: 2781 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7604 Checksum: 0x98b1 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2724 The RTT to ACK the segment was: 0.000768000 seconds Data (438 bytes) 0000 bc ef b6 01 b4 fe 18 00 9c 01 00 21 13 cf 32 0a ...........!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 e2 99 fa 42 ..<*qC..f......B 0020 68 04 85 2e 75 b4 48 a7 d3 f5 4e a7 69 e2 01 3d h...u.H...N.i..= 0030 21 7d 71 2e 79 94 00 ff 8d 4b 06 f0 a3 32 e4 42 !}q.y....K...2.B 0040 7f 14 03 2e 9d 84 8d f0 85 6b fd f1 c4 4e 2c 72 .........k...N,r 0050 7f 34 05 30 61 94 fc 99 9d 4b 62 0f ab 32 18 43 .4.0a....Kb..2.C 0060 6f 14 67 28 85 84 71 ee 85 6b 99 96 cc 4e d0 8b o.g(..q..k...N.. 0070 6f 34 61 2e 69 94 00 ff 8d 4b 16 f0 b3 32 e4 42 o4a.i....K...2.B 0080 5f 14 13 2e ad 84 8d f0 85 6b ed f1 d4 4e 2c 72 _........k...N,r 0090 5f 34 15 30 51 94 fc 99 bd 4b 52 0f bb 32 18 43 _4.0Q....KR..2.C 00a0 6f 14 57 28 95 84 71 ee 85 6b a9 96 dc 4e d0 8b o.W(..q..k...N.. 00b0 6f 34 51 2e 59 94 00 ff 8d 4b 26 f0 83 32 e4 42 o4Q.Y....K&..2.B 00c0 7f 14 23 2e bd 84 8d f0 85 6b dd f1 e4 4e 2c 72 ..#......k...N,r 00d0 7f 34 25 30 41 94 fc 99 9d 4b 42 0f 8b 32 18 43 .4%0A....KB..2.C 00e0 6f 14 47 28 a5 84 71 ee 85 6b b9 96 ec 4e d0 8b o.G(..q..k...N.. 00f0 6f 34 41 2e 49 94 00 ff 8d 4b 36 f0 93 32 e4 42 o4A.I....K6..2.B 0100 1f 14 33 2e cd 84 8d f0 85 6b cd f1 f4 4e 2c 72 ..3......k...N,r 0110 1f 34 35 30 31 94 4f 3d e1 4b 35 0f 93 32 98 43 .4501.O=.K5..2.C 0120 00 72 c1 40 d0 f3 02 e8 36 cf d5 88 fb 4e 54 ed .r.@....6....NT. 0130 6f 34 c6 b8 57 94 ae 5b 91 4b 45 f0 f3 32 64 42 o4..W..[.KE..2dB 0140 38 43 95 66 98 d3 d8 a5 ab 22 f3 a6 84 4e ac 14 8C.f....."...N.. 0150 e4 90 d9 cf 2b 94 f0 99 03 ef 3e 0f e7 32 98 43 ....+.....>..2.C 0160 6f 14 b7 8d c4 84 7b e8 d0 6b 57 2c 8b 4e 5e ed o.....{..kW,.N^. 0170 74 34 bd d1 25 94 7b fc 8d 4b 20 f1 ef 32 6a 42 t4..%.{..K ..2jB 0180 c0 b0 cf 2f e7 84 9f f6 8c 6b b1 ef 9c 4e a4 14 .../.....k...N.. 0190 fe 90 c9 cf 1b 94 cc 99 26 ef 0e 0f f1 32 94 43 ........&....2.C 01a0 f1 b0 8b 29 d9 84 cd 12 97 6b 74 2c 80 4e 5a ed ...).....kt,.NZ. 01b0 6f 34 33 75 b6 01 o43u.. No. Time Source Destination Protocol Info 2728 819.778838 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=2781 Ack=9809 Win=17082 [TCP CHECKSUM INCORRECT] Len=0 Frame 2728 (54 bytes on wire, 54 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.537342000 Time delta from previous packet: 0.185282000 seconds Time since reference or first frame: 819.778838000 seconds Frame Number: 2728 Packet Length: 54 bytes Capture Length: 54 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x41bf (16831) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x34cd] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 2781, Ack: 9809, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 2781 (relative sequence number) Acknowledgement number: 9809 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17082 Checksum: 0x845e [incorrect, should be 0x2a94] SEQ/ACK analysis This is an ACK to the segment in frame: 2725 The RTT to ACK the segment was: 0.185282000 seconds No. Time Source Destination Protocol Info 2729 819.779056 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=9809 Ack=2781 Win=7604 Len=976 Frame 2729 (1030 bytes on wire, 1030 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.537560000 Time delta from previous packet: 0.000218000 seconds Time since reference or first frame: 819.779056000 seconds Frame Number: 2729 Packet Length: 1030 bytes Capture Length: 1030 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1016 Identification: 0x9d52 (40274) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xd569 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 9809, Ack: 2781, Len: 976 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 9809 (relative sequence number) Next sequence number: 10785 (relative sequence number) Acknowledgement number: 2781 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7604 Checksum: 0xc78f [correct] Data (976 bytes) 0000 bc ef 9a 03 b0 fe 1c 00 7b 03 01 21 50 37 e0 0e ........{..!P7.. 0010 3c ca 74 43 04 00 3c 2a 71 43 00 00 26 fe 6e 99 <.tC..<*qC..&.n. 0020 37 60 eb 48 3a 57 38 62 2a e7 3e de d3 f9 5c cd 7`.H:W8b*.>...\. 0030 71 d0 46 18 62 3e 24 7d 34 d8 5f ac bf 65 50 b5 q.F.b>$}4._..eP. 0040 f4 0f a9 23 16 78 23 06 ee ed e0 80 e9 0e d4 fc ...#.x#......... 0050 ce 43 26 29 2f 5b 76 44 41 d9 9d f0 f1 16 6f 05 .C&)/[vDA.....o. 0060 fe 61 55 0f 30 44 49 7e c0 d3 4c be ea 18 ed f3 .aU.0DI~..L..... 0070 a8 6e 9d ee 1c 47 00 49 0c 99 0a f2 87 10 55 91 .n...G.I......U. 0080 df 57 8a 26 3e 66 4e 23 a7 d1 de b4 c4 32 c3 a7 .W.&>fN#.....2.. 0090 91 19 11 36 3e 4d 18 3a 04 c7 ab dc f8 00 63 21 ...6>M.:......c! 00a0 ed 77 4f 7e 38 71 32 43 98 8e 24 bd d2 2e ec dd .wO~8q2C..$..... 00b0 ee 60 86 ce 38 09 06 4b 3c ff 20 9e e3 2f 06 b3 .`..8..K<. ../.. 00c0 e2 5e 81 2c 1b 75 51 23 b7 d1 de bd ca 25 89 b9 .^.,.uQ#.....%.. 00d0 d5 60 7a 37 28 09 68 5f 2f e0 94 94 97 1e 11 42 .`z7(.h_/......B 00e0 c4 7c 4c 0b 5d 3a 11 6d f2 b9 3c 81 eb 1f d1 b6 .|L.]:.m..<..... 00f0 8d 20 b4 ab 2c 55 2d 4b 27 f0 61 8d 80 41 63 a3 . ..,U-K'.a..Ac. 0100 ca 77 a5 10 31 42 76 79 f0 dd e8 91 f7 66 c7 a4 .w..1Bvy.....f.. 0110 a7 0a 7f 39 40 75 65 1e 67 d1 ab a4 b9 2e 41 64 ...9@ue.g.....Ad 0120 bb 71 f9 2f 0a 7a d3 48 c7 89 7b bd d6 2f 9a c3 .q./.z.H..{../.. 0130 a3 00 04 c3 39 71 e6 ec 77 fb 74 9a ef 24 29 9b ....9q..w.t..$). 0140 ee 38 31 11 2f 46 8c 65 9e d0 a3 a0 c0 3c 80 ab .81./F.e.....<.. 0150 e5 37 8c 44 0d 5b af aa 42 e0 8f 94 97 1e 71 5f .7.D.[..B.....q_ 0160 a7 73 d6 1c 5e 3a f1 6c 92 b9 35 89 fc 4b 89 e4 .s..^:.l..5..K.. 0170 ed 20 3e 88 1d 39 ab 84 7a c4 4c be c3 14 64 de . >..9..z.L...d. 0180 a5 77 33 7f 0f 66 bc 45 88 e7 f9 d6 d5 07 cc 81 .w3..f.E........ 0190 fa 2b de 19 55 61 86 9c 5c cb bd c9 93 1d 57 58 .+..Ua..\.....WX 01a0 c6 73 e8 33 1b 34 bf 5a b8 ad 7c e2 d0 38 ba c5 .s.3.4.Z..|..8.. 01b0 c3 00 04 c3 39 71 c6 ec 57 fb 74 9a ad 63 15 9d ....9q..W.t..c.. 01c0 ea 3f 6e 17 2c 47 ae 70 a9 cf a3 a0 c0 3c a0 bb .?n.,G.p.....<.. 01d0 c5 3d c7 34 57 47 88 e6 0c 9e a9 ca d0 1e 4e 5b .=.4WG........N[ 01e0 82 1c ce 06 38 29 ca 5c 89 f0 18 c5 d0 18 9c fa ....8).\........ 01f0 a1 44 5d e7 34 73 f3 be 7c e4 20 be fd 3b 02 ad .D].4s..|. ..;.. 0200 de 38 31 11 de 43 ac 7c 23 da c8 a1 b8 38 e8 8a .81..C.|#....8.. 0210 c0 01 c2 73 92 d7 f8 c5 aa fa 98 eb 0e aa b0 7f ...s............ 0220 ab 81 39 4f 65 8e 59 6e a5 0c 5f d9 d3 d1 dd d4 ..9Oe.Yn.._..... 0230 ec 26 5f 7e 0a 5f ad e9 89 f4 93 09 e3 09 97 75 .&_~._.........u 0240 4d 9f 15 29 72 f1 a5 8f 6f db 06 ff a5 e9 1e 02 M..)r...o....... 0250 2f ea 5e f9 2a 68 51 fc be d7 52 56 d8 2a 5f a5 /.^.*hQ...RV.*_. 0260 4a 98 f3 48 65 f6 6c 6c 55 d1 81 fc a5 e9 86 03 J..He.llU....... 0270 27 ea de ff 3a 68 c9 e3 b6 d4 d2 36 c8 2a d7 40 '...:h.....6.*.@ 0280 5c 98 6c 46 3b db ba a9 5e df 7e 85 88 b7 34 36 \.lF;...^.~...46 0290 26 d8 26 83 7f 75 7a c3 b4 d9 71 0a e8 2e 00 bc &.&..uz...q..... 02a0 64 b8 b6 13 2a ac 6b 65 70 d9 9a e1 e1 d8 a5 7d d...*.kep......} 02b0 56 ba d9 ae 3f 5e df db f9 ca 93 14 e8 20 d7 1a V...?^....... .. 02c0 56 b8 4a 6e 20 ab f0 9e 78 e3 4e df ea ce 2b 14 V.Jn ...x.N...+. 02d0 00 97 01 96 12 52 4b d3 a4 f6 71 0a b7 28 11 a2 .....RK...q..(.. 02e0 43 b9 cc 0a 3f d5 10 72 72 89 bd c8 d2 93 83 39 C...?..rr......9 02f0 3f f4 86 a6 3c 36 b7 82 9c d7 af 28 df 29 85 42 ?...<6.....(.).B 0300 3d bd 5d 74 22 b5 89 9f 63 f0 3a dc c6 e8 1c 22 =.]t"...c.:...." 0310 5a e5 16 a3 53 62 38 bd bc 8e 27 50 95 12 5c 94 Z...Sb8...'P..\. 0320 46 e6 12 10 3c ab fe 69 66 85 dd df c0 ea 8a 3e F...<..if......> 0330 14 d8 3d f6 4f 76 28 24 ca e5 9b 05 80 77 ef 43 ..=.Ov($.....w.C 0340 33 a3 c7 70 4d d5 68 8c 0a 89 24 e1 ec d1 5a 4f 3..pM.h...$...ZO 0350 5d d8 a6 b5 28 5e b7 2d 81 cb 09 74 90 77 2f fb ]...(^.-...t.w/. 0360 30 bb 77 36 1b db f6 5e 2a da 96 d4 88 b7 f2 3d 0.w6...^*......= 0370 5c ff 0c c3 41 6d 18 00 94 d4 93 13 f9 18 ce 30 \...Am.........0 0380 23 83 f7 4d 3a db 63 ac 1e c7 12 ee e0 b0 25 62 #..M:.c.......%b 0390 1e ba d9 98 55 36 df 48 9a 03 bc ef 36 00 b5 fe ....U6.H....6... 03a0 1c 00 16 00 02 21 db 5e e0 0e 3c ca 74 43 04 00 .....!.^..<.tC.. 03b0 3c 2a 71 43 00 00 61 17 13 54 73 99 e1 42 6b 04 <*qC..a..Ts..Bk. 03c0 07 8a 74 b4 03 f0 85 bc 0b f0 20 15 69 6c 36 00 ..t....... .il6. No. Time Source Destination Protocol Info 2730 819.782555 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=2781 Ack=10785 Win=16106 [TCP CHECKSUM INCORRECT] Len=162 Frame 2730 (216 bytes on wire, 216 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.541059000 Time delta from previous packet: 0.003499000 seconds Time since reference or first frame: 819.782555000 seconds Frame Number: 2730 Packet Length: 216 bytes Capture Length: 216 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 202 Identification: 0x41c0 (16832) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x342a] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 2781, Ack: 10785, Len: 162 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 2781 (relative sequence number) Next sequence number: 2943 (relative sequence number) Acknowledgement number: 10785 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16106 Checksum: 0x8500 [incorrect, should be 0x26f8] SEQ/ACK analysis This is an ACK to the segment in frame: 2729 The RTT to ACK the segment was: 0.003499000 seconds Data (162 bytes) 0000 bc ef a2 00 b5 fe 18 00 88 00 00 21 ac d0 32 0a ...........!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9e bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 35 4f 28 7e 94 0a f5 8a 49 44 4a a4 32 ee 20 o5O(~....IDJ.2. 0040 6f 14 82 6c 9a 84 87 9a 15 6b 83 ab c3 4e 26 74 o..l.....k...N&t 0050 80 cb 8f 8a 66 94 ec ff 9d 4b 1f 55 ac 32 14 41 ....f....K.U.2.A 0060 6e 14 67 2a f2 20 76 fc 8b 6b af e4 ca 4e da 09 n.g*. v..k...N.. 0070 6d 34 7d 0c 16 30 07 75 83 4b 28 6e af 32 ee a0 m4}..0.u.K(n.2.. 0080 58 16 0f ec 2d 20 8a 1a 8b 6b d3 8f c8 4e 26 f4 X...- ...k...N&. 0090 58 36 09 0a 4d 30 81 7f bc 4b 5a 71 97 33 04 65 X6..M0...KZq.3.e 00a0 a2 00 .. No. Time Source Destination Protocol Info 2731 819.783854 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=10785 Ack=2943 Win=7442 Len=1030 Frame 2731 (1084 bytes on wire, 1084 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.542358000 Time delta from previous packet: 0.001299000 seconds Time since reference or first frame: 819.783854000 seconds Frame Number: 2731 Packet Length: 1084 bytes Capture Length: 1084 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1070 Identification: 0x9e52 (40530) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xd433 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 10785, Ack: 2943, Len: 1030 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 10785 (relative sequence number) Next sequence number: 11815 (relative sequence number) Acknowledgement number: 2943 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7442 Checksum: 0x0855 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2730 The RTT to ACK the segment was: 0.001299000 seconds Data (1030 bytes) 0000 bc ef 06 04 b5 fe 18 00 63 0a 13 21 c6 6b 32 0a ........c..!.k2. 0010 04 00 3c 2a 71 43 00 00 70 1a 0f f0 5b bf 76 4c ..<*qC..p...[.vL 0020 6f 01 75 2d 15 b5 49 d1 87 dd b5 3f e4 d6 6f 76 o.u-..I....?..ov 0030 2f 3c dd 6c 69 94 01 3f cc b6 9f 71 f7 b2 f4 a2 /<.li..?...q.... 0040 7f 24 03 22 7f 15 ed 18 cd 1d c6 79 f4 66 a4 b6 .$.".......y.f.. 0050 5f 2a 0f 35 27 75 f2 ab 82 ab a3 07 17 33 bb 42 _*.5'u.......3.B 0060 ef 14 69 a5 46 9c d1 ff 0f 2f e1 1a cb ce d6 53 ..i.F..../.....S 0070 e8 92 61 9f 27 b4 01 7f 8b 51 32 b4 b3 34 13 4e ..a.'....Q2..4.N 0080 55 4c d8 37 9d 84 9e 3f 84 ac bd e9 3d c2 dd 5a UL.7...?....=..Z 0090 5d 80 1b 01 96 fd 2e 8b 3d 4a 51 cd 56 b3 90 73 ].......=JQ.V..s 00a0 ab 33 1b 20 d4 b2 6a ea 81 f8 08 02 06 3d c9 ef .3. ..j......=.. 00b0 9f 67 c2 66 df 07 99 3f 55 2a 1a 78 8f 0b 50 91 .g.f...?U*.x..P. 00c0 e4 a4 e2 96 fd f0 b9 e9 c1 6c ee d8 54 84 4f ba .........l..T.O. 00d0 f9 75 24 a8 9f f8 ce 80 d3 09 a0 60 2e 34 98 5d .u$........`.4.] 00e0 89 e0 f7 c6 b1 02 59 6b 23 e4 05 cf e2 be e9 84 ......Yk#....... 00f0 1f 31 50 fd 4a d7 cf 01 8a 33 04 ee ee 38 e2 5c .1P.J....3...8.\ 0100 63 12 b4 b1 cc e5 6a 1e d7 ba ec 2d 75 41 18 09 c.....j....-uA.. 0110 8b 06 11 05 c1 a8 f9 1e 72 da ea 00 05 43 05 4d ........r....C.M 0120 9f 7f b8 f6 83 94 75 57 23 9a be 88 7e f4 3f f1 ......uW#...~.?. 0130 0e bc 93 fa d5 9a c8 7f 8f 57 78 33 ca 8a ac 23 .........Wx3...# 0140 46 50 a8 ff 54 1c ef c3 67 4b 8c 07 38 6c 9c 0c FP..T...gK..8l.. 0150 31 a5 dc c2 27 67 40 d0 11 ec ae 42 94 cd 79 13 1...'g@....B..y. 0160 5e dc 07 21 4c ea 21 28 14 79 04 b9 9c e1 31 2b ^..!L.!(.y....1+ 0170 06 bb 0a c1 8f ab 7e b4 cd 63 96 f7 7f c2 7b 40 ......~..c....{@ 0180 4a 14 cf 48 6c dc 85 73 87 88 91 cd c8 2c a4 6c J..Hl..s.....,.l 0190 24 31 e7 ef 11 35 f5 19 5b 24 25 4d 07 b5 18 2d $1...5..[$%M...- 01a0 ea 24 e5 1f 16 cc 45 0b 0d 10 81 3b a0 8d 8b 2d .$....E....;...- 01b0 9d 5b ab 12 69 a5 e6 7c 2c cd 7c f0 5d 2e 65 81 .[..i..|,.|.].e. 01c0 14 f5 ed bc 96 66 a3 79 ea fb 1d 61 fb 79 6b 93 .....f.y...a.yk. 01d0 5c ee 05 a3 67 f4 ad 95 dd 3f 2c 78 cb a2 ba 40 \...g....?,x...@ 01e0 93 bd 0f 26 7d ab 65 2c 82 93 40 12 ce 4d ae 5d ...&}.e,..@..M.] 01f0 86 38 f0 d0 f8 c2 00 2b 55 84 40 0e e0 fe 29 fe .8.....+U.@...). 0200 6e d5 f8 23 ca 06 c7 93 da 54 a1 67 b4 4f 35 98 n..#.....T.g.O5. 0210 59 4e e9 bb f9 3b 01 13 4e 06 b9 f0 1b 1a ce 4f YN...;..N......O 0220 1e c4 f5 6e e1 17 27 78 7a 69 82 9b b2 4d c8 f3 ...n..'xzi...M.. 0230 22 6c 79 2b 7a a2 57 b8 ae 7f bf 1b e3 ac 90 ed "ly+z.W......... 0240 96 ef 51 a2 39 ce 3e d0 4f 34 60 8f 97 84 d9 a1 ..Q.9.>.O4`..... 0250 9a 37 a3 24 55 3d a5 99 64 f6 d1 fd 6d 57 96 1f .7.$U=..d...mW.. 0260 60 f2 e8 c8 fa 76 6d cc 1b cd 59 40 68 81 65 59 `....vm...Y@h.eY 0270 4b 0d 2a 8c aa ef 24 c9 2f 1c 9e 94 43 03 1a 3a K.*...$./...C..: 0280 81 bd 2e f0 76 b8 90 bb 41 bf e8 e6 f5 30 4a 11 ....v...A....0J. 0290 4b 39 d6 7c 0b 02 43 eb e9 15 d5 fd fb 2d f3 73 K9.|..C......-.s 02a0 2c 57 6c 74 f2 d5 b1 ef cd c1 2f 16 a0 d6 26 0b ,Wlt....../...&. 02b0 9e ea 5f 38 0d a2 ec 00 d4 70 a5 ed 50 1b d8 ff .._8.....p..P... 02c0 e0 d2 d3 b6 b2 c4 17 09 3f a4 99 75 ee b1 a1 bb ........?..u.... 02d0 df 57 53 f5 a7 ef 7c 04 91 64 56 5e 69 5d 29 ba .WS...|..dV^i]). 02e0 ef 22 54 53 f9 88 7f 8f cd 16 be 34 a4 67 eb 32 ."TS.......4.g.2 02f0 72 8a 8f b3 55 07 e1 83 9e 3c 71 96 62 71 ec b8 r...U.... 1677 [PSH, ACK] Seq=2943 Ack=11815 Win=17520 [TCP CHECKSUM INCORRECT] Len=598 Frame 2732 (652 bytes on wire, 652 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.552481000 Time delta from previous packet: 0.010123000 seconds Time since reference or first frame: 819.793977000 seconds Frame Number: 2732 Packet Length: 652 bytes Capture Length: 652 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x41c1 (16833) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3275] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 2943, Ack: 11815, Len: 598 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 2943 (relative sequence number) Next sequence number: 3541 (relative sequence number) Acknowledgement number: 11815 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x86b4 [incorrect, should be 0xde00] SEQ/ACK analysis This is an ACK to the segment in frame: 2731 The RTT to ACK the segment was: 0.010123000 seconds Data (598 bytes) 0000 bc ef 56 02 b5 fe 18 00 3a 02 02 21 e9 7e 32 0a ..V.....:..!.~2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9e bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 35 4f 28 7e 94 0a f5 8a 49 44 4a a4 32 ee 20 o5O(~....IDJ.2. 0040 6f 14 82 6c 9a 84 87 9a 15 6b 83 ab c3 4e 26 74 o..l.....k...N&t 0050 80 cb 8f 8a 66 94 ec ff 9d 4b 1f 55 ac 32 14 41 ....f....K.U.2.A 0060 6e 14 67 2a f9 20 76 fc 94 6b 18 e4 cc 4e da 09 n.g*. v..k...N.. 0070 6f 34 31 ab 69 94 0a 75 8d 4b f3 6c b3 32 e7 a0 o41.i..u.K.l.2.. 0080 5f 14 13 48 40 86 8d 1a 86 6b ed 8f d4 4e c2 f6 _..H@....k...N.. 0090 5f 34 16 ae 51 94 fc 7f 52 49 52 71 b8 32 18 c1 _4..Q...RIRq.2.. 00a0 6f 14 b1 a8 95 84 72 7c 85 6b a9 64 2c 4c d0 89 o.....r|.k.d,L.. 00b0 6c 34 51 28 59 94 e8 f7 8d 4b 25 ee 83 32 e4 20 l4Q(Y....K%..2. 00c0 98 16 23 c8 be 84 8d 9a 85 6b 34 0d e4 4e 2f 74 ..#......k4..N/t 00d0 7f 34 25 2e ab 96 fc ff 9e 4b 42 f1 8b 32 f3 43 .4%......KB..2.C 00e0 6f 14 44 2a a5 84 71 fc 69 69 b9 e4 ef 4e d0 09 o.D*..q.ii...N.. 00f0 6f 34 b0 aa 49 94 03 75 8d 4b 36 6e 61 30 e4 a0 o4..I..u.K6na0.. 0100 1c 14 33 48 cd 84 74 18 85 6b ce 8f f4 4e 2c f4 ..3H..t..k...N,. 0110 e5 36 35 ae 32 94 fc 7f fd 4b 3f 72 9b 32 9b c1 .65.2....K?r.2.. 0120 6f 14 b7 ab b9 87 71 7e 86 6b c9 62 fc 4e a4 81 o.....q~.k.b.N.. 0130 6f 34 b2 37 39 94 00 95 dc 48 46 0e e0 32 64 40 o4.79....HF..2d@ 0140 7f 14 56 2c dd 84 8e f8 85 6b bd e9 12 4b ac 1e ..V,.....k...K.. 0150 7c 34 c5 d1 21 94 6b fa 9d 4b 21 f1 eb 32 98 41 |4..!.k..K!..2.A 0160 f7 11 a7 2b c6 84 71 fe 85 6b 40 e7 8c 4e 53 03 ...+..q..k@..NS. 0170 6f 34 a1 b7 b3 91 00 15 8e 4b 56 8e f3 32 ff c5 o4.......KV..2.. 0180 5f 14 d0 a9 ed 84 8d 78 1a 6e ad 69 97 4e ac 9e _......x.n.i.N.. 0190 5f 34 75 54 11 94 ff 7f bd 4b 12 71 5a 37 98 c1 _4uT.....K.qZ7.. 01a0 6c 14 97 ab d5 84 d3 7b 85 6b ea 62 9c 4e 50 83 l......{.k.b.NP. 01b0 cc 31 91 37 1a 94 00 95 8d 4b c2 0b c3 32 67 40 .1.7.....K...2g@ 01c0 7f 14 e3 29 54 81 8d f8 86 6b 9d e9 a4 4e 06 1b ...)T....k...N.. 01d0 7f 34 e6 d1 01 94 fc ff 36 4e 02 f1 c8 32 98 41 .4......6N...2.A 01e0 6f 14 2b 2e e5 84 72 fe 85 6b f9 e2 01 4b 50 03 o.+...r..k...KP. 01f0 6c 34 81 b7 09 94 ae 10 8d 4b 75 8e d3 32 64 c0 l4.......Ku..2d. 0200 30 16 f3 a9 0e 8c 8d 78 85 75 91 cd c3 cc ab 9e 0......x.u...... 0210 91 dd c3 51 f7 aa f7 7f 7a 8a de 71 dd f5 68 c0 ...Q....z..q..h. 0220 7d db 0a a9 e9 f7 70 dd 82 94 84 6b 82 49 3e 98 }.....p....k.I>. 0230 65 3b 8a 58 e5 20 7c c6 8a 7d f4 16 1d eb 0a 29 e;.X. |..}.....) 0240 75 fb f9 d0 01 10 6f 51 f8 bd 7e ff 4c b7 7f 64 u.....oQ..~.L..d 0250 63 9f a3 ce 56 02 c...V. No. Time Source Destination Protocol Info 2733 819.794849 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=11815 Ack=3541 Win=7604 Len=382 Frame 2733 (436 bytes on wire, 436 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.553353000 Time delta from previous packet: 0.000872000 seconds Time since reference or first frame: 819.794849000 seconds Frame Number: 2733 Packet Length: 436 bytes Capture Length: 436 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 422 Identification: 0xa052 (41042) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xd4bb [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 11815, Ack: 3541, Len: 382 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 11815 (relative sequence number) Next sequence number: 12197 (relative sequence number) Acknowledgement number: 3541 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7604 Checksum: 0xe7cc [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2732 The RTT to ACK the segment was: 0.000872000 seconds Data (382 bytes) 0000 bc ef 7e 01 b5 fe 18 00 12 04 10 21 f6 76 32 0a ..~........!.v2. 0010 04 00 3c 2a 71 43 00 00 70 1a 0f f0 5b bf 76 4c ..<*qC..p...[.vL 0020 6f 01 75 2d 15 b5 49 d1 87 dd b5 3f e4 d6 6f 74 o.u-..I....?..ot 0030 2f 3c dd 6c 69 94 01 3f cf e6 9f 71 f3 12 e4 a4 /<.li..?...q.... 0040 26 d4 86 2e 83 a6 42 fe d5 7d dd f0 44 5b b5 57 &.....B..}..D[.W 0050 99 36 00 37 66 8c 90 55 85 23 7b 89 6a 94 03 44 .6.7f..U.#{.j..D 0060 b7 78 18 97 75 52 da 99 c3 71 98 f7 7c c5 4e 78 .x..uR...q..|.Nx 0070 eb b5 e7 b9 30 bb 32 ef 8c 63 13 01 a9 93 66 43 ....0.2..c....fC 0080 33 68 93 cf 3d 80 19 a2 e4 ef cd f8 b4 4b ef 6e 3h..=........K.n 0090 fc 11 0f 02 09 19 fc fd 13 fa c0 83 42 1e 5e 27 ............B.^' 00a0 d3 d8 ee 04 d7 60 c2 7a e5 2c c1 9c c6 c9 80 4b .....`.z.,.....K 00b0 a1 d8 06 a5 e6 81 e2 19 0b ed 23 c1 cc f9 a6 3a ..........#....: 00c0 18 0c 53 82 27 84 f5 97 38 98 c9 d5 d8 7e 0f d1 ..S.'...8....~.. 00d0 42 ca eb 4c b6 6f c6 ea 42 a7 a8 c0 f4 81 b6 54 B..L.o..B......T 00e0 b1 3a 8b 7f 2e 43 64 0c 77 ae c1 28 9d 10 ff 27 .:...Cd.w..(...' 00f0 38 bc 75 29 c3 64 06 9d 31 15 af 1f 81 be 9e de 8.u).d..1....... 0100 4f 32 f6 11 45 57 75 05 4c 3a a3 2d 63 c8 28 38 O2..EWu.L:.-c.(8 0110 9e 42 25 5b 25 73 4a be 23 d1 7d 0b 2b 25 25 a3 .B%[%sJ.#.}.+%%. 0120 f8 c3 c8 cb d6 d9 93 71 40 13 6f 39 a2 67 ee fa .......q@.o9.g.. 0130 91 13 44 0f 13 99 77 53 02 46 31 12 64 6f 86 e0 ..D...wS.F1.do.. 0140 ba 6c 6b d8 c2 7c 29 24 fa 89 1a 4a 66 e4 69 6c .lk..|)$...Jf.il 0150 d5 c5 9b e5 ed c3 76 2e 88 a9 8c e4 91 f1 1b ba ......v......... 0160 30 ba 56 27 8a ed 4f 26 4c f0 28 a7 2f 4c 1f ae 0.V'..O&L.(./L.. 0170 bc 39 55 a3 7b fd 0d be 0c fd 90 f0 7e 01 .9U.{.......~. No. Time Source Destination Protocol Info 2734 819.824432 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=3541 Ack=12197 Win=17138 [TCP CHECKSUM INCORRECT] Len=154 Frame 2734 (208 bytes on wire, 208 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.582936000 Time delta from previous packet: 0.029583000 seconds Time since reference or first frame: 819.824432000 seconds Frame Number: 2734 Packet Length: 208 bytes Capture Length: 208 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 194 Identification: 0x41c2 (16834) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3430] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 3541, Ack: 12197, Len: 154 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 3541 (relative sequence number) Next sequence number: 3695 (relative sequence number) Acknowledgement number: 12197 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17138 Checksum: 0x84f8 [incorrect, should be 0x7e7b] SEQ/ACK analysis This is an ACK to the segment in frame: 2733 The RTT to ACK the segment was: 0.029583000 seconds Data (154 bytes) 0000 bc ef 9a 00 b5 fe 18 00 80 00 00 21 5b 16 32 0a ...........![.2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9e bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 35 4f 28 7e 94 0a f5 74 4a 44 4a a4 32 ee 20 o5O(~...tJDJ.2. 0040 7f 14 82 6c 9a 84 87 9a 15 6b 83 ab c3 4e 26 74 ...l.....k...N&t 0050 80 cb 8f 8a 66 94 ec ff 9d 4b 1f 55 ac 32 14 41 ....f....K.U.2.A 0060 6e 14 67 2a f2 20 76 fc 8b 6b 85 40 b3 ea d7 09 n.g*. v..k.@.... 0070 61 34 5f a8 75 94 0a 75 74 4a 0a ca 33 96 e3 a0 a4_.u..utJ..3... 0080 51 14 2d 48 b1 84 87 1a 7c 6a f1 2b c8 ea 51 f4 Q.-H....|j.+..Q. 0090 5e 34 1d ae 7d 95 e0 db 9a 00 ^4..}..... No. Time Source Destination Protocol Info 2735 819.824939 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=12197 Ack=3695 Win=7450 Len=438 Frame 2735 (492 bytes on wire, 492 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.583443000 Time delta from previous packet: 0.000507000 seconds Time since reference or first frame: 819.824939000 seconds Frame Number: 2735 Packet Length: 492 bytes Capture Length: 492 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 478 Identification: 0xa252 (41554) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xd283 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 12197, Ack: 3695, Len: 438 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 12197 (relative sequence number) Next sequence number: 12635 (relative sequence number) Acknowledgement number: 3695 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7450 Checksum: 0x1661 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2734 The RTT to ACK the segment was: 0.000507000 seconds Data (438 bytes) 0000 bc ef b6 01 b5 fe 18 00 9b 01 01 21 07 a8 32 0a ...........!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6e 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.n.].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 dd 96 e3 42 G.v.}.([.K.....B 0040 75 14 02 2e 17 20 8a f0 95 6b 04 f0 8e 4b 2c 72 u.... ...k...K,r 0050 7f 34 a1 31 7d 94 e4 99 84 4b 62 0f 87 60 4e 10 .4.1}....Kb..`N. 0060 28 34 47 08 a5 a6 13 ce b9 43 b3 f8 ed 6e f0 ab (4G......C...n.. 0070 41 0c 41 0e 48 14 00 e3 8d 4e 16 ac b3 32 e4 0d A.A.H....N...2.. 0080 5f 55 13 65 ad db 8d b4 85 24 ed bc d4 60 2c 3d _U.e.....$...`,= 0090 5f 75 15 7b 51 cb fc c9 bd 04 52 21 bb 61 18 0c _u.{Q.....R!.a.. 00a0 6f 40 57 60 95 c1 71 bc 85 3f a9 d9 dc 00 d0 d8 o@W`..q..?...... 00b0 6f 74 51 7d 59 db 00 ab 8d 03 26 b5 83 60 e4 16 otQ}Y.....&..`.. 00c0 7f 5b 23 60 bd d7 8d dd 85 3c dd b0 e4 60 2c 31 .[#`.....<...`,1 00d0 7f 7b 25 7d 41 ba fc d8 9d 1e 42 2e 89 2e 18 46 .{%}A.....B....F 00e0 6f 12 47 28 a5 d7 71 ad 85 2a b9 46 ee 52 d0 87 o.G(..q..*.F.R.. 00f0 6f 34 41 2e 49 68 01 e3 8d 47 36 f0 93 32 e6 0a o4A.Ih...G6..2.. 0100 1d 08 33 2b cd d8 8d f0 85 38 cd be f4 1a 2c 3a ..3+.....8....,: 0110 1f 71 35 62 31 c0 fc d6 fd 05 32 5c 9b 1c 98 0c .q5b1.....2\.... 0120 6f 55 b7 62 b5 db 71 b8 85 24 c9 a6 fc 01 50 ac oU.b..q..$....P. 0130 6f 7f b1 8e 39 d0 00 b0 8d 06 46 b0 e3 61 64 0d o...9.....F..ad. 0140 7f 40 c3 67 dd c1 8d a4 85 3f bd a0 84 00 ac 47 .@.g.....?.....G 0150 7f 19 c5 98 21 d5 fc b7 9d 08 22 40 eb 7f 98 6d ....!....."@...m 0160 6f 55 a7 7c c5 c9 73 f4 85 66 d9 ec cc 99 6c ec oU.|..s..f....l. 0170 6f 28 a1 dd 29 95 00 ff 8d 75 56 ec f3 38 64 bb o(..)....uV..8d. 0180 5e 08 77 2f ed f9 29 f1 85 67 ad ee 94 4e ac 3c ^.w/..)..g...N.< 0190 fb 33 d5 cb 11 bc 58 9e bd 4f 12 27 5f 35 98 47 .3....X..O.'_5.G 01a0 6f 3c 33 2e d5 80 71 9a 21 6a e9 84 9c 4e 50 ed o<3...q.!j...NP. 01b0 6f 28 35 d1 b6 01 o(5... No. Time Source Destination Protocol Info 2736 819.843538 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=3695 Ack=12635 Win=16700 [TCP CHECKSUM INCORRECT] Len=154 Frame 2736 (208 bytes on wire, 208 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.602042000 Time delta from previous packet: 0.018599000 seconds Time since reference or first frame: 819.843538000 seconds Frame Number: 2736 Packet Length: 208 bytes Capture Length: 208 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 194 Identification: 0x41c3 (16835) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x342f] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 3695, Ack: 12635, Len: 154 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 3695 (relative sequence number) Next sequence number: 3849 (relative sequence number) Acknowledgement number: 12635 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16700 Checksum: 0x84f8 [incorrect, should be 0x698c] SEQ/ACK analysis This is an ACK to the segment in frame: 2735 The RTT to ACK the segment was: 0.018599000 seconds Data (154 bytes) 0000 bc ef 9a 00 b5 fe 18 00 80 00 00 21 4b 65 32 0a ...........!Ke2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9e bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 35 4f 28 7e 94 0a f5 8a 49 44 4a a4 32 ee 20 o5O(~....IDJ.2. 0040 6f 14 82 6c 9a 84 87 9a 15 6b 83 ab c3 4e 26 74 o..l.....k...N&t 0050 80 cb 8f 8a 66 94 ec ff 9d 4b 1f 55 ac 32 14 41 ....f....K.U.2.A 0060 6e 14 67 2a f2 20 76 fc 8b 6b 85 40 b3 ea d7 09 n.g*. v..k.@.... 0070 61 34 5f a8 75 94 0a 75 03 4e 0a ca 33 96 e3 a0 a4_.u..u.N..3... 0080 51 14 2d 48 b1 84 87 1a 0b 6e f1 2b c8 ea 51 f4 Q.-H.....n.+..Q. 0090 5e 34 1d ae 7d 95 e0 db 9a 00 ^4..}..... No. Time Source Destination Protocol Info 2737 819.844066 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=12635 Ack=3849 Win=7296 Len=522 Frame 2737 (576 bytes on wire, 576 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.602570000 Time delta from previous packet: 0.000528000 seconds Time since reference or first frame: 819.844066000 seconds Frame Number: 2737 Packet Length: 576 bytes Capture Length: 576 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 562 Identification: 0xa452 (42066) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xd02f [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 12635, Ack: 3849, Len: 522 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 12635 (relative sequence number) Next sequence number: 13157 (relative sequence number) Acknowledgement number: 3849 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7296 Checksum: 0x2462 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2736 The RTT to ACK the segment was: 0.000528000 seconds Data (522 bytes) 0000 bc ef 0a 02 b5 fe 18 00 ee 01 02 21 d3 de 32 0a ...........!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6e 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.n.].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 dd 96 e3 42 G.v.}.([.K.....B 0040 75 14 07 2e 17 20 8a f0 95 6b 73 f4 69 7f 2c 72 u.... ...ks.i.,r 0050 7f 34 84 30 7d 94 f6 99 9d 4b 7e 0f b7 32 12 43 .4.0}....K~..2.C 0060 6b 14 c0 2d 99 84 7d ee 45 ab 59 96 68 4f cc 8b k..-..}.E.Y.hO.. 0070 77 34 78 2e 69 94 20 df ad 6b 32 d0 93 12 c4 60 w4x.i. ..k2....` 0080 3d 34 33 0e 8d a4 ac d0 a5 4b cd d1 f4 6e 0d 3f =43......K...n.? 0090 5d 28 15 3d 51 83 8b 98 fd 4a 52 13 bb 3e 18 42 ](.=Q....JR..>.B 00a0 6f 14 57 16 95 98 71 e4 85 e5 ac 8a 78 c0 d5 27 o.W...q.....x..' 00b0 5e 34 51 2e 59 15 00 e3 8d 41 26 f0 83 2e e4 5e ^4Q.Y....A&....^ 00c0 7f 1e 23 2d bd 23 88 ec 85 67 dd 0e e4 4e 2c d6 ..#-.#...g...N,. 00d0 7e 28 25 28 41 8d fc 99 9d 6b 62 2f ab 11 38 63 ~(%(A....kb/..8c 00e0 4f 34 65 4a 85 a4 51 ce a5 4a 99 b6 cc 6e f0 ab O4eJ..Q..J...n.. 00f0 4f 15 0c 2c 55 94 0d ff 9a 3c 37 b0 92 32 f8 42 O..,U....<7..2.B 0100 13 14 32 2e cd 84 b3 f0 99 6b c7 f1 7a 4b 30 d6 ..2......k..zK0. 0110 91 31 9e 01 31 94 fc 99 7c 4b 2e 0f 91 32 98 43 .1..1...|K...2.C 0120 73 14 ab 29 bf 84 73 e8 22 6e d5 88 f0 4e af 6d s..)..s."n...N.m 0130 6f 34 15 d0 25 94 18 ff 94 4b 46 f0 c3 12 44 62 o4..%....KF...Db 0140 5d 34 e3 0f fd a6 ef d6 a5 4b 9d cf a5 6e 8c 34 ]4.......K...n.4 0150 5f 14 e5 ef 00 d9 fe 85 9d 46 22 18 9c 33 d8 42 _........F"..3.B 0160 6f 08 a7 25 c5 85 71 e8 85 55 d9 94 8c 44 50 63 o..%..q..U...DPc 0170 6a 28 05 5f 2c 3e 31 ff 8d 4b 56 71 f3 2e 64 48 j(._,>1..KVq..dH 0180 5f 14 d3 33 ed 98 8d fc 85 6a ad 48 91 52 ac 18 _..3.....j.H.R.. 0190 5f 34 d5 30 11 30 fd 85 bd 53 12 16 fb 32 98 63 _4.0.0...S...2.c 01a0 4f 34 b7 08 f5 a4 51 c8 a7 09 c9 a8 bc 6e 70 cc O4....Q......np. 01b0 4f 14 b1 f1 39 b4 20 de c0 49 7a f0 ce 32 73 35 O...9. ..Iz..2s5 01c0 7e 54 e2 2f e1 84 81 f6 84 6b 9d ef 9a 4e b0 14 ~T./.....k...N.. 01d0 75 34 6b ca 1d 30 fc 99 e0 ef 05 0f c7 32 99 43 u4k..0.......2.C 01e0 6f 14 af 8d e2 84 75 e8 ad cf fe 88 a8 4e 78 49 o.....u......NxI 01f0 68 34 85 d1 21 30 07 ff 89 4b 04 54 d2 32 68 42 h4..!0...K.T.2hB 0200 9f 13 f3 2f 11 28 8d f6 0a 02 .../.(.... No. Time Source Destination Protocol Info 2738 819.914332 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=3849 Ack=13157 Win=16178 [TCP CHECKSUM INCORRECT] Len=130 Frame 2738 (184 bytes on wire, 184 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.672836000 Time delta from previous packet: 0.070266000 seconds Time since reference or first frame: 819.914332000 seconds Frame Number: 2738 Packet Length: 184 bytes Capture Length: 184 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 170 Identification: 0x41c4 (16836) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3446] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 3849, Ack: 13157, Len: 130 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 3849 (relative sequence number) Next sequence number: 3979 (relative sequence number) Acknowledgement number: 13157 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16178 Checksum: 0x84e0 [incorrect, should be 0x0837] SEQ/ACK analysis This is an ACK to the segment in frame: 2737 The RTT to ACK the segment was: 0.070266000 seconds Data (130 bytes) 0000 bc ef 82 00 b5 fe 18 00 68 00 00 21 d8 71 32 0a ........h..!.q2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9c bc 30 aa 3b b1 29 76 a.elr.....0.;.)v 0030 47 94 71 28 3b 30 07 f5 87 4b 06 ee db 96 e3 20 G.q(;0...K..... 0040 6e 14 79 4a 9d 84 8e 9a 85 6b fd 0f bc cc 2b 74 n.yJ.....k....+t 0050 7c 34 05 2e 61 94 85 7d 9d 4b 6e f1 ab 32 18 41 |4..a..}.Kn..2.A 0060 6e 14 67 2a 89 84 71 fc 85 6b 85 40 b5 ea d7 09 n.g*..q..k.@.... 0070 65 34 63 a9 75 30 7d 75 8c 4b 1e 6e 9f 33 f8 04 e4c.u0}u.K.n.3.. 0080 82 00 .. No. Time Source Destination Protocol Info 2739 819.914756 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=13157 Ack=3979 Win=7166 Len=190 Frame 2739 (244 bytes on wire, 244 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.673260000 Time delta from previous packet: 0.000424000 seconds Time since reference or first frame: 819.914756000 seconds Frame Number: 2739 Packet Length: 244 bytes Capture Length: 244 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 230 Identification: 0xa652 (42578) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xcf7b [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 13157, Ack: 3979, Len: 190 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 13157 (relative sequence number) Next sequence number: 13347 (relative sequence number) Acknowledgement number: 3979 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7166 Checksum: 0x1e64 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2738 The RTT to ACK the segment was: 0.000424000 seconds Data (190 bytes) 0000 bc ef be 00 b5 fe 18 00 a2 00 02 21 4e 4f 32 0a ...........!NO2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6c 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.l.].....#T;.+t 0030 18 90 76 2e 77 94 7a 7d 91 4b 05 f0 8b 32 e4 42 ..v.w.z}.K...2.B 0040 7f 14 03 1f d5 86 8f f0 85 6b fd f1 8c 06 64 3a .........k....d: 0050 37 7c 4d 30 61 96 fc 99 9d 4b 62 0f ab 32 18 43 7|M0a....Kb..2.C 0060 6f 9c 65 28 85 84 71 ee fd e9 85 96 cf 4e ca 8b o.e(..q......N.. 0070 6f 34 61 2e 69 a5 48 fd 8f 4b 16 f0 b3 32 ac 0a o4a.i.H..K...2.. 0080 17 5c 5b 66 e5 84 8d f2 85 6b ed f1 ad cc 30 72 .\[f.....k....0r 0090 53 34 3c 30 51 94 fd 99 a1 4b 5e 0f aa 32 18 43 S4<0Q....K^..2.C 00a0 73 b0 7f 8c 92 84 75 ee ad cf ae 96 d8 4e a2 2f s.....u......N./ 00b0 6e 34 5d 2e 59 94 00 ff 91 ef 00 00 be 00 n4].Y......... No. Time Source Destination Protocol Info 2740 819.916559 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=3979 Ack=13347 Win=17520 [TCP CHECKSUM INCORRECT] Len=210 Frame 2740 (264 bytes on wire, 264 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.675063000 Time delta from previous packet: 0.001803000 seconds Time since reference or first frame: 819.916559000 seconds Frame Number: 2740 Packet Length: 264 bytes Capture Length: 264 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 250 Identification: 0x41c5 (16837) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x33f5] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 3979, Ack: 13347, Len: 210 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 3979 (relative sequence number) Next sequence number: 4189 (relative sequence number) Acknowledgement number: 13347 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x8530 [incorrect, should be 0xf8b8] SEQ/ACK analysis This is an ACK to the segment in frame: 2739 The RTT to ACK the segment was: 0.001803000 seconds Data (210 bytes) 0000 bc ef d2 00 b5 fe 18 00 b6 00 02 21 c5 70 32 0a ...........!.p2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9e bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 35 4f 28 7e 94 0a f5 1b 4b 44 4a a4 32 ee 20 o5O(~....KDJ.2. 0040 6f 14 82 6c 9a 84 87 9a 09 6b 83 ab c3 4e 26 74 o..l.....k...N&t 0050 80 cb 8a 8a 66 94 eb ff 9d 4b 62 f1 d6 96 1f 41 ....f....Kb....A 0060 63 14 67 2a 85 84 06 58 82 6b 97 e4 4f 4e c6 09 c.g*...X.k..ON.. 0070 63 34 61 a8 69 94 83 75 9b 4b 1a 6e f3 32 e4 a0 c4a.i..u.K.n.2.. 0080 7c 14 07 48 a5 84 80 1a 06 6b fb 8f d8 4e 2c f4 |..H.....k...N,. 0090 5f 34 96 ae 47 94 f0 7f fd 4b 52 71 a7 96 67 65 _4..G....KRq..ge 00a0 68 14 59 aa a9 84 6d 7c 83 6b a9 64 dc 4e cc 2d h.Y...m|.k.d.N.- 00b0 ef 90 56 28 57 94 3c f5 91 4b 20 ee 83 32 e4 20 ..V(W.<..K ..2. 00c0 63 b0 3f 6c c0 84 8c 9a 8d 6b f1 0e f8 ea 2c d0 c.?l.....k....,. 00d0 d2 00 .. No. Time Source Destination Protocol Info 2741 819.919479 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=13347 Ack=4189 Win=7604 Len=514 Frame 2741 (568 bytes on wire, 568 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.677983000 Time delta from previous packet: 0.002920000 seconds Time since reference or first frame: 819.919479000 seconds Frame Number: 2741 Packet Length: 568 bytes Capture Length: 568 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 554 Identification: 0xa852 (43090) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xcc37 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 13347, Ack: 4189, Len: 514 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 13347 (relative sequence number) Next sequence number: 13861 (relative sequence number) Acknowledgement number: 4189 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7604 Checksum: 0x0b4e [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2740 The RTT to ACK the segment was: 0.002920000 seconds Data (514 bytes) 0000 bc ef 02 02 b5 fe 18 00 e8 01 00 21 e7 79 32 0a ...........!.y2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6e 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.n.].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 dd 96 e3 42 G.v.}.([.K.....B 0040 75 14 62 2e 12 20 8a f0 92 6b 77 c0 c4 4e 9d 43 u.b.. ...kw..N.C 0050 7f 34 b6 01 61 94 49 a8 9d 4b d9 3e ab 32 a5 72 .4..a.I..K.>.2.r 0060 6f 14 23 1a 85 84 38 dc 85 6b fe a4 cc 4e be b9 o.#...8..k...N.. 0070 6f 34 73 1a 69 94 6d cb 8d 4b 11 c7 b3 32 75 75 o4s.i.m..K...2uu 0080 5f 14 f4 19 ad 84 fb c8 85 6b 78 c9 d4 4e b0 4a _........kx..N.J 0090 5f 34 8b 08 51 94 55 a1 bd 4b eb 37 bb 32 a4 7b _4..Q.U..K.7.2.{ 00a0 6f 14 e9 10 95 84 b1 d6 85 6b 6b ae dc 4e de b2 o........kk..N.. 00b0 6f 34 41 17 59 94 4d c6 8d 4b 71 c9 83 32 89 7b o4A.Y.M..Kq..2.{ 00c0 7f 14 53 17 bd 84 f9 c9 85 6b ab c8 e4 4e a9 4b ..S......k...N.K 00d0 7f 34 a9 09 41 94 68 a0 9d 4b db 36 8b 32 a1 7a .4..A.h..K.6.2.z 00e0 6f 14 fa 11 a5 84 b2 d7 85 6b 7c af ec 4e 1b b2 o........k|..N.. 00f0 6f 34 90 17 49 94 d5 c6 8d 4b ee c9 93 32 3e 7b o4..I....K...2>{ 0100 1f 14 d3 17 cd 84 6f c9 85 6b 29 c8 f4 4e c0 4b ......o..k)..N.K 0110 1f 34 db 09 31 94 04 a0 fd 4b ce 36 9b 32 67 7a .4..1....K.6.2gz 0120 6f 14 b3 13 b5 84 7b d2 85 6b da b2 fc 4e 60 d7 o.....{..k...N`. 0130 6f 34 87 eb 39 94 3b c5 8d 4b 79 ca e3 32 34 78 o4..9.;..Ky..24x 0140 7f 14 90 15 dd 84 ed cc 85 6b d3 d5 84 4e d8 2e .........k...N.. 0150 7f 34 b3 f5 21 94 86 a3 9d 4b 5c 35 eb 32 18 79 .4..!....K\5.2.y 0160 6f 14 25 13 c5 84 f5 d2 85 6b 5f b2 8c 4e df d7 o.%......k_..N.. 0170 6f 34 30 eb 29 94 99 c5 8d 4b cb ca f3 32 c6 78 o40.)....K...2.x 0180 5f 14 7a 15 ed 84 26 cc 85 6b 19 d5 94 4e 1a 2e _.z...&..k...N.. 0190 5f 34 6f f5 11 94 40 a3 bd 4b ac 35 fb 32 5a 79 _4o...@..K.5.2Zy 01a0 6f 14 5f 13 d5 84 bc d2 85 6b 3b b2 9c 4e b3 d7 o._......k;..N.. 01b0 6f 34 76 eb 19 94 eb c5 8d 4b 95 ca c3 32 91 78 o4v......K...2.x 01c0 7f 14 1f 15 fd 84 8d cd 85 6b 6b d7 a4 4e ac 14 .........kk..N.. 01d0 7f 34 98 6b 06 94 f0 99 9d 4b 02 0f e3 96 9f 43 .4.k.....K.....C 01e0 6b 14 af 8d e2 84 75 e8 ad cf fe 88 a8 4e 78 49 k.....u......NxI 01f0 68 34 85 d1 7b 30 01 ff 81 4b 76 f0 d3 32 78 e6 h4..{0...Kv..2x. 0200 02 02 .. No. Time Source Destination Protocol Info 2742 819.920613 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=4189 Ack=13861 Win=17006 [TCP CHECKSUM INCORRECT] Len=370 Frame 2742 (424 bytes on wire, 424 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.679117000 Time delta from previous packet: 0.001134000 seconds Time since reference or first frame: 819.920613000 seconds Frame Number: 2742 Packet Length: 424 bytes Capture Length: 424 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 410 Identification: 0x41c6 (16838) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3354] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 4189, Ack: 13861, Len: 370 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 4189 (relative sequence number) Next sequence number: 4559 (relative sequence number) Acknowledgement number: 13861 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17006 Checksum: 0x85d0 [incorrect, should be 0xb295] SEQ/ACK analysis This is an ACK to the segment in frame: 2741 The RTT to ACK the segment was: 0.001134000 seconds Data (370 bytes) 0000 bc ef 72 01 b5 fe 18 00 10 04 13 21 41 98 32 0a ..r........!A.2. 0010 04 00 3c 2a 71 43 00 0a 70 1a 0f ee 58 8f 76 22 ..<*qC..p...X.v" 0020 6f 03 75 ca 7f f4 37 9a 91 bc 06 0e 33 89 a3 76 o.u...7.....3..v 0030 6f 7c 29 a5 79 8a 31 fd c9 4b 1a bc bc 43 ec 10 o|).y.1..K...C.. 0040 7f 17 ca ef 71 53 ae eb 8d 33 fd 99 c4 73 ab 6c ....qS...3...s.l 0050 a8 37 9d ee 61 af 38 a7 86 53 5d f6 f3 ae d8 f9 .7..a.8..S]..... 0060 ae ff eb d9 fc 67 4d 21 fd a4 ae da ff 83 17 85 .....gM!........ 0070 9c 5d 02 94 b0 2c cf 43 cb 78 db eb 3f c1 bb c3 .]...,.C.x..?... 0080 63 c3 8b 87 98 52 be d7 e8 e7 1e d5 b7 72 f9 8c c....R.......r.. 0090 90 01 5b 9d 9c d1 70 8c f3 a8 6e a2 83 fd 2c 4f ..[...p...n...,O 00a0 5c d9 48 26 66 c7 12 40 55 f3 66 50 ca 7d 1d 88 \.H&f..@U.fP.}.. 00b0 e3 c7 6e 4b 65 5b 58 3a be fd 15 22 6a be 17 17 ..nKe[X:..."j... 00c0 1c 28 ef d0 72 b6 13 a9 49 ca 51 fc fb ad 10 b3 .(..r...I.Q..... 00d0 07 fb 14 98 72 58 9d 73 6e 42 a1 cd 4a 6a d7 71 ....rX.snB..Jj.q 00e0 49 27 8a d4 9c 40 97 f9 43 64 75 83 77 ad c9 ef I'...@..Cdu.w... 00f0 81 f2 38 13 78 0a 6e 39 ea d0 bd 77 75 d2 22 d9 ..8.x.n9...wu.". 0100 a9 a5 ad 25 41 e3 16 4d 9c 8d 1c 49 8d fc dd 6a ...%A..M...I...j 0110 73 68 52 35 3e 8d 1a c2 3b 32 9c 00 05 5b 04 a6 shR5>...;2...[.. 0120 f5 47 ae 4d 39 42 08 df f4 f5 ae 0e 9b d7 83 9a .G.M9B.......... 0130 89 44 77 4e a2 e5 9e f0 f1 2c df 39 fa d4 74 86 .DwN.....,.9..t. 0140 06 97 72 b7 b1 ad 3d 81 35 5a 23 82 68 29 36 ed ..r...=.5Z#.h)6. 0150 66 d2 7c 17 58 3e 8d 61 f4 a7 45 6b 98 2b 7b c0 f.|.X>.a..Ek.+{. 0160 48 ac 68 97 c5 86 71 fc 45 65 f1 22 8c 4e 50 03 H.h...q.Ee.".NP. 0170 72 01 r. No. Time Source Destination Protocol Info 2743 819.930569 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=13861 Ack=4559 Win=7234 Len=1460 Frame 2743 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.689073000 Time delta from previous packet: 0.009956000 seconds Time since reference or first frame: 819.930569000 seconds Frame Number: 2743 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xaa52 (43602) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xc685 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 13861, Ack: 4559, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 13861 (relative sequence number) Next sequence number: 15321 (relative sequence number) Acknowledgement number: 4559 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7234 Checksum: 0xc543 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2742 The RTT to ACK the segment was: 0.009956000 seconds Data (1460 bytes) 0000 bc ef 26 2e b4 fe 18 00 00 80 10 21 96 fd 32 0a ..&........!..2. 0010 04 00 3c 2a 71 43 00 00 70 1a 0f f0 5b bf 76 4c ..<*qC..p...[.vL 0020 6f 01 75 2d 35 b5 49 d1 87 dd b6 bf 84 d5 37 74 o.u-5.I.......7t 0030 6e dc b1 2f 82 80 e9 fd 0d 4a 1d 78 e1 f2 e0 f2 n../.....J.x.... 0040 7e f8 3b e4 3d 87 4b 9d b6 83 7b b7 e9 50 ac 72 ~.;.=.K...{..P.r 0050 3f 84 04 18 bf fa ec 8a d0 6d a1 6e 3f d7 83 76 ?........m.n?..v 0060 8e 20 67 5c 4f 06 71 ef 1d 83 ea a4 51 40 77 8a . g\O.q.....Q@w. 0070 6d 24 21 46 59 0f 8c 79 1e d2 a9 d2 bb 3e 3e 12 m$!FY..y.....>>. 0080 95 34 29 37 e3 fc be a4 88 2b ed 27 d5 96 fc 30 .4)7.....+.'...0 0090 64 d5 c3 a9 c5 10 9d 7d c6 d7 52 0f 3b 23 d7 4b d......}..R.;#.K 00a0 50 d8 8a 28 5d 84 4a 89 c5 43 a9 3e bd 77 4a 4b P..(].J..C.>.wJK 00b0 63 c8 c9 2d 31 f5 00 fc ca 43 9c 43 68 65 c4 f7 c..-1....C.Che.. 00c0 ce 9f 48 26 05 f6 84 8c 82 60 5e f3 7c 7e ce 71 ..H&.....`^.|~.q 00d0 fb 34 39 69 24 5b 78 99 b6 1b 4a 07 bd 32 33 c8 .49i$[x...J..23. 00e0 eb 10 54 87 4d bd 69 a3 03 f8 b1 16 4a 3a 54 29 ..T.M.i.....J:T) 00f0 0e 0d 58 2a 4c d7 49 4b 47 4b 6d 98 ac d2 d4 47 ..X*L.IKGKm....G 0100 1a 1d f3 2c f3 ce c1 77 2c 7a 2e f3 fa 2c 64 7d ...,...w,z...,d} 0110 1f 34 59 7a 31 89 18 dc 3f 99 25 cf bc e0 78 02 .4Yz1...?.%...x. 0120 03 26 7b 45 cf 0d e3 e8 6d 6b 08 1e 51 70 b6 ae .&{E....mk..Qp.. 0130 4e 9f 91 d5 39 9d 00 f7 bd 48 e5 bd 5b f3 0e 03 N...9....H..[... 0140 48 94 c3 cf 0d 84 5d 92 b3 71 2d 69 00 6f 6c ac H.....]..q-i.ol. 0150 0f 0d dd cf 38 54 dc 5d cb 0a 4b 8f 93 42 87 cb ....8T.]..K..B.. 0160 5f 3c 33 a3 e5 a7 fa e7 a3 2a d7 a0 9f 5b d5 15 _<3......*...[.. 0170 3f 77 19 a1 16 7e a2 ff 62 34 86 b5 52 7f 75 36 ?w...~..b4..R.u6 0180 7c 02 96 7b dc 41 55 70 05 0d 9a 74 98 df f3 11 |..{.AUp...t.... 0190 9f 37 9b ae 95 ac 9c f1 fa 27 96 e5 aa b4 f0 dc .7.......'...... 01a0 e6 55 9c 69 d3 81 64 e8 a7 81 ab f4 12 4e 38 ed .U.i..d......N8. 01b0 2c ec 1d f8 91 a5 81 44 a9 88 02 7d f2 28 77 28 ,......D...}.(w( 01c0 67 e6 ef 1f 71 c5 01 f8 3e 8d ac 2f b3 38 bf d4 g...q...>../.8.. 01d0 7b 24 e4 e3 01 cb fc 88 ac 07 7c 43 c2 9d 98 e3 {$........|C.... 01e0 83 bb 08 5d 20 9c 62 78 84 29 b9 80 2e c8 9d 36 ...] .bx.).....6 01f0 99 04 47 d9 e4 4c 10 a9 8e 4a 32 74 5c a0 64 57 ..G..L...J2t\.dW 0200 fd 5a dd be fa 6c 6d fa 91 77 8d c2 97 76 a5 54 .Z...lm..w...v.T 0210 9c 5f e5 1b 81 ef e4 09 fb 88 20 8f 0b 98 e1 32 ._........ ....2 0220 47 6f 7a 6b 30 6b 3f 7f b6 8c 06 5b aa 4d 2c 1c Gozk0k?....[.M,. 0230 0e 47 8c ac fd 08 d5 75 3d 24 7f 80 52 9e 08 27 .G.....u=$..R..' 0240 73 c3 d1 0b 83 b0 73 0e 4c 75 27 b1 c8 32 77 bb s.....s.Lu'..2w. 0250 02 7f 43 96 e1 74 2c 2a aa 39 e7 e1 bd 62 60 12 ..C..t,*.9...b`. 0260 38 9b 19 e7 9f b6 f5 3c cb fa d5 68 0f b9 94 87 8......<...h.... 0270 7e 7c 11 b7 6c 4a 78 57 e5 6a 2e 00 20 a3 36 db ~|..lJxW.j.. .6. 0280 53 9c 86 1e 45 bc 76 00 bc 9c 7f 31 62 94 5e 7b S...E.v....1b.^{ 0290 dc 4a 91 09 1d 8e e8 91 9c fc 54 d3 d2 72 80 5c .J........T..r.\ 02a0 76 76 f0 15 76 c1 f8 02 4c 1b ef 68 b1 3a 27 cf vv..v...L..h.:'. 02b0 0c 5a 9e 2b c2 23 f0 0d ab 91 1a e7 5c db 3e 5a .Z.+.#......\.>Z 02c0 62 19 f9 0c 77 bd b1 f6 40 6d 7a bc d0 83 db f9 b...w...@mz..... 02d0 ad 89 06 77 db 08 4d 9a ba 79 80 bd 22 f2 df 07 ...w..M..y.."... 02e0 6c 7a 8e e5 4b 2f 86 b9 8a 4d c3 e9 ce fd 9e 75 lz..K/...M.....u 02f0 44 da f2 e1 da 58 62 a9 bb b1 ec 88 67 2f a5 9e D....Xb.....g/.. 0300 7e 2f ae 80 05 26 85 7c 8b 86 ad 59 3f 6c 94 e8 ~/...&.|...Y?l.. 0310 12 4b ce 98 35 31 95 25 0c ef c1 18 64 4a 51 39 .K..51.%....dJQ9 0320 2e ec f2 88 01 d2 c4 90 14 f5 74 7c 64 0f d9 d7 ..........t|d... 0330 87 a9 b5 84 18 68 a5 21 3e 7f 70 ff 2e fa 02 67 .....h.!>.p....g 0340 9d 78 c8 dd d1 65 54 a6 0c e0 5c 2c 1c d7 91 05 .x...eT...\,.... 0350 67 fa ee f3 13 ce 91 0e 23 cf 26 5f 94 14 e7 9b g.......#.&_.... 0360 16 7d 9a de d9 46 95 bd 29 65 29 7f 65 12 3a d0 .}...F..)e).e.:. 0370 97 b0 2a db 04 38 74 24 cc d5 76 74 47 ca 52 e6 ..*..8t$..vtG.R. 0380 7d 99 a2 e0 ec f1 d0 10 8f 3e 13 3e 3f c4 d1 1b }........>.>?... 0390 6f 8f 78 c1 49 31 5b 21 51 63 9f 14 73 91 ab f4 o.x.I1[!Qc..s... 03a0 9c e8 0f 15 6b fe 8f 01 ff 9a aa 88 04 30 a9 0d ....k........0.. 03b0 1f 9d 0b 42 86 f7 f2 ab 59 92 1f 23 77 bb e7 67 ...B....Y..#w..g 03c0 2f 48 6e f6 4e 87 84 10 e2 19 d5 58 bf 56 e1 1a /Hn.N......X.V.. 03d0 4d c7 86 fa 9d 66 6c 04 2d f5 82 ed 93 b3 07 ec M....fl.-....... 03e0 fb d6 c4 72 a3 3d 67 bb 82 39 d5 60 f5 23 31 f1 ...r.=g..9.`.#1. 03f0 0a 2e ee 3e 1d f9 7d 44 ab 1c 16 18 52 58 51 a8 ...>..}D....RXQ. 0400 60 c6 f7 42 fd 3b 74 4f e5 3e ff 1a bc 24 c0 91 `..B.;tO.>...$.. 0410 60 c4 0a b7 a3 c6 ca 1c 39 bc ce 81 ef 2b 84 7f `.......9....+.. 0420 5f bf fd 8b 13 bc 0c f3 c4 19 08 e0 be cc 94 dd _............... 0430 99 14 d2 5b 49 ca fc a4 4c 42 85 ee 5c 14 e7 fe ...[I...LB..\... 0440 61 2e bf ef 63 14 73 b8 6f 2b d8 16 ab 41 0b 92 a...c.s.o+...A.. 0450 f8 96 ae 10 d1 bc 02 70 41 3d 26 16 ac 3d c0 cb .......pA=&..=.. 0460 f2 27 fa 2d dd 39 82 16 91 ce d1 b1 53 43 d3 7b .'.-.9......SC.{ 0470 28 2e dd 39 7c b5 c2 26 3e 54 8e 90 99 aa f3 0e (..9|..&>T...... 0480 13 57 2b cf f2 a4 c2 f3 00 dc af 8a e4 95 9b 4a .W+............J 0490 bc a8 84 f6 93 9c 61 af 5e 3a 4a 65 d0 e2 78 e6 ......a.^:Je..x. 04a0 2a e7 de 25 e7 2c fd 31 16 a4 c1 be dd 73 39 6f *..%.,.1.....s9o 04b0 56 a7 24 96 ca db f0 d7 cd ad 31 97 85 08 61 7d V.$.......1...a} 04c0 19 e8 c8 83 47 b2 f5 54 e4 0b 86 d0 a4 8e c8 c2 ....G..T........ 04d0 e8 de ab f0 08 e8 7b 31 f4 a1 00 de ba 70 55 e0 ......{1.....pU. 04e0 8c f3 12 52 94 8d d8 52 a0 4f 5f 12 0d 63 33 4a ...R...R.O_..c3J 04f0 58 21 f3 6e 14 ec 61 d3 c9 f7 da a5 e9 33 53 b6 X!.n..a......3S. 0500 f6 d9 e0 9b 59 74 71 1e 8b cb cb 66 cf 32 70 ea ....Ytq....f.2p. 0510 d7 56 31 26 ad b7 b8 92 74 5d a0 de a5 6d 1c da .V1&....t]...m.. 0520 78 b7 f7 a7 67 b1 6a 32 b7 c7 77 d6 da dc 22 d6 x...g.j2..w...". 0530 2d 3d d5 56 b9 66 e0 5f d9 9d 4a 19 ac 9d e5 1a -=.V.f._..J..... 0540 3f f5 52 1a cd f8 41 e9 2a 3d b4 52 83 db ac 94 ?.R...A.*=.R.... 0550 9a 5f be 42 31 82 4d c0 2a 71 4d 22 05 96 d8 d1 ._.B1.M.*qM".... 0560 fa 98 e5 60 90 86 1c 71 81 59 5d 89 f5 8d 49 16 ...`...q.Y]...I. 0570 51 96 ee 01 89 03 6d 5d 95 3a ac 11 c0 72 7b 98 Q.....m].:...r{. 0580 26 33 b3 c9 ff e4 29 91 17 e7 8a c1 82 07 77 01 &3....).......w. 0590 17 f5 65 b1 24 eb 7b fa e1 60 2f 0e ea 83 eb 41 ..e.$.{..`/....A 05a0 91 89 c0 4a e9 fa aa c9 36 cc 93 4c a1 5e 16 be ...J....6..L.^.. 05b0 9c c1 18 a3 .... No. Time Source Destination Protocol Info 2744 819.930651 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=15321 Ack=4559 Win=7234 Len=1460 Frame 2744 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.689155000 Time delta from previous packet: 0.000082000 seconds Time since reference or first frame: 819.930651000 seconds Frame Number: 2744 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xab52 (43858) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xc585 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 15321, Ack: 4559, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 15321 (relative sequence number) Next sequence number: 16781 (relative sequence number) Acknowledgement number: 4559 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7234 Checksum: 0xa414 [correct] Data (1460 bytes) 0000 a5 78 f2 18 db 58 3e 5e 42 7f d7 b8 74 48 2e ee .x...X>^B...tH.. 0010 ef 46 27 3c ed c6 8d 05 c5 4c db c8 27 5b 8c 31 .F'<.....L..'[.1 0020 c3 8c 05 ff 33 3e c4 13 a7 79 5e 8a 3a 52 db 43 ....3>...y^.:R.C 0030 51 85 cd 82 81 a3 74 f3 57 6c d0 f5 ed 0b 3d 71 Q.....t.Wl....=q 0040 01 53 c0 ed bd 77 0c dd c1 bf 5d 18 07 dc 71 2e .S...w....]...q. 0050 f2 4a 8c 0e 7a 46 02 3a 05 b1 f0 4f f3 46 8b ae .J..zF.:...O.F.. 0060 f8 78 82 91 1c d8 7a 43 77 b4 d4 50 92 34 f0 55 .x....zCw..P.4.U 0070 b4 84 bc 4e 5c a2 be f7 b8 20 ed 04 8a b4 9f dc ...N\.... ...... 0080 e1 d7 c9 c4 e9 84 c9 c4 84 10 80 02 f9 0c 0a 92 ................ 0090 34 2a 8b 77 a6 9e 9d f0 cc f9 d2 19 59 32 fa a1 4*.w........Y2.. 00a0 0a 5c fe 7a 81 0f cc 6e eb 17 3c 82 7a 10 38 36 .\.z...n..<.z.86 00b0 c1 74 eb 91 47 97 71 89 36 d4 4c 66 ee bb af ae .t..G.q.6.Lf.... 00c0 35 da 60 a1 b3 79 19 15 2e 9b 1c dc 47 eb 68 d4 5.`..y......G.h. 00d0 3c 05 cb 63 b0 a7 a3 82 5c 78 41 bd d8 dd 1d df <..c....\xA..... 00e0 04 42 75 82 c2 80 ad 0f c4 17 67 bc e3 84 47 e4 .Bu.......g...G. 00f0 54 bd 0d 34 9a 40 6e 13 23 4b 77 cb 06 b9 8b da T..4.@n.#Kw..... 0100 28 b5 b3 97 98 d3 ef 15 c2 d6 54 40 2c df 4c 1b (.........T@,.L. 0110 34 99 0e dd 4c ce 4c 86 6c cc 01 f5 e1 03 3a b8 4...L.L.l.....:. 0120 59 a2 13 7f 19 25 7e 30 f4 74 59 5a 60 ed 4e b5 Y....%~0.tYZ`.N. 0130 3d 77 93 70 e1 96 45 ef 96 4e b3 0d e9 a7 96 61 =w.p..E..N.....a 0140 36 7d 64 42 65 79 06 02 32 13 10 87 47 9a 27 55 6}dBey..2...G.'U 0150 34 b4 07 83 44 80 8f 99 f2 78 5c 6f 9c 5d 3d 71 4...D....x\o.]=q 0160 57 8c 88 41 df 6e 3a 83 1f 89 04 0f 7e 77 3f 33 W..A.n:.....~w?3 0170 55 a1 a3 71 a1 93 e1 f2 b5 96 40 f1 90 c4 b2 57 U..q......@....W 0180 46 7a 03 9e 95 e6 fc b7 5a 6a e7 de 93 87 58 df Fz......Zj....X. 0190 a2 4b e2 88 23 b7 b2 aa 74 78 c0 0e e2 f1 18 f6 .K..#...tx...... 01a0 91 ca de 79 1b 36 44 f4 fd d6 81 67 d7 72 6a 4a ...y.6D....g.rjJ 01b0 19 9c c3 a6 99 70 ff ac f0 83 ec 37 46 77 a2 6c .....p.....7Fw.l 01c0 68 9d 88 f3 89 28 8a e9 25 fb 9c de ef bc d9 79 h....(..%......y 01d0 cb bc 9b 8c 47 05 54 8d ea 27 d7 b9 f4 23 ae a4 ....G.T..'...#.. 01e0 95 e4 87 08 1f 27 73 19 f9 97 ce 76 74 6b f5 1f .....'s....vtk.. 01f0 58 32 cb 31 1f 8c d1 9a 08 34 73 3e ff a5 30 82 X2.1.....4s>..0. 0200 0f 34 66 07 bf e4 3e 59 c3 ee eb 21 63 88 1a 2d .4f...>Y...!c..- 0210 5c b8 9c 47 94 39 9b e7 a6 f4 2a 71 3b c2 67 fc \..G.9....*q;.g. 0220 64 ca a0 92 bd 7d 92 a9 64 78 d5 73 2f 5e a9 46 d....}..dx.s/^.F 0230 9a 40 e0 00 c5 49 10 43 f6 d9 69 bf 1a 00 e6 66 .@...I.C..i....f 0240 cf 36 62 ef 4b 1c b5 ee ac 17 67 d7 fd c8 4a b2 .6b.K.....g...J. 0250 1d 23 c2 16 7e 27 c0 71 ce f1 09 6b 55 32 62 2c .#..~'.q...kU2b, 0260 40 10 48 cc bb 00 33 eb f0 3f 8b 5d 95 dc 31 ce @.H...3..?.]..1. 0270 b5 04 2f 44 99 20 26 3b 64 0c 56 4a 5c db 8c aa ../D. &;d.VJ\... 0280 70 0a 04 0f f2 3b 20 2e 63 17 84 e4 26 e1 ed d4 p....; .c...&... 0290 c4 18 0f f6 b4 20 00 44 9a 78 34 ba bc bd e2 43 ..... .D.x4....C 02a0 9e 95 65 46 2e 74 84 c1 68 1e 89 00 df 3b 35 2b ..eF.t..h....;5+ 02b0 77 b4 9b 4e 09 42 a0 ee 0e 8d 20 6f 88 08 5c f0 w..N.B.... o..\. 02c0 59 ca c0 22 fd f4 89 22 ff 71 a1 30 7f 94 5a da Y.."...".q.0..Z. 02d0 bd 3e c0 93 48 ce f6 1b c0 5b 5e a6 4e 3b 81 87 .>..H....[^.N;.. 02e0 62 82 dd 9e ac f1 34 b2 6b 68 14 13 ad fd d5 3f b.....4.kh.....? 02f0 17 35 85 8f a2 37 76 58 d1 b1 70 6d a9 29 b4 b5 .5...7vX..pm.).. 0300 6d 96 ef 29 28 3e 5b 28 d9 54 18 ba d0 07 15 04 m..)(>[(.T...... 0310 56 b4 51 c1 dd 38 1f 46 30 d4 d9 4b f9 f7 63 2e V.Q..8.F0..K..c. 0320 3e 15 75 44 4d e7 b2 b7 af e1 b8 d6 52 c8 07 ec >.uDM.......R... 0330 b2 1a 4c 1e b1 20 55 42 52 ac 50 9a 23 3c fd c6 ..L.. UBR.P.#<.. 0340 50 76 f5 23 b8 ec 53 8a 9e da 73 ef be 6b 7e ed Pv.#..S...s..k~. 0350 65 b0 71 94 40 97 3c eb f4 e3 df 42 83 7a bb d3 e.q.@.<....B.z.. 0360 be 78 b6 70 65 7a 9e f1 8f 57 f1 74 f0 e0 91 b5 .x.pez...W.t.... 0370 84 37 65 b8 61 ce f6 9a 17 4b ae ac e8 c6 fc 9d .7e.a....K...... 0380 1f 00 b8 43 72 19 9d f0 e5 66 b3 17 4b a6 97 0b ...Cr....f..K... 0390 cb da 87 37 80 8a c0 86 3d f7 8b 41 20 dc 19 94 ...7....=..A ... 03a0 19 40 e4 c0 0e 65 70 5f 40 39 39 ac dc 7d 0d a2 .@...ep_@99..}.. 03b0 3a 85 a4 7c 6a 4f ad 03 e8 f6 d0 16 38 bb fd 2a :..|jO......8..* 03c0 e5 e9 ca 79 af 57 68 de 33 48 cb 21 1d ef 88 c8 ...y.Wh.3H.!.... 03d0 58 db 46 e7 90 9b 7a c0 8e 0f f3 41 02 96 ac 80 X.F...z....A.... 03e0 6e fa 45 35 c2 c0 cd be a4 38 b9 c1 2f ec a3 32 n.E5.....8../..2 03f0 94 74 73 b9 c0 af b5 24 1a b1 94 4d 26 ae 35 b4 .ts....$...M&.5. 0400 83 3c cb 20 4e a7 80 a9 cc 33 d4 c3 96 53 67 80 .<. N....3...Sg. 0410 03 2c cc 48 84 ca 1a 67 79 d3 b0 3c ee 8a b3 82 .,.H...gy..<.... 0420 d6 85 7e 61 d6 39 76 33 32 9b f4 4f 57 b9 9d 0b ..~a.9v32..OW... 0430 aa 27 42 87 05 be 13 48 ed 44 40 8e ca 40 ba 8a .'B....H.D@..@.. 0440 0c 9a ff 33 09 2b 24 a1 e7 09 b8 9e e6 b8 a6 26 ...3.+$........& 0450 25 37 bb 52 ac ff e0 f4 7c 64 b6 35 7e fa 5c 01 %7.R....|d.5~.\. 0460 32 a1 6e 6d 82 80 11 da 6c 4d 84 b4 41 1b de 54 2.nm....lM..A..T 0470 c4 a8 94 07 9d f8 a4 03 ce a7 6b 1c ff e2 c6 2c ..........k...., 0480 60 f1 29 b5 c0 44 91 66 ee 3e 1c b3 f6 9d 7c 83 `.)..D.f.>....|. 0490 b1 32 6a bb 9e b5 03 3f 55 25 5d 83 c9 49 81 29 .2j....?U%]..I.) 04a0 9d b6 58 dc 61 58 ae 31 6e 26 e0 28 63 9b 04 a1 ..X.aX.1n&.(c... 04b0 5e 00 c2 4b f3 14 59 c0 17 8a 2e c2 85 75 59 8e ^..K..Y......uY. 04c0 5b e9 03 9b a7 1f 82 a6 09 a1 41 dc 9b 29 92 4c [.........A..).L 04d0 ce e5 52 07 4e 85 50 7e a3 4a a8 bd 40 c7 50 e6 ..R.N.P~.J..@.P. 04e0 56 4e f1 7f 71 9c 2e 90 b6 a7 8d 5f e6 8a 92 d4 VN..q......_.... 04f0 6a 5e 47 62 53 ae 52 8a 65 2b 1f d7 06 5d b5 b8 j^GbS.R.e+...].. 0500 b0 9c 9a f6 67 58 c5 47 e3 7f f3 c5 c2 3f 8d 02 ....gX.G.....?.. 0510 8e ae 61 60 1e 3c ab ef 4a 5a 2c 33 3a 30 97 24 ..a`.<..JZ,3:0.$ 0520 df 77 8e 30 a3 ee c7 96 05 a7 8d 78 c1 0a c3 82 .w.0.......x.... 0530 1a 86 17 6e fb 00 b9 61 e9 41 f6 14 37 68 a0 55 ...n...a.A..7h.U 0540 55 89 58 81 db 11 f7 8b d1 59 e5 a7 4e cb fe 3e U.X......Y..N..> 0550 ac c9 9b fc 9f 3e 40 1e 93 81 21 7e a2 bc 83 4b .....>@...!~...K 0560 e2 db 0a f0 ee 12 32 e7 c9 95 68 7b dc 7f af 27 ......2...h{...' 0570 b1 4d e9 19 0d ee 33 57 78 54 7b 51 7e 60 4c 13 .M....3WxT{Q~`L. 0580 c0 44 bc c7 a9 5e 32 e1 f0 6d 67 dc de c5 aa d0 .D...^2..mg..... 0590 13 a6 53 61 c6 78 83 ae 2d 5d 03 e3 4b dc 06 13 ..Sa.x..-]..K... 05a0 45 c3 6e 70 5e ef 67 35 b7 7e 94 e0 91 4c c2 db E.np^.g5.~...L.. 05b0 ba 49 0c 76 .I.v No. Time Source Destination Protocol Info 2745 819.930698 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=4559 Ack=16781 Win=17520 [TCP CHECKSUM INCORRECT] Len=0 Frame 2745 (54 bytes on wire, 54 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.689202000 Time delta from previous packet: 0.000047000 seconds Time since reference or first frame: 819.930698000 seconds Frame Number: 2745 Packet Length: 54 bytes Capture Length: 54 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x41c7 (16839) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x34c5] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 4559, Ack: 16781, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 4559 (relative sequence number) Acknowledgement number: 16781 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x845e [incorrect, should be 0x06b0] SEQ/ACK analysis This is an ACK to the segment in frame: 2744 The RTT to ACK the segment was: 0.000047000 seconds No. Time Source Destination Protocol Info 2746 819.930759 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=16781 Ack=4559 Win=7234 Len=1460 Frame 2746 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.689263000 Time delta from previous packet: 0.000061000 seconds Time since reference or first frame: 819.930759000 seconds Frame Number: 2746 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xac52 (44114) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xc485 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 16781, Ack: 4559, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 16781 (relative sequence number) Next sequence number: 18241 (relative sequence number) Acknowledgement number: 4559 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7234 Checksum: 0x7492 [correct] Data (1460 bytes) 0000 7a 42 58 93 e0 d9 60 a2 24 04 6a 8a 56 75 c7 9f zBX...`.$.j.Vu.. 0010 72 82 93 12 a0 56 ce a2 a3 8a 15 3f 68 23 14 f6 r....V.....?h#.. 0020 7b d0 18 43 a4 28 2c 44 6f ee e5 29 93 c8 77 4b {..C.(,Do..)..wK 0030 0e 6a 57 d4 f9 a7 0c dd d0 7e 57 cb 93 c1 0d 92 .jW......~W..... 0040 5a 6c 81 9b ac 8a b0 a8 99 2b 89 ba 49 57 86 53 Zl.......+..IW.S 0050 49 92 65 12 30 56 65 d6 93 14 e3 c3 a5 e2 73 b9 I.e.0Ve.......s. 0060 9e 33 77 09 37 fc 76 d4 7e 01 63 17 38 36 42 33 .3w.7.v.~.c.86B3 0070 22 2a 2c 6b 30 fa 90 24 94 f3 24 54 04 5f 37 f5 "*,k0..$..$T._7. 0080 4b 42 64 6e e2 a5 32 dd 7c df 19 67 92 0b 34 e2 KBdn..2.|..g..4. 0090 6c bc 90 3c b7 08 88 57 fe 6b 5d 1f bc ad 23 8c l..<...W.k]...#. 00a0 d6 1d ab 28 29 bd f0 4f 87 d8 0d 56 bd 20 44 98 ...()..O...V. D. 00b0 da 54 30 b5 68 80 1a 65 6e 3a 2e 42 49 3f fd 34 .T0.h..en:.BI?.4 00c0 d4 cc b0 ef 7f b8 2d 84 5e 13 85 2d 6d a7 f9 ea ......-.^..-m... 00d0 ab 19 32 77 26 40 21 68 6e b6 c3 4e 62 4c be 66 ..2w&@!hn..NbL.f 00e0 5a bf d7 85 43 c4 52 04 a1 4f b2 ac 6d a0 52 98 Z...C.R..O..m.R. 00f0 ce 47 7e fc b5 99 71 fe 21 82 4b 0d ce 8b c8 6f .G~...q.!.K....o 0100 36 60 51 d4 d4 d0 41 3b 4b 44 00 4c 3f 44 f4 f9 6`Q...A;KD.L?D.. 0110 e4 f1 4e 3d cc a0 30 a3 c6 d8 96 32 e4 18 8b bd ..N=..0....2.... 0120 ad 34 56 48 f0 df 33 80 9e b5 b4 1d 31 c6 28 d4 .4VH..3.....1.(. 0130 52 42 9f bc 33 e0 90 5d 26 57 a9 c1 b8 be 7d b6 RB..3..]&W....}. 0140 0b 6c 92 33 8d c9 9f 59 a7 5e 14 b1 c0 0b 6f 32 .l.3...Y.^....o2 0150 7d a6 25 ed 4e c2 e4 60 ac b0 3c d1 43 44 35 06 }.%.N..`..<.CD5. 0160 09 70 eb 8e 06 ac 94 1b 7a c5 01 cd de df 31 1b .p......z.....1. 0170 79 cf e0 dd c1 dd 58 d1 66 29 d2 8a 34 86 bd 5e y.....X.f)..4..^ 0180 21 1a dd 75 93 1b d7 90 58 55 42 2e 1a c1 15 09 !..u....XUB..... 0190 36 77 20 4c a0 af 7d 2c 52 e3 2b 6b 7c 33 a2 48 6w L..},R.+k|3.H 01a0 b5 59 1e 54 09 c8 67 63 5d 3c a0 b5 35 73 fc 70 .Y.T..gc]<..5s.p 01b0 5d 77 a3 b6 b3 42 51 c3 1e 2b e6 25 3f 07 c8 c5 ]w...BQ..+.%?... 01c0 e1 9b 34 c4 31 af d4 81 c9 4a 39 84 85 07 a6 56 ..4.1....J9....V 01d0 e5 a2 41 1b fd 06 b8 48 53 c7 0e 5b c6 b8 d2 4c ..A....HS..[...L 01e0 33 70 2e c8 27 93 33 16 ce e7 7d 0b 5c bf 33 91 3p..'.3...}.\.3. 01f0 15 a1 28 b3 ca 27 08 58 36 22 ba 0f ee 65 cb 71 ..(..'.X6"...e.q 0200 ad 39 3f 6f 5e b0 13 f4 01 2b cf 15 2d e4 45 f0 .9?o^....+..-.E. 0210 f9 5d 0b 8e 9d eb dc ec d4 83 9c 5c ec b6 3b 3b .].........\..;; 0220 f4 11 7e 85 c0 d7 e7 aa dc 6b dd 8e 75 a7 64 0c ..~......k..u.d. 0230 f9 7f 43 f3 ab 6b 5a 52 7c f3 32 0e 44 b3 57 a8 ..C..kZR|.2.D.W. 0240 13 6c c1 fc f9 e7 d2 48 f3 79 ca c6 53 83 3e 49 .l.....H.y..S.>I 0250 dd f6 38 b7 c6 e1 ea 57 00 03 89 c1 84 0e 4f 1e ..8....W......O. 0260 36 d4 2b 1d 8f 57 41 f1 ce cb f9 f9 28 f5 6a a6 6.+..WA.....(.j. 0270 95 f8 eb db 70 e5 52 36 f4 6f 2a 1e 8d d3 56 8d ....p.R6.o*...V. 0280 b4 ba eb 60 c5 34 74 55 8f 28 7a 06 69 94 cc 38 ...`.4tU.(z.i..8 0290 81 be 12 30 bb 8d 54 2c b5 67 06 d4 81 06 94 38 ...0..T,.g.....8 02a0 4b 73 d4 8c a4 20 b4 41 60 b7 99 6c 4e 1c 45 85 Ks... .A`..lN.E. 02b0 52 4b be 7d 13 22 ff 70 63 0f 7a b3 05 e3 0d 10 RK.}.".pc.z..... 02c0 11 c3 0a 54 9a f9 95 7d eb 3c 51 a2 05 6c 39 4f ...T...}..... 0300 bb 3b 26 78 ef 89 5b 24 e2 40 9d ab 89 41 71 01 .;&x..[$.@...Aq. 0310 85 8c ac 0b 8d e8 87 43 ff 50 9b 8c 3d 6d ad 9b .......C.P..=m.. 0320 3f 74 69 f3 ac 91 bc 19 3e b8 61 e8 b1 6e 69 d1 ?ti.....>.a..ni. 0330 42 3d 2b f1 5a e5 64 06 70 b2 a4 6b 25 29 4f 1e B=+.Z.d.p..k%)O. 0340 74 8a c1 c9 57 23 11 16 e3 45 e9 78 fd ee fd b9 t...W#...E.x.... 0350 41 82 e3 bc 1c 4c ae 48 4b a8 6f 5b 1d 55 3e 1d A....L.HK.o[.U>. 0360 01 89 2d 3c 68 49 07 f9 f8 60 55 d7 0a 8b d3 77 ..- 0460 0a cc c5 d6 ea a8 f6 a0 23 78 2a c5 74 cc 3f ef ........#x*.t.?. 0470 aa 33 69 83 c9 bc 96 db 2c b1 b4 3f 02 e7 ce f1 .3i.....,..?.... 0480 b2 97 5c 01 a4 18 59 0f ea a0 bd b5 0d bb 49 09 ..\...Y.......I. 0490 3d 2d af a4 4b b2 f4 40 79 57 79 47 5d 18 d5 01 =-..K..@yWyG]... 04a0 99 de 2e e9 15 56 ce 48 80 6a e5 94 33 02 b0 be .....V.H.j..3... 04b0 3e 81 0f f6 9e 7f d8 90 30 09 b5 84 e9 df 0a 00 >.......0....... 04c0 04 2d 4f b1 99 f9 e6 9b 1a 6d b1 84 f0 df 68 ac .-O......m....h. 04d0 c1 39 64 79 ae 9c aa 59 e1 37 c3 12 05 81 61 4a .9dy...Y.7....aJ 04e0 b4 47 16 fa 2d 1a 6c 19 57 bb 99 c4 58 bf 74 fd .G..-.l.W...X.t. 04f0 0f 59 d4 50 37 a2 f6 a3 5e 50 52 b9 8d ca ec 7c .Y.P7...^PR....| 0500 62 2a 5d ba cd 13 af e5 56 eb 60 36 c8 25 05 28 b*].....V.`6.%.( 0510 57 fb 53 80 9c 27 ad a4 12 88 77 aa 24 aa 16 54 W.S..'....w.$..T 0520 7a 3f f5 7e 2a 05 59 cd 55 f0 92 30 b6 13 9e 86 z?.~*.Y.U..0.... 0530 27 b3 f8 56 81 0a 07 44 82 12 48 29 9a 00 9c 5c '..V...D..H)...\ 0540 a9 40 a8 a6 cf 7f bf 48 e0 0c 1f e8 75 61 07 0f .@.....H....ua.. 0550 73 90 59 77 5d 50 6f 7c 3d f3 a0 ed 90 09 f1 7b s.Yw]Po|=......{ 0560 19 c8 a8 87 94 1a 15 07 f3 93 a6 c5 66 13 82 5c ............f..\ 0570 2c 9c a8 fa b8 2f 14 27 0e e4 47 fa ed e7 7a 09 ,..../.'..G...z. 0580 24 d7 f8 61 3e 2a bb 11 72 b4 25 18 4a a3 fc 5e $..a>*..r.%.J..^ 0590 65 e8 bc 6e ac c3 d4 5a b8 b7 b0 93 de 90 dc dc e..n...Z........ 05a0 63 8a 71 37 90 e4 b0 36 27 ce c5 12 c6 0c cd f6 c.q7...6'....... 05b0 2e 4d 43 90 .MC. No. Time Source Destination Protocol Info 2747 819.933133 soth1 zen1 TCP [TCP Previous segment lost] 1677 > 4605 [ACK] Seq=29921 Ack=4559 Win=7234 Len=1460 Frame 2747 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.691637000 Time delta from previous packet: 0.002374000 seconds Time since reference or first frame: 819.933133000 seconds Frame Number: 2747 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xb652 (46674) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xba85 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 29921, Ack: 4559, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 29921 (relative sequence number) Next sequence number: 31381 (relative sequence number) Acknowledgement number: 4559 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7234 Checksum: 0xe593 [correct] SEQ/ACK analysis TCP Analysis Flags A segment before this frame was lost Data (1460 bytes) 0000 69 fc f9 94 19 c4 e4 4f c2 01 9b 95 fd e0 7d 6c i......O......}l 0010 e8 ac 19 2b 52 d7 6c 92 72 ba 1a 87 da 6c 84 3e ...+R.l.r....l.> 0020 81 7e 16 af df 39 e7 af 75 c2 f8 3d c5 a6 4a 99 .~...9..u..=..J. 0030 4f 3c af cb b2 a9 eb c7 f9 f6 d0 03 a7 19 c8 ac O<.............. 0040 48 91 33 37 df 39 5b fd 8e ce 5a 28 76 32 ad 8c H.37.9[...Z(v2.. 0050 47 9c f2 ae 55 87 5a 63 b1 60 2e 34 42 bf 14 2d G...U.Zc.`.4B..- 0060 9a 0c 4d 4d 9c 94 60 63 e0 d3 ab 8f 92 26 22 0a ..MM..`c.....&". 0070 3f 8d 61 99 be 09 f4 ad 7b d7 0b 04 ec 99 7c 36 ?.a.....{.....|6 0080 89 a7 97 34 71 95 b6 9e 36 a2 c4 fd f2 95 2d 6b ...4q...6.....-k 0090 b3 67 d0 78 ff 29 be 9f 1e b2 27 94 fa e3 40 fe .g.x.)....'...@. 00a0 5f 07 b1 82 b5 64 e8 f0 b2 11 0a 8d 60 19 af e2 _....d......`... 00b0 fa 08 a7 51 a4 f9 eb 57 ce d7 9b 6a 1f ea fb 06 ...Q...W...j.... 00c0 7e 90 ee be 65 e1 60 25 a7 1e 9c a1 83 21 a8 7e ~...e.`%.....!.~ 00d0 91 c2 99 b0 8d 1f fd f9 01 81 bf 86 9a ac ad 8a ................ 00e0 9f c8 f1 44 0c 61 54 38 20 7b 24 c9 35 da e3 86 ...D.aT8 {$.5... 00f0 15 e3 aa f9 6a ea 5f 05 ba 1d 97 c6 a9 02 42 b2 ....j._.......B. 0100 25 12 94 e8 fc eb 88 6b df 0e 93 e6 ce 40 a8 ea %......k.....@.. 0110 43 f5 e1 68 18 53 11 85 04 7c bb 7f 22 65 bb d4 C..h.S...|.."e.. 0120 43 6b 42 b3 b4 07 5b 68 58 f2 a4 6f 40 32 7c 18 CkB...[hX..o@2|. 0130 11 e9 cc ae 3b b7 49 5e 85 61 a5 d2 cf 0b 29 7c ....;.I^.a....)| 0140 9c 1d 02 06 e4 0a 03 3d a7 d5 7a e5 bc a6 2c 2f .......=..z...,/ 0150 4e 7e 11 6c 84 d8 de 18 e5 23 ec b9 f3 25 0f 5f N~.l.....#...%._ 0160 92 8d 6d 18 1c 2c fc cf 40 31 bf 4a 4c f0 df cc ..m..,..@1.JL... 0170 4f 0e 05 90 21 f9 65 ed 14 ad 60 34 02 c4 9e 7b O...!.e...`4...{ 0180 db e9 f8 a0 ba 54 99 0c c8 e9 8f d1 df 9d e3 d9 .....T.......... 0190 e1 1f 51 25 0f ed d1 40 c0 c2 7b 5c 2d 37 f1 69 ..Q%...@..{\-7.i 01a0 b9 29 d1 cb 35 16 d5 cc b4 f4 fc fd 87 c9 71 05 .)..5.........q. 01b0 fe 43 5f 15 e7 ac 3e d3 4c f3 5d c2 87 d6 2e e6 .C_...>.L.]..... 01c0 71 51 dc 22 43 94 83 47 54 fe 08 e5 a4 ee 2d d1 qQ."C..GT.....-. 01d0 4c 5c 9c 54 16 df 00 9f 72 12 10 b2 70 47 5d 5a L\.T....r...pG]Z 01e0 de 94 8f 4a c4 fb 4e d3 c1 92 6e ab c2 54 0b 01 ...J..N...n..T.. 01f0 51 40 e1 aa 2e 9d da b2 1f fa f6 c1 6c 13 9d c0 Q@..........l... 0200 be bd 8b 1b 61 b7 3d 00 be 80 9b 20 09 d8 5a a3 ....a.=.... ..Z. 0210 95 e9 06 27 7f e3 dc 4a bf e6 44 94 63 07 cc ba ...'...J..D.c... 0220 de ab e3 b7 bc 21 f5 f4 79 da 1e 4f 49 24 13 b4 .....!..y..OI$.. 0230 bf 30 a8 29 52 11 c0 d5 9d 34 78 85 83 ab 71 7b .0.)R....4x...q{ 0240 5c 7c 77 14 e9 27 21 d0 00 8f f1 af d7 14 bf 6b \|w..'!........k 0250 12 85 39 00 6f 7e 33 95 0a 01 94 9d 92 d0 48 2a ..9.o~3.......H* 0260 fb a7 61 06 70 2b e6 18 71 93 f1 c0 6b 6b 8d 7f ..a.p+..q...kk.. 0270 ba eb 91 ee 60 bf 1f a8 ce b7 fd 8d 0b b7 46 bd ....`.........F. 0280 91 30 cc 52 46 54 0a 17 09 6b da 70 3a f8 55 c0 .0.RFT...k.p:.U. 0290 49 d7 73 06 ff 50 6d a5 8a e7 34 54 a3 5d 15 a4 I.s..Pm...4T.].. 02a0 80 5c bf 4b a2 2f 0e f1 79 dc f1 37 c0 51 b4 cc .\.K./..y..7.Q.. 02b0 80 5c 82 e9 de df 05 27 0b 62 74 ed 61 b4 ed 58 .\.....'.bt.a..X 02c0 90 3d 01 d7 61 e6 b1 e4 8c 2f a4 fe 40 5a 4e 5d .=..a..../..@ZN] 02d0 4b 72 57 93 84 e4 b5 08 96 8c 9f d6 0b 2c 49 32 KrW..........,I2 02e0 3e 3c f9 76 15 bf 8e 4a d5 54 f3 f4 fb fa 4e 1d ><.v...J.T....N. 02f0 9d 91 cd 0c 99 a4 26 99 7f 9d 71 6d e5 ea f9 85 ......&...qm.... 0300 ce 38 62 89 f6 06 8c f0 d6 69 bd 85 3e ac d9 ae .8b......i..>... 0310 99 b2 d7 94 5a f3 9e 92 11 ca 1e 08 ce b0 cd e5 ....Z........... 0320 04 2f a6 17 fe e0 3d 67 9a a2 f0 9f 59 fb f9 74 ./....=g....Y..t 0330 4d bd d6 d8 90 2c 1b e2 b1 ab 73 04 b0 10 de 7c M....,....s....| 0340 1f 20 6e 3b fa 87 3f 20 27 a3 e9 ee 6f 67 69 2a . n;..? '...ogi* 0350 ee 81 f3 c6 ad a9 f5 92 cd 2d fe 38 53 74 78 f7 .........-.8Stx. 0360 1c 02 71 a4 53 b2 cb 95 c9 5f 45 d1 56 82 7d 46 ..q.S...._E.V.}F 0370 d4 31 0c 93 73 bd a8 1e 38 9d 1f 80 e9 92 ae 6c .1..s...8......l 0380 ac 5a e4 ae 10 8e 04 c0 a2 ff f6 89 2e 4f ea cc .Z...........O.. 0390 dc 92 a1 c7 ba 32 6c d2 eb e9 9a 7a 1b 43 e4 34 .....2l....z.C.4 03a0 45 d3 5f 56 b0 a3 da a0 f6 4b 43 e3 38 29 9c 0c E._V.....KC.8).. 03b0 4a e6 3f e6 7a e5 1b 6d 5a 83 a1 6d 61 63 fb 56 J.?.z..mZ..mac.V 03c0 e1 5d e7 0a 52 02 7f 30 f7 a8 7e 6e 33 8b 93 e2 .]..R..0..~n3... 03d0 df 3e 94 62 35 5b af ed bc 6c 3b be 5b 02 27 ae .>.b5[...l;.[.'. 03e0 b9 52 96 eb f1 9a 0d 87 3a 2f 3c 9b 98 44 ad 83 .R......:/<..D.. 03f0 7a 42 06 b8 32 28 38 a3 a4 2a 55 73 72 90 98 5f zB..2(8..*Usr.._ 0400 95 d3 f6 d4 99 fa e3 33 a8 33 d6 00 df 22 69 10 .......3.3..."i. 0410 77 ed 54 1a 61 c7 e0 d0 07 cb 20 0b 1f 20 75 37 w.T.a..... .. u7 0420 39 6c 1b 41 77 91 c6 ee cb 9f 3f 0e a0 7d 52 44 9l.Aw.....?..}RD 0430 cf 4a b2 4f c8 fc 5c 70 7c db b6 f6 ba 4e 2d ae .J.O..\p|....N-. 0440 af cb 18 7e 29 f1 b4 47 9f a3 42 ec 19 57 71 37 ...~)..G..B..Wq7 0450 f3 85 0b 4b c3 12 e6 70 ea e5 3a fb 82 d6 dd d3 ...K...p..:..... 0460 3f 03 bc 4c e8 0a 64 81 bd a7 23 95 cc 43 01 c4 ?..L..d...#..C.. 0470 97 ac 6c d7 14 62 26 5c 82 12 b1 6d 64 a8 9a 5a ..l..b&\...md..Z 0480 91 66 60 63 38 33 00 96 3f 12 b6 44 41 b4 2e 68 .f`c83..?..DA..h 0490 a9 34 a8 86 fa e3 ec 1a 72 5f 7d 9a bb 1a 8e d8 .4......r_}..... 04a0 d7 f9 d5 6a 45 11 62 4b 56 d1 8e 0b 3c 20 db c6 ...jE.bKV...< .. 04b0 94 60 15 b0 51 ae 0d 3f 62 e5 ff e0 af 58 bb c4 .`..Q..?b....X.. 04c0 91 71 a2 37 09 9c 18 63 32 dc dc af b3 fb 35 4c .q.7...c2.....5L 04d0 d1 5f 43 e7 9d 56 e6 dd f4 7a e6 b9 d9 6a 02 f7 ._C..V...z...j.. 04e0 aa 95 74 48 be 4a 27 35 73 fc 15 aa 57 18 ab 74 ..tH.J'5s...W..t 04f0 f7 4f 4b 89 2a 78 84 f1 6b 89 5f 82 de 9f 7b 86 .OK.*x..k._...{. 0500 f4 4d df ab b5 e7 c0 30 b2 10 cd 41 db ff 12 03 .M.....0...A.... 0510 a8 ad 02 e9 ee bd df dd 11 cb 50 32 ca b1 52 25 ..........P2..R% 0520 72 a4 23 8d 88 1f f3 5a 64 c1 a0 c1 a5 8b 31 2b r.#....Zd.....1+ 0530 c9 b7 fb 6f 47 d6 63 c5 a7 08 7a 81 0f a1 24 a4 ...oG.c...z...$. 0540 61 b2 7c 32 66 a0 55 b0 9c fd aa 5a 98 71 f1 b2 a.|2f.U....Z.q.. 0550 f2 ee e4 0d fc 23 fe f4 ac ac de 95 89 77 42 79 .....#.......wBy 0560 48 c9 a2 b0 80 e3 2d 46 e4 70 53 f7 50 bb ad 0b H.....-F.pS.P... 0570 8b 4d b4 d1 8e e3 74 28 fb b3 3b 38 d5 c5 fb ea .M....t(..;8.... 0580 0d 8b 3e c2 8f ec d7 fd 43 ee 5a 72 7f 6c 2c cf ..>.....C.Zr.l,. 0590 6e 24 3f ba 94 90 c4 16 fd 08 06 92 22 6c b7 69 n$?........."l.i 05a0 41 fb 92 de 63 d3 bd fb 8b 0c b5 4f 40 04 00 7c A...c......O@..| 05b0 4d c7 4f a7 M.O. No. Time Source Destination Protocol Info 2748 819.933189 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=4559 Ack=18241 Win=17520 Len=0 SLE=29921 SRE=31381 Frame 2748 (66 bytes on wire, 66 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.691693000 Time delta from previous packet: 0.000056000 seconds Time since reference or first frame: 819.933189000 seconds Frame Number: 2748 Packet Length: 66 bytes Capture Length: 66 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x41c8 (16840) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x34b8] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 4559, Ack: 18241, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 4559 (relative sequence number) Acknowledgement number: 18241 (relative ack number) Header length: 32 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x8398 [correct] Options: (12 bytes) NOP NOP SACK: 29921-31381 left edge = 29921 (relative) right edge = 31381 (relative) SEQ/ACK analysis This is an ACK to the segment in frame: 2746 The RTT to ACK the segment was: 0.002430000 seconds No. Time Source Destination Protocol Info 2749 819.933235 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=31381 Ack=4559 Win=7234 Len=1460 Frame 2749 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.691739000 Time delta from previous packet: 0.000046000 seconds Time since reference or first frame: 819.933235000 seconds Frame Number: 2749 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xb752 (46930) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xb985 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 31381, Ack: 4559, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 31381 (relative sequence number) Next sequence number: 32841 (relative sequence number) Acknowledgement number: 4559 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7234 Checksum: 0xf368 [correct] Data (1460 bytes) 0000 b0 08 4c bd d6 9b 5c 8a 88 58 82 a8 66 98 ce 75 ..L...\..X..f..u 0010 42 06 23 1e fe e7 53 7c 33 32 09 e0 51 ac a3 53 B.#...S|32..Q..S 0020 7a 28 77 36 ef d8 52 61 02 cd a0 9b 1e 1b 4c cc z(w6..Ra......L. 0030 49 c7 7d a4 51 39 9d 6f 35 7c 06 77 46 2f 01 1f I.}.Q9.o5|.wF/.. 0040 cb ad b9 12 b1 e8 88 a3 a2 dc 8d c2 5c ba ee 13 ............\... 0050 5d 0c f2 7a a4 ec cd c8 ac 4e 36 2a 30 61 27 d4 ]..z.....N6*0a'. 0060 05 53 cb b0 1c 38 68 fa fc ab 18 75 ac 5f e3 b8 .S...8h....u._.. 0070 09 b3 54 99 bb 30 b8 0b 37 25 13 c7 92 5c 88 db ..T..0..7%...\.. 0080 52 79 b0 56 79 61 c4 85 c7 84 25 37 df 71 04 84 Ry.Vya....%7.q.. 0090 74 99 15 04 00 c9 33 43 4f 69 02 88 25 0c 6f 5f t.....3COi..%.o_ 00a0 f7 ff 21 9f 85 4e f1 87 ca 88 ec 80 cc b3 78 c4 ..!..N........x. 00b0 79 0f 09 27 30 79 c8 32 a1 84 17 f1 9e 9d 9f 22 y..'0y.2......." 00c0 8f fe 01 14 09 14 b3 99 03 02 ee bb 9e 9d 9c a1 ................ 00d0 0b 0c 76 83 a7 6b a0 92 db 13 2e 53 77 f3 17 69 ..v..k.....Sw..i 00e0 a3 02 fc f8 32 10 aa 1c ea 75 f0 d8 71 d1 59 f5 ....2....u..q.Y. 00f0 2e 35 e6 59 ed 16 db 1e 4c fc e7 17 bc 81 a3 0a .5.Y....L....... 0100 dd b7 2b 68 2d e5 bd 16 ee e4 c3 bc 6e 64 fc ad ..+h-.......nd.. 0110 65 89 f1 aa d0 0f 0f 60 34 8d a9 20 e2 04 c8 54 e......`4.. ...T 0120 4e df d1 af 72 10 29 ea 8c ab 9a fe 1e 62 d4 62 N...r.)......b.b 0130 7f 33 b9 b8 6e 10 2c 74 d9 36 e0 25 71 6c 54 27 .3..n.,t.6.%qlT' 0140 8b 6b 90 a8 37 d3 e2 4c c4 bc 8b be b9 b0 12 ad .k..7..L........ 0150 4d 4d 3b 9e 23 df cd da 68 63 fc 2f 27 f3 b9 ca MM;.#...hc./'... 0160 d2 7e 07 23 ae c4 96 1e a1 dc 05 6d 56 22 c1 a3 .~.#.......mV".. 0170 3e d3 70 9f 81 31 5a 69 d8 ea 0f e6 13 d5 44 4b >.p..1Zi......DK 0180 d2 5b 9e b3 d0 06 fa b5 ba d1 bc 5b 93 5e 05 63 .[.........[.^.c 0190 ca 99 a5 0b de 51 c7 f3 2b 1a be 41 51 cc d8 a4 .....Q..+..AQ... 01a0 51 64 ec 63 82 a2 1d eb b0 fd 20 65 bd 38 5a e5 Qd.c...... e.8Z. 01b0 94 9a f7 9d 48 75 f9 fe 29 1a 8d 73 4b 7a e0 0f ....Hu..)..sKz.. 01c0 a0 65 b0 23 90 46 9a fa 0e b5 a4 1d 6c ed c7 b0 .e.#.F......l... 01d0 f9 33 f5 dd 64 dd f8 98 3a 99 ba b1 79 6c 3e d2 .3..d...:...yl>. 01e0 49 66 cf fd 00 c9 4f 8f 25 47 94 80 42 e4 7f b0 If....O.%G..B... 01f0 8d 8e f1 42 b7 61 85 93 a6 69 11 cb 19 27 f3 09 ...B.a...i...'.. 0200 48 ef 50 27 ed 5b fb d8 c5 06 09 4b 98 f2 c0 0e H.P'.[.....K.... 0210 b4 29 33 af 91 ed 5c b3 c4 98 b0 b7 bd 6c f7 be .)3...\......l.. 0220 73 42 ff 78 8f 6d 92 e7 44 9d 62 4e d9 dd 4f 3e sB.x.m..D.bN..O> 0230 3b 3e 77 68 de fd 32 8c 9d ad 92 59 06 f2 0a f5 ;>wh..2....Y.... 0240 f8 06 65 aa 00 ad 28 fe 5f 65 65 f1 fe 47 22 6d ..e...(._ee..G"m 0250 12 4a b5 33 94 a8 0d f2 c4 70 37 a3 4e 20 f7 f5 .J.3.....p7.N .. 0260 ff b0 8e fc ee f6 a5 14 cb 07 ae eb d6 e4 e5 b3 ................ 0270 db c6 63 9f 79 27 70 7b 76 dc 05 c5 23 d9 9b cd ..c.y'p{v...#... 0280 14 0d d9 c1 09 2b f7 7c d3 d7 fd fd 3d 24 c9 7e .....+.|....=$.~ 0290 a7 cd 75 d3 38 5f 1d 43 d3 bd b1 86 72 35 32 b8 ..u.8_.C....r52. 02a0 d1 81 fd 12 81 74 96 20 37 11 6f 20 8e 88 04 65 .....t. 7.o ...e 02b0 c4 8a 73 01 f3 25 2f cf 46 e7 2a cd 29 93 e9 f9 ..s..%/.F.*.)... 02c0 33 20 ed 61 fb eb 1f 51 5f de 26 ba 63 a5 6b 5f 3 .a...Q_.&.c.k_ 02d0 1c de 75 3a 0a dc c3 86 b8 f9 48 e4 35 e1 12 4b ..u:......H.5..K 02e0 b2 bb 67 20 01 de 84 00 65 fb 7b 79 9f 81 5f fb ..g ....e.{y.._. 02f0 0d 25 90 e7 6d a0 6f 68 c5 dc 95 bf 3e 87 0b 30 .%..m.oh....>..0 0300 59 eb 66 a5 7f bc 30 85 27 85 4f 5e 7e a0 f0 1c Y.f...0.'.O^~... 0310 9b ed 3b c4 db 1c 40 74 6f b0 9d 93 bf c9 a6 cb ..;...@to....... 0320 17 6b 42 eb 16 c5 e9 1c cc 2e 05 63 d3 0a e7 4d .kB........c...M 0330 95 5b 7d a7 6c 6b 00 79 4d 44 15 e4 d3 40 24 90 .[}.lk.yMD...@$. 0340 dd 45 0c fe b0 29 b7 85 76 db ac 03 94 c6 94 f6 .E...)..v....... 0350 93 d5 3e f7 f9 43 49 bc 11 5b c6 0e 56 66 15 31 ..>..CI..[..Vf.1 0360 39 b6 67 46 ab d7 0a d7 fc 84 43 3a e7 a7 1f 65 9.gF......C:...e 0370 40 ed 0d 46 83 09 85 34 98 79 65 50 63 9d 34 93 @..F...4.yePc.4. 0380 0d 33 35 73 69 10 1c 89 11 17 65 63 33 98 da 12 .35si.....ec3... 0390 d9 45 56 50 76 15 49 11 5f 9c 8c 2a 90 20 89 8f .EVPv.I._..*. .. 03a0 4d ba 03 d7 32 9c 47 e6 c9 18 a2 c5 60 5c 0f 4e M...2.G.....`\.N 03b0 f0 b7 58 f9 cf 21 70 42 db 38 f2 b0 b2 1e 4a a8 ..X..!pB.8....J. 03c0 e4 a6 90 4d 3b 5e fc a4 c2 cf a3 53 75 53 1e 92 ...M;^.....SuS.. 03d0 5e be 3a 66 a6 4d 81 4b 13 79 8a f9 6d cb aa f0 ^.:f.M.K.y..m... 03e0 01 e8 3a f6 52 6c 12 4e 03 7e 71 f2 ba 92 81 73 ..:.Rl.N.~q....s 03f0 f6 f7 d1 da e0 48 a1 89 70 55 f4 5a 5c 86 32 29 .....H..pU.Z\.2) 0400 50 07 f7 46 be 79 36 02 45 8d dc 3a 23 52 18 69 P..F.y6.E..:#R.i 0410 37 98 8e f6 21 4a 73 df 6c 44 99 da b3 ab a0 91 7...!Js.lD...... 0420 29 30 49 9f ee 3d 4b b9 18 3a c9 56 74 c4 9f fd )0I..=K..:.Vt... 0430 f4 86 49 2a e3 a7 4a 0d 07 33 39 2c d5 67 1a e1 ..I*..J..39,.g.. 0440 e1 06 67 5d 74 5d 4e b3 ab 91 25 2e c8 2e cc b6 ..g]t]N...%..... 0450 f0 ed 4a d6 75 fc e0 b3 bb ca bc 22 90 a7 30 3a ..J.u......"..0: 0460 c1 68 80 9f 72 12 59 e9 fc 8d 64 bc 5a 9c 55 a6 .h..r.Y...d.Z.U. 0470 92 db be f2 8c 1d 0d dc 19 ac 6e e8 57 37 a5 10 ..........n.W7.. 0480 27 33 b8 e2 f8 d2 5b b7 bd 06 1a 1b 20 b2 05 11 '3....[..... ... 0490 99 96 f4 ba 1c 39 7e c2 2d c2 7b 47 63 a3 f3 2d .....9~.-.{Gc..- 04a0 6a 3e 3f 2f ad 7f 7d f2 51 2c d1 66 97 29 b4 4f j>?/..}.Q,.f.).O 04b0 97 57 83 11 a7 f3 d0 c3 35 81 f5 f3 37 73 a2 ff .W......5...7s.. 04c0 5d 2e b7 99 cb f6 ab a8 81 3b a6 44 ba 34 7c c9 ]........;.D.4|. 04d0 d3 60 8a e6 f3 4c 81 40 fa 3a 48 bd 2f ec 80 1a .`...L.@.:H./... 04e0 85 13 66 24 89 f4 a9 10 80 f5 8e f3 36 30 e5 be ..f$........60.. 04f0 c7 94 5c 57 c7 b5 bb a1 8f f5 61 73 f1 19 b3 2d ..\W......as...- 0500 ea 89 da 0e d7 ab 48 9e c5 f3 f3 ac e7 53 98 4f ......H......S.O 0510 11 7c d5 86 ed e7 b8 e6 ee a1 9d 4e 0d f7 ae 10 .|.........N.... 0520 6a b3 8f aa 91 69 79 2a 7e 90 46 7f 0a af 59 91 j....iy*~.F...Y. 0530 90 f8 b4 9b 97 fb dd c9 46 e5 75 f9 e1 89 96 c4 ........F.u..... 0540 ba ec 21 1e b5 5a 51 a9 64 3c 3b 9a 3d f4 e0 7c ..!..ZQ.d<;.=..| 0550 10 55 d4 14 7a 08 cf b1 16 81 38 6d a7 48 6c f7 .U..z.....8m.Hl. 0560 a8 f0 c5 94 4a 5d 33 37 39 1f 7e fd 0d 9c 12 8c ....J]379.~..... 0570 2c 23 ce 6a f1 28 fb e0 61 12 b5 01 2d 27 0a fe ,#.j.(..a...-'.. 0580 7b c2 b6 f3 9a 84 ec f0 ab 52 e1 80 bc 71 87 4f {........R...q.O 0590 46 a3 30 15 0b c8 48 bc 39 89 99 af a7 74 7f c6 F.0...H.9....t.. 05a0 90 2f 7b 02 35 07 ee 92 9d 56 44 9f 79 cc 43 f1 ./{.5....VD.y.C. 05b0 69 7b 82 11 i{.. No. Time Source Destination Protocol Info 2750 819.933266 zen1 soth1 TCP [TCP Dup ACK 2748#1] 4605 > 1677 [ACK] Seq=4559 Ack=18241 Win=17520 Len=0 SLE=29921 SRE=32841 Frame 2750 (66 bytes on wire, 66 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.691770000 Time delta from previous packet: 0.000031000 seconds Time since reference or first frame: 819.933266000 seconds Frame Number: 2750 Packet Length: 66 bytes Capture Length: 66 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x41c9 (16841) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x34b7] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 4559, Ack: 18241, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 4559 (relative sequence number) Acknowledgement number: 18241 (relative ack number) Header length: 32 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x7de4 [correct] Options: (12 bytes) NOP NOP SACK: 29921-32841 left edge = 29921 (relative) right edge = 32841 (relative) SEQ/ACK analysis TCP Analysis Flags This is a TCP duplicate ack Duplicate ACK #: 1 Duplicate to the ACK in frame: 2748 No. Time Source Destination Protocol Info 2751 819.933572 soth1 zen1 TCP [TCP Window Full] [TCP Previous segment lost] 1677 > 4605 [ACK] Seq=34301 Ack=4559 Win=7234 Len=1460 Frame 2751 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.692076000 Time delta from previous packet: 0.000306000 seconds Time since reference or first frame: 819.933572000 seconds Frame Number: 2751 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xb952 (47442) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xb785 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 34301, Ack: 4559, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 34301 (relative sequence number) Next sequence number: 35761 (relative sequence number) Acknowledgement number: 4559 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7234 Checksum: 0x0237 [correct] SEQ/ACK analysis TCP Analysis Flags A segment before this frame was lost The transmission window is now completely full Data (1460 bytes) 0000 07 79 5d fc e1 b3 30 c6 20 c3 f3 08 fc c1 e0 69 .y]...0. ......i 0010 c6 6c fe 5f c1 73 8c 44 21 c6 f4 d1 bd d4 0f 40 .l._.s.D!......@ 0020 a0 b5 29 83 89 24 66 e8 24 a4 e6 66 b6 60 77 47 ..)..$f.$..f.`wG 0030 3f 6e 01 e8 ac 05 57 4b a8 89 2f 26 71 f1 1f 9c ?n....WK../&q... 0040 b3 02 b0 a5 85 e5 c8 9a f2 05 1a 53 17 f3 56 7a ...........S..Vz 0050 77 d3 a2 30 c9 f4 51 4a a2 f0 16 61 20 b5 0f ac w..0..QJ...a ... 0060 0c ac 5c fd 2d 25 63 b5 63 a5 06 87 75 42 eb 46 ..\.-%c.c...uB.F 0070 b0 0a 5f cf cc f3 99 ae 53 59 c5 c3 d1 7a 94 c2 .._.....SY...z.. 0080 aa e2 60 9d 14 94 82 2c 30 e8 4e f5 b4 f9 22 ad ..`....,0.N...". 0090 4d a5 d2 84 df b3 f5 f7 43 b5 11 fd 5e 4c 72 5b M.......C...^Lr[ 00a0 c0 1c 6f 73 d9 c3 39 68 8c 2c 96 0f 87 91 9c d4 ..os..9h.,...... 00b0 a1 e1 49 33 ee 63 16 f8 ed 94 c7 7f ac c3 2c e9 ..I3.c........,. 00c0 c3 22 a9 bd ff dc 4a 8d 7a c7 7b fb d9 bd bd 8e ."....J.z.{..... 00d0 61 e7 61 73 ee 6f 4d 82 e7 34 06 cf bf 19 c3 d9 a.as.oM..4...... 00e0 c4 ab 42 3f 4d 3d 8e af e5 41 a6 96 0f db 13 29 ..B?M=...A.....) 00f0 9a 7a 68 46 51 cc c9 51 66 f2 8a 00 9e 82 79 14 .zhFQ..Qf.....y. 0100 62 e8 61 a4 cd 55 7a 1d f4 3b 8b 4d 96 3f 25 19 b.a..Uz..;.M.?%. 0110 77 1c 0c 4f 2d 8f 6b d3 e2 cc 44 8f 47 e4 73 63 w..O-.k...D.G.sc 0120 45 b6 e4 7e ef 98 22 cc d3 1c 06 1d 7a 0b 1d 22 E..~..".....z.." 0130 b8 5f ca 5e ea 44 46 14 76 34 e0 ca bf e5 af f9 ._.^.DF.v4...... 0140 f0 d9 18 c5 36 df 31 32 00 c5 c6 98 8d 02 94 59 ....6.12.......Y 0150 8c 39 bb 8e f5 75 0a 78 86 23 79 aa d2 88 b4 be .9...u.x.#y..... 0160 65 27 01 8f f3 02 ba 2f 01 01 5e bb d0 e5 2c fd e'...../..^...,. 0170 a4 ad f7 d1 00 94 91 48 04 41 7c e9 cf 61 b6 56 .......H.A|..a.V 0180 25 a4 00 39 8a 5c e8 f3 99 d3 20 db 43 36 a4 86 %..9.\.... .C6.. 0190 fd 05 51 55 84 83 00 fc 10 d8 a0 5a 72 0a 10 5f ..QU.......Zr.._ 01a0 f8 1e 31 2e 12 b3 58 e4 6d 94 6a 8a e1 02 c4 cf ..1...X.m.j..... 01b0 d3 d3 c7 43 74 08 8d 11 9f 33 7a 9c 31 5e 89 00 ...Ct....3z.1^.. 01c0 15 7a ea 36 39 32 55 ae bd a8 66 d5 2d 6d 78 ab .z.692U...f.-mx. 01d0 b4 3a 88 17 8d 0e e3 be e2 c4 9b ec 89 bf 74 59 .:............tY 01e0 33 78 84 d1 21 7b 1e 68 46 1f 6d 06 d7 36 36 ee 3x..!{.hF.m..66. 01f0 d0 36 09 f4 39 5b ac 17 a0 60 4e c9 e6 f0 ff 93 .6..9[...`N..... 0200 6f f0 6e 8f bf d2 7f db c9 b6 48 9b 2a 6d 51 81 o.n.......H.*mQ. 0210 56 a7 c1 c4 bd 02 e0 0a 81 ff 82 d7 cd 63 3a 58 V............c:X 0220 65 ed e8 22 c6 9a b2 5f ea 93 3b c0 03 b4 09 7a e.."..._..;....z 0230 05 db ed b8 ca 48 d8 28 c1 15 ef 7d 4f 1d 01 f5 .....H.(...}O... 0240 01 5d 8d 3b bf 12 3d 9f 2a fe c4 42 20 fa bd 97 .].;..=.*..B ... 0250 0d dd bd 35 7b 5a 06 36 fb ce 82 cf b6 b1 c0 b2 ...5{Z.6........ 0260 78 aa 07 f2 95 83 18 0e 3d a9 d2 a7 47 6e c7 80 x.......=...Gn.. 0270 cc 20 d2 6d e5 31 b0 a0 66 b4 9b c8 1b d9 9c 69 . .m.1..f......i 0280 2a 93 43 15 27 e0 d8 86 76 c5 1b 62 b4 da 0c 1c *.C.'...v..b.... 0290 c8 9e 56 b0 64 0e cc 4c 98 cf 0d eb 94 cb 4f bd ..V.d..L......O. 02a0 d3 66 e0 df 13 11 c0 17 45 91 f0 04 e9 a8 68 d6 .f......E.....h. 02b0 fb 64 b7 8d e3 3b 08 cb 6b ac 9f 71 7c e4 76 42 .d...;..k..q|.vB 02c0 b5 a5 9c 94 4f af 2e fc ad 4d 30 21 84 e9 6a 5d ....O....M0!..j] 02d0 56 db 4c fe 3f 47 0b cd d7 99 93 eb fc fc 70 bc V.L.?G........p. 02e0 e1 21 c7 2b e7 b2 f2 5f a4 15 7e 48 fd 5d bd 4e .!.+..._..~H.].N 02f0 5b 2e 03 62 90 42 bf 20 12 5e 4e 4c e4 3f 68 35 [..b.B. .^NL.?h5 0300 76 a5 ff 9f 63 b1 df 8a 74 9f 9a f6 28 35 35 6c v...c...t...(55l 0310 0c 9c 82 e2 dc d7 95 29 c9 ef 6a 78 c1 62 4c d7 .......)..jx.bL. 0320 b7 ee d3 7d 61 e8 4f 66 97 a9 73 58 ad 05 55 2f ...}a.Of..sX..U/ 0330 d5 de bc a5 2d 88 37 10 c2 df e9 8a f2 7d 98 58 ....-.7......}.X 0340 26 46 91 71 1e 50 8e 66 4d eb 02 41 61 b4 e2 5e &F.q.P.fM..Aa..^ 0350 40 18 c9 6f 2f 68 f2 d7 31 37 7d 7a a5 36 4c c2 @..o/h..17}z.6L. 0360 83 6b ee dc a3 0a c5 2e a0 e1 92 de ed 2f b3 72 .k.........../.r 0370 da 22 96 68 53 62 c9 af fb fb c1 b6 79 ce a5 d7 .".hSb......y... 0380 7d 51 6e 5c ad 22 b2 51 4c bf 54 57 dd e1 2d fc }Qn\.".QL.TW..-. 0390 e2 6f c6 9d c0 62 51 c6 79 3a 42 ae bc 0a fc 0a .o...bQ.y:B..... 03a0 e6 72 79 b8 28 5c de e5 dd 1f 48 e6 f9 04 dd a6 .ry.(\....H..... 03b0 32 66 74 83 13 db 60 d9 a4 da 65 6b c8 dc e5 1f 2ft...`...ek.... 03c0 80 95 96 26 c7 00 98 aa 61 4f 9b 7d be 62 52 95 ...&....aO.}.bR. 03d0 02 a0 41 be 9f 72 75 f8 bd bf bd 61 7b c3 a1 c0 ..A..ru....a{... 03e0 5c 8d cb 3e 9f b7 ba 5d 2a 42 cf eb c6 10 84 80 \..>...]*B...... 03f0 17 e7 59 a1 6d 5f b1 3b 10 c1 af c8 c7 78 8a a2 ..Y.m_.;.....x.. 0400 db a1 f5 9c 5c 41 39 86 fc 49 98 18 03 5c 8e 84 ....\A9..I...\.. 0410 68 c6 9c ce 8b 70 a5 d9 31 d1 7d 7c e6 01 a2 e5 h....p..1.}|.... 0420 b2 3f 08 4c f0 91 a0 cc 9a e7 27 d3 09 db 17 e0 .?.L......'..... 0430 8a 6c 52 55 d1 f0 b0 86 96 f7 40 5b 29 c4 3c 8b .lRU......@[).<. 0440 29 f9 2d 35 cf a8 56 3d 46 02 aa 32 96 fc 82 38 ).-5..V=F..2...8 0450 73 03 22 56 37 d9 15 fd 62 8c 7d 8e cd 87 20 a6 s."V7...b.}... . 0460 fa 73 e1 00 ff 0f b2 b0 35 1c 26 9a 16 fe 59 26 .s......5.&...Y& 0470 ae dc aa 14 b9 c7 6f 93 99 c4 47 ed ea cf f0 3b ......o...G....; 0480 05 ec 6e a5 bd 67 d6 c5 85 1b 02 f7 e6 ce bc 11 ..n..g.......... 0490 36 f2 68 b0 6d 7b 5d 4e 74 93 0b 45 b6 99 6c 1b 6.h.m{]Nt..E..l. 04a0 2b 70 b3 bb 3d 49 25 84 21 df e6 ac 1c bb 67 36 +p..=I%.!.....g6 04b0 4c 38 45 44 76 39 ab 3b ad e4 06 48 a4 8e 66 c6 L8EDv9.;...H..f. 04c0 12 1f ee fd a0 8f 64 60 3c 43 e9 e8 5d 3d 1f 36 ......d`.. 0540 19 0c ef 8e cb eb cc cd 52 f9 82 bf b5 29 6b c7 ........R....)k. 0550 98 a0 14 e2 15 79 10 0e 95 35 76 50 cf c7 77 4b .....y...5vP..wK 0560 97 c1 48 67 0f ea 9a e1 08 ba cd 70 a7 7a a4 06 ..Hg.......p.z.. 0570 73 5f 8c 9d 14 88 79 de 9b 79 5a eb cf c4 20 ac s_....y..yZ... . 0580 e0 8c e2 14 7d 07 21 fe e2 04 c2 16 13 b0 65 4e ....}.!.......eN 0590 68 e3 5b 80 7b fb 61 00 e2 0b 93 c3 5d 3c f3 00 h.[.{.a.....]<.. 05a0 99 62 0f 62 f4 13 eb ba 8f 65 6c d5 da e2 50 91 .b.b.....el...P. 05b0 64 c8 8e 02 d... No. Time Source Destination Protocol Info 2752 819.933602 zen1 soth1 TCP [TCP Dup ACK 2748#2] 4605 > 1677 [ACK] Seq=4559 Ack=18241 Win=17520 Len=0 SLE=34301 SRE=35761 SLE=29921 SRE=32841 Frame 2752 (74 bytes on wire, 74 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.692106000 Time delta from previous packet: 0.000030000 seconds Time since reference or first frame: 819.933602000 seconds Frame Number: 2752 Packet Length: 74 bytes Capture Length: 74 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 60 Identification: 0x41ca (16842) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x34ae] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 4559, Ack: 18241, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 4559 (relative sequence number) Acknowledgement number: 18241 (relative ack number) Header length: 40 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0xf44f [correct] Options: (20 bytes) NOP NOP SACK: 34301-35761 29921-32841 left edge = 34301 (relative) right edge = 35761 (relative) left edge = 29921 (relative) right edge = 32841 (relative) SEQ/ACK analysis TCP Analysis Flags This is a TCP duplicate ack Duplicate ACK #: 2 Duplicate to the ACK in frame: 2748 No. Time Source Destination Protocol Info 2753 820.185130 soth1 zen1 TCP [TCP Retransmission] 1677 > 4605 [ACK] Seq=18241 Ack=4559 Win=7234 Len=1460 Frame 2753 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:43:48.943634000 Time delta from previous packet: 0.251528000 seconds Time since reference or first frame: 820.185130000 seconds Frame Number: 2753 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xe552 (58706) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x8b85 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 18241, Ack: 4559, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 18241 (relative sequence number) Next sequence number: 19701 (relative sequence number) Acknowledgement number: 4559 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7234 Checksum: 0xd857 [correct] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 0.251558000 seconds RTO based on delta from frame: 2751 Data (1460 bytes) 0000 8d 6d cb 79 6f f8 dd ed 80 cc fc 54 b5 05 e2 10 .m.yo......T.... 0010 46 0f 09 30 ef 35 8d 4e 08 cc b5 23 9d d7 16 8c F..0.5.N...#.... 0020 76 9c 13 05 a1 15 8a 27 cb e8 56 5d 42 e0 e7 23 v......'..V]B..# 0030 06 51 87 09 03 9d 95 10 64 80 fe ba f7 42 d5 51 .Q......d....B.Q 0040 21 ce a7 2f 7b 93 29 3a 8e 8b d3 e8 6f 67 c2 3d !../{.):....og.= 0050 f0 bd b2 e1 0e 3c 3e 25 30 a8 07 5f e6 ad ee e6 .....<>%0.._.... 0060 7b 47 7c 28 59 e9 e6 ef 7d f4 4f ea cc 43 73 c5 {G|(Y...}.O..Cs. 0070 99 7a ef bd d3 87 94 42 f5 7e 3e 9f f5 6c 18 71 .z.....B.~>..l.q 0080 da 66 e4 39 a8 0f dc 05 56 a5 57 0e a3 d7 66 ec .f.9....V.W...f. 0090 82 dd db fb 30 db 12 c8 4b 78 82 90 98 73 0e ae ....0...Kx...s.. 00a0 95 11 2c 8d db 9c af 40 50 f1 e1 a1 a3 8b b8 19 ..,....@P....... 00b0 60 2a ee a8 19 fc e3 eb 33 82 5a df 27 a0 fd 9c `*......3.Z.'... 00c0 fa 29 5b fb fc e9 7a 63 65 b8 ca 16 da cd 13 7f .)[...zce....... 00d0 9c 15 0c a3 de 11 4d aa d5 df 60 2b a3 85 8c 34 ......M...`+...4 00e0 f5 e8 d4 f5 02 8a 7a ee 61 5e fe 05 e5 00 53 6f ......z.a^....So 00f0 b1 af 5e 00 ad 4f 06 02 95 14 7c f7 9d b6 c2 35 ..^..O....|....5 0100 50 00 32 31 69 81 d9 a5 15 79 49 b4 b0 ae f2 70 P.21i....yI....p 0110 8d 9d 7e 78 2d 2a c0 86 46 59 95 1d 49 be 23 bd ..~x-*..FY..I.#. 0120 cb 63 27 8b b6 81 a6 f1 5e 1a 74 f6 dd f3 15 0f .c'.....^.t..... 0130 9d ff 16 1e eb 40 67 7c a4 3d e2 75 7a 15 d5 c0 .....@g|.=.uz... 0140 e7 5c 60 12 53 c8 aa d4 4d c2 55 1f 17 49 52 fe .\`.S...M.U..IR. 0150 35 0c 9d 8e 97 91 41 20 6f f2 2d 44 92 88 5f 13 5.....A o.-D.._. 0160 94 37 51 05 57 db 26 9d d2 22 bd 37 4e 3b b9 12 .7Q.W.&..".7N;.. 0170 ab 34 ae ed a0 5c 94 2b 60 89 67 8f 8c dd 37 f0 .4...\.+`.g...7. 0180 bc cc 8a 5d 9e 35 f7 a7 9f ef 0f 2a b6 a2 7c b9 ...].5.....*..|. 0190 ba 8b 54 81 50 4b 3f aa 4b a1 f1 c2 0b 5d 29 18 ..T.PK?.K....]). 01a0 5b f4 25 bf 51 97 ea d9 fd 43 31 da 21 46 b0 c5 [.%.Q....C1.!F.. 01b0 c0 22 d4 37 27 e4 64 3b c2 c7 c0 3f 43 12 b6 31 .".7'.d;...?C..1 01c0 15 1f 12 69 6c 54 87 9d 2f 9f 04 71 a9 1d 5d 39 ...ilT../..q..]9 01d0 11 27 00 f5 11 1d d9 0c 69 eb f5 b8 2e 13 7d b2 .'......i.....}. 01e0 ba fd 81 04 72 90 37 19 1c 2f 6a 91 41 7a 00 a3 ....r.7../j.Az.. 01f0 78 fb bf f7 dc 70 c6 2b ba 34 05 81 8b 9d 4c 3d x....p.+.4....L= 0200 6b c8 46 23 a6 a5 cf 8b 8f 5a 10 15 f5 78 ef 7c k.F#.....Z...x.| 0210 9e cb 74 15 21 c8 f8 09 81 78 de ae a0 61 06 7d ..t.!....x...a.} 0220 5b 4a 69 1d 56 05 52 26 7b 00 02 07 28 12 25 bf [Ji.V.R&{...(.%. 0230 4d 0d 35 97 c1 6e 1d f8 05 bf 7c 40 43 bd 1b fd M.5..n....|@C... 0240 97 b1 c9 6b 33 59 c0 68 9f 99 9f cc 97 b0 ff 91 ...k3Y.h........ 0250 46 c7 29 ff 3a 53 67 4b 1b 6d 59 64 17 0a 56 5e F.).:SgK.mYd..V^ 0260 66 1a c7 37 9f ca 93 8c 4f 63 a7 0a 90 b9 33 0a f..7....Oc....3. 0270 78 1c bb 4a cf 20 0d 80 6e 92 53 c7 82 ab 7a 16 x..J. ..n.S...z. 0280 54 ad 29 2d a5 00 09 c3 32 c2 33 64 b8 57 16 0b T.)-....2.3d.W.. 0290 35 65 2e e1 22 6a 3d c5 91 df 26 d1 75 2b 6c 8f 5e.."j=...&.u+l. 02a0 59 00 95 3b 76 12 9f 67 3c e5 5d 2f 75 a0 6e 2b Y..;v..g<.]/u.n+ 02b0 c0 b9 e1 6c 9c ef fb 62 12 49 75 b6 f5 75 5e d1 ...l...b.Iu..u^. 02c0 89 c5 de ac 7b 8b 84 c6 34 db 2a 0d 48 62 8e 4b ....{...4.*.Hb.K 02d0 cc e9 4c 6a 93 ee 0e c7 90 16 cb 90 68 2b e5 77 ..Lj........h+.w 02e0 13 e4 06 c3 5c 30 13 4e 78 29 bc 81 55 be 74 90 ....\0.Nx)..U.t. 02f0 3c 84 ea be 49 5c 40 5c f8 57 93 95 42 8c 1a de <...I\@\.W..B... 0300 57 6b d3 9a 46 37 72 9f fa 1a a1 c7 8e 49 34 34 Wk..F7r......I44 0310 c4 07 1a 3e 41 84 e6 ab 5b 91 05 eb 06 13 a5 24 ...>A...[......$ 0320 79 da 26 d6 44 ad a8 51 a3 23 4a 72 4b fd 55 fa y.&.D..Q.#JrK.U. 0330 75 d9 32 cd b5 c7 9f b6 b8 bb 4e 7c 94 6b 8d 42 u.2.......N|.k.B 0340 2b f3 80 95 a8 a6 22 31 04 cc 0d f2 3c 7d 6c 62 +....."1....<}lb 0350 1c 08 46 04 bd f6 d3 35 6d 22 d7 0b 0e b5 6f 10 ..F....5m"....o. 0360 d2 c3 dd 3d d7 22 f4 c8 3e b1 90 49 1c 87 e4 74 ...=."..>..I...t 0370 55 b9 b6 24 24 56 95 bd 20 81 66 e2 dc b2 24 ea U..$$V.. .f...$. 0380 b3 fe 11 18 76 2a 2c 81 9b 49 f1 77 85 4d 88 4f ....v*,..I.w.M.O 0390 5c 79 32 c9 4d ed 82 f1 73 65 61 62 55 6f be cf \y2.M...seabUo.. 03a0 cf d9 fb af 5d 21 bb f5 bd 43 54 56 0b 4c 6a a9 ....]!...CTV.Lj. 03b0 c1 eb 53 78 f0 0b 90 40 04 c0 3e e5 f8 bd 9e 10 ..Sx...@..>..... 03c0 ce c1 54 80 a0 a3 a1 94 b3 f7 f5 e1 7b 78 9a 1b ..T.........{x.. 03d0 66 85 77 08 46 f9 3c 54 44 ce 07 68 28 de c9 07 f.w.F...Z.; 04d0 e6 14 2e 6d 90 5d fc 27 4c c2 c6 e6 0b 83 72 92 ...m.].'L.....r. 04e0 ad ce 44 e2 16 69 15 f0 25 f3 79 31 7d 67 d7 e4 ..D..i..%.y1}g.. 04f0 cb 50 98 6e fa dd ee 0c 06 9c 16 a8 87 8d 57 7f .P.n..........W. 0500 a4 9a 41 74 8f 15 bf 71 51 08 11 2b ad 0f 65 af ..At...qQ..+..e. 0510 43 25 78 8e 38 0c 5f 73 7d 88 fb 8c 24 df 76 16 C%x.8._s}...$.v. 0520 e1 45 11 cd 64 b2 f4 4b 0f 10 10 72 c1 0b 05 1c .E..d..K...r.... 0530 f0 4c 76 dc 39 e4 31 7e 31 77 de 2b 54 e3 58 3a .Lv.9.1~1w.+T.X: 0540 1a c8 68 83 6c 03 18 98 22 51 3a 65 d5 22 b2 89 ..h.l..."Q:e.".. 0550 e5 6d 43 2e cb 8d 6b b4 7b 98 85 e0 7f 16 c8 32 .mC...k.{......2 0560 00 2d 37 24 a0 d0 93 c8 07 d9 54 d7 ce 6c 15 5d .-7$......T..l.] 0570 57 fe 2f 43 a2 59 b3 b9 e1 65 2f 64 cd a8 5a 1d W./C.Y...e/d..Z. 0580 82 29 aa 51 af 32 4c 25 b1 53 a8 c2 95 55 8f 21 .).Q.2L%.S...U.! 0590 3a c1 57 f5 0c a7 1a c6 19 b3 f5 20 7c ae 9a ec :.W........ |... 05a0 22 ae a7 f9 5f 4a b8 18 c4 18 3e cc 89 df a5 e5 "..._J....>..... 05b0 76 8b 5f a4 v._. No. Time Source Destination Protocol Info 2754 820.379724 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=4559 Ack=19701 Win=17520 Len=0 SLE=34301 SRE=35761 SLE=29921 SRE=32841 Frame 2754 (74 bytes on wire, 74 bytes captured) Arrival Time: Nov 11, 2005 16:43:49.138228000 Time delta from previous packet: 0.194594000 seconds Time since reference or first frame: 820.379724000 seconds Frame Number: 2754 Packet Length: 74 bytes Capture Length: 74 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 60 Identification: 0x41d4 (16852) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x34a4] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 4559, Ack: 19701, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 4559 (relative sequence number) Acknowledgement number: 19701 (relative ack number) Header length: 40 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0xee9b [correct] Options: (20 bytes) NOP NOP SACK: 34301-35761 29921-32841 left edge = 34301 (relative) right edge = 35761 (relative) left edge = 29921 (relative) right edge = 32841 (relative) No. Time Source Destination Protocol Info 2755 820.380018 soth1 zen1 TCP [TCP Retransmission] 1677 > 4605 [ACK] Seq=19701 Ack=4559 Win=7234 Len=1460 Frame 2755 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:43:49.138522000 Time delta from previous packet: 0.000294000 seconds Time since reference or first frame: 820.380018000 seconds Frame Number: 2755 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xed52 (60754) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x8385 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 19701, Ack: 4559, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 19701 (relative sequence number) Next sequence number: 21161 (relative sequence number) Acknowledgement number: 4559 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7234 Checksum: 0x5730 [correct] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 0.446446000 seconds RTO based on delta from frame: 2751 Data (1460 bytes) 0000 df 85 01 39 8c f1 2e 80 89 00 3e 8a 05 74 06 52 ...9......>..t.R 0010 35 2b cb f3 67 46 0d 8c 68 0b 8e 82 9d f4 73 33 5+..gF..h.....s3 0020 b6 19 bc ab 90 58 81 ac 21 ee 72 c9 3e 90 c6 c2 .....X..!.r.>... 0030 94 19 47 a8 32 99 28 0c 7c ba 90 8f 68 87 d6 dc ..G.2.(.|...h... 0040 98 37 1b 8c 5a 71 68 34 f9 09 18 86 3e 85 7b bc .7..Zqh4....>.{. 0050 6f 6c ff d8 f6 12 1d ca 1c 9d 38 bf 23 18 65 fc ol........8.#.e. 0060 ea 86 ff e8 a2 c3 ab de 3e d4 36 cb 9c 5c c4 73 ........>.6..\.s 0070 13 d1 0c ad 55 06 97 69 5b 6a 8d 8e ce dd fe 45 ....U..i[j.....E 0080 a1 93 21 ee a0 bb c0 7c a0 55 b7 4d 15 ea ff d3 ..!....|.U.M.... 0090 f6 d9 f4 30 6f c1 6f ff 8b fb d8 57 24 4d c0 8f ...0o.o....W$M.. 00a0 5f 8d 99 91 a8 10 a9 67 eb 73 66 3e b0 e4 98 89 _......g.sf>.... 00b0 91 bd ca df 4d 4b 86 95 e5 91 28 58 58 7e 85 f7 ....MK....(XX~.. 00c0 19 71 65 c8 74 19 84 74 58 da 29 07 9e 6c 2a 88 .qe.t..tX.)..l*. 00d0 60 27 89 50 99 30 cf 29 26 6e 21 d1 97 e8 33 9f `'.P.0.)&n!...3. 00e0 cb 42 b8 ac 88 fa fe 2f 8d 6b 9a 95 56 7b 27 0c .B...../.k..V{'. 00f0 23 d7 40 8a ed 18 f3 6c 94 7b 3d 71 10 d3 be 6e #.@....l.{=q...n 0100 65 6e bd 37 b9 a1 58 c4 5d 03 97 a3 d2 38 c9 62 en.7..X.]....8.b 0110 0b 38 21 7b 45 8a f9 4e 9b 68 d3 85 cb e8 33 82 .8!{E..N.h....3. 0120 da 47 59 15 2e 1a 01 23 f0 7f a5 82 bb 32 80 2c .GY....#.....2., 0130 e5 af 57 98 14 46 29 0c 56 e9 8c d8 47 02 b1 aa ..W..F).V...G... 0140 4e 37 7a f4 69 6e 99 d2 18 ed 02 e0 e6 12 23 40 N7z.in........#@ 0150 bb 4a 38 72 5d d4 a0 57 8d 68 18 a7 9e 87 95 34 .J8r]..W.h.....4 0160 66 f3 e1 cc a5 13 d4 42 3f 1b ee 2a a7 cd 23 23 f......B?..*..## 0170 b9 d8 94 c9 19 e1 b7 68 13 06 b9 a5 82 0a 8c 8d .......h........ 0180 53 93 58 0e 43 42 b6 38 ad 15 3f 9a 4e 6f 8f db S.X.CB.8..?.No.. 0190 2b 87 2e 38 9a 29 e4 53 ea 3b 98 d8 91 b7 9d 72 +..8.).S.;.....r 01a0 93 26 45 37 a1 c5 d5 2e 7a 58 e9 e9 5c 68 ca cb .&E7....zX..\h.. 01b0 d8 61 2c 92 89 8d 1a 2b 2a f7 ce c4 6e 90 61 56 .a,....+*...n.aV 01c0 38 d5 14 6a f5 6c 4f 7c 6a 26 5e 1b d3 44 85 fa 8..j.lO|j&^..D.. 01d0 d1 49 56 2d dd 46 8c 2a 2a 10 64 7f 2c 42 26 cf .IV-.F.**.d.,B&. 01e0 24 ef e2 9b a0 1f 1c 3e c3 06 47 38 72 d1 25 47 $......>..G8r.%G 01f0 98 d5 de ce 03 4f 26 b1 5e e5 e5 cc 4d 6d b0 0a .....O&.^...Mm.. 0200 42 de 08 59 06 0d 56 37 8e 9f 5f 6a 83 f6 85 c2 B..Y..V7.._j.... 0210 86 18 41 4f 11 be 2d 2d e2 9a cf 1f 66 51 d6 27 ..AO..--....fQ.' 0220 23 03 1f 58 42 45 f7 44 ee 0d 56 4f 51 2e 85 fb #..XBE.D..VOQ... 0230 d7 74 bc 9e ee b2 b8 d2 c4 a6 f3 d8 04 b4 b0 97 .t.............. 0240 4f f2 e9 a7 96 22 b7 f9 c8 72 00 93 98 d1 da a0 O...."...r...... 0250 7b 73 0b 22 c7 93 9d 36 c3 ff 97 f0 58 e3 51 e2 {s."...6....X.Q. 0260 47 3b ac 56 ed 1b be 71 ce 71 5c 78 41 4c 82 8c G;.V...q.q\xAL.. 0270 62 c4 20 d7 90 e3 78 31 33 f6 36 20 8a 87 d0 57 b. ...x13.6 ...W 0280 49 c1 8b 31 ae aa f9 dc 2b a2 f5 90 3a 74 18 27 I..1....+...:t.' 0290 26 1c e8 6a 13 6e f2 57 87 f3 8a 3c c5 0e d9 6e &..j.n.W...<...n 02a0 1a a9 b0 89 4a ae 36 ec bd cb 82 06 dd 68 81 89 ....J.6......h.. 02b0 15 22 e1 01 d3 ac 02 42 7a 37 3f 9a 81 6a d5 af .".....Bz7?..j.. 02c0 00 4e 69 08 52 61 f7 05 75 89 79 d7 55 8d 1a 5d .Ni.Ra..u.y.U..] 02d0 23 4b 14 36 f1 1c 79 6e ff a3 c2 48 b2 7c 1b 63 #K.6..yn...H.|.c 02e0 f1 24 8a fe e4 bb 38 5a 4f 8a 39 33 e0 c5 d7 74 .$....8ZO.93...t 02f0 59 a4 77 df 67 f7 f5 9f 0b 2b fd a0 8c ea 47 f9 Y.w.g....+....G. 0300 17 f8 49 2f 5f a5 34 e3 51 44 c9 2e 09 7c db 37 ..I/_.4.QD...|.7 0310 5f 5f c1 f7 d6 f8 90 49 c9 46 35 32 5d 4c 1b 4b __.....I.F52]L.K 0320 93 5d 7e 9b a6 6b cd f0 25 8b d1 e1 52 a7 fc 68 .]~..k..%...R..h 0330 12 f3 b3 69 94 81 fe ce c0 fe 72 86 f8 61 2e b5 ...i......r..a.. 0340 2e 94 c7 d9 60 26 27 57 78 dc c5 21 ef 5c 69 37 ....`&'Wx..!.\i7 0350 ca a5 ec 69 3d 09 95 31 a7 fc 2b 36 f7 bf 71 28 ...i=..1..+6..q( 0360 c9 00 c0 f1 0b ce a7 7b ad a0 e2 d6 ef 5f e8 23 .......{....._.# 0370 6b ba 0d 62 f3 e5 c5 ce 82 0e bd cc a3 c0 d8 9f k..b............ 0380 8c 8b 2e 47 6a 44 c5 27 59 cb 84 fe b1 0e 8d 92 ...GjD.'Y....... 0390 a8 f7 03 a2 1d 49 19 6c 98 e5 bc 8c 0f 1d 41 12 .....I.l......A. 03a0 3f 35 9c 96 69 a1 cf 79 a9 49 d3 a6 a3 b6 87 dd ?5..i..y.I...... 03b0 30 9d c2 b5 e4 b0 d1 91 82 0c ce e5 55 eb e8 f3 0...........U... 03c0 72 f5 0b 37 e6 54 7f e2 bd bd fe 0f 7a 2c ca 0c r..7.T......z,.. 03d0 fe cc 01 a0 9d 81 60 66 ce e1 af 0b 35 ff e9 71 ......`f....5..q 03e0 22 08 04 85 10 54 6c ef dd 94 23 87 2a 65 f1 97 "....Tl...#.*e.. 03f0 02 f3 4b 77 5b e6 eb 05 4d d9 9b e7 56 0e 75 d9 ..Kw[...M...V.u. 0400 bb 10 e2 78 f4 a4 fb 70 db 78 1d eb 81 18 77 c7 ...x...p.x....w. 0410 90 6a ac 75 b7 97 fb 91 36 0a 9e 00 e6 6e cd f3 .j.u....6....n.. 0420 e7 21 d0 a6 ee a6 bc e0 49 f5 76 cb 81 34 d9 26 .!......I.v..4.& 0430 f9 92 57 3f 7c 57 bd 21 21 93 5a 25 68 f0 0e 1c ..W?|W.!!.Z%h... 0440 f6 29 7b f1 91 20 3c d5 7a 14 a6 43 0a 00 60 7a .){.. <.z..C..`z 0450 fc b2 26 21 60 63 82 c5 a9 dd 4a e0 fc d9 c1 f9 ..&!`c....J..... 0460 6f e1 ab c6 3f a1 9e e1 95 8d eb 0e b5 65 44 b0 o...?........eD. 0470 1e e7 a2 37 9c ca 95 37 93 7d 07 c9 a4 41 90 b6 ...7...7.}...A.. 0480 7c d2 2d 39 a1 6e a0 68 fa ae d2 aa f3 22 94 30 |.-9.n.h.....".0 0490 72 4b c4 e3 60 10 73 27 01 92 51 7d f4 29 88 e8 rK..`.s'..Q}.).. 04a0 94 6f b0 b9 d6 f1 fb 94 15 46 e6 50 f8 ca 56 3e .o.......F.P..V> 04b0 73 fe ba f2 48 94 15 96 a6 f1 d9 b4 08 b4 49 50 s...H.........IP 04c0 1f 3b 8c d3 75 5a 91 d7 74 49 87 1b 9a f9 af db .;..uZ..tI...... 04d0 4f e9 f8 0a 0d 71 11 66 25 e5 cd c7 dc 71 5b 55 O....q.f%....q[U 04e0 76 6b b9 51 51 08 be e3 28 bb 34 9a 6a c1 df 3b vk.QQ...(.4.j..; 04f0 bf c7 52 ae f1 3e 63 03 41 ee 49 88 b2 f1 5d 17 ..R..>c.A.I...]. 0500 f7 51 99 28 c1 e6 9b d2 14 1d d0 bd d9 13 54 a3 .Q.(..........T. 0510 6b a1 a4 e8 6e 24 32 8f 07 68 59 74 34 cc da 24 k...n$2..hYt4..$ 0520 87 25 c2 57 13 e8 1e d4 cc 8f 12 56 3b 6f a6 8b .%.W.......V;o.. 0530 59 a4 2a 77 af d0 40 a8 af 4a fc 3a b3 91 a7 a5 Y.*w..@..J.:.... 0540 91 82 1b 2e 3c 07 0d fd c4 01 2b bf af 68 e5 16 ....<.....+..h.. 0550 08 33 bc 8b 0b 7c 58 07 85 cd af fe f2 19 ae 56 .3...|X........V 0560 a7 0f f5 ba dd 4c 77 22 1c a5 0b 30 9f f4 f1 81 .....Lw"...0.... 0570 e3 91 27 6f d9 81 26 77 1e fb 87 f5 52 a9 6b af ..'o..&w....R.k. 0580 57 95 f3 df a7 db aa c3 b0 94 7f 23 b8 3e 18 80 W..........#.>.. 0590 39 71 64 c4 fc f6 b3 22 21 48 70 3c 34 a9 1a a6 9qd...."!Hp<4... 05a0 97 e8 f7 6b fb af cd e6 ed 7b 4b 96 97 8b 28 e4 ...k.....{K...(. 05b0 b7 c6 b0 47 ...G No. Time Source Destination Protocol Info 2756 820.380137 soth1 zen1 TCP [TCP Retransmission] 1677 > 4605 [ACK] Seq=21161 Ack=4559 Win=7234 Len=1460 Frame 2756 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:43:49.138641000 Time delta from previous packet: 0.000119000 seconds Time since reference or first frame: 820.380137000 seconds Frame Number: 2756 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xee52 (61010) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x8285 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 21161, Ack: 4559, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 21161 (relative sequence number) Next sequence number: 22621 (relative sequence number) Acknowledgement number: 4559 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7234 Checksum: 0x76b0 [correct] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 0.446565000 seconds RTO based on delta from frame: 2751 Data (1460 bytes) 0000 0c cd 5e 1b c9 92 fd 51 1f fa 07 39 7e b9 1a e3 ..^....Q...9~... 0010 ce 32 5e 79 75 8f 34 d5 73 c5 6d 94 b8 5d d5 1d .2^yu.4.s.m..].. 0020 be 25 23 3c 5f 66 60 21 39 31 e5 33 e3 c5 f9 bc .%#<_f`!91.3.... 0030 fa 43 69 58 2c d6 75 cd 12 6c 8c 73 e8 8b 8b ff .CiX,.u..l.s.... 0040 ec 4c b5 08 e7 3f bf 74 17 10 8b b7 99 a6 42 e8 .L...?.t......B. 0050 d9 c6 2f 68 15 df 18 b5 5a 13 26 42 1f 42 44 36 ../h....Z.&B.BD6 0060 5e 08 2e 90 90 48 06 9f c3 ec 4a e2 fc dd db e7 ^....H....J..... 0070 6e f5 9c 85 28 d2 f9 c0 40 c5 11 0d fe fa b6 bd n...(...@....... 0080 74 fb 8d 36 e9 68 08 5c 87 ca a6 d4 1b c2 7b 51 t..6.h.\......{Q 0090 80 1a f9 fe 4d 67 6b 16 85 e1 c2 58 65 d2 46 56 ....Mgk....Xe.FV 00a0 b0 60 75 67 16 69 8e a9 55 42 70 aa 22 06 23 6e .`ug.i..UBp.".#n 00b0 25 2d ba a4 bf c4 4c 67 73 4b 15 af d3 ba b4 3f %-....LgsK.....? 00c0 ec f5 53 b3 cc 36 47 60 a7 0d cd 45 c9 84 17 62 ..S..6G`...E...b 00d0 52 2a 7e 1e 59 56 b7 35 14 99 dd 74 58 37 19 4f R*~.YV.5...tX7.O 00e0 87 87 f5 da 09 dc 01 2d 9d 8d 64 db 79 bc 11 17 .......-..d.y... 00f0 77 3b 7c ba db c7 c1 b8 77 d7 2d 71 4e ad e3 aa w;|.....w.-qN... 0100 61 5f c0 f4 ae 68 31 21 f9 b4 9e d2 1b 08 22 8d a_...h1!......". 0110 28 53 03 28 f5 78 fa 8c 19 45 f3 5a 56 fc 11 48 (S.(.x...E.ZV..H 0120 93 f0 60 f3 c6 a4 37 fb 62 fe 8e 6d 84 8d 6c a7 ..`...7.b..m..l. 0130 89 b2 d0 12 92 d2 9d 27 5c 4d 02 ef 76 ff d6 ff .......'\M..v... 0140 db c0 b2 c8 1d a3 33 ba 3c a6 1b ec 27 6e 2c cd ......3.<...'n,. 0150 47 11 d9 28 cd 2d ec 40 19 89 fc f4 3e 49 e6 98 G..(.-.@....>I.. 0160 71 4e 2e c3 e0 e5 23 d7 b3 f0 57 64 98 5a 46 5c qN....#...Wd.ZF\ 0170 7b 1b 0f d2 10 52 ee 0d b2 f9 f4 35 19 0c f4 a2 {....R.....5.... 0180 21 da 77 8c 64 a2 f7 97 2b 78 77 90 77 f4 c9 98 !.w.d...+xw.w... 0190 ff e9 9f 07 65 68 fa 2d a5 aa fd 2b 09 70 47 aa ....eh.-...+.pG. 01a0 47 ac 6e 4f 9e 1b 4b 51 3e d8 f9 2f 13 67 9e 52 G.nO..KQ>../.g.R 01b0 e9 fd 53 04 ef 85 4b e6 a8 cb 7f fc 6b 72 79 07 ..S...K.....kry. 01c0 5c 4c 84 4f 51 d3 af df 02 c5 b6 f4 2c f3 b4 02 \L.OQ.......,... 01d0 14 dc 3e 0f d1 71 90 9a fb 87 eb 3a 47 db 0a 21 ..>..q.....:G..! 01e0 01 df 03 79 17 50 bf d2 c5 ba 2b 97 26 63 45 3b ...y.P....+.&cE; 01f0 e4 03 12 05 d2 dd 66 02 37 f6 cb 8d 53 6b f4 06 ......f.7...Sk.. 0200 ec 0f cf 7a 1a 5f 09 51 e2 da e1 ac a0 97 05 32 ...z._.Q.......2 0210 17 7b f9 12 31 4b d8 67 b8 d4 78 2b 19 c1 97 37 .{..1K.g..x+...7 0220 e8 d6 36 19 d5 35 b1 00 e3 c1 fb fc 90 54 50 f8 ..6..5.......TP. 0230 1f 9d 0e ad 29 4d ea e8 fd 28 ad 31 1e af 20 ef ....)M...(.1.. . 0240 51 66 7c 1c ad be 8f 45 7e eb 25 03 db cc 2f 72 Qf|....E~.%.../r 0250 3e 1c 34 60 90 0c 56 1d 1f 96 90 0f d2 64 5b 1c >.4`..V......d[. 0260 53 e8 94 39 55 42 bc 98 68 ef fd f4 e9 c3 41 54 S..9UB..h.....AT 0270 22 e2 23 9a 9a d3 9f 17 34 16 64 b9 1f cb c5 8f ".#.....4.d..... 0280 09 7a fc 7c 0b 5d 33 23 21 7f f6 30 b8 32 6a bc .z.|.]3#!..0.2j. 0290 8e 96 33 f8 5b 6c 31 2e 54 53 dd 06 43 ca fa 59 ..3.[l1.TS..C..Y 02a0 75 dc 8f ce e0 87 eb 2a 7c 37 7c 7a 0c 9f 5f d5 u......*|7|z.._. 02b0 a1 fe 18 c4 8a b3 42 57 ef a4 07 20 58 93 9f 68 ......BW... X..h 02c0 54 e9 b2 0b 0b 95 07 b0 75 f6 dc 57 58 63 cf 82 T.......u..WXc.. 02d0 79 f1 49 1d 7a eb 64 5d 8f cb a7 f8 ef 5b 80 49 y.I.z.d].....[.I 02e0 77 c2 fc a8 e6 22 12 4e 25 1f e5 18 55 bb 46 91 w....".N%...U.F. 02f0 aa 67 d0 48 95 af d1 75 a2 72 5f 8e 16 83 6a f3 .g.H...u.r_...j. 0300 7d 10 82 f0 01 0f bd ea 64 de 23 75 7f 52 30 c6 }.......d.#u.R0. 0310 a9 62 4c fd be d2 24 3b 7b f0 15 d5 ef 8b 1d 41 .bL...$;{......A 0320 e4 57 fe 3c 55 57 ed 13 55 b9 2a 97 ac 05 d6 3b .W.{5...#.v..o 0390 0f 2c 99 55 7f 09 c2 1d a4 a1 65 a5 37 29 1d 47 .,.U......e.7).G 03a0 97 9d 2a 60 60 84 68 2f a8 70 d0 c5 c7 c0 31 7e ..*``.h/.p....1~ 03b0 bb 9e 49 44 59 1f 0e 63 d8 fd 67 54 49 c9 5d d9 ..IDY..c..gTI.]. 03c0 1d b6 43 75 f7 d5 0f c1 57 73 b6 bd 32 c1 51 69 ..Cu....Ws..2.Qi 03d0 90 89 29 44 fc 95 ac f0 57 f7 9a b1 0a 60 35 a7 ..)D....W....`5. 03e0 dd 6f 91 ec 4f bc f0 67 57 3c 2a 09 41 97 69 49 .o..O..gW<*.A.iI 03f0 2d cc c1 ab e8 14 d9 64 28 49 45 2f 6d 50 f6 e7 -......d(IE/mP.. 0400 dc ac c8 f1 9c e7 1f e4 d8 91 d6 2f 4b 02 9e 1b .........../K... 0410 d5 0f e4 6d 9d ae 85 a7 68 06 d4 93 b4 8f c3 32 ...m....h......2 0420 53 e0 2f 0b 22 27 bb b9 c5 f7 0e 9d d9 2c 90 16 S./."'.......,.. 0430 4a e4 6a 3e 97 fb be 69 8d 7c 00 5c 63 55 b4 86 J.j>...i.|.\cU.. 0440 a9 b5 09 3c 70 a5 f6 c8 cc 90 9b 4f 77 90 24 49 ...D...>...,fG... 0540 de 1c 1e 82 8a 29 df 72 da 73 d6 48 a7 cf 14 a8 .....).r.s.H.... 0550 da 26 e3 8b f2 34 74 b0 ad b8 68 81 37 d8 ab 5b .&...4t...h.7..[ 0560 f5 da 66 76 fb d1 6e 42 20 43 39 37 c3 6f a8 d7 ..fv..nB C97.o.. 0570 fe 53 fe 56 c0 0f 93 39 66 c9 40 59 57 07 e7 d9 .S.V...9f.@YW... 0580 55 8a 0c 84 01 ea 5c 65 73 16 e2 82 ee 95 ba a5 U.....\es....... 0590 e8 3a 98 41 39 85 c8 2c 55 03 76 e1 a1 b9 f8 9f .:.A9..,U.v..... 05a0 a7 f9 7d b6 b9 78 e0 40 bd 29 e6 99 24 ed be c6 ..}..x.@.)..$... 05b0 c2 f5 c7 60 ...` No. Time Source Destination Protocol Info 2757 820.380193 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=4559 Ack=22621 Win=17520 Len=0 SLE=34301 SRE=35761 SLE=29921 SRE=32841 Frame 2757 (74 bytes on wire, 74 bytes captured) Arrival Time: Nov 11, 2005 16:43:49.138697000 Time delta from previous packet: 0.000056000 seconds Time since reference or first frame: 820.380193000 seconds Frame Number: 2757 Packet Length: 74 bytes Capture Length: 74 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 60 Identification: 0x41d5 (16853) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x34a3] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 4559, Ack: 22621, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 4559 (relative sequence number) Acknowledgement number: 22621 (relative ack number) Header length: 40 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0xe333 [correct] Options: (20 bytes) NOP NOP SACK: 34301-35761 29921-32841 left edge = 34301 (relative) right edge = 35761 (relative) left edge = 29921 (relative) right edge = 32841 (relative) No. Time Source Destination Protocol Info 2758 820.380441 soth1 zen1 TCP [TCP Retransmission] 1677 > 4605 [ACK] Seq=22621 Ack=4559 Win=7234 Len=1460 Frame 2758 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:43:49.138945000 Time delta from previous packet: 0.000248000 seconds Time since reference or first frame: 820.380441000 seconds Frame Number: 2758 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xef52 (61266) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x8185 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 22621, Ack: 4559, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 22621 (relative sequence number) Next sequence number: 24081 (relative sequence number) Acknowledgement number: 4559 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7234 Checksum: 0x6098 [correct] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 0.446869000 seconds RTO based on delta from frame: 2751 Data (1460 bytes) 0000 8c 99 f9 f1 09 7c e7 ba e4 53 22 24 e6 35 fd f2 .....|...S"$.5.. 0010 35 3d 5f ce 22 7c e1 5b 7c 2a 4d 95 05 b1 cb d0 5=_."|.[|*M..... 0020 9f ff 15 e9 46 80 85 12 e6 a2 03 96 fa f2 55 f0 ....F.........U. 0030 4c 31 8d 82 ac 95 0c ac c0 32 5c a7 04 51 7d 08 L1.......2\..Q}. 0040 49 99 73 24 83 f8 10 51 a0 96 48 53 d3 3a 94 f6 I.s$...Q..HS.:.. 0050 0d 44 3e 8f 12 3e 01 64 69 e4 de 73 ad 7e 65 a7 .D>..>.di..s.~e. 0060 70 6e b8 2f 1e 73 87 e4 fc 82 80 70 9d 9c ac dc pn./.s.....p.... 0070 47 6f 30 ce 69 01 15 0f f4 4c 29 2f 2d b9 b4 f7 Go0.i....L)/-... 0080 96 22 a0 80 7e c5 2f f8 eb f0 fc e1 68 6f 7b bb ."..~./.....ho{. 0090 f8 6d ed 03 bd c0 10 6e 49 24 e5 7f d4 76 42 f3 .m.....nI$...vB. 00a0 3b 72 8d 62 f7 85 fd 28 8e 87 0a 12 a2 e0 50 7f ;r.b...(......P. 00b0 e4 7a e3 fd 89 99 7b 73 d1 38 db 2a 09 4f 86 f6 .z....{s.8.*.O.. 00c0 5e f9 8c 24 d2 7a e0 16 93 30 e7 09 1f 5a c2 3e ^..$.z...0...Z.> 00d0 cd 5d 5d f6 d0 e3 62 24 87 68 91 93 d1 ed 14 fc .]]...b$.h...... 00e0 59 48 38 18 bb 43 3f bf 32 f5 62 ce fc 2d 52 68 YH8..C?.2.b..-Rh 00f0 43 1c 6a f2 7d d7 28 95 4a 5f 44 2e 1a 9b 84 f8 C.j.}.(.J_D..... 0100 2d 5c 04 83 11 2c 7a 20 80 39 6f 9d 68 f2 70 d7 -\...,z .9o.h.p. 0110 d9 e5 e7 c4 6a e1 22 29 e9 8b 56 e1 69 0b 76 63 ....j.")..V.i.vc 0120 4d c1 c4 87 b2 0d 24 b9 84 97 21 25 07 04 ca 92 M.....$...!%.... 0130 c0 e4 a5 db c3 38 ae bc b1 4e 99 23 24 aa 14 1a .....8...N.#$... 0140 f3 77 a7 e2 1f 4a 74 c8 6a 34 db 66 4e 58 fc 1f .w...Jt.j4.fNX.. 0150 bb 8f 40 95 a7 f7 c5 6d 7d 75 b3 ec 79 8c 9a 04 ..@....m}u..y... 0160 a5 b9 04 a8 6b fd 69 41 39 39 c8 3b 4a 05 14 8e ....k.iA99.;J... 0170 6e 34 dd 41 43 f1 44 fe 5f 4f 86 14 36 9b 8b 88 n4.AC.D._O..6... 0180 16 4f 3d 46 47 ff ac 2a 3d 46 27 85 80 87 04 c0 .O=FG..*=F'..... 0190 cc 71 7d 4d 24 7f 29 c6 7f 42 93 33 c9 3f 18 05 .q}M$.)..B.3.?.. 01a0 1f 2c c0 a9 2d 21 71 7f b7 71 0b d7 2d e8 17 7a .,..-!q..q..-..z 01b0 ef c8 c1 ea 24 2d f9 2a 68 68 df ed 97 10 bc c0 ....$-.*hh...... 01c0 44 f2 8c ae 02 4f 06 7b 8b 2f 71 7b c8 f2 02 23 D....O.{./q{...# 01d0 20 40 e8 e6 c3 40 44 34 65 7f 87 96 73 98 7c 94 @...@D4e...s.|. 01e0 ae 0d 30 9b 0d 10 69 a9 47 9c 4f 0f ff 37 69 a6 ..0...i.G.O..7i. 01f0 7d 7d ac b0 95 b9 d7 08 d3 01 6a 3c 00 dd c8 68 }}........j<...h 0200 b7 b7 6b ee b1 a4 85 bd 38 8d bd 9a 91 66 22 b6 ..k.....8....f". 0210 ad 6d 56 2f 76 bd 87 ec ca 7a 49 94 78 e9 f2 6c .mV/v....zI.x..l 0220 d3 9d 3c 07 bb 2f 53 83 f2 26 d7 86 04 a1 c0 a2 ..<../S..&...... 0230 a5 f5 56 7f ed a3 83 d1 84 2d e0 7a 01 32 04 6b ..V......-.z.2.k 0240 e3 34 cf f8 fd 9a 00 59 0c 1a b7 a1 9c a5 ba f1 .4.....Y........ 0250 f2 16 fa e2 61 81 1f de 1c b8 09 a5 0d 86 ca c5 ....a........... 0260 2c 3e e1 66 a3 f2 a0 7f 05 16 72 65 fd 01 b7 c0 ,>.f......re.... 0270 ed 97 d5 66 ba 67 d3 df 12 56 74 f9 67 07 d7 5b ...f.g...Vt.g..[ 0280 72 25 63 74 f7 e1 1a 1f 6d 95 ea 70 49 16 ff 93 r%ct....m..pI... 0290 df bb 43 a4 1b 00 a9 52 80 01 79 48 6a a3 41 50 ..C....R..yHj.AP 02a0 60 96 b3 83 9c 89 9e 70 ac da 46 14 d6 e4 31 14 `......p..F...1. 02b0 32 42 e5 bd d2 4f 80 02 a6 aa d5 ad da 54 03 dd 2B...O.......T.. 02c0 06 5b 41 a2 b1 00 6b 9c ad 5c 91 c0 0f 43 16 60 .[A...k..\...C.` 02d0 ea 61 c6 4f 4b f2 c2 02 95 c0 68 30 70 cb c8 66 .a.OK.....h0p..f 02e0 bb ef 53 41 78 ef 41 f5 80 27 4a aa d4 3f 9d 4b ..SAx.A..'J..?.K 02f0 2c 26 01 16 e5 68 d4 1f 1f c6 8b a9 de 4b 85 26 ,&...h.......K.& 0300 e8 36 e8 72 ec 01 02 f1 40 0b aa eb d1 30 29 a8 .6.r....@....0). 0310 78 3d 5b 99 db dd 27 88 52 98 ba fd 9a 1a 8d e8 x=[...'.R....... 0320 21 7d fa 57 96 80 52 d5 43 61 30 c5 ed 9c 99 06 !}.W..R.Ca0..... 0330 a3 bc 07 94 f5 b2 d0 a2 3c 74 3f 4e 2b 67 7e 64 ..........Nr..9n.....w 0390 1f f9 8f 87 b4 77 55 15 a0 f3 63 58 62 7b a3 b0 .....wU...cXb{.. 03a0 93 25 ff 9b 06 cc 9b d2 d3 27 2a ba 14 03 6d 41 .%.......'*...mA 03b0 37 05 40 1f 37 d5 80 83 8c e3 4d d8 d8 89 e5 54 7.@.7.....M....T 03c0 ab 36 7c a1 eb a9 d7 fd 0c 43 5c 03 a2 5c 5a ff .6|......C\..\Z. 03d0 d2 7a af 9e f2 dd 28 db 02 6c 8b 4e cf ec e7 77 .z....(..l.N...w 03e0 a3 00 f8 c9 2c fa ad 54 70 8e 73 1e 3f 8f e4 ae ....,..Tp.s.?... 03f0 f7 90 ca f9 22 43 b6 5b ce 44 85 e3 b9 77 1b db ...."C.[.D...w.. 0400 02 e0 e4 87 12 f8 06 69 98 59 8b 49 5f 8a c3 5b .......i.Y.I_..[ 0410 f3 e0 cd 8c 62 fa 33 ea 40 ff 5e 41 23 9e 5c 34 ....b.3.@.^A#.\4 0420 99 f3 76 e8 d2 7a 76 f3 4b 03 01 3b 94 c9 54 d5 ..v..zv.K..;..T. 0430 d1 d7 a5 7b 8d d8 6d 50 86 48 ad 76 08 b5 08 c2 ...{..mP.H.v.... 0440 9d ec 65 c7 00 4c 53 3f 77 eb 31 91 9e 05 6b ed ..e..LS?w.1...k. 0450 83 bc 61 97 dc 9c 32 d3 a9 82 b5 f2 f7 38 80 ae ..a...2......8.. 0460 38 86 58 c6 2c 9f 44 c6 ff 38 37 be 7b ac 60 16 8.X.,.D..87.{.`. 0470 46 ca 25 cd 30 cd 44 f7 51 8e 01 26 4d 78 56 35 F.%.0.D.Q..&MxV5 0480 bf 61 5c e2 0f 5e 24 5d db 8a 50 96 91 97 f1 bd .a\..^$]..P..... 0490 4d 8d 15 41 a8 50 c4 f1 72 f9 e5 5a e9 e1 66 ff M..A.P..r..Z..f. 04a0 4b 48 24 f1 15 c1 4d 77 f0 a9 7c 9e 55 8b 7b 08 KH$...Mw..|.U.{. 04b0 a1 85 24 0b bd 62 09 8e 01 67 2e 97 7e bc 09 f4 ..$..b...g..~... 04c0 65 36 c6 79 01 07 0f 10 1e 63 91 88 ec de 3d 48 e6.y.....c....=H 04d0 bc 4c 09 f9 ac 5f be 67 bc 0d f5 d5 4f 99 71 63 .L..._.g....O.qc 04e0 cb e5 f9 88 90 21 7b 40 10 94 c9 6a 57 f2 69 f6 .....!{@...jW.i. 04f0 54 dd ca 40 c8 84 6b e8 f4 29 5f 50 b8 cb 0d 03 T..@..k..)_P.... 0500 89 c5 cd 65 b9 5e 2e 1b ac 6f 95 6c 54 3f cf 5e ...e.^...o.lT?.^ 0510 4e fe 2e 16 f5 98 1d 0d 86 17 a7 bc c7 2c 59 58 N............,YX 0520 7c eb 9f 1f 89 0d 6b 1c 66 df 0d 3f ab 3d e9 d7 |.....k.f..?.=.. 0530 63 e3 be 5e d3 53 0b c3 87 56 9d 6b 7a 02 09 bf c..^.S...V.kz... 0540 5d 09 4e 31 b0 96 76 78 9f a8 fd c8 9f 0c 1a b6 ].N1..vx........ 0550 31 82 cd 7c 60 af 21 29 d0 a8 b9 70 93 9f ae 8c 1..|`.!)...p.... 0560 36 9d 97 00 09 10 e6 f5 1f f4 35 78 9c 05 14 a9 6.........5x.... 0570 92 f1 1d 5a 55 3e f4 90 1f e1 bf c9 a1 b2 90 e1 ...ZU>.......... 0580 81 6f 38 c0 0b f4 56 a6 72 cd 0d 31 d1 4d 01 58 .o8...V.r..1.M.X 0590 9f b3 cc b7 21 4c 3b 0d 36 f9 43 20 be 02 7d 78 ....!L;.6.C ..}x 05a0 62 00 ff 9f b4 9f 97 d1 5f c4 ff 2f e7 47 a4 6f b......._../.G.o 05b0 7a 01 a2 10 z... No. Time Source Destination Protocol Info 2759 820.380561 soth1 zen1 TCP [TCP Retransmission] 1677 > 4605 [ACK] Seq=24081 Ack=4559 Win=7234 Len=1460 Frame 2759 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:43:49.139065000 Time delta from previous packet: 0.000120000 seconds Time since reference or first frame: 820.380561000 seconds Frame Number: 2759 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xf052 (61522) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x8085 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 24081, Ack: 4559, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 24081 (relative sequence number) Next sequence number: 25541 (relative sequence number) Acknowledgement number: 4559 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7234 Checksum: 0xf4c4 [correct] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 0.446989000 seconds RTO based on delta from frame: 2751 Data (1460 bytes) 0000 d3 03 3c ac c8 63 d6 a0 4d 1c bd 14 23 64 de f2 ..<..c..M...#d.. 0010 d7 99 47 2f 9b 99 c5 90 a9 df 86 c0 a8 3b 5f 4c ..G/.........;_L 0020 29 1d e5 72 8e 9f 8c 44 f2 7f 72 1b 5a 90 8f e7 )..r...D..r.Z... 0030 08 7a 18 35 ad 5a ea 05 7c 1a 53 8e cb ef 0a 53 .z.5.Z..|.S....S 0040 eb 2c a9 7f f6 e9 05 a3 04 01 6d c0 c8 76 f7 84 .,........m..v.. 0050 d3 ec d8 5a 6b 24 72 86 a5 41 88 d8 7d 24 36 57 ...Zk$r..A..}$6W 0060 b5 82 0d d0 3a e9 e5 38 80 fc 06 66 a3 79 03 f2 ....:..8...f.y.. 0070 12 6e 97 3c 8b 05 5e 6a aa 36 3b c3 bd b0 1f e6 .n.<..^j.6;..... 0080 d1 1d 01 c5 7c 97 e0 da 96 01 7d 07 72 00 16 24 ....|.....}.r..$ 0090 35 31 2b 40 57 9d 88 44 52 f0 d5 18 7a 00 7c 23 51+@W..DR...z.|# 00a0 73 f4 bd 62 4e 97 be 0f 9f 4e 1e a0 75 03 70 4b s..bN....N..u.pK 00b0 2d 39 66 9a e0 ce ef 4c b7 4d ab 09 8f b1 c6 6b -9f....L.M.....k 00c0 df 1b 15 c5 b1 97 27 83 6a 01 91 7c e8 c7 96 f3 ......'.j..|.... 00d0 92 4b 16 bf 9e 57 7b 19 f3 1d 9d c6 56 7b 29 8b .K...W{.....V{). 00e0 05 a5 da 73 bb 89 37 c6 7b e0 46 66 85 81 02 4b ...s..7.{.Ff...K 00f0 13 78 9d cc f1 3b 7d 44 46 eb 4a a1 a2 03 e5 91 .x...;}DF.J..... 0100 26 9b 45 9c 18 5e 21 f9 f1 85 f1 e8 ba c6 4b d2 &.E..^!.......K. 0110 aa 58 a7 45 25 ac 0b 3b eb 1e e1 03 4d 3a 7e 84 .X.E%..;....M:~. 0120 96 34 3e 81 38 c9 36 74 fb 9f 0e c6 ca 2b 1c 63 .4>.8.6t.....+.c 0130 bc 71 2d 4f 12 61 52 6b 27 8a 10 91 cd bf e5 a6 .q-O.aRk'....... 0140 ef 36 29 11 15 38 eb 4b 48 58 86 e0 4f 2f a2 07 .6)..8.KHX..O/.. 0150 ea d4 75 0e 73 ca b7 76 db b2 5a 64 bf 63 0d 22 ..u.s..v..Zd.c." 0160 60 22 d8 fa 37 84 0d 44 00 fa 5d 9b 05 9c 69 f1 `"..7..D..]...i. 0170 b2 64 61 af 5b c4 7a 9b aa 36 6c a5 a3 1c 99 03 .da.[.z..6l..... 0180 45 26 89 fd 66 60 07 bb b7 75 21 f2 2b 16 90 70 E&..f`...u!.+..p 0190 8a 6e c1 d1 de 4c 9d fb 5d d1 e3 27 6c 37 7e aa .n...L..]..'l7~. 01a0 b7 6c c9 49 ce ec 05 a4 d2 f8 7c 0e 5f cb c1 73 .l.I......|._..s 01b0 39 16 53 25 48 bc f5 20 a4 b1 6e 79 76 3b 56 8a 9.S%H.. ..nyv;V. 01c0 dd 66 4d 26 c0 59 06 f9 57 b4 52 18 89 a6 c5 5b .fM&.Y..W.R....[ 01d0 d0 40 f5 9e f5 72 6c b4 b9 8b 62 63 be 64 50 65 .@...rl...bc.dPe 01e0 e8 61 ef 65 63 02 ac 54 61 92 0d 27 dc c8 99 52 .a.ec..Ta..'...R 01f0 0e 6a e9 49 fe 66 00 b2 e4 56 96 8c 61 f9 2d ea .j.I.f...V..a.-. 0200 b5 fb 7d f0 4e e2 62 1e 0d 0d be 7d 07 c5 95 d9 ..}.N.b....}.... 0210 f6 80 37 bc 96 67 6d 06 69 9c 04 5f b5 00 2f ea ..7..gm.i.._../. 0220 60 2c df 27 8e 51 c5 aa b9 2d 6e a6 7e 7b 53 1f `,.'.Q...-n.~{S. 0230 0f 6b 7a ad ca 0a 26 66 15 3d 96 95 4b cc a0 e2 .kz...&f.=..K... 0240 8e cb 6a 9a 11 cd d3 50 aa df 12 9a 57 e5 b4 45 ..j....P....W..E 0250 2c a0 ef 26 56 8a 7d f5 9a 6a 30 49 42 92 15 28 ,..&V.}..j0IB..( 0260 d4 5c 25 92 ec 04 28 89 3a b9 20 ef 9f 7c dc 8c .\%...(.:. ..|.. 0270 20 c7 82 84 2e 3f f5 16 69 ae a1 a0 b7 ee a1 d2 ....?..i....... 0280 8c fd 4d 18 65 78 53 41 c1 81 41 61 29 87 63 7a ..M.exSA..Aa).cz 0290 11 98 43 4a e9 28 e8 8a b1 4d f5 ae 95 51 83 fd ..CJ.(...M...Q.. 02a0 99 1f b1 77 4b bb b1 6d 61 fc 2e b3 11 80 06 e8 ...wK..ma....... 02b0 bd 25 85 a5 ab 0f 93 88 05 4a 9a 65 05 2e 2c 78 .%.......J.e..,x 02c0 15 d1 5a 10 22 64 e5 08 01 bb a7 99 33 e9 c4 e5 ..Z."d......3... 02d0 fc e7 10 c6 7b 3f fd 4f fd f0 3c 08 01 4c 65 e1 ....{?.O..<..Le. 02e0 b0 ac ab cc 27 af f2 86 27 ed 66 2d 17 c6 d5 33 ....'...'.f-...3 02f0 ba 67 d7 62 f6 49 dd 44 fb 42 1f eb b3 e5 01 7f .g.b.I.D.B...... 0300 85 4e 79 a2 92 bc 3f 8a bf a9 45 42 ef 71 41 b9 .Ny...?...EB.qA. 0310 a5 45 e3 75 15 36 5e 34 7d 2e dc b8 61 35 44 6c .E.u.6^4}...a5Dl 0320 c1 55 8f d5 53 08 9c 03 73 f2 d8 87 bd bf 60 62 .U..S...s.....`b 0330 13 03 25 a7 62 ed 32 45 b5 ba 10 c5 99 6d f0 4e ..%.b.2E.....m.N 0340 59 8c ed 94 e3 59 53 ae db ae e0 7a ac fa 30 ef Y....YS....z..0. 0350 a5 39 25 be a0 d3 4c c9 98 07 ce 2c 99 ad a6 99 .9%...L....,.... 0360 26 6d cf 73 3b 62 e6 0b 30 8a 75 02 fc bb 76 3c &m.s;b..0.u...v< 0370 97 83 d7 72 da 51 76 45 da 64 30 7e bf df ab 8b ...r.QvE.d0~.... 0380 8b 5a 76 91 65 c8 5d 75 32 12 82 e8 b8 ca 63 64 .Zv.e.]u2.....cd 0390 10 d7 77 41 45 1b ae db 44 ee 79 59 a8 66 05 e9 ..wAE...D.yY.f.. 03a0 b4 16 a5 d1 6d 27 dc bd 3c 13 82 8e 09 39 7c d0 ....m'..<....9|. 03b0 b8 e0 1b 37 6b 77 24 d6 10 52 49 14 f5 0a 86 06 ...7kw$..RI..... 03c0 33 0a 48 f5 07 a3 61 cd 50 71 0f e3 a9 92 1a eb 3.H...a.Pq...... 03d0 55 44 c3 ab fd 43 d2 38 5b 26 7b 29 ad 8b 33 6f UD...C.8[&{)..3o 03e0 46 08 dc f9 f7 1f 15 7f 36 11 40 16 51 0e 33 51 F.......6.@.Q.3Q 03f0 ce 88 df 70 50 b9 8c a0 bd 47 fc 52 89 a4 3e a8 ...pP....G.R..>. 0400 ab ca c1 cb 68 95 16 64 9d 04 01 be 59 dc 58 8e ....h..d....Y.X. 0410 6f 2f 17 2b da 23 3b a5 3c 57 32 94 e4 a1 ef 93 o/.+.#;. 1677 [ACK] Seq=4559 Ack=25541 Win=17520 Len=0 SLE=34301 SRE=35761 SLE=29921 SRE=32841 Frame 2760 (74 bytes on wire, 74 bytes captured) Arrival Time: Nov 11, 2005 16:43:49.139082000 Time delta from previous packet: 0.000017000 seconds Time since reference or first frame: 820.380578000 seconds Frame Number: 2760 Packet Length: 74 bytes Capture Length: 74 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 60 Identification: 0x41d6 (16854) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x34a2] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 4559, Ack: 25541, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 4559 (relative sequence number) Acknowledgement number: 25541 (relative ack number) Header length: 40 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0xd7cb [correct] Options: (20 bytes) NOP NOP SACK: 34301-35761 29921-32841 left edge = 34301 (relative) right edge = 35761 (relative) left edge = 29921 (relative) right edge = 32841 (relative) No. Time Source Destination Protocol Info 2761 820.380680 soth1 zen1 TCP [TCP Retransmission] 1677 > 4605 [ACK] Seq=25541 Ack=4559 Win=7234 Len=1460 Frame 2761 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:43:49.139184000 Time delta from previous packet: 0.000102000 seconds Time since reference or first frame: 820.380680000 seconds Frame Number: 2761 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xf152 (61778) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x7f85 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 25541, Ack: 4559, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 25541 (relative sequence number) Next sequence number: 27001 (relative sequence number) Acknowledgement number: 4559 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7234 Checksum: 0x8c05 [correct] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 0.447108000 seconds RTO based on delta from frame: 2751 Data (1460 bytes) 0000 1f c5 9c 76 19 84 17 0c 23 c0 68 56 22 23 52 83 ...v....#.hV"#R. 0010 ce 0c a7 6e fa fc 69 cd 3b b2 1c 35 14 23 35 2b ...n..i.;..5.#5+ 0020 7b bc 4e a5 7b 64 0c a1 23 08 5b 71 ff 12 f2 c1 {.N.{d..#.[q.... 0030 10 ba 02 b9 41 fe bf a7 81 d5 82 e6 9a 6b 44 b2 ....A........kD. 0040 0f 36 f2 48 e7 6d de 86 48 90 ca 64 0a 67 e0 e6 .6.H.m..H..d.g.. 0050 e8 87 59 55 fd 29 7e 78 d7 cb e3 9c ab 2a 3f a6 ..YU.)~x.....*?. 0060 0a ac 9c b3 be c5 02 89 26 91 85 ac db ab 4a dd ........&.....J. 0070 ff 39 f1 f8 cd 0e 24 80 da 6a 7d 45 d2 71 65 ad .9....$..j}E.qe. 0080 7f 57 88 ba 26 2e bc ef e8 2a b4 fe 0e 00 00 80 .W..&....*...... 0090 10 21 70 d9 7b 81 0f e8 4b 47 e6 43 6c 04 70 1d .!p.{...KG.Cl.p. 00a0 0c 0c dd 91 95 ad 87 57 10 f1 2f 44 8b 74 29 2e .......W../D.t). 00b0 ec 1d 04 fb 5e 02 b6 29 31 32 e3 42 7f 34 07 5d ....^..)12.B.4.] 00c0 5f 84 1e c0 85 7f 99 f1 d9 fd 8c 66 7f 79 35 d6 _..........f.y5. 00d0 e1 94 9c 93 97 58 e2 0b d2 b2 1a 0f 6f 17 67 14 .....X......o.g. 00e0 01 f6 71 ec 8a 6b 99 fa 86 4e cd 6f 28 e4 4d 7c ..q..k...N.o(.M| 00f0 2a 90 e7 f3 e7 66 16 f3 c2 82 33 4d fe a8 cb 36 *....f....3M...6 0100 d7 82 0d f7 59 b3 89 b9 d4 38 d4 18 b4 34 65 31 ....Y....8...4e1 0110 e6 9e ca 52 db bb 52 13 a1 32 02 4f a9 57 c6 a9 ...R..R..2.O.W.. 0120 9d 08 30 f9 95 1a e9 97 40 4c dc 85 57 15 ed 42 ..0.....@L..W..B 0130 66 a6 88 cf a5 df ac d0 a0 b9 eb 67 ce 1a 0b 3b f..........g...; 0140 aa 4e 15 a0 c7 6b e4 ec c5 04 30 b7 d8 47 2d 88 .N...k....0..G-. 0150 87 fb ca 12 11 6c 13 f8 b2 f2 e1 eb ef 2f 98 dc .....l......./.. 0160 b4 84 7f 54 b2 62 b7 da 4a 6f a0 4b 0f 05 84 16 ...T.b..Jo.K.... 0170 56 d6 84 da 2f c7 05 30 6a d0 f0 c2 73 12 36 3b V.../..0j...s.6; 0180 cd a6 8f b2 f9 51 cd fc f4 4d 03 aa db 0c f7 14 .....Q...M...... 0190 d7 dc 7a 41 8a c2 58 21 9b 2a 6a 4f 5f 98 f6 a5 ..zA..X!.*jO_... 01a0 8f b5 dd e8 80 63 c9 81 1c 4c 58 ed f9 34 9e 51 .....c...LX..4.Q 01b0 31 0c a4 64 18 3e a6 e4 fe a7 95 ac e7 b7 c1 5d 1..d.>.........] 01c0 d1 1f 5a 45 04 cc cb 2a fc 8e 2e a4 67 3e ed eb ..ZE...*....g>.. 01d0 43 64 fc b3 58 9a b2 df 0b 3e 8c 41 6f 39 a7 09 Cd..X....>.Ao9.. 01e0 e4 ac 71 88 bd e1 99 ce 90 c2 16 ef be f4 69 b7 ..q...........i. 01f0 6b 82 c2 27 97 46 a7 b8 17 57 ee 23 dd 18 d5 4c k..'.F...W.#...L 0200 ac 20 c0 3e 1e 6b af 23 ba 8e a4 94 ce b1 95 cd . .>.k.#........ 0210 dd b8 7f 12 2d cb 32 6e 3a 4c 84 b3 cf 10 99 67 ....-.2n:L.....g 0220 87 c0 1a 3c c1 09 f9 87 99 4c f3 99 29 a5 98 a5 ...<.....L..)... 0230 c0 11 61 6d c8 74 26 ff 26 0a 78 41 66 08 d3 a2 ..am.t&.&.xAf... 0240 71 47 ce ea cc 3a 1a e5 82 ce 2d bd 6e e0 97 8f qG...:....-.n... 0250 87 88 72 1d bf c5 bc b4 8b 8f 78 c3 f7 55 f1 e9 ..r.......x..U.. 0260 81 ae fd e0 48 6a b0 c1 48 ca 11 ed b7 b8 b7 f3 ....Hj..H....... 0270 04 52 02 f3 17 09 a7 8f 53 ee 09 e6 d7 c9 d8 2c .R......S......, 0280 ab 3f a4 12 05 e3 8d eb 73 30 64 e4 9c 1f e4 d1 .?......s0d..... 0290 d5 83 5e 81 13 89 a3 23 5e fd 1f d0 5f 79 38 67 ..^....#^..._y8g 02a0 34 42 85 54 8b 94 28 6b a8 c1 8f a5 56 34 6d db 4B.T..(k....V4m. 02b0 e8 e4 94 50 96 bb b3 16 9e e2 ba 31 63 b4 3e dc ...P.......1c.>. 02c0 21 b5 63 11 dd 23 3d 00 50 8e 50 a2 cf e0 89 75 !.c..#=.P.P....u 02d0 e0 48 a2 74 a9 1c ab ef 57 a0 a8 44 6a bb 65 f4 .H.t....W..Dj.e. 02e0 3c 74 39 e4 b2 20 6a 56 7e b6 5f 27 1c f6 84 73 ..{".#5x 0390 72 c9 b9 d1 8c db 63 f7 1f 76 86 d3 ca c9 3f 3f r.....c..v....?? 03a0 b0 b8 da a0 16 70 cc e7 cf de 53 51 0c 0a d6 5a .....p....SQ...Z 03b0 9e 87 60 4a 05 1d 9c f3 b7 14 81 db 11 0c c2 cd ..`J............ 03c0 0e 01 51 e1 18 70 d8 4c 5d 79 ce 40 74 85 a2 a8 ..Q..p.L]y.@t... 03d0 63 c8 e3 82 15 33 c1 f8 cb 4b 51 e5 93 b1 8a ac c....3...KQ..... 03e0 4a 63 5c 4b ed 83 23 92 27 bd 30 2c ec 6a ed 91 Jc\K..#.'.0,.j.. 03f0 81 7f 7d 97 17 77 a5 3b b0 33 02 28 50 23 6b da ..}..w.;.3.(P#k. 0400 6e bb 3f f7 95 f1 50 4a fe 7b ac 5f 37 05 8d 57 n.?...PJ.{._7..W 0410 d4 17 a7 4b dd 3e be ce f8 7b fc af 09 ec 8f 3a ...K.>...{.....: 0420 15 be f4 0a 14 0d 5f 1e 58 96 16 3f f8 1b 2d bd ......_.X..?..-. 0430 b1 64 75 cf 24 9b 98 c6 fe a4 89 bb a4 ff 7e 07 .du.$.........~. 0440 d8 80 90 9b 95 4c 29 7c e7 e2 6b 85 b5 54 79 68 .....L)|..k..Tyh 0450 8b 18 5b dd 84 3c ce 10 4a 67 60 8c ad da 9e f0 ..[..<..Jg`..... 0460 45 14 5f 68 ba 7c d7 51 aa 26 6b dc 90 c4 82 a8 E._h.|.Q.&k..... 0470 76 7b 03 9f 7a 65 04 32 27 a3 aa fb 60 06 cc 51 v{..ze.2'...`..Q 0480 11 92 8c 71 c3 b7 93 4d 4d 3e 7a ad d0 c0 e4 58 ...q...MM>z....X 0490 04 01 9d 3e 36 fb 83 84 e9 26 91 76 12 c8 3d 5e ...>6....&.v..=^ 04a0 66 ba fd 6f d7 e7 e8 1a 04 f8 0d f5 67 9d 04 57 f..o........g..W 04b0 0b d3 db 68 02 e6 a2 d3 d3 74 e6 5a c1 66 59 75 ...h.....t.Z.fYu 04c0 0e 7d 27 c6 8b 15 a6 16 b7 33 12 48 97 41 96 33 .}'......3.H.A.3 04d0 00 7e 74 a2 fd 1c 0b 68 d2 ea ee ee a3 c6 81 26 .~t....h.......& 04e0 79 8b da 1d 89 b0 5f a1 38 dd ef c4 7c de ab da y....._.8...|... 04f0 29 0b ac 4a 6c 5e 6a 09 02 9f 29 e3 91 08 9f e5 )..Jl^j...)..... 0500 6d 5d 17 e7 5b 75 48 63 89 41 a5 7e 6a 7e f6 40 m]..[uHc.A.~j~.@ 0510 13 f9 04 1a e1 75 02 d3 39 8b e0 45 80 99 c5 54 .....u..9..E...T 0520 69 d6 09 fa 75 fd 88 36 92 a7 d1 44 7c d1 2b a6 i...u..6...D|.+. 0530 51 d6 78 4f 79 33 48 da 13 0f 3a 6a 75 7f ee 6f Q.xOy3H...:ju..o 0540 a9 16 4b a8 16 36 bd a8 f5 39 b5 4d af ba 29 e0 ..K..6...9.M..). 0550 83 81 3e 99 ad 3d 81 62 47 cb 0d 2a 09 38 55 41 ..>..=.bG..*.8UA 0560 a9 84 71 d1 7d a4 8a f1 8c 73 b6 1a 22 d6 0b b4 ..q.}....s.."... 0570 45 42 af 04 c5 5d 5d b9 0f 5c e4 e9 ee 76 66 f2 EB...]]..\...vf. 0580 53 f8 4f 59 94 f2 e8 24 2e da dd a3 cb da 64 83 S.OY...$......d. 0590 17 59 6d 09 cd a0 84 67 97 f6 f9 c2 a2 12 a0 77 .Ym....g.......w 05a0 9f 67 a6 cf 94 26 c7 6b 53 23 67 6f 09 5b 5b de .g...&.kS#go.[[. 05b0 bf b5 ba b0 .... No. Time Source Destination Protocol Info 2762 820.380707 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=4559 Ack=27001 Win=17520 Len=0 SLE=34301 SRE=35761 SLE=29921 SRE=32841 Frame 2762 (74 bytes on wire, 74 bytes captured) Arrival Time: Nov 11, 2005 16:43:49.139211000 Time delta from previous packet: 0.000027000 seconds Time since reference or first frame: 820.380707000 seconds Frame Number: 2762 Packet Length: 74 bytes Capture Length: 74 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 60 Identification: 0x41d7 (16855) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x34a1] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 4559, Ack: 27001, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 4559 (relative sequence number) Acknowledgement number: 27001 (relative ack number) Header length: 40 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0xd217 [correct] Options: (20 bytes) NOP NOP SACK: 34301-35761 29921-32841 left edge = 34301 (relative) right edge = 35761 (relative) left edge = 29921 (relative) right edge = 32841 (relative) No. Time Source Destination Protocol Info 2763 820.381321 soth1 zen1 TCP [TCP Retransmission] 1677 > 4605 [ACK] Seq=31381 Ack=4559 Win=7234 Len=1460 Frame 2763 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:43:49.139825000 Time delta from previous packet: 0.000614000 seconds Time since reference or first frame: 820.381321000 seconds Frame Number: 2763 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xf552 (62802) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x7b85 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 31381, Ack: 4559, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 31381 (relative sequence number) Next sequence number: 32841 (relative sequence number) Acknowledgement number: 4559 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7234 Checksum: 0xf368 [correct] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 0.447749000 seconds RTO based on delta from frame: 2751 Data (1460 bytes) 0000 b0 08 4c bd d6 9b 5c 8a 88 58 82 a8 66 98 ce 75 ..L...\..X..f..u 0010 42 06 23 1e fe e7 53 7c 33 32 09 e0 51 ac a3 53 B.#...S|32..Q..S 0020 7a 28 77 36 ef d8 52 61 02 cd a0 9b 1e 1b 4c cc z(w6..Ra......L. 0030 49 c7 7d a4 51 39 9d 6f 35 7c 06 77 46 2f 01 1f I.}.Q9.o5|.wF/.. 0040 cb ad b9 12 b1 e8 88 a3 a2 dc 8d c2 5c ba ee 13 ............\... 0050 5d 0c f2 7a a4 ec cd c8 ac 4e 36 2a 30 61 27 d4 ]..z.....N6*0a'. 0060 05 53 cb b0 1c 38 68 fa fc ab 18 75 ac 5f e3 b8 .S...8h....u._.. 0070 09 b3 54 99 bb 30 b8 0b 37 25 13 c7 92 5c 88 db ..T..0..7%...\.. 0080 52 79 b0 56 79 61 c4 85 c7 84 25 37 df 71 04 84 Ry.Vya....%7.q.. 0090 74 99 15 04 00 c9 33 43 4f 69 02 88 25 0c 6f 5f t.....3COi..%.o_ 00a0 f7 ff 21 9f 85 4e f1 87 ca 88 ec 80 cc b3 78 c4 ..!..N........x. 00b0 79 0f 09 27 30 79 c8 32 a1 84 17 f1 9e 9d 9f 22 y..'0y.2......." 00c0 8f fe 01 14 09 14 b3 99 03 02 ee bb 9e 9d 9c a1 ................ 00d0 0b 0c 76 83 a7 6b a0 92 db 13 2e 53 77 f3 17 69 ..v..k.....Sw..i 00e0 a3 02 fc f8 32 10 aa 1c ea 75 f0 d8 71 d1 59 f5 ....2....u..q.Y. 00f0 2e 35 e6 59 ed 16 db 1e 4c fc e7 17 bc 81 a3 0a .5.Y....L....... 0100 dd b7 2b 68 2d e5 bd 16 ee e4 c3 bc 6e 64 fc ad ..+h-.......nd.. 0110 65 89 f1 aa d0 0f 0f 60 34 8d a9 20 e2 04 c8 54 e......`4.. ...T 0120 4e df d1 af 72 10 29 ea 8c ab 9a fe 1e 62 d4 62 N...r.)......b.b 0130 7f 33 b9 b8 6e 10 2c 74 d9 36 e0 25 71 6c 54 27 .3..n.,t.6.%qlT' 0140 8b 6b 90 a8 37 d3 e2 4c c4 bc 8b be b9 b0 12 ad .k..7..L........ 0150 4d 4d 3b 9e 23 df cd da 68 63 fc 2f 27 f3 b9 ca MM;.#...hc./'... 0160 d2 7e 07 23 ae c4 96 1e a1 dc 05 6d 56 22 c1 a3 .~.#.......mV".. 0170 3e d3 70 9f 81 31 5a 69 d8 ea 0f e6 13 d5 44 4b >.p..1Zi......DK 0180 d2 5b 9e b3 d0 06 fa b5 ba d1 bc 5b 93 5e 05 63 .[.........[.^.c 0190 ca 99 a5 0b de 51 c7 f3 2b 1a be 41 51 cc d8 a4 .....Q..+..AQ... 01a0 51 64 ec 63 82 a2 1d eb b0 fd 20 65 bd 38 5a e5 Qd.c...... e.8Z. 01b0 94 9a f7 9d 48 75 f9 fe 29 1a 8d 73 4b 7a e0 0f ....Hu..)..sKz.. 01c0 a0 65 b0 23 90 46 9a fa 0e b5 a4 1d 6c ed c7 b0 .e.#.F......l... 01d0 f9 33 f5 dd 64 dd f8 98 3a 99 ba b1 79 6c 3e d2 .3..d...:...yl>. 01e0 49 66 cf fd 00 c9 4f 8f 25 47 94 80 42 e4 7f b0 If....O.%G..B... 01f0 8d 8e f1 42 b7 61 85 93 a6 69 11 cb 19 27 f3 09 ...B.a...i...'.. 0200 48 ef 50 27 ed 5b fb d8 c5 06 09 4b 98 f2 c0 0e H.P'.[.....K.... 0210 b4 29 33 af 91 ed 5c b3 c4 98 b0 b7 bd 6c f7 be .)3...\......l.. 0220 73 42 ff 78 8f 6d 92 e7 44 9d 62 4e d9 dd 4f 3e sB.x.m..D.bN..O> 0230 3b 3e 77 68 de fd 32 8c 9d ad 92 59 06 f2 0a f5 ;>wh..2....Y.... 0240 f8 06 65 aa 00 ad 28 fe 5f 65 65 f1 fe 47 22 6d ..e...(._ee..G"m 0250 12 4a b5 33 94 a8 0d f2 c4 70 37 a3 4e 20 f7 f5 .J.3.....p7.N .. 0260 ff b0 8e fc ee f6 a5 14 cb 07 ae eb d6 e4 e5 b3 ................ 0270 db c6 63 9f 79 27 70 7b 76 dc 05 c5 23 d9 9b cd ..c.y'p{v...#... 0280 14 0d d9 c1 09 2b f7 7c d3 d7 fd fd 3d 24 c9 7e .....+.|....=$.~ 0290 a7 cd 75 d3 38 5f 1d 43 d3 bd b1 86 72 35 32 b8 ..u.8_.C....r52. 02a0 d1 81 fd 12 81 74 96 20 37 11 6f 20 8e 88 04 65 .....t. 7.o ...e 02b0 c4 8a 73 01 f3 25 2f cf 46 e7 2a cd 29 93 e9 f9 ..s..%/.F.*.)... 02c0 33 20 ed 61 fb eb 1f 51 5f de 26 ba 63 a5 6b 5f 3 .a...Q_.&.c.k_ 02d0 1c de 75 3a 0a dc c3 86 b8 f9 48 e4 35 e1 12 4b ..u:......H.5..K 02e0 b2 bb 67 20 01 de 84 00 65 fb 7b 79 9f 81 5f fb ..g ....e.{y.._. 02f0 0d 25 90 e7 6d a0 6f 68 c5 dc 95 bf 3e 87 0b 30 .%..m.oh....>..0 0300 59 eb 66 a5 7f bc 30 85 27 85 4f 5e 7e a0 f0 1c Y.f...0.'.O^~... 0310 9b ed 3b c4 db 1c 40 74 6f b0 9d 93 bf c9 a6 cb ..;...@to....... 0320 17 6b 42 eb 16 c5 e9 1c cc 2e 05 63 d3 0a e7 4d .kB........c...M 0330 95 5b 7d a7 6c 6b 00 79 4d 44 15 e4 d3 40 24 90 .[}.lk.yMD...@$. 0340 dd 45 0c fe b0 29 b7 85 76 db ac 03 94 c6 94 f6 .E...)..v....... 0350 93 d5 3e f7 f9 43 49 bc 11 5b c6 0e 56 66 15 31 ..>..CI..[..Vf.1 0360 39 b6 67 46 ab d7 0a d7 fc 84 43 3a e7 a7 1f 65 9.gF......C:...e 0370 40 ed 0d 46 83 09 85 34 98 79 65 50 63 9d 34 93 @..F...4.yePc.4. 0380 0d 33 35 73 69 10 1c 89 11 17 65 63 33 98 da 12 .35si.....ec3... 0390 d9 45 56 50 76 15 49 11 5f 9c 8c 2a 90 20 89 8f .EVPv.I._..*. .. 03a0 4d ba 03 d7 32 9c 47 e6 c9 18 a2 c5 60 5c 0f 4e M...2.G.....`\.N 03b0 f0 b7 58 f9 cf 21 70 42 db 38 f2 b0 b2 1e 4a a8 ..X..!pB.8....J. 03c0 e4 a6 90 4d 3b 5e fc a4 c2 cf a3 53 75 53 1e 92 ...M;^.....SuS.. 03d0 5e be 3a 66 a6 4d 81 4b 13 79 8a f9 6d cb aa f0 ^.:f.M.K.y..m... 03e0 01 e8 3a f6 52 6c 12 4e 03 7e 71 f2 ba 92 81 73 ..:.Rl.N.~q....s 03f0 f6 f7 d1 da e0 48 a1 89 70 55 f4 5a 5c 86 32 29 .....H..pU.Z\.2) 0400 50 07 f7 46 be 79 36 02 45 8d dc 3a 23 52 18 69 P..F.y6.E..:#R.i 0410 37 98 8e f6 21 4a 73 df 6c 44 99 da b3 ab a0 91 7...!Js.lD...... 0420 29 30 49 9f ee 3d 4b b9 18 3a c9 56 74 c4 9f fd )0I..=K..:.Vt... 0430 f4 86 49 2a e3 a7 4a 0d 07 33 39 2c d5 67 1a e1 ..I*..J..39,.g.. 0440 e1 06 67 5d 74 5d 4e b3 ab 91 25 2e c8 2e cc b6 ..g]t]N...%..... 0450 f0 ed 4a d6 75 fc e0 b3 bb ca bc 22 90 a7 30 3a ..J.u......"..0: 0460 c1 68 80 9f 72 12 59 e9 fc 8d 64 bc 5a 9c 55 a6 .h..r.Y...d.Z.U. 0470 92 db be f2 8c 1d 0d dc 19 ac 6e e8 57 37 a5 10 ..........n.W7.. 0480 27 33 b8 e2 f8 d2 5b b7 bd 06 1a 1b 20 b2 05 11 '3....[..... ... 0490 99 96 f4 ba 1c 39 7e c2 2d c2 7b 47 63 a3 f3 2d .....9~.-.{Gc..- 04a0 6a 3e 3f 2f ad 7f 7d f2 51 2c d1 66 97 29 b4 4f j>?/..}.Q,.f.).O 04b0 97 57 83 11 a7 f3 d0 c3 35 81 f5 f3 37 73 a2 ff .W......5...7s.. 04c0 5d 2e b7 99 cb f6 ab a8 81 3b a6 44 ba 34 7c c9 ]........;.D.4|. 04d0 d3 60 8a e6 f3 4c 81 40 fa 3a 48 bd 2f ec 80 1a .`...L.@.:H./... 04e0 85 13 66 24 89 f4 a9 10 80 f5 8e f3 36 30 e5 be ..f$........60.. 04f0 c7 94 5c 57 c7 b5 bb a1 8f f5 61 73 f1 19 b3 2d ..\W......as...- 0500 ea 89 da 0e d7 ab 48 9e c5 f3 f3 ac e7 53 98 4f ......H......S.O 0510 11 7c d5 86 ed e7 b8 e6 ee a1 9d 4e 0d f7 ae 10 .|.........N.... 0520 6a b3 8f aa 91 69 79 2a 7e 90 46 7f 0a af 59 91 j....iy*~.F...Y. 0530 90 f8 b4 9b 97 fb dd c9 46 e5 75 f9 e1 89 96 c4 ........F.u..... 0540 ba ec 21 1e b5 5a 51 a9 64 3c 3b 9a 3d f4 e0 7c ..!..ZQ.d<;.=..| 0550 10 55 d4 14 7a 08 cf b1 16 81 38 6d a7 48 6c f7 .U..z.....8m.Hl. 0560 a8 f0 c5 94 4a 5d 33 37 39 1f 7e fd 0d 9c 12 8c ....J]379.~..... 0570 2c 23 ce 6a f1 28 fb e0 61 12 b5 01 2d 27 0a fe ,#.j.(..a...-'.. 0580 7b c2 b6 f3 9a 84 ec f0 ab 52 e1 80 bc 71 87 4f {........R...q.O 0590 46 a3 30 15 0b c8 48 bc 39 89 99 af a7 74 7f c6 F.0...H.9....t.. 05a0 90 2f 7b 02 35 07 ee 92 9d 56 44 9f 79 cc 43 f1 ./{.5....VD.y.C. 05b0 69 7b 82 11 i{.. No. Time Source Destination Protocol Info 2764 820.381346 zen1 soth1 TCP [TCP Dup ACK 2762#1] 4605 > 1677 [ACK] Seq=4559 Ack=27001 Win=17520 Len=0 SLE=29921 SRE=32841 SLE=34301 SRE=35761 SLE=29921 SRE=32841 Frame 2764 (82 bytes on wire, 82 bytes captured) Arrival Time: Nov 11, 2005 16:43:49.139850000 Time delta from previous packet: 0.000025000 seconds Time since reference or first frame: 820.381346000 seconds Frame Number: 2764 Packet Length: 82 bytes Capture Length: 82 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 68 Identification: 0x41d8 (16856) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3498] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 4559, Ack: 27001, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 4559 (relative sequence number) Acknowledgement number: 27001 (relative ack number) Header length: 48 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x6507 [correct] Options: (28 bytes) NOP NOP SACK: 29921-32841 34301-35761 29921-32841 left edge = 29921 (relative) right edge = 32841 (relative) left edge = 34301 (relative) right edge = 35761 (relative) left edge = 29921 (relative) right edge = 32841 (relative) SEQ/ACK analysis TCP Analysis Flags This is a TCP duplicate ack Duplicate ACK #: 1 Duplicate to the ACK in frame: 2762 No. Time Source Destination Protocol Info 2765 820.381441 soth1 zen1 TCP [TCP Retransmission] 1677 > 4605 [ACK] Seq=32841 Ack=4559 Win=7234 Len=1460 Frame 2765 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:43:49.139945000 Time delta from previous packet: 0.000095000 seconds Time since reference or first frame: 820.381441000 seconds Frame Number: 2765 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xf652 (63058) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x7a85 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 32841, Ack: 4559, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 32841 (relative sequence number) Next sequence number: 34301 (relative sequence number) Acknowledgement number: 4559 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7234 Checksum: 0xe153 [correct] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 0.447869000 seconds RTO based on delta from frame: 2751 Data (1460 bytes) 0000 75 3e 86 ab 09 60 89 58 54 82 c3 d4 9a 20 36 c1 u>...`.XT.... 6. 0010 05 fd 3a 35 be e8 e0 02 1c af b3 a8 08 f0 6b 6f ..:5..........ko 0020 45 67 84 e6 8b f0 98 b8 85 d2 cb fd fd 19 f7 c1 Eg.............. 0030 53 a7 ce d2 c2 55 34 de 8f 78 78 7f 04 55 68 32 S....U4..xx..Uh2 0040 86 2d 44 0e 55 28 6c ff f9 b6 6a 1e 28 32 54 19 .-D.U(l...j.(2T. 0050 16 a3 51 7d 27 e4 47 97 6b 3b 14 41 1b e2 17 d1 ..Q}'.G.k;.A.... 0060 45 7e eb 15 7c b3 eb 75 39 02 67 a6 e5 97 83 45 E~..|..u9.g....E 0070 33 7d 26 d7 a1 01 88 5e 76 e6 14 36 ca c3 4c 7d 3}&....^v..6..L} 0080 56 fb 11 70 14 d1 5d 89 5f dc 35 4f 5d d3 43 c0 V..p..]._.5O].C. 0090 f8 1e 52 cf a8 4c 6d d5 57 ba 31 f4 40 48 8e 8e ..R..Lm.W.1.@H.. 00a0 77 7f 86 9d e2 09 49 54 6f f9 5b be a4 34 8a 0e w.....ITo.[..4.. 00b0 89 76 bd 0f 59 3b 8f 51 5c 2c 07 b0 6e a5 0e 45 .v..Y;.Q\,..n..E 00c0 2d b2 79 3b 3f 03 3a b1 5a b1 57 72 ab ef 88 6a -.y;?.:.Z.Wr...j 00d0 8f 68 78 97 68 6b f1 31 46 ba c5 db d3 11 17 d4 .hx.hk.1F....... 00e0 7d 8f 20 7c 2a 5a 0b 03 b1 5d cb 08 17 66 c6 5b }. |*Z...]...f.[ 00f0 49 cd 03 8b 70 e4 06 bd eb 38 e3 89 7f b8 b9 94 I...p....8...... 0100 2a c7 e3 da 0b ad 7d d4 2d 7d 74 89 39 85 a4 05 *.....}.-}t.9... 0110 a6 d5 2f c8 cf 2f a1 fe 1f 9c 5b 7c dd 43 bd c0 ../../....[|.C.. 0120 a4 16 41 ce 68 a8 38 04 ad ab a5 b2 fb ba 69 9e ..A.h.8.......i. 0130 1c a0 d7 aa ef f1 66 45 99 fc 64 28 95 b2 e3 a0 ......fE..d(.... 0140 8b 4b 88 17 82 2a ed b8 17 46 c3 7b a5 3f e6 a7 .K...*...F.{.?.. 0150 9b dc c2 10 d7 53 f7 a5 a7 66 43 ce 3c 4f d1 03 .....S...fC....Xr..Q.r.m 0270 55 5d d5 3f a5 aa 1d 40 41 db 42 b5 13 14 4f e1 U].?...@A.B...O. 0280 99 15 74 7d 5b 7a ef 0c 7b 1d de 45 44 45 50 83 ..t}[z..{..EDEP. 0290 76 66 d3 2e 2c 90 48 c6 ee 78 bd ab 29 eb d4 bf vf..,.H..x..)... 02a0 ca 81 43 25 4b 76 52 b0 2c 2c ea 16 fa 34 fc 92 ..C%KvR.,,...4.. 02b0 8d a2 57 77 70 33 27 fd 96 9a cc aa 33 08 14 dc ..Wwp3'.....3... 02c0 31 a9 b3 c9 e7 a5 c5 60 9b 6d 6e d8 09 23 1d 2f 1......`.mn..#./ 02d0 89 be 05 d1 9f fa 46 16 db 24 33 94 a2 d7 43 18 ......F..$3...C. 02e0 85 a2 fa 06 f9 ac 0a 2e 20 e8 ba f8 d7 1c 37 9f ........ .....7. 02f0 fa 56 7e 71 df d3 26 7c b1 f3 7b 64 a9 c9 f6 64 .V~q..&|..{d...d 0300 a3 0e 88 8c 48 dd c0 64 68 34 36 c0 15 16 1d 0e ....H..dh46..... 0310 55 c6 5d 15 17 53 fb eb a9 5f f3 02 aa e5 ae bd U.]..S..._...... 0320 4e b2 1a 32 63 19 ce 0d da eb be 33 8e c2 4d bb N..2c......3..M. 0330 45 e1 25 5c 82 a6 25 31 a9 7c 40 b2 7a 54 0e 26 E.%\..%1.|@.zT.& 0340 fe 2c 34 1c 01 c7 da 0c 51 a9 4b b1 12 3e 2e e8 .,4.....Q.K..>.. 0350 6b c0 fc 7c 62 bf 99 a4 a0 99 cb 6d d9 d7 f9 db k..|b......m.... 0360 68 3e 90 95 1e 35 e7 6a 3d fb 7b 23 57 15 77 99 h>...5.j=.{#W.w. 0370 30 dc 56 03 5a 7a 0e 58 33 ed c9 b0 3e 80 91 57 0.V.Zz.X3...>..W 0380 cb be d4 55 a5 7a 49 0a a3 d6 57 bc 0a 0f 35 1e ...U.zI...W...5. 0390 e5 6e f9 91 84 1b f1 7e 76 96 84 f6 34 cf bc 82 .n.....~v...4... 03a0 b8 2a 55 8a d5 46 a0 34 b6 ef e3 24 38 01 c6 50 .*U..F.4...$8..P 03b0 bc 6a fe c1 0a 5f 6b 6d 66 d8 8b 09 45 9d 09 9d .j..._kmf...E... 03c0 b4 d7 85 ae e4 3e a9 ba ef 8c 11 54 e6 f2 f2 27 .....>.....T...' 03d0 bc ee 76 b3 1a 03 72 69 21 49 f7 d0 5d 9f 2a 10 ..v...ri!I..].*. 03e0 93 f8 3f d3 21 af db 18 50 ce a4 69 41 bc ac 22 ..?.!...P..iA.." 03f0 e1 e2 c0 23 c7 fc 41 c1 96 76 cf ff 15 3b ff 8e ...#..A..v...;.. 0400 15 4a c9 2e d5 43 d0 0a 60 4c f8 33 ab 10 86 14 .J...C..`L.3.... 0410 d8 e4 5b fc ba b8 93 f8 40 99 06 9e 43 77 72 6e ..[.....@...Cwrn 0420 08 3b 5b 17 b0 d3 12 a2 ac b8 41 c9 61 2d 5d 35 .;[.......A.a-]5 0430 0a 23 0a 4b d3 2e 01 21 a8 12 44 d9 7f 4e 53 12 .#.K...!..D..NS. 0440 ad 29 98 c0 3b fb cf d7 0b 1c db d5 ef 2b c7 86 .)..;........+.. 0450 d1 de 57 d7 36 5d 2d 6a b7 a3 8c 0f 04 1a 47 b6 ..W.6]-j......G. 0460 cc 56 c5 fa 15 cd 58 d9 87 db 10 85 a9 30 e5 3d .V....X......0.= 0470 56 34 88 75 9e 03 ff 42 eb 7c 0b a2 3e 9e 58 de V4.u...B.|..>.X. 0480 d9 4a 55 db df 2c fd 93 aa a0 ff e5 5d f4 d4 58 .JU..,......]..X 0490 3a 94 f7 5a db 00 e2 5f 21 1d 4d 05 4c a1 9f 1f :..Z..._!.M.L... 04a0 5d 6e c4 9a d3 58 d9 6c cd 9a 23 28 c0 17 51 7c ]n...X.l..#(..Q| 04b0 83 6b 5a 51 87 6a 2d 08 99 68 61 14 0b 0c 28 1b .kZQ.j-..ha...(. 04c0 cd 9a c0 cd c8 b2 33 6f c1 33 3c 58 7d 2d 9b 0b ......3o.3....9... 0550 9f a7 32 72 18 7e 26 5e a3 c6 4e e6 65 5e 04 69 ..2r.~&^..N.e^.i 0560 97 9a 17 01 a4 d5 cb 37 6d 1a 56 2f 28 f9 f6 e4 .......7m.V/(... 0570 d1 ee be 18 15 2c 1f 42 fa 1d f5 47 11 3c 75 41 .....,.B...G. 1677 [ACK] Seq=4559 Ack=27001 Win=17520 Len=0 SLE=29921 SRE=34301 SLE=34301 SRE=35761 Frame 2766 (74 bytes on wire, 74 bytes captured) Arrival Time: Nov 11, 2005 16:43:49.139971000 Time delta from previous packet: 0.000026000 seconds Time since reference or first frame: 820.381467000 seconds Frame Number: 2766 Packet Length: 74 bytes Capture Length: 74 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 60 Identification: 0x41d9 (16857) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x349f] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 4559, Ack: 27001, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 4559 (relative sequence number) Acknowledgement number: 27001 (relative ack number) Header length: 40 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0xcc63 [correct] Options: (20 bytes) NOP NOP SACK: 29921-34301 34301-35761 left edge = 29921 (relative) right edge = 34301 (relative) left edge = 34301 (relative) right edge = 35761 (relative) SEQ/ACK analysis TCP Analysis Flags This is a TCP duplicate ack Duplicate ACK #: 2 Duplicate to the ACK in frame: 2762 No. Time Source Destination Protocol Info 2773 821.008980 soth1 zen1 TCP [TCP Retransmission] 1677 > 4605 [ACK] Seq=27001 Ack=4559 Win=7234 Len=1460 Frame 2773 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:43:49.767484000 Time delta from previous packet: 0.627513000 seconds Time since reference or first frame: 821.008980000 seconds Frame Number: 2773 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x8055 (32853) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xf082 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 27001, Ack: 4559, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 27001 (relative sequence number) Next sequence number: 28461 (relative sequence number) Acknowledgement number: 4559 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7234 Checksum: 0xb54b [correct] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 1.075408000 seconds RTO based on delta from frame: 2751 Data (1460 bytes) 0000 44 e5 28 63 4b f5 ad 63 e0 dd 97 97 89 31 6e c8 D.(cK..c.....1n. 0010 ba 40 27 f7 b2 9f ea b9 5e 71 bb 3b 4a 76 4c 8c .@'.....^q.;JvL. 0020 5b 7b 8b 3e 93 85 a7 bd a5 8e 99 cd d6 c7 87 55 [{.>...........U 0030 c7 82 d1 81 72 86 9b cb 01 a6 68 73 c4 7a b8 18 ....r.....hs.z.. 0040 cf 09 34 35 f2 bf fb e8 56 cc 93 fb a6 54 61 9c ..45....V....Ta. 0050 c9 94 95 f9 6b 9a 3c 82 d5 28 11 10 18 db 4c aa ....k.<..(....L. 0060 9e 86 75 34 08 76 1b c7 48 ba a4 7b ad c7 87 f9 ..u4.v..H..{.... 0070 91 fe 2d f8 ec bf 41 18 70 a4 50 ca 1e 24 ff 6a ..-...A.p.P..$.j 0080 0d 57 1a 13 40 6e 98 74 f5 e4 fa 8a b1 be fd 7f .W..@n.t........ 0090 05 f1 ca 77 7d 67 fe bb eb 78 ac 98 2b d9 47 a6 ...w}g...x..+.G. 00a0 ed 89 6a cc 7e bf d4 3e 08 bb e7 63 aa e8 06 bc ..j.~..>...c.... 00b0 c8 7d ca e0 26 52 b5 89 03 03 34 de 4d 47 41 75 .}..&R....4.MGAu 00c0 fb 6c 32 fd d2 41 1c 6f ad 4b 4f 39 17 8c 4d 69 .l2..A.o.KO9..Mi 00d0 28 ba 5f 2e e8 70 c3 6a 48 68 a7 78 ce 34 f8 1f (._..p.jHh.x.4.. 00e0 80 fd 70 3e c8 26 fa 05 4e 76 70 8b d4 c4 13 63 ..p>.&..Nvp....c 00f0 c0 29 55 9b 75 a7 16 92 20 da cd e1 ed e4 59 ea .)U.u... .....Y. 0100 92 e3 df 19 03 49 99 28 86 39 95 a8 e2 4a 8c 10 .....I.(.9...J.. 0110 7a 40 80 6f 27 b5 cb 45 b6 29 97 18 17 6e 83 fd z@.o'..E.)...n.. 0120 fb c8 9d 0f c0 f1 62 28 04 ec a6 65 6a 4b b9 c8 ......b(...ejK.. 0130 24 33 84 5d 45 85 3e a3 a5 f6 8f dc 63 3d ae 36 $3.]E.>.....c=.6 0140 e9 54 14 32 2f 88 65 03 e8 20 31 36 39 91 7e 61 .T.2/.e.. 169.~a 0150 d5 6a d1 47 da b3 81 fe 33 1d 1c e5 7b 40 d2 30 .j.G....3...{@.0 0160 27 a2 3d 4f b2 45 66 b9 95 90 28 ab a9 9e fc 9f '.=O.Ef...(..... 0170 6c e1 78 2d 53 38 05 45 bb fc f4 fa 7f f3 d8 24 l.x-S8.E.......$ 0180 0c 6b 9c 5d 3e dd a7 da 12 0e eb 68 33 9d 0b c3 .k.]>......h3... 0190 97 77 03 c7 6b c5 2f 33 25 ca 59 ce 22 eb 47 79 .w..k./3%.Y.".Gy 01a0 de 59 8b 99 9f 07 1e d6 6e 9a 9b 07 ad 6d 9b d9 .Y......n....m.. 01b0 3c 57 f0 43 8e 8a e0 55 71 ea cb 52 55 a5 00 fc .."'nP 0240 1a 75 e4 ee 8c 2f e3 d9 7d 7e 17 67 a5 d5 e1 fd .u.../..}~.g.... 0250 76 38 84 0f e4 29 28 db 1d 4c 3c 17 06 8e 7e 77 v8...)(..L<...~w 0260 55 7d f1 af 5b e1 c7 be 95 01 e1 d7 d6 39 d8 98 U}..[........9.. 0270 2a 44 f9 a9 1f 67 ec 54 94 52 f1 95 ae 2a d5 ca *D...g.T.R...*.. 0280 76 31 65 a1 67 09 65 63 87 a3 04 7c 00 bd fb f2 v1e.g.ec...|.... 0290 72 b0 70 6c 22 4b 2e 83 5b da e2 73 60 bb 34 44 r.pl"K..[..s`.4D 02a0 ac be 0a 74 65 f3 15 24 66 7b 3e cc 45 17 3b 73 ...te..$f{>.E.;s 02b0 f5 37 0a 17 37 28 76 c6 5d 4b e5 fb 1b 95 8a 54 .7..7(v.]K.....T 02c0 40 e3 9a 01 b1 84 84 01 03 e6 03 e4 4d fe 55 a5 @...........M.U. 02d0 13 a6 81 d7 07 ac c8 91 01 b3 ff 23 d7 8a c4 84 ...........#.... 02e0 a7 0a c5 95 12 24 82 02 2c 3c 13 cd 8a 49 0c 68 .....$..,<...I.h 02f0 7a 43 88 f4 f0 d4 e2 a4 a3 fd 34 2a 86 76 21 19 zC........4*.v!. 0300 c3 20 85 ed 75 d2 cc c7 aa 78 94 d2 b9 53 8c 7e . ..u....x...S.~ 0310 19 77 29 18 53 4d 49 e2 f4 a9 23 7a 45 50 c8 bf .w).SMI...#zEP.. 0320 b3 8b a8 d9 97 89 d1 8f 90 00 09 4d 01 e6 54 a1 ...........M..T. 0330 bc ca 08 fe 58 0d ea 18 c9 8c db 42 3f 21 d3 9f ....X......B?!.. 0340 53 c1 f6 ad 13 3b 12 e6 c7 49 a9 70 78 08 24 da S....;...I.px.$. 0350 2d c4 fc 9c b5 4f 5b c8 3f 59 7c 81 ae 50 17 e2 -....O[.?Y|..P.. 0360 c9 e1 8a e1 5b 17 ab c0 32 2b 52 cb 8c 27 b4 80 ....[...2+R..'.. 0370 bf ba 94 3b 58 9a 5a ae 54 2a 1b b5 71 96 df 76 ...;X.Z.T*..q..v 0380 72 fb f9 be a4 d0 50 87 47 b4 6a d0 b3 31 72 47 r.....P.G.j..1rG 0390 39 e1 a8 cb 66 57 7a d2 a1 5b 91 07 71 b5 39 c8 9...fWz..[..q.9. 03a0 ad a3 82 78 04 e3 56 35 ee f6 61 31 91 23 70 be ...x..V5..a1.#p. 03b0 49 e1 12 32 f5 7a 95 7f 4e ac b4 f3 47 20 21 00 I..2.z..N...G !. 03c0 f9 5b 52 5f 55 a1 2e 00 ce 70 fa ac 4f 01 92 75 .[R_U....p..O..u 03d0 9a bb 29 74 0b 4b ac 95 e0 c7 4a b4 f7 05 2d c1 ..)t.K....J...-. 03e0 73 51 16 68 36 3f e7 be a1 9f c9 cc 63 8b 87 77 sQ.h6?......c..w 03f0 d2 3f 60 08 b2 d3 ad 81 e1 b5 ac 93 a6 05 95 08 .?`............. 0400 51 0f b7 23 62 ce 21 84 76 56 fa 0e 4b a2 e4 18 Q..#b.!.vV..K... 0410 69 4d 7f 8b 69 74 29 42 18 4f fa 55 03 03 b5 10 iM..it)B.O.U.... 0420 a2 06 49 88 a5 8d 8d 25 56 6d b0 f3 03 a1 c3 6e ..I....%Vm.....n 0430 77 4a df 5a eb 64 06 8f 0e 74 aa 58 0c 02 63 9c wJ.Z.d...t.X..c. 0440 6f bf ca 6e d4 da 3d fd 6f 0e 89 fe 2e 40 62 d5 o..n..=.o....@b. 0450 45 7c 7c 8c 6b 14 d0 de 79 41 71 b6 12 77 44 41 E||.k...yAq..wDA 0460 64 47 dd 62 6a f8 7a 02 d7 b8 24 29 c4 11 fa e5 dG.bj.z...$).... 0470 cd 24 17 b6 e4 3e 23 82 ca 92 ff 36 3c a7 5e 81 .$...>#....6<.^. 0480 95 3e 86 3b f6 fe 43 4c 53 60 21 50 2e 1e ad 12 .>.;..CLS`!P.... 0490 47 de 3b e0 90 2b 23 1f 97 31 d2 ca fe 79 83 ff G.;..+#..1...y.. 04a0 62 80 7d 0f c7 2e 9b 65 d2 39 f9 cc 22 c3 16 a7 b.}....e.9.."... 04b0 6a 40 f8 4c 46 67 3d 49 b3 9a 90 7e 86 2f 4b 1f j@.LFg=I...~./K. 04c0 15 62 af be f5 35 6a 70 a3 e0 ed 80 6d ff eb 78 .b...5jp....m..x 04d0 df e5 47 b1 36 c6 11 9e 59 c9 41 71 67 36 83 dc ..G.6...Y.Aqg6.. 04e0 a6 c5 09 0f f9 eb 9c a4 67 fc 7c 35 59 f5 fe 07 ........g.|5Y... 04f0 4c 3d 86 a3 6c be 59 45 54 0d 6b bf dd 5d 6a a1 L=..l.YET.k..]j. 0500 ab 4e ff d3 de 9b dc f8 c0 34 29 19 73 42 67 ee .N.......4).sBg. 0510 d8 80 fe 80 dd d3 52 bf 72 33 93 ad f5 89 f4 26 ......R.r3.....& 0520 41 c0 eb 32 42 5e d8 3d 11 59 4e 7d 9d cc 9e 50 A..2B^.=.YN}...P 0530 72 ae c8 76 64 79 7c e6 40 a8 0c 0a 75 d6 00 f8 r..vdy|.@...u... 0540 9f 63 50 70 b7 ba 20 62 96 c3 a2 a6 63 a5 bb ef .cPp.. b....c... 0550 b3 a4 61 75 30 84 22 ff 2d 0f 89 90 fa a4 4b 00 ..au0.".-.....K. 0560 94 55 4e 6f 19 30 8b 44 c8 f2 5c 97 1d aa 51 38 .UNo.0.D..\...Q8 0570 07 b1 97 1d 64 d4 1a 31 79 d7 9c da 59 dd cf 70 ....d..1y...Y..p 0580 17 29 ca 01 a7 6a c1 13 20 d0 0c f3 49 53 eb c3 .)...j.. ...IS.. 0590 96 fe ad e8 d3 4c 1a db 6e 27 ab 53 92 a7 d8 ce .....L..n'.S.... 05a0 dd 45 3a c4 05 9e 64 74 21 51 57 71 d9 67 8c 4b .E:...dt!QWq.g.K 05b0 66 0d a2 85 f... No. Time Source Destination Protocol Info 2774 821.180913 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=4559 Ack=28461 Win=17520 Len=0 SLE=29921 SRE=34301 SLE=34301 SRE=35761 Frame 2774 (74 bytes on wire, 74 bytes captured) Arrival Time: Nov 11, 2005 16:43:49.939417000 Time delta from previous packet: 0.171933000 seconds Time since reference or first frame: 821.180913000 seconds Frame Number: 2774 Packet Length: 74 bytes Capture Length: 74 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 60 Identification: 0x41e5 (16869) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3493] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 4559, Ack: 28461, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 4559 (relative sequence number) Acknowledgement number: 28461 (relative ack number) Header length: 40 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0xc6af [correct] Options: (20 bytes) NOP NOP SACK: 29921-34301 34301-35761 left edge = 29921 (relative) right edge = 34301 (relative) left edge = 34301 (relative) right edge = 35761 (relative) No. Time Source Destination Protocol Info 2775 821.181291 soth1 zen1 TCP [TCP Retransmission] 1677 > 4605 [ACK] Seq=28461 Ack=4559 Win=7234 Len=1460 Frame 2775 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:43:49.939795000 Time delta from previous packet: 0.000378000 seconds Time since reference or first frame: 821.181291000 seconds Frame Number: 2775 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x7057 (28759) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0081 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 28461, Ack: 4559, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 28461 (relative sequence number) Next sequence number: 29921 (relative sequence number) Acknowledgement number: 4559 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7234 Checksum: 0xa51b [correct] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 1.247719000 seconds RTO based on delta from frame: 2751 Data (1460 bytes) 0000 08 45 9e 85 fb 0a b7 48 a2 10 c6 e6 54 fb fb 84 .E.....H....T... 0010 5b 25 00 a1 4d bd 9d af 7c 57 f2 a8 b0 5d 41 b1 [%..M...|W...]A. 0020 c6 0d 67 b7 be b6 74 82 e2 84 32 29 78 94 c7 0c ..g...t...2)x... 0030 92 3b e7 a9 36 f2 03 e8 8a 4d 68 f6 01 dc b6 a4 .;..6....Mh..... 0040 9c 71 30 0e 20 bd b6 aa 44 21 a7 9e bf 70 9d 48 .q0. ...D!...p.H 0050 27 76 67 c9 08 c5 0c c1 fa c4 ff 2d 3f 61 a0 bf 'vg........-?a.. 0060 72 0a f6 e4 39 9b 51 55 60 36 d6 7d 82 37 2d 3b r...9.QU`6.}.7-; 0070 d6 c1 2c 09 07 d1 47 7d c3 26 31 21 60 43 bf 7a ..,...G}.&1!`C.z 0080 7a 0e ee 6c 6e 2f 7a a7 22 5d 7d 57 35 49 b0 9c z..ln/z."]}W5I.. 0090 7f 8a f5 cc db 16 76 24 fe 03 3d e7 69 dc 14 39 ......v$..=.i..9 00a0 1c 95 4e 3a d9 2f 48 e5 68 fc 80 27 d6 94 9d 92 ..N:./H.h..'.... 00b0 2b bd 97 a7 21 7d 91 e6 23 1e 72 49 8e 20 3a 63 +...!}..#.rI. :c 00c0 c4 f0 5b 40 60 75 ba ab 3d 7c 1c 1f 72 82 56 92 ..[@`u..=|..r.V. 00d0 24 db 03 ab 6c 1f 02 98 99 71 b4 70 10 97 d7 a8 $...l....q.p.... 00e0 97 c5 b0 a7 23 92 f5 5e 0d 20 64 dc 0c 92 02 a2 ....#..^. d..... 00f0 9d c7 ad e3 b7 94 a4 36 44 fa 6b a9 10 4d f4 56 .......6D.k..M.V 0100 34 d2 37 8b 0b fb 27 74 a0 64 3f c1 5b 07 eb 46 4.7...'t.d?.[..F 0110 b3 8d 5c 25 ce f9 1e 8b e0 8d ef 04 30 e4 09 6e ..\%........0..n 0120 0f 0c 13 2e ca 5e 5b f0 37 a3 80 49 fd dd 6b fa .....^[.7..I..k. 0130 3a b7 92 3e e7 4a 02 e9 e5 9b b4 b4 8b 24 77 ed :..>.J.......$w. 0140 3c 14 78 ce ed 07 2d ab e0 38 b4 ab 59 8b 05 11 <.x...-..8..Y... 0150 6b 22 9d 95 44 cb ca 49 01 8a 55 12 55 32 5a f3 k"..D..I..U.U2Z. 0160 e2 9f 1d 51 36 8d 3f f2 b5 82 57 1f cc 81 cb 9d ...Q6.?...W..... 0170 08 b8 21 5a 01 b8 f1 20 c3 73 d3 f3 1f 05 c5 d9 ..!Z... .s...... 0180 d1 73 1a a5 78 9a f5 cd ec a3 29 9f 6e c0 94 02 .s..x.....).n... 0190 ff 9e e6 08 60 1a 6c f1 6f 27 d7 ac d7 7e a1 8d ....`.l.o'...~.. 01a0 99 3c 64 1e 35 e1 19 93 8d e3 f4 6d 29 1e f0 80 ..|.....b.]. 0270 da 5f d8 31 6b 08 e0 ff c1 c7 07 30 91 57 6d 95 ._.1k......0.Wm. 0280 13 45 60 4e 7f bc 1e 6c ab fd ed 27 ce 05 fc 0b .E`N...l...'.... 0290 e1 b1 66 47 dd 64 ba 4b ce 90 9c 8d 8a 09 6e cf ..fG.d.K......n. 02a0 ef 49 f1 f2 78 c5 dc da 9c 8d 3e 60 22 82 6d 0d .I..x.....>`".m. 02b0 04 16 78 0b ed 85 aa 6e 6f d7 6d 76 39 96 1c 47 ..x....no.mv9..G 02c0 fc 2a a1 0c 5b 71 35 cd 3a 9b f7 2c 6c 94 98 6c .*..[q5.:..,l..l 02d0 12 65 26 66 aa 50 62 e8 56 73 a5 5e 63 df a1 ac .e&f.Pb.Vs.^c... 02e0 5b cc 51 24 43 1a 25 88 32 83 88 90 4c fc 5b 70 [.Q$C.%.2...L.[p 02f0 c6 40 9a 23 8d b2 a2 71 7c af 30 d3 b5 59 77 b0 .@.#...q|.0..Yw. 0300 b7 a5 37 0e 61 58 27 1c 3e 46 c6 75 1e c7 31 55 ..7.aX'.>F.u..1U 0310 6d a1 cb 36 dd 4a c1 94 4f b4 52 4d 43 c6 b9 2d m..6.J..O.RMC..- 0320 94 3b 73 02 af 9e f9 d8 13 e4 98 e9 7c a6 cf 0e .;s.........|... 0330 5f 11 8c 4e 29 40 67 05 fd 39 41 96 55 f5 f2 9c _..N)@g..9A.U... 0340 25 dc ca b8 54 db e3 0d 1a 39 3b f7 e1 78 62 60 %...T....9;..xb` 0350 c3 3e 80 0c 1c 97 19 87 9a 8c 83 89 ea 6f 4c a8 .>...........oL. 0360 37 23 de 69 b3 38 7a 0d ed 3c dd 88 ad 77 93 48 7#.i.8z..<...w.H 0370 c4 4f 45 20 e0 2a 61 a2 b3 fb ee de a5 99 9d 3e .OE .*a........> 0380 9e f9 37 fa c7 05 04 c8 a1 d0 ed ff fd 4f 63 2c ..7..........Oc, 0390 ba c6 ce 6f 59 1b 40 58 8a e9 34 76 40 11 6e b2 ...oY.@X..4v@.n. 03a0 32 fa 33 6b f9 7a ef fa 11 9d b2 66 69 a9 10 31 2.3k.z.....fi..1 03b0 72 66 78 3d 43 87 fc 1c a6 bd 44 82 21 07 18 0f rfx=C.....D.!... 03c0 81 f8 bc 4d 13 a8 a7 43 ca f3 f2 47 67 e4 47 b4 ...M...C...Gg.G. 03d0 05 55 9e 9c 82 11 aa 6c 0f c7 6d f5 e3 c4 dd 65 .U.....l..m....e 03e0 fc 98 c9 58 b5 cb 4e 03 15 9c 31 c3 62 14 d6 6b ...X..N...1.b..k 03f0 75 94 92 45 89 21 99 7e 1a 23 69 fc 26 53 c2 66 u..E.!.~.#i.&S.f 0400 75 fe ff e1 b5 73 c8 7a 7b 96 09 1c a7 b9 b1 54 u....s.z{......T 0410 02 8c d8 c8 85 80 72 4a 57 e9 9b a2 37 46 e5 fc ......rJW...7F.. 0420 44 c7 a4 96 f1 ed 28 03 23 9d a7 2a 84 15 17 e5 D.....(.#..*.... 0430 96 cd 5b bb 6e b7 6d 8c d7 52 10 91 67 2f 64 1c ..[.n.m..R..g/d. 0440 9f a8 5a ef 16 16 9a 90 6d 40 cb ea 5a 0a 87 2b ..Z.....m@..Z..+ 0450 20 f8 8f d5 97 f7 51 58 fe 69 ef c5 62 28 e0 c0 .....QX.i..b(.. 0460 c6 6a 91 4c 39 46 bb 2d bb 1e ac 30 b5 f4 4f bc .j.L9F.-...0..O. 0470 5e 3c 4c 25 83 ec 90 b4 a9 fd 0a 18 02 ac 1d 4f ^ 4605 [ACK] Seq=29921 Ack=4559 Win=7234 Len=1460 Frame 2776 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:43:49.939845000 Time delta from previous packet: 0.000050000 seconds Time since reference or first frame: 821.181341000 seconds Frame Number: 2776 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x7157 (29015) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xff80 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 29921, Ack: 4559, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 29921 (relative sequence number) Next sequence number: 31381 (relative sequence number) Acknowledgement number: 4559 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7234 Checksum: 0xe593 [correct] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 1.247769000 seconds RTO based on delta from frame: 2751 Data (1460 bytes) 0000 69 fc f9 94 19 c4 e4 4f c2 01 9b 95 fd e0 7d 6c i......O......}l 0010 e8 ac 19 2b 52 d7 6c 92 72 ba 1a 87 da 6c 84 3e ...+R.l.r....l.> 0020 81 7e 16 af df 39 e7 af 75 c2 f8 3d c5 a6 4a 99 .~...9..u..=..J. 0030 4f 3c af cb b2 a9 eb c7 f9 f6 d0 03 a7 19 c8 ac O<.............. 0040 48 91 33 37 df 39 5b fd 8e ce 5a 28 76 32 ad 8c H.37.9[...Z(v2.. 0050 47 9c f2 ae 55 87 5a 63 b1 60 2e 34 42 bf 14 2d G...U.Zc.`.4B..- 0060 9a 0c 4d 4d 9c 94 60 63 e0 d3 ab 8f 92 26 22 0a ..MM..`c.....&". 0070 3f 8d 61 99 be 09 f4 ad 7b d7 0b 04 ec 99 7c 36 ?.a.....{.....|6 0080 89 a7 97 34 71 95 b6 9e 36 a2 c4 fd f2 95 2d 6b ...4q...6.....-k 0090 b3 67 d0 78 ff 29 be 9f 1e b2 27 94 fa e3 40 fe .g.x.)....'...@. 00a0 5f 07 b1 82 b5 64 e8 f0 b2 11 0a 8d 60 19 af e2 _....d......`... 00b0 fa 08 a7 51 a4 f9 eb 57 ce d7 9b 6a 1f ea fb 06 ...Q...W...j.... 00c0 7e 90 ee be 65 e1 60 25 a7 1e 9c a1 83 21 a8 7e ~...e.`%.....!.~ 00d0 91 c2 99 b0 8d 1f fd f9 01 81 bf 86 9a ac ad 8a ................ 00e0 9f c8 f1 44 0c 61 54 38 20 7b 24 c9 35 da e3 86 ...D.aT8 {$.5... 00f0 15 e3 aa f9 6a ea 5f 05 ba 1d 97 c6 a9 02 42 b2 ....j._.......B. 0100 25 12 94 e8 fc eb 88 6b df 0e 93 e6 ce 40 a8 ea %......k.....@.. 0110 43 f5 e1 68 18 53 11 85 04 7c bb 7f 22 65 bb d4 C..h.S...|.."e.. 0120 43 6b 42 b3 b4 07 5b 68 58 f2 a4 6f 40 32 7c 18 CkB...[hX..o@2|. 0130 11 e9 cc ae 3b b7 49 5e 85 61 a5 d2 cf 0b 29 7c ....;.I^.a....)| 0140 9c 1d 02 06 e4 0a 03 3d a7 d5 7a e5 bc a6 2c 2f .......=..z...,/ 0150 4e 7e 11 6c 84 d8 de 18 e5 23 ec b9 f3 25 0f 5f N~.l.....#...%._ 0160 92 8d 6d 18 1c 2c fc cf 40 31 bf 4a 4c f0 df cc ..m..,..@1.JL... 0170 4f 0e 05 90 21 f9 65 ed 14 ad 60 34 02 c4 9e 7b O...!.e...`4...{ 0180 db e9 f8 a0 ba 54 99 0c c8 e9 8f d1 df 9d e3 d9 .....T.......... 0190 e1 1f 51 25 0f ed d1 40 c0 c2 7b 5c 2d 37 f1 69 ..Q%...@..{\-7.i 01a0 b9 29 d1 cb 35 16 d5 cc b4 f4 fc fd 87 c9 71 05 .)..5.........q. 01b0 fe 43 5f 15 e7 ac 3e d3 4c f3 5d c2 87 d6 2e e6 .C_...>.L.]..... 01c0 71 51 dc 22 43 94 83 47 54 fe 08 e5 a4 ee 2d d1 qQ."C..GT.....-. 01d0 4c 5c 9c 54 16 df 00 9f 72 12 10 b2 70 47 5d 5a L\.T....r...pG]Z 01e0 de 94 8f 4a c4 fb 4e d3 c1 92 6e ab c2 54 0b 01 ...J..N...n..T.. 01f0 51 40 e1 aa 2e 9d da b2 1f fa f6 c1 6c 13 9d c0 Q@..........l... 0200 be bd 8b 1b 61 b7 3d 00 be 80 9b 20 09 d8 5a a3 ....a.=.... ..Z. 0210 95 e9 06 27 7f e3 dc 4a bf e6 44 94 63 07 cc ba ...'...J..D.c... 0220 de ab e3 b7 bc 21 f5 f4 79 da 1e 4f 49 24 13 b4 .....!..y..OI$.. 0230 bf 30 a8 29 52 11 c0 d5 9d 34 78 85 83 ab 71 7b .0.)R....4x...q{ 0240 5c 7c 77 14 e9 27 21 d0 00 8f f1 af d7 14 bf 6b \|w..'!........k 0250 12 85 39 00 6f 7e 33 95 0a 01 94 9d 92 d0 48 2a ..9.o~3.......H* 0260 fb a7 61 06 70 2b e6 18 71 93 f1 c0 6b 6b 8d 7f ..a.p+..q...kk.. 0270 ba eb 91 ee 60 bf 1f a8 ce b7 fd 8d 0b b7 46 bd ....`.........F. 0280 91 30 cc 52 46 54 0a 17 09 6b da 70 3a f8 55 c0 .0.RFT...k.p:.U. 0290 49 d7 73 06 ff 50 6d a5 8a e7 34 54 a3 5d 15 a4 I.s..Pm...4T.].. 02a0 80 5c bf 4b a2 2f 0e f1 79 dc f1 37 c0 51 b4 cc .\.K./..y..7.Q.. 02b0 80 5c 82 e9 de df 05 27 0b 62 74 ed 61 b4 ed 58 .\.....'.bt.a..X 02c0 90 3d 01 d7 61 e6 b1 e4 8c 2f a4 fe 40 5a 4e 5d .=..a..../..@ZN] 02d0 4b 72 57 93 84 e4 b5 08 96 8c 9f d6 0b 2c 49 32 KrW..........,I2 02e0 3e 3c f9 76 15 bf 8e 4a d5 54 f3 f4 fb fa 4e 1d ><.v...J.T....N. 02f0 9d 91 cd 0c 99 a4 26 99 7f 9d 71 6d e5 ea f9 85 ......&...qm.... 0300 ce 38 62 89 f6 06 8c f0 d6 69 bd 85 3e ac d9 ae .8b......i..>... 0310 99 b2 d7 94 5a f3 9e 92 11 ca 1e 08 ce b0 cd e5 ....Z........... 0320 04 2f a6 17 fe e0 3d 67 9a a2 f0 9f 59 fb f9 74 ./....=g....Y..t 0330 4d bd d6 d8 90 2c 1b e2 b1 ab 73 04 b0 10 de 7c M....,....s....| 0340 1f 20 6e 3b fa 87 3f 20 27 a3 e9 ee 6f 67 69 2a . n;..? '...ogi* 0350 ee 81 f3 c6 ad a9 f5 92 cd 2d fe 38 53 74 78 f7 .........-.8Stx. 0360 1c 02 71 a4 53 b2 cb 95 c9 5f 45 d1 56 82 7d 46 ..q.S...._E.V.}F 0370 d4 31 0c 93 73 bd a8 1e 38 9d 1f 80 e9 92 ae 6c .1..s...8......l 0380 ac 5a e4 ae 10 8e 04 c0 a2 ff f6 89 2e 4f ea cc .Z...........O.. 0390 dc 92 a1 c7 ba 32 6c d2 eb e9 9a 7a 1b 43 e4 34 .....2l....z.C.4 03a0 45 d3 5f 56 b0 a3 da a0 f6 4b 43 e3 38 29 9c 0c E._V.....KC.8).. 03b0 4a e6 3f e6 7a e5 1b 6d 5a 83 a1 6d 61 63 fb 56 J.?.z..mZ..mac.V 03c0 e1 5d e7 0a 52 02 7f 30 f7 a8 7e 6e 33 8b 93 e2 .]..R..0..~n3... 03d0 df 3e 94 62 35 5b af ed bc 6c 3b be 5b 02 27 ae .>.b5[...l;.[.'. 03e0 b9 52 96 eb f1 9a 0d 87 3a 2f 3c 9b 98 44 ad 83 .R......:/<..D.. 03f0 7a 42 06 b8 32 28 38 a3 a4 2a 55 73 72 90 98 5f zB..2(8..*Usr.._ 0400 95 d3 f6 d4 99 fa e3 33 a8 33 d6 00 df 22 69 10 .......3.3..."i. 0410 77 ed 54 1a 61 c7 e0 d0 07 cb 20 0b 1f 20 75 37 w.T.a..... .. u7 0420 39 6c 1b 41 77 91 c6 ee cb 9f 3f 0e a0 7d 52 44 9l.Aw.....?..}RD 0430 cf 4a b2 4f c8 fc 5c 70 7c db b6 f6 ba 4e 2d ae .J.O..\p|....N-. 0440 af cb 18 7e 29 f1 b4 47 9f a3 42 ec 19 57 71 37 ...~)..G..B..Wq7 0450 f3 85 0b 4b c3 12 e6 70 ea e5 3a fb 82 d6 dd d3 ...K...p..:..... 0460 3f 03 bc 4c e8 0a 64 81 bd a7 23 95 cc 43 01 c4 ?..L..d...#..C.. 0470 97 ac 6c d7 14 62 26 5c 82 12 b1 6d 64 a8 9a 5a ..l..b&\...md..Z 0480 91 66 60 63 38 33 00 96 3f 12 b6 44 41 b4 2e 68 .f`c83..?..DA..h 0490 a9 34 a8 86 fa e3 ec 1a 72 5f 7d 9a bb 1a 8e d8 .4......r_}..... 04a0 d7 f9 d5 6a 45 11 62 4b 56 d1 8e 0b 3c 20 db c6 ...jE.bKV...< .. 04b0 94 60 15 b0 51 ae 0d 3f 62 e5 ff e0 af 58 bb c4 .`..Q..?b....X.. 04c0 91 71 a2 37 09 9c 18 63 32 dc dc af b3 fb 35 4c .q.7...c2.....5L 04d0 d1 5f 43 e7 9d 56 e6 dd f4 7a e6 b9 d9 6a 02 f7 ._C..V...z...j.. 04e0 aa 95 74 48 be 4a 27 35 73 fc 15 aa 57 18 ab 74 ..tH.J'5s...W..t 04f0 f7 4f 4b 89 2a 78 84 f1 6b 89 5f 82 de 9f 7b 86 .OK.*x..k._...{. 0500 f4 4d df ab b5 e7 c0 30 b2 10 cd 41 db ff 12 03 .M.....0...A.... 0510 a8 ad 02 e9 ee bd df dd 11 cb 50 32 ca b1 52 25 ..........P2..R% 0520 72 a4 23 8d 88 1f f3 5a 64 c1 a0 c1 a5 8b 31 2b r.#....Zd.....1+ 0530 c9 b7 fb 6f 47 d6 63 c5 a7 08 7a 81 0f a1 24 a4 ...oG.c...z...$. 0540 61 b2 7c 32 66 a0 55 b0 9c fd aa 5a 98 71 f1 b2 a.|2f.U....Z.q.. 0550 f2 ee e4 0d fc 23 fe f4 ac ac de 95 89 77 42 79 .....#.......wBy 0560 48 c9 a2 b0 80 e3 2d 46 e4 70 53 f7 50 bb ad 0b H.....-F.pS.P... 0570 8b 4d b4 d1 8e e3 74 28 fb b3 3b 38 d5 c5 fb ea .M....t(..;8.... 0580 0d 8b 3e c2 8f ec d7 fd 43 ee 5a 72 7f 6c 2c cf ..>.....C.Zr.l,. 0590 6e 24 3f ba 94 90 c4 16 fd 08 06 92 22 6c b7 69 n$?........."l.i 05a0 41 fb 92 de 63 d3 bd fb 8b 0c b5 4f 40 04 00 7c A...c......O@..| 05b0 4d c7 4f a7 M.O. No. Time Source Destination Protocol Info 2777 821.181436 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=4559 Ack=35761 Win=12496 [TCP CHECKSUM INCORRECT] Len=0 Frame 2777 (54 bytes on wire, 54 bytes captured) Arrival Time: Nov 11, 2005 16:43:49.939940000 Time delta from previous packet: 0.000095000 seconds Time since reference or first frame: 821.181436000 seconds Frame Number: 2777 Packet Length: 54 bytes Capture Length: 54 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x41e6 (16870) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x34a6] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 4559, Ack: 35761, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 4559 (relative sequence number) Acknowledgement number: 35761 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 12496 Checksum: 0x845e [incorrect, should be 0xd02b] SEQ/ACK analysis This is an ACK to the segment in frame: 2751 The RTT to ACK the segment was: 1.247864000 seconds No. Time Source Destination Protocol Info 2778 821.181441 zen1 soth1 TCP [TCP Window Update] 4605 > 1677 [ACK] Seq=4559 Ack=35761 Win=17520 [TCP CHECKSUM INCORRECT] Len=0 Frame 2778 (54 bytes on wire, 54 bytes captured) Arrival Time: Nov 11, 2005 16:43:49.939945000 Time delta from previous packet: 0.000005000 seconds Time since reference or first frame: 821.181441000 seconds Frame Number: 2778 Packet Length: 54 bytes Capture Length: 54 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x41e7 (16871) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x34a5] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 4559, Ack: 35761, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 4559 (relative sequence number) Acknowledgement number: 35761 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x845e [incorrect, should be 0xbc8b] SEQ/ACK analysis TCP Analysis Flags This is a tcp window update No. Time Source Destination Protocol Info 2779 821.181681 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=35761 Ack=4559 Win=7234 Len=1460 Frame 2779 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:43:49.940185000 Time delta from previous packet: 0.000240000 seconds Time since reference or first frame: 821.181681000 seconds Frame Number: 2779 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x7257 (29271) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xfe80 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 35761, Ack: 4559, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 35761 (relative sequence number) Next sequence number: 37221 (relative sequence number) Acknowledgement number: 4559 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7234 Checksum: 0x78b1 [correct] Data (1460 bytes) 0000 e9 5d fc 14 a6 3a 0f c8 a8 b1 0c de 69 eb 2e 5d .]...:......i..] 0010 90 70 a9 07 5e e8 46 b8 42 1a f4 ea 9c d7 b0 c6 .p..^.F.B....... 0020 5d 21 ba 57 08 d7 50 cb d9 cf 58 8c e9 d3 68 88 ]!.W..P...X...h. 0030 eb 73 06 d4 65 21 93 ad cd 9b 74 89 d6 8c 2c 16 .s..e!....t...,. 0040 e2 53 25 9b 5d 82 c2 aa 33 8f 8c 65 8a a2 64 9d .S%.]...3..e..d. 0050 7e a9 55 e1 a5 df 1d d9 bf 9a 0b 83 68 cf dd 15 ~.U.........h... 0060 7d b3 27 c4 f7 89 ba 49 e5 fd c5 77 58 9f 98 44 }.'....I...wX..D 0070 90 94 f9 c6 9a f2 0b 23 86 cc 34 9f 05 f8 0c 3f .......#..4....? 0080 a0 94 85 96 f6 01 ec df 72 10 12 eb 25 09 ef 11 ........r...%... 0090 11 4c 69 5f cf f8 0c df 18 60 c1 27 7c 00 b5 03 .Li_.....`.'|... 00a0 f1 b1 13 59 2b d8 a6 cb 52 31 12 1c b4 de 18 bd ...Y+...R1...... 00b0 79 9f d5 41 c6 46 88 73 1e f3 67 ea 56 1e e8 07 y..A.F.s..g.V... 00c0 48 0f f9 65 e4 61 6d 57 2a 98 10 9a 61 d1 fd 15 H..e.amW*...a... 00d0 82 96 ad eb de 00 ba 6a 96 af 9c 66 cc 5e 4d ed .......j...f.^M. 00e0 96 b1 fe 71 22 28 eb 4b 71 05 8b dd 1b b9 ea ec ...q"(.Kq....... 00f0 b6 ee a2 cd f0 01 92 64 b6 3d d3 79 6d 47 b5 09 .......d.=.ymG.. 0100 4e 91 9e cd 05 4f 0a d9 3f 48 73 9a 71 39 0a 6a N....O..?Hs.q9.j 0110 97 b6 fd 3f ba de cc 21 a9 1e d0 15 b7 9e 31 6d ...?...!......1m 0120 47 95 04 b8 10 8f 56 c6 f7 56 12 1c 09 89 70 b7 G.....V..V....p. 0130 2d 41 d6 29 81 40 61 11 7a 00 2a 63 23 03 d2 75 -A.).@a.z.*c#..u 0140 e3 0e 7c 39 fd 4d f1 07 73 6c 5c 1d 7c 91 6a 3e ..|9.M..sl\.|.j> 0150 47 2c f4 ae 7a 1d f6 ee 21 a4 ee c5 aa ef c5 42 G,..z...!......B 0160 50 fa ce bd 67 71 27 7e aa dd 81 9a ac 6a ae 04 P...gq'~.....j.. 0170 e9 51 5b 4d 3e 73 0b 20 96 3c be 66 ce 64 e2 77 .Q[M>s. .<.f.d.w 0180 25 c5 ac f4 63 4b de 60 4b ec 4c 1e 50 f3 63 c7 %...cK.`K.L.P.c. 0190 ea 84 af 86 c3 d6 24 6c 7a 0e f5 d9 66 21 aa 3d ......$lz...f!.= 01a0 72 22 28 94 bb d8 84 99 61 d8 20 68 dd ae 74 53 r"(.....a. h..tS 01b0 33 50 68 e4 18 a2 c5 2b 3e a8 ba de db 37 c6 06 3Ph....+>....7.. 01c0 55 a7 e7 73 bf b6 43 8c 5b 66 7d 71 b9 20 e1 83 U..s..C.[f}q. .. 01d0 a7 fb 3a ad 4d b0 42 3b 64 c2 bb 67 a5 55 b5 8b ..:.M.B;d..g.U.. 01e0 47 28 ae dc 62 aa 06 32 cc c9 d0 f4 ff fc 43 ff G(..b..2......C. 01f0 4b f9 a2 41 ce da 71 99 0d 2b e4 ba 6f e2 b5 61 K..A..q..+..o..a 0200 49 5b 86 0e c9 de b1 b5 35 cd 60 ca e5 a2 4b 21 I[......5.`...K! 0210 f2 1f 6a 81 a0 6d 4a 28 79 ed 63 8f ad 13 ae 6e ..j..mJ(y.c....n 0220 3d 6b 77 49 37 58 a9 22 88 0c 3a 45 08 9f 94 97 =kwI7X."..:E.... 0230 2c 2c f2 2a e5 96 51 d4 e6 32 d4 03 ba 30 64 b9 ,,.*..Q..2...0d. 0240 9f 1c 35 e5 ed 9b b0 04 81 13 64 c3 e4 93 55 e4 ..5.......d...U. 0250 5e a8 56 d7 e4 2e 2f 30 ce 90 62 7d f7 98 52 15 ^.V.../0..b}..R. 0260 8e e3 42 f5 44 3a c5 40 8e 9b 7f c4 1d d1 fc 9b ..B.D:.@........ 0270 a6 c0 66 6c f5 6e 2b 7b 6c 65 d2 0a 20 24 83 2f ..fl.n+{le.. $./ 0280 fd d4 00 43 bb 88 75 00 c8 c9 c7 19 41 b1 51 7f ...C..u.....A.Q. 0290 95 ed 48 a9 69 f1 81 e2 71 24 b0 8d 2c a9 e7 90 ..H.i...q$..,... 02a0 60 b3 9b 48 b3 90 19 88 a5 bb 63 60 d4 2e 74 43 `..H......c`..tC 02b0 dc b4 65 68 07 80 97 2f 00 9e 06 45 b3 4d ae a2 ..eh.../...E.M.. 02c0 80 0e 4c 07 66 0e 5f 01 cb 99 53 21 e2 e6 d3 bb ..L.f._...S!.... 02d0 f8 58 d9 68 16 36 33 7a 88 1e 7f 2b 57 29 5f 22 .X.h.63z...+W)_" 02e0 65 25 96 da f1 59 8b c1 59 cb 81 22 76 a3 d8 65 e%...Y..Y.."v..e 02f0 97 fd 60 84 1f 9e 77 7c ab ec 9a 1b b3 02 d2 ed ..`...w|........ 0300 90 94 60 d9 63 ab 84 c1 5c 85 86 9d cc a7 93 a5 ..`.c...\....... 0310 a0 95 df 1c 8a 46 cf b2 05 ff 19 7a a0 a8 66 fe .....F.....z..f. 0320 56 b9 eb 59 9e 79 f3 81 b8 66 6e f4 5e 99 6e 30 V..Y.y...fn.^.n0 0330 69 67 ff 0a d7 a1 29 eb ea a6 d1 99 33 82 a9 48 ig....).....3..H 0340 6d 0c 90 37 e3 b8 92 1c 64 ee ab 59 1b 2f 74 c8 m..7....d..Y./t. 0350 2a 8f 37 82 c0 73 48 46 c6 73 48 45 1b 01 60 38 *.7..sHF.sHE..`8 0360 79 40 46 2f 8c d3 05 6b bf 74 c1 e4 ad f6 02 8c y@F/...k.t...... 0370 f9 02 b8 76 6c 69 3b 2c 1c 64 6f 36 b3 62 ca 92 ...vli;,.do6.b.. 0380 e8 2a bc ef 98 04 b5 fe 0e 00 ca 0a 10 21 54 75 .*...........!Tu 0390 66 a2 bf b0 db 3c 67 82 ed a4 11 2b b1 54 df 9c f....1m.. 0490 aa c7 93 04 3b 30 f8 43 77 15 78 8f c9 bc 31 2b ....;0.Cw.x...1+ 04a0 85 25 69 80 fc 53 f1 a5 6d 74 b5 42 4d a1 c3 6b .%i..S..mt.BM..k 04b0 ae 55 46 f3 e2 bf 24 4d aa 2c df 2d c1 6e 1d 51 .UF...$M.,.-.n.Q 04c0 7a 5b be 14 c0 8b a7 52 99 25 09 9f a0 12 f8 44 z[.....R.%.....D 04d0 e2 b4 96 38 eb 1e c7 41 17 14 25 29 e0 04 7a 08 ...8...A..%)..z. 04e0 87 4d f0 ae 4e c7 64 ed 6f 56 61 d0 47 b5 5f 03 .M..N.d.oVa.G._. 04f0 d0 9c ee e3 09 74 87 41 2f ce c1 ee a1 f4 1d f6 .....t.A/....... 0500 46 c8 a1 3e 46 42 2c 17 b3 0d 56 ef f7 89 5c 69 F..>FB,...V...\i 0510 bd 4d db 2f fa ec 1c 4d ed a1 93 14 dd f9 e9 f8 .M./...M........ 0520 c2 ed e9 a4 7c 5e 32 ae 4f 80 29 eb 3a 9a 04 e7 ....|^2.O.).:... 0530 99 01 23 e0 d2 f7 e3 d1 5f 93 f7 26 75 7c d9 b5 ..#....._..&u|.. 0540 8d f9 84 eb d1 b0 9c 2a 15 14 eb 38 fc 90 ac 2c .......*...8..., 0550 bc b4 ed b3 3e 32 8c 67 84 00 e6 07 5d 35 f0 8f ....>2.g....]5.. 0560 9d 6a bd 8c 20 67 5b 8f 71 d2 94 90 cb 0c 40 ef .j.. g[.q.....@. 0570 bd ab c9 fe b9 56 6a 0c cd 69 0e 6b 4b a5 a9 74 .....Vj..i.kK..t 0580 04 24 37 fb c5 0e ff 30 b5 c5 67 51 4e 5f db 19 .$7....0..gQN_.. 0590 fc 2b 51 73 e6 75 e2 5e e8 37 28 a6 94 d4 92 57 .+Qs.u.^.7(....W 05a0 db 64 aa a5 9c f2 4c 3a 6a 98 d4 08 d9 92 c1 70 .d....L:j......p 05b0 1c 79 e9 44 .y.D No. Time Source Destination Protocol Info 2780 821.381161 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=4559 Ack=37221 Win=17520 [TCP CHECKSUM INCORRECT] Len=0 Frame 2780 (54 bytes on wire, 54 bytes captured) Arrival Time: Nov 11, 2005 16:43:50.139665000 Time delta from previous packet: 0.199480000 seconds Time since reference or first frame: 821.381161000 seconds Frame Number: 2780 Packet Length: 54 bytes Capture Length: 54 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x41eb (16875) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x34a1] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 4559, Ack: 37221, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 4559 (relative sequence number) Acknowledgement number: 37221 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x845e [incorrect, should be 0xb6d7] SEQ/ACK analysis This is an ACK to the segment in frame: 2779 The RTT to ACK the segment was: 0.199480000 seconds No. Time Source Destination Protocol Info 2781 821.381341 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=37221 Ack=4559 Win=7234 Len=614 Frame 2781 (668 bytes on wire, 668 bytes captured) Arrival Time: Nov 11, 2005 16:43:50.139845000 Time delta from previous packet: 0.000180000 seconds Time since reference or first frame: 821.381341000 seconds Frame Number: 2781 Packet Length: 668 bytes Capture Length: 668 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 654 Identification: 0x8557 (34135) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xeece [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 37221, Ack: 4559, Len: 614 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 37221 (relative sequence number) Next sequence number: 37835 (relative sequence number) Acknowledgement number: 4559 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7234 Checksum: 0x4fed [correct] Data (614 bytes) 0000 6b 68 69 a7 af 9a 7e 94 bf fd 0f a9 98 3f f9 b3 khi...~......?.. 0010 4c ad 29 a5 64 fb ea 52 30 41 d4 55 9f 56 b6 7a L.).d..R0A.U.V.z 0020 0f f3 3d b1 5f be 5e b0 27 90 21 56 69 03 e8 4f ..=._.^.'.!Vi..O 0030 03 be 33 a7 03 5b c2 a3 e1 c6 96 61 be 15 b2 88 ..3..[.....a.... 0040 1d d9 d2 00 2e 9a d2 6e ca bc ec 96 05 bb af e4 .......n........ 0050 dc be 00 45 48 5d 17 c7 95 2a 2c 55 53 7e 0e 10 ...EH]...*,US~.. 0060 3f 1f 79 7b 4b e9 47 50 1d a5 b6 4b 9c bb c4 f4 ?.y{K.GP...K.... 0070 de 66 06 b4 26 7e 79 49 cb 97 54 27 b5 35 f1 1b .f..&~yI..T'.5.. 0080 a3 4d 38 04 e6 77 18 5b 24 20 33 cb b2 25 9b 77 .M8..w.[$ 3..%.w 0090 77 a9 77 ca b7 3f be 40 3e 10 2f 09 22 19 9d ce w.w..?.@>./."... 00a0 f4 14 67 b7 fd 5f 66 de 98 cb 0c 71 89 3b 44 29 ..g.._f....q.;D) 00b0 cc b1 8a 48 10 c4 d3 14 2f 71 03 9f 66 67 20 7f ...H..../q..fg . 00c0 5a 97 3f ad 39 0e 27 9a d7 db ac ad 58 de 78 9e Z.?.9.'.....X.x. 00d0 f6 6f bb a1 35 b6 04 36 97 07 da a9 96 5f 70 e8 .o..5..6....._p. 00e0 cc e1 53 1d e3 35 71 69 e1 7c 90 93 47 4a 87 42 ..S..5qi.|..GJ.B 00f0 a3 00 28 6d 6d 16 4c 47 86 f9 1d e1 79 e6 49 36 ..(mm.LG....y.I6 0100 91 84 51 7a 4a 77 18 34 a2 51 98 79 1e 4a 9e 34 ..QzJw.4.Q.y.J.4 0110 0e 73 43 60 80 8f 1a de 40 6c 37 37 77 62 92 7b .sC`....@l77wb.{ 0120 4d ed 06 de 98 06 b1 b3 a2 d0 3a a0 39 90 88 e2 M.........:.9... 0130 95 98 f6 8b 23 99 a7 16 b6 41 32 72 ee 71 58 56 ....#....A2r.qXV 0140 38 fb c7 60 0f 23 2b 1b 79 e2 f7 d1 4a 09 47 b7 8..`.#+.y...J.G. 0150 5c b3 c1 3b 4a 3d a3 f0 6d 86 19 62 9a 62 d3 82 \..;J=..m..b.b.. 0160 41 ff f8 6e 50 47 56 5b 81 0c ea b3 41 b1 33 64 A..nPGV[....A.3d 0170 17 55 22 e6 ad 54 0c cc 59 09 1c 9a 08 97 8f 37 .U"..T..Y......7 0180 72 e7 b6 7a b4 f1 d7 0b 74 7d b1 f4 95 fb 5b 76 r..z....t}....[v 0190 e6 94 e1 81 9e 13 28 59 5e 85 3f b9 5f 30 f7 e5 ......(Y^.?._0.. 01a0 62 63 e6 d5 da fb 82 1f de 32 40 20 45 fd ee f5 bc.......2@ E... 01b0 fc c2 c3 ea 58 f4 82 a8 76 7b 03 9f 72 82 4b 98 ....X...v{..r.K. 01c0 9f 8e af ec 60 09 d3 b1 40 46 8c 76 53 89 db b0 ....`...@F.vS... 01d0 20 e3 90 5c 21 44 2e 4b 29 48 8f e4 0d 5b dc b6 ..\!D.K)H...[.. 01e0 c3 2a 0b 7d bd 1e 39 cd 38 2d 2a 49 fb 5c 0b 0f .*.}..9.8-*I.\.. 01f0 c5 6d 0c eb 7b 14 45 29 82 6a c1 06 74 3f 6e 8a .m..{.E).j..t?n. 0200 41 b8 56 47 76 44 01 29 67 4f 1c 69 00 f1 d4 4d A.VGvD.)gO.i...M 0210 f9 c8 be 3b ba 3e d6 a1 ac 77 fb ec bf f4 63 77 ...;.>...w....cw 0220 0d 12 67 1b a0 5b 5e f4 b9 24 40 64 00 e1 25 97 ..g..[^..$@d..%. 0230 85 23 13 d9 23 32 10 44 01 df 3a 98 bd 66 32 c1 .#..#2.D..:..f2. 0240 3e 66 e8 04 6a 0b cd 4e 82 ac e9 6d fd 6c 4a 65 >f..j..N...m.lJe 0250 24 97 67 3c 9f 9b dc 1f 51 14 a4 21 09 3e 4d 95 $.g<....Q..!.>M. 0260 13 c2 a8 42 98 04 ...B.. No. Time Source Destination Protocol Info 2782 821.382771 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=4559 Ack=37835 Win=16906 [TCP CHECKSUM INCORRECT] Len=310 Frame 2782 (364 bytes on wire, 364 bytes captured) Arrival Time: Nov 11, 2005 16:43:50.141275000 Time delta from previous packet: 0.001430000 seconds Time since reference or first frame: 821.382771000 seconds Frame Number: 2782 Packet Length: 364 bytes Capture Length: 364 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 350 Identification: 0x41ec (16876) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x336a] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 4559, Ack: 37835, Len: 310 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 4559 (relative sequence number) Next sequence number: 4869 (relative sequence number) Acknowledgement number: 37835 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16906 Checksum: 0x8594 [incorrect, should be 0x633e] SEQ/ACK analysis This is an ACK to the segment in frame: 2781 The RTT to ACK the segment was: 0.001430000 seconds Data (310 bytes) 0000 bc ef 36 01 b5 fe 18 00 1c 01 00 21 0f 10 32 0a ..6........!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9f bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 35 33 8c 7e 94 0a f5 8d 4b 7e 4a a4 32 f5 20 o53.~....K~J.2. 0040 63 b0 7e 6c 9a 84 81 9a 86 6b fd 0f ba ea 2b 74 c.~l.....k....+t 0050 75 34 05 2e ec 30 fb ff 8b 4b f4 f1 3e 0a 18 41 u4...0...K..>..A 0060 6f 14 67 2a 85 84 e7 fc f3 53 99 e4 cc 4e d0 09 o.g*.....S...N.. 0070 6f 34 f7 a8 8e a3 00 75 8d 4b 16 6e b3 32 72 a0 o4.....u.K.n.2r. 0080 ce 23 13 48 ad 84 8d 1a 85 6b 7b 8f d3 79 2c f4 .#.H.....k{..y,. 0090 5f 34 15 ae 51 94 6a 7f d0 7f 52 71 bb 32 18 c1 _4..Q.j...Rq.2.. 00a0 6f 14 c1 aa 87 b0 71 7c 85 6b a9 64 dc 4e 46 89 o.....q|.k.d.NF. 00b0 01 06 51 28 59 94 00 f5 8d 4b b0 ee e4 00 e4 20 ..Q(Y....K..... 00c0 7f 14 23 c8 bd 84 1b 9a cc 59 dd 0f e4 4e 2c 74 ..#......Y...N,t 00d0 7f 34 b3 2e 05 a6 fc ff 9d 4b 42 f1 8b 32 8e 41 .4.......KB..2.A 00e0 d2 25 47 2a a5 84 71 fc 85 6b 2f e4 57 7f d0 09 .%G*..q..k/.W... 00f0 6f 34 41 a8 49 94 96 75 38 7a 36 6e 93 32 e4 a0 o4A.I..u8z6n.2.. 0100 1f 14 a5 48 7e b5 8d 1a 85 6b cd 8f f4 4e ba f4 ...H~....k...N.. 0110 ae 05 35 ae 31 94 fc 7f fd 4b a4 71 11 03 98 c1 ..5.1....K.q.... 0120 6f 14 b7 ab b5 84 71 7e 99 cf b4 62 fd 4e 58 83 o.....q~...b.NX. 0130 43 35 ad 93 36 01 C5..6. No. Time Source Destination Protocol Info 2783 821.385341 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=37835 Ack=4869 Win=7604 Len=1460 Frame 2783 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:43:50.143845000 Time delta from previous packet: 0.002570000 seconds Time since reference or first frame: 821.385341000 seconds Frame Number: 2783 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x8657 (34391) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xea80 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 37835, Ack: 4869, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 37835 (relative sequence number) Next sequence number: 39295 (relative sequence number) Acknowledgement number: 4869 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7604 Checksum: 0x6cf9 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2782 The RTT to ACK the segment was: 0.002570000 seconds Data (1460 bytes) 0000 bc ef c2 14 b5 fe 18 00 6e 34 10 21 14 d6 32 0a ........n4.!..2. 0010 04 00 3c 2a 71 43 00 00 70 1a 0f f0 5b bf 76 4c ..<*qC..p...[.vL 0020 6f 01 75 2d 35 b5 49 d1 87 dd b6 bf 84 d5 37 74 o.u-5.I.......7t 0030 6e dc b1 2f 82 80 e9 ff 05 4a 1d 78 e1 f2 e0 f2 n../.....J.x.... 0040 7e 3e 3b e4 3d 83 4d fb 8d 72 09 b2 e7 58 a3 32 ~>;.=.M..r...X.2 0050 7f 14 7d 30 cd f5 cb 80 d3 2c 51 07 2b 92 77 78 ..}0.....,Q.+.wx 0060 f6 59 e1 e8 84 57 59 e8 c5 6f fa 2f 5c 3a f0 ad .Y...WY..o./\:.. 0070 8a d7 58 ba 29 e5 3a 67 c3 11 56 18 da e1 62 02 ..X.).:g..V...b. 0080 5e 93 2f 2c 6d 80 2e 89 3e 51 f7 84 55 da c8 72 ^./,m...>Q..U..r 0090 67 34 14 30 72 0a ec 9d 24 f6 74 7b 90 d3 56 a3 g4.0r...$.t{..V. 00a0 ec f9 df 2a 92 7c 4a 84 c5 43 a9 0c bd 9d d0 8b ...*.|J..C...... 00b0 af 20 45 09 59 9c f4 7f 89 d2 bc f0 bc 66 97 48 . E.Y........f.H 00c0 3f 6c 23 2d df d4 8d 1f a7 77 8e 50 36 5e 0b 4a ?l#-.....w.P6^.J 00d0 1c 65 4d 30 5a 19 7a 21 e0 46 a4 ca 8f 1c d0 25 .eM0Z.z!.F.....% 00e0 76 a4 8f b8 a5 69 81 3b 58 4a 35 8d 9c ed 29 51 v....i.;XJ5...)Q 00f0 00 34 40 ef e9 95 a0 37 ef 0f 2a 61 95 d1 f5 32 .4@....7..*a...2 0100 db 9e 00 2e fe 04 cc 78 e8 e9 1f 20 58 cc 18 62 .......x... X..b 0110 7f 65 1c 24 71 d3 ea 87 b6 29 2e 5f b2 20 88 73 .e.$q....)._. .s 0120 cf 90 b7 07 84 1f bc 4a 66 62 1d 88 02 1d d1 2d .......Jfb.....- 0130 54 9c d5 e5 21 18 c6 b9 dc 3b 85 f2 95 22 66 ca T...!....;..."f. 0140 7c a9 3c 6e cd 87 51 8b c4 1f 83 f2 7d cf 9b ae |...f.. 0440 fc e6 d4 a3 e8 4a 8d 45 20 40 69 18 c7 3e eb 57 .....J.E @i..>.W 0450 f7 7d 7a a0 14 6b 78 9e 36 67 68 8a 01 9d 19 22 .}z..kx.6gh...." 0460 6d 80 db 6c b9 17 f6 c9 df 3f d9 48 4a 49 63 aa m..l.....?.HJIc. 0470 c1 b2 ed 68 6f fe 46 2b b3 ef a6 80 15 db 3c cc ...ho.F+......<. 0480 6b 47 47 b4 e5 e8 e2 46 ac db dc d3 c9 c8 00 2d kGG....F.......- 0490 d1 b8 71 98 3d 8e 41 dd 63 82 52 7b fb af 97 9d ..q.=.A.c.R{.... 04a0 17 9a ab 08 2f 72 e3 69 6f 70 06 0a d5 2c 28 d9 ..../r.iop...,(. 04b0 f4 9c 50 5d b2 75 65 97 14 21 e1 94 e1 a3 62 db ..P].ue..!....b. 04c0 a5 9d 94 51 8f e9 53 3b 7c 3a 33 ca 6d 36 d4 a7 ...Q..S;|:3.m6.. 04d0 e0 df 96 58 b1 67 6c e6 41 73 b2 24 30 0f bf 23 ...X.gl.As.$0..# 04e0 47 42 2e ec 39 82 fc 87 7a 55 47 1d 67 01 99 06 GB..9...zUG.g... 04f0 af c6 73 b8 01 4b ef 86 f2 b8 4b 10 33 53 7e 61 ..s..K....K.3S~a 0500 06 b4 5c 1c dc 50 72 b9 a6 a1 b0 e8 e0 d8 1b 5a ..\..Pr........Z 0510 18 b1 e1 b5 33 99 4a 43 94 a9 6f 93 db 29 6c 76 ....3.JC..o..)lv 0520 a2 5f b1 9e e6 87 6f d4 f3 a6 7b a5 91 b3 47 15 ._....o...{...G. 0530 01 b8 c6 13 23 e9 df f9 ef 69 26 9d c5 2a 99 1c ....#....i&..*.. 0540 b5 8d 2f a1 32 30 72 f8 46 bf b4 97 d8 83 88 ef ../.20r.F....... 0550 4d 36 a8 13 1c 06 b7 e1 1b 5c cb 3f ad f6 a1 66 M6.......\.?...f 0560 9d f8 27 a9 a3 71 39 76 dc 87 f1 a0 6a c4 83 37 ..'..q9v....j..7 0570 20 e8 84 d6 92 c0 1f 59 57 10 8d 1d cf a6 35 b0 ......YW.....5. 0580 60 6c aa 4d a2 35 e0 d5 4f f9 62 e6 25 84 c7 88 `l.M.5..O.b.%... 0590 30 8b df 6d 13 ee f5 61 25 3e 86 91 77 0a 99 65 0..m...a%>..w..e 05a0 64 05 fd 26 1a 40 69 ae 08 d9 46 3b d0 7e 14 37 d..&.@i...F;.~.7 05b0 c0 c5 18 cb .... No. Time Source Destination Protocol Info 2784 821.385459 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=39295 Ack=4869 Win=7604 Len=1460 Frame 2784 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:43:50.143963000 Time delta from previous packet: 0.000118000 seconds Time since reference or first frame: 821.385459000 seconds Frame Number: 2784 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x8757 (34647) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xe980 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 39295, Ack: 4869, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 39295 (relative sequence number) Next sequence number: 40755 (relative sequence number) Acknowledgement number: 4869 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7604 Checksum: 0x25a3 [correct] Data (1460 bytes) 0000 36 7d 38 d0 11 54 15 1e 4a 53 60 e1 3d 61 14 34 6}8..T..JS`.=a.4 0010 71 5c 44 eb ba 6c 05 c3 40 6b ac aa 23 ca b3 5b q\D..l..@k..#..[ 0020 70 7c 5d 9c 92 4f 3a c0 ef 26 2c ed 43 6e 4a 1c p|]..O:..&,.CnJ. 0030 68 1c df 66 48 f2 70 87 88 9d 08 cb 11 d5 82 97 h..fH.p......... 0040 4c b5 93 db 2a 06 c3 49 48 61 18 49 fc f2 36 71 L...*..IHa.I..6q 0050 4c b1 af 8d 85 2c fe 09 fb ea 9e ad 53 95 13 8a L....,......S... 0060 41 21 47 f9 77 b1 59 2c 20 a6 21 53 68 30 25 59 A!G.w.Y, .!Sh0%Y 0070 54 4f fb 4e 11 dd 1e 06 c3 61 e3 53 97 cb d8 84 TO.N.....a.S.... 0080 91 b2 ca 99 11 b7 39 8d 34 e7 68 5a 94 ce 0f b8 ......9.4.hZ.... 0090 f2 f1 0f 86 49 82 dc 7c 49 8c 13 9a 47 74 8c 43 ....I..|I...Gt.C 00a0 e2 b4 cd 04 fb 51 40 60 e3 7b 1c f6 4b c3 66 7b .....Q@`.{..K.f{ 00b0 31 09 de 10 82 2e 6e 8b ad a0 ee 58 eb 5a cb 1c 1.....n....X.Z.. 00c0 25 db 7f c9 29 b7 8f a9 4a fe f8 65 1d 60 76 b4 %...)...J..e.`v. 00d0 19 ae 3f de f2 9b bd db 30 3c 23 97 a7 2d f2 ba ..?.....0<#..-.. 00e0 69 52 83 ff 42 80 ad 0f c4 15 dd 53 5f 76 90 79 iR..B......S_v.y 00f0 51 91 e6 81 3a 40 01 e3 e3 57 a2 3c 90 83 70 04 Q...:@...W.<..p. 0100 70 c8 d3 b0 d1 95 b2 65 50 41 e7 10 8b 70 d7 03 p......ePA...p.. 0110 c1 27 f4 0c a4 cb 36 1c 6d 82 9e be 32 89 02 46 .'....6.m...2..F 0120 b1 21 fe 88 fe 03 04 64 cb 12 d6 e4 18 44 a6 0a .!.....d.....D.. 0130 f5 ae 2c 19 18 f4 e0 23 19 9e 16 5a e3 1c ee 0b ..,....#...Z.... 0140 a2 7a 81 1e 9e d6 39 3b 9d 18 b4 61 91 05 86 a4 .z....9;...a.... 0150 2f 98 cb f0 cc 0b 69 e2 48 89 da 21 2f c6 b1 19 /.....i.H..!/... 0160 81 b5 88 da c2 94 21 13 2d a7 49 fd 79 fd 1c b6 ......!.-.I.y... 0170 77 97 f4 c8 46 63 3f 0e b4 4b 0f fc 57 7b 97 9c w...Fc?..K..W{.. 0180 7d ca 71 73 96 9d ca 81 a3 64 a9 3c 6e 73 7d 57 }.qs.....d.z(. 0250 28 5f 21 4b c4 56 2c 84 7e 23 11 91 81 ad bb 43 (_!K.V,.~#.....C 0260 eb e8 93 7f bd 3a e4 50 2b f1 f2 b0 a0 13 46 17 .....:.P+.....F. 0270 d7 4b 55 0d 43 38 ed 60 d3 fc 30 67 14 42 ec 1c .KU.C8.`..0g.B.. 0280 df 63 83 29 2b 82 00 ee 85 73 fe 6c 62 99 26 99 .c.)+....s.lb.&. 0290 ea 29 15 0c 7f 6f eb 36 0c a7 1e 0b 84 30 27 12 .)...o.6.....0'. 02a0 00 6f da f9 c4 e2 7a dc 4b 3e f8 c4 25 98 7f 5a .o....z.K>..%..Z 02b0 0a 97 72 83 0e a5 07 6c f8 2c f3 5b 4d f4 0e 91 ..r....l.,.[M... 02c0 94 b6 b6 5b 0c 71 50 62 33 99 28 22 1f ac 5c 56 ...[.qPb3.("..\V 02d0 e3 a7 94 b3 db fd 53 ff 50 53 a0 de de 31 f5 4f ......S.PS...1.O 02e0 9e a3 95 ff 27 8f 7a 92 80 99 19 45 41 de 7a 05 ....'.z....EA.z. 02f0 56 10 c1 80 c0 b9 cd 5a b9 83 27 25 52 be 71 74 V......Z..'%R.qt 0300 f7 30 a2 72 74 3a 0f 3d ff 0c 3e ee 4e 9c c4 dd .0.rt:.=..>.N... 0310 5b a6 b7 c5 9d 66 cf 73 a1 43 91 0b 81 39 c8 09 [....f.s.C...9.. 0320 d3 a3 d4 49 bf b1 d0 9f ba ed f4 0c bd cb d5 b2 ...I............ 0330 17 c4 ce 7b 46 56 51 1a 67 7d 55 93 83 af 34 3b ...{FVQ.g}U...4; 0340 19 67 dd 01 72 6d a3 e3 a1 71 5e c1 2c ec 1e 44 .g..rm...q^.,..D 0350 cf 6d 9c 68 7c 26 f0 f3 12 3d c0 fb 08 c7 47 d3 .m.h|&...=....G. 0360 de 0a 16 29 63 d1 3e aa a8 37 46 55 07 17 84 b3 ...)c.>..7FU.... 0370 bb db d7 41 fb f5 d1 26 68 16 5f 03 5f 77 8c f4 ...A...&h._._w.. 0380 2d 12 35 6b 03 e1 c5 8c e4 3a f0 1f c2 06 af 89 -.5k.....:...... 0390 3d 86 a3 3a 4f 81 9b da 0f 70 aa ec 26 98 bd 81 =..:O....p..&... 03a0 87 05 dc 59 3d 83 c3 3a 4b 15 e2 be 07 c6 42 e2 ...Y=..:K.....B. 03b0 33 a3 7a 58 ac 80 8b 1b 10 64 07 f6 52 a1 7d 1a 3.zX.....d..R.}. 03c0 d4 02 ad 50 bd 8b fa 6e 73 b2 ae 4a 60 80 78 1c ...P...ns..J`.x. 03d0 53 e4 36 f4 92 5e 1d ec 12 74 ea 17 52 cc ed 3a S.6..^...t..R..: 03e0 9a 6f fb b4 e0 fe f5 fb e0 6e 40 cd 5e 68 73 3d .o.......n@.^hs= 03f0 67 87 9f 5b 5d 00 93 d7 d5 5c 12 6d 1f fb f7 98 g..[]....\.m.... 0400 22 66 f4 7f e5 63 8e 92 b4 f8 d0 d2 46 b5 e2 5a "f...c......F..Z 0410 7c 51 73 d1 35 ba 03 a9 07 3b 41 b1 3e 09 b1 77 |Qs.5....;A.>..w 0420 bf 92 7e 44 1a bd db 3f 76 aa 71 c3 23 f8 05 33 ..~D...?v.q.#..3 0430 b5 e6 6d ab 9c 90 39 9b 3b 1d 97 1a be b7 6a a1 ..m...9.;.....j. 0440 68 70 9f 09 94 47 70 54 9b 0b b4 ea 15 6a 39 9c hp...GpT.....j9. 0450 58 33 3a b4 65 a9 23 68 fd 22 72 82 8e 3f 56 b4 X3:.e.#h."r..?V. 0460 31 58 1e 2e 5d f2 d7 a3 93 40 d0 61 5e 32 18 1b 1X..]....@.a^2.. 0470 d3 b1 7c e1 10 1f f3 fb f3 d5 3f dc 77 14 74 25 ..|.......?.w.t% 0480 92 5f df ba 0b 67 a2 d0 5c b0 15 20 bb b8 0e 5d ._...g..\.. ...] 0490 9c 9b e1 93 83 9d b9 63 b2 87 17 d4 fc 87 3a ac .......c......:. 04a0 90 7d 1c 49 09 83 89 33 06 07 94 ea e8 8f a3 2d .}.I...3.......- 04b0 17 35 5f bc cd c2 73 63 43 ed 05 75 c3 72 15 18 .5_...scC..u.r.. 04c0 5d 9e 24 d5 e8 6d 72 53 b8 a9 10 2b 15 fb cf c6 ].$..mrS...+.... 04d0 65 e7 c0 89 81 dc ef c7 36 80 4f 63 9a 89 9a c4 e.......6.Oc.... 04e0 91 66 f0 32 a1 b4 2a 74 52 e6 88 c6 eb de 1c 54 .f.2..*tR......T 04f0 15 b2 44 b9 98 5d 1b db 52 53 ce 09 0b bc d1 ee ..D..]..RS...... 0500 7e 9f d4 62 ac 62 38 30 fd d1 0e e1 41 09 17 30 ~..b.b80....A..0 0510 e2 4e 38 a8 49 2d 2a b1 d4 4b aa 33 84 70 00 8f .N8.I-*..K.3.p.. 0520 07 63 ea 4b 81 75 07 ef 76 7f d4 05 f9 b4 bc d4 .c.K.u..v....... 0530 de b4 14 f3 e0 0e 23 0b 4c ff 43 c6 e3 8a 91 03 ......#.L.C..... 0540 f6 5d 2a 71 03 9b 8b c6 27 2a 11 9b d7 92 64 2a .]*q....'*....d* 0550 35 a6 37 06 9c 35 41 a0 b8 f3 71 f0 8a 01 e6 bc 5.7..5A...q..... 0560 7d 4d db 25 92 82 0f 01 4d 16 e7 40 3a f0 8a b5 }M.%....M..@:... 0570 1e c9 ef e4 ae ca b8 26 a1 8a 59 a1 cb 96 b2 81 .......&..Y..... 0580 3f c0 dc a7 fd 67 31 94 c7 f8 24 8e 83 fc 1c b2 ?....g1...$..... 0590 f2 2e 65 bc 7b da a7 ad b5 c5 f2 05 38 f0 03 d6 ..e.{.......8... 05a0 9e 63 c1 ff 9c 69 49 8d 02 2a eb 4c 0d a5 2c 29 .c...iI..*.L..,) 05b0 e6 3a d6 60 .:.` No. Time Source Destination Protocol Info 2785 821.385486 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=4869 Ack=40755 Win=17520 [TCP CHECKSUM INCORRECT] Len=0 Frame 2785 (54 bytes on wire, 54 bytes captured) Arrival Time: Nov 11, 2005 16:43:50.143990000 Time delta from previous packet: 0.000027000 seconds Time since reference or first frame: 821.385486000 seconds Frame Number: 2785 Packet Length: 54 bytes Capture Length: 54 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x41ed (16877) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x349f] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 4869, Ack: 40755, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 4869 (relative sequence number) Acknowledgement number: 40755 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x845e [incorrect, should be 0xa7d3] SEQ/ACK analysis This is an ACK to the segment in frame: 2784 The RTT to ACK the segment was: 0.000027000 seconds No. Time Source Destination Protocol Info 2786 821.385577 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=40755 Ack=4869 Win=7604 Len=1460 Frame 2786 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:43:50.144081000 Time delta from previous packet: 0.000091000 seconds Time since reference or first frame: 821.385577000 seconds Frame Number: 2786 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x8857 (34903) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xe880 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 40755, Ack: 4869, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 40755 (relative sequence number) Next sequence number: 42215 (relative sequence number) Acknowledgement number: 4869 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7604 Checksum: 0x8753 [correct] Data (1460 bytes) 0000 7a 42 58 93 f3 45 0a 16 ff 3f c9 14 2c a4 54 2a zBX..E...?..,.T* 0010 52 81 c8 07 a1 5e 6c ac de ef 58 15 12 85 8d 8f R....^l...X..... 0020 e6 9e 03 2f a8 90 bd 3d 0b 4a 6c 6f ff 41 7e 11 .../...=.Jlo.A~. 0030 fa 62 77 9c 84 bc 62 b5 5a 62 f3 7d 47 d3 ba 06 .bw...b.Zb.}G... 0040 08 de 85 fe 20 2f 65 b2 0f 79 45 ed 1f b2 df 28 .... /e..yE....( 0050 8f 76 d2 10 64 66 ba bd 7c be 95 6d 4c b4 22 e7 .v..df..|..mL.". 0060 69 a3 05 e0 a2 6c 96 f4 7d 91 44 98 12 79 0e e5 i....l..}.D..y.. 0070 fc 0f 0d c0 d5 b3 67 88 5e e0 20 79 c1 d8 4c 75 ......g.^. y..Lu 0080 b5 99 db 70 05 ac 05 82 a9 f0 8e 57 c2 19 5a ac ...p.......W..Z. 0090 1d 4d 4a 01 77 af 6c bb fc d5 4e 59 e3 3e 9b fb .MJ.w.l...NY.>.. 00a0 35 b4 a7 60 b4 85 cf ac 58 d6 28 1a bf 3b 46 99 5..`....X.(..;F. 00b0 30 0d 60 0e 5b d7 37 6b a9 c2 2f ab 44 2b ab 00 0.`.[.7k../.D+.. 00c0 ea 43 89 b9 5a 49 56 92 6c bc 6d f1 ff 80 10 5c .C..ZIV.l.m....\ 00d0 33 f6 c1 04 a1 a7 79 af d2 c3 fb 4c 10 24 ba ce 3.....y....L.$.. 00e0 cb 22 49 ba ca 28 16 31 f0 6c 6f 5a 39 c8 1f 44 ."I..(.1.loZ9..D 00f0 e5 1d e1 c8 a6 c9 8d 8b c9 93 c2 35 97 db 89 9d ...........5.... 0100 17 77 45 d2 54 85 77 62 67 ef f3 ae 9e d4 e6 e6 .wE.T.wbg....... 0110 ce 3c e6 85 cf 0e 59 9f 80 0a 7f bd d6 c4 c3 5c .<....Y........\ 0120 59 b2 4b 02 cc 61 40 ac 0e ca 71 90 a4 86 17 63 Y.K..a@...q....c 0130 5a 37 4c 6a b4 3e 37 80 0f c4 53 21 be 12 d0 89 Z7Lj.>7...S!.... 0140 18 70 b0 c8 85 7b 98 f4 57 25 64 2a f9 21 f8 5d .p...{..W%d*.!.] 0150 04 fd ea ee 07 b8 28 14 8b 3a 3f d6 7d c8 a4 f5 ......(..:?.}... 0160 e2 b1 d0 76 25 b7 77 cd 4d 8f ba 5e 19 97 e0 45 ...v%.w.M..^...E 0170 b6 f5 c8 f6 d9 78 d4 dc 21 7d 0c 2f aa fb 83 6f .....x..!}./...o 0180 aa 47 91 78 36 06 cc f4 45 f9 5e bc fa 99 a4 ba .G.x6...E.^..... 0190 cd 73 54 83 91 56 ca 11 87 05 2f 7a 15 30 1c 47 .sT..V..../z.0.G 01a0 d8 80 69 59 e8 f5 75 93 16 eb 8a 85 14 d1 80 ce ..iY..u......... 01b0 58 61 9b e7 99 fe 9c d8 51 4a 08 7d 4d 5a 1c 01 Xa......QJ.}MZ.. 01c0 0e d3 74 84 6b 3a b5 6b 04 0b 2d 54 51 e4 f6 ac ..t.k:.k..-TQ... 01d0 f2 82 c5 ec 1c 17 d2 5f 80 58 9d 01 43 43 56 10 ......._.X..CCV. 01e0 dd de ae e6 21 93 a0 42 1b 5c 42 90 72 4f 44 dd ....!..B.\B.rOD. 01f0 81 7f f1 3e 9a 08 0c 31 d9 49 d9 d9 48 f1 10 9d ...>...1.I..H... 0200 fe e7 7b 37 f4 ff c3 32 e3 4a 35 55 d9 84 3e 71 ..{7...2.J5U..>q 0210 b4 5e c3 86 54 e1 fb 15 e7 3c 1b d2 fb 91 77 75 .^..T....<....wu 0220 99 2c 8e f1 4e a9 46 31 54 ca d9 03 37 96 35 b2 .,..N.F1T...7.5. 0230 15 78 56 70 9a a9 6e 24 fc 4a 73 1a 1f c7 e4 e0 .xVp..n$.Js..... 0240 4c 99 56 2c 87 ac 95 3f ae ae 9b 07 3b 17 b4 e4 L.V,...?....;... 0250 57 8e 1f 51 02 bb aa 4c 4a 2e 23 e6 6d 92 14 90 W..Q...LJ.#.m... 0260 ad 74 9f db 35 eb 9c 96 8b 38 47 13 b2 9f 60 c4 .t..5....8G...`. 0270 98 0e c3 54 67 0f 88 c9 97 d8 8e dc 92 71 8b e1 ...Tg........q.. 0280 88 bb 14 84 3c 66 ee 60 a8 77 5a d9 8c 9f 7e 72 ....S> 02a0 0f 45 f7 f1 90 f7 38 e7 de a7 51 ca b8 53 b3 1b .E....8...Q..S.. 02b0 1e b0 34 43 14 df b5 5a 6d d0 12 0b fa a8 76 10 ..4C...Zm.....v. 02c0 54 81 06 e0 d6 18 05 2a a1 18 53 69 90 61 ff 32 T......*..Si.a.2 02d0 b9 bc 73 18 b2 8c 2d 63 80 4a ac 25 c5 ba 72 35 ..s...-c.J.%..r5 02e0 f9 1d f4 d6 55 15 99 68 8e cf a4 0a c5 69 c9 03 ....U..h.....i.. 02f0 1d c7 1a 1a 74 b9 f2 4f 60 f3 35 c9 41 a7 ec 28 ....t..O`.5.A..( 0300 59 32 35 96 40 38 74 5a 4b b1 e9 89 c2 8b ba 2d Y25.@8tZK......- 0310 4a 5e bd 0b a9 55 74 ab a3 a7 c1 e9 1b e6 e8 d3 J^...Ut......... 0320 27 04 2a f0 f4 d9 bf 18 df 8b b7 51 14 70 3f fc '.*........Q.p?. 0330 40 95 3c 93 c8 75 ee b4 c3 e6 dd 66 6a 6b 56 81 @.<..u.....fjkV. 0340 f1 36 b1 bb 6c 17 57 3b 43 73 58 35 66 e6 1e b8 .6..l.W;CsX5f... 0350 f4 52 80 fa 71 34 4b 6c d0 e6 a2 4a 54 18 92 03 .R..q4Kl...JT... 0360 d1 29 85 61 e2 e5 ef bb b6 b7 9c 22 ef 89 42 e6 .).a......."..B. 0370 b5 6b 39 49 8d 57 e7 b9 f3 83 fe ae 02 52 04 a8 .k9I.W.......R.. 0380 41 29 38 2f 7c a3 17 28 22 ca 3f 7b 99 4f a9 29 A)8/|..(".?{.O.) 0390 dc 4f e1 e5 71 04 9a c1 cd a7 97 dc 53 fd e6 17 .O..q.......S... 03a0 cb e8 74 9f 6c 58 e8 63 a7 03 0a d6 d3 6a 14 e0 ..t.lX.c.....j.. 03b0 8e 22 6b da 7b 50 05 58 fa 2e 3d 5d 04 96 fa 16 ."k.{P.X..=].... 03c0 ad 65 81 b1 4f ab e3 d3 fe 73 a4 7e e3 42 0c 3b .e..O....s.~.B.; 03d0 69 48 2e 64 20 68 82 6b 92 7e 30 db 15 59 e1 b9 iH.d h.k.~0..Y.. 03e0 21 c3 9c 14 02 36 4d 4b b1 5f 1b 66 67 bf b2 eb !....6MK._.fg... 03f0 d1 91 15 1c cf 8f 39 22 5a 86 60 3b 71 57 84 56 ......9"Z.`;qW.V 0400 a6 2d bc 20 14 a7 2a 0a be 42 8f cf 80 d0 a0 43 .-. ..*..B.....C 0410 45 61 0b 97 ba 12 76 cc 3e 27 f0 a5 64 78 a1 41 Ea....v.>'..dx.A 0420 4f 50 3a a7 3d ad ef ed f9 71 98 31 74 06 36 85 OP:.=....q.1t.6. 0430 1b af 46 07 b8 1f 62 04 29 4a 8d b0 48 92 32 41 ..F...b.)J..H.2A 0440 be 89 7b 90 15 a4 3a 9d 25 99 09 52 0d 35 5d bd ..{...:.%..R.5]. 0450 63 8e 67 e2 bd a9 65 59 2c bb de 24 92 f3 9f 27 c.g...eY,..$...' 0460 42 04 d7 1b 34 32 33 bb 88 c3 a6 f5 5a f4 64 6a B...423.....Z.dj 0470 db ca f2 7b 6f 47 97 50 e8 95 c7 6c 7f e7 bf 0d ...{oG.P...l.... 0480 ac 13 18 4e 4c 13 c3 00 b7 11 37 b1 5e b2 4c 3e ...NL.....7.^.L> 0490 9f 13 56 1b ab 5e 31 87 24 61 0c 74 f5 ca 2d d6 ..V..^1.$a.t..-. 04a0 83 a6 6a da 83 35 d0 f3 60 a4 76 4a a6 98 1c f6 ..j..5..`.vJ.... 04b0 b9 4e 99 30 5b e1 74 62 80 48 db 5f 97 80 0d 3c .N.0[.tb.H._...< 04c0 24 07 5b 13 5b 09 2a d4 29 0d 42 f8 21 f3 df 31 $.[.[.*.).B.!..1 04d0 6a db 82 55 7c 5a 66 c1 6c b7 bf f7 66 c1 0b b0 j..U|Zf.l...f... 04e0 67 f0 9b 37 00 29 21 19 8b 55 80 61 80 21 4c 20 g..7.)!..U.a.!L 04f0 d1 39 82 64 34 1f ab 33 0b 46 0e f5 2e d7 c0 ac .9.d4..3.F...... 0500 bd fc aa b3 ce 50 72 5e cf 4b 62 b7 70 94 16 33 .....Pr^.Kb.p..3 0510 82 ef 85 a0 b4 a1 ad 5c 36 f2 4b 5e aa 66 ae 1a .......\6.K^.f.. 0520 82 0b 5e 1f e2 2a 22 ec 3d 55 34 d5 36 3a 73 85 ..^..*".=U4.6:s. 0530 2e cc 75 dc 1b 36 f5 77 11 d6 15 2b 81 6a e1 28 ..u..6.w...+.j.( 0540 2a 4a 9b 10 96 b1 db b3 8f 96 38 b4 a6 9b ac 7a *J........8....z 0550 01 e6 99 75 7c 51 18 22 80 30 73 f2 97 ef 5c ee ...u|Q.".0s...\. 0560 af ce 2a fa 60 9a 90 22 ad ba 87 51 b2 2c 9c 0b ..*.`.."...Q.,.. 0570 52 10 22 40 83 83 c7 06 fa b1 5b cd e0 fc 9d 9c R."@......[..... 0580 82 53 b5 ad 26 35 6a 58 71 e6 05 4c 55 1f 67 d5 .S..&5jXq..LU.g. 0590 2a 51 cc 23 96 36 20 c4 55 27 97 df cd c9 ed e5 *Q.#.6 .U'...... 05a0 4d d1 58 ad ee 50 d8 a8 2b 20 32 32 cf a0 ad dd M.X..P..+ 22.... 05b0 74 8b c4 a8 t... No. Time Source Destination Protocol Info 2787 821.581428 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=4869 Ack=42215 Win=17520 [TCP CHECKSUM INCORRECT] Len=0 Frame 2787 (54 bytes on wire, 54 bytes captured) Arrival Time: Nov 11, 2005 16:43:50.339932000 Time delta from previous packet: 0.195851000 seconds Time since reference or first frame: 821.581428000 seconds Frame Number: 2787 Packet Length: 54 bytes Capture Length: 54 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x41f1 (16881) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x349b] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 4869, Ack: 42215, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 4869 (relative sequence number) Acknowledgement number: 42215 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x845e [incorrect, should be 0xa21f] SEQ/ACK analysis This is an ACK to the segment in frame: 2786 The RTT to ACK the segment was: 0.195851000 seconds No. Time Source Destination Protocol Info 2788 821.581663 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=42215 Ack=4869 Win=7604 Len=934 Frame 2788 (988 bytes on wire, 988 bytes captured) Arrival Time: Nov 11, 2005 16:43:50.340167000 Time delta from previous packet: 0.000235000 seconds Time since reference or first frame: 821.581663000 seconds Frame Number: 2788 Packet Length: 988 bytes Capture Length: 988 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 974 Identification: 0x8a57 (35415) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xe88e [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 42215, Ack: 4869, Len: 934 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 42215 (relative sequence number) Next sequence number: 43149 (relative sequence number) Acknowledgement number: 4869 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7604 Checksum: 0x2e6f [correct] Data (934 bytes) 0000 43 d8 63 71 91 33 d9 4c e2 fd 78 08 30 5d c3 10 C.cq.3.L..x.0].. 0010 be 72 e8 d5 40 20 cf 76 13 84 9b 13 9a c9 dd d3 .r..@ .v........ 0020 f6 ab af 30 df 69 22 e1 ba ef 3a 50 f3 ac 4b 30 ...0.i"...:P..K0 0030 ff e7 58 19 cd 29 3e 75 cd 85 cb 93 1a c0 21 85 ..X..)>u......!. 0040 e5 f8 a7 f1 47 10 0a 0c ad ae 59 04 27 6d ba bc ....G.....Y.'m.. 0050 b0 db a2 47 67 38 14 5a a5 83 b2 e2 47 18 df 35 ...Gg8.Z....G..5 0060 13 8c f4 b2 91 43 75 9c 21 c5 f9 d2 ac 5a 90 79 .....Cu.!....Z.y 0070 22 cd d3 73 d7 7a 49 61 77 64 b2 b4 96 4e 1d 4f "..s.zIawd...N.O 0080 d0 24 4a bf 03 82 c0 8a 96 b1 e0 df f7 f7 f2 64 .$J............d 0090 b9 6c 75 be 4f 39 9d ea 1c 06 ed 91 3f 0f 9d 38 .lu.O9......?..8 00a0 0e a6 e4 ec f3 fe 53 c4 b7 07 8f 47 a7 5d f0 d2 ......S....G.].. 00b0 50 0e 4d d4 1d 21 2f fa 64 e9 39 cf af 07 cb d3 P.M..!/.d.9..... 00c0 c9 e4 82 1a 25 53 e4 21 ed 43 d3 bd 3c 3c 56 fa ....%S.!.C..< 00e0 4a 36 89 58 fc c2 45 35 6d a8 fa e4 11 f6 e0 49 J6.X..E5m......I 00f0 a7 7c 27 7b 8b ce 32 70 3d c2 e4 d1 9e 6a ad 0d .|'{..2p=....j.. 0100 69 a0 2a fc 4e 87 88 c4 61 c3 79 48 61 56 e5 c1 i.*.N...a.yHaV.. 0110 7f dc 22 25 bd a9 d5 48 e8 b6 3a 21 59 30 15 70 .."%...H..:!Y0.p 0120 7b cb e9 1c 43 4f c3 8c 6c 53 cf 10 b2 06 5c dc {...CO..lS....\. 0130 d4 83 d7 01 ce 07 b3 f4 40 b0 92 27 e5 7e d0 34 ........@..'.~.4 0140 08 d6 45 51 e0 eb 62 f9 a7 d8 fb 1b 66 e1 3e d9 ..EQ..b.....f.>. 0150 ea f6 74 92 0e e1 6b a1 2e 03 d9 8c b8 f5 db 6d ..t...k........m 0160 35 32 44 eb b6 45 9e 4f 3f 5c 56 74 b4 09 33 9b 52D..E.O?\Vt..3. 0170 1c fb 93 2a a3 3f 49 c2 f7 48 5c 38 2e a7 e8 cb ...*.?I..H\8.... 0180 79 51 d6 bb e9 c7 cc 79 c6 99 75 d2 8d c5 0d 93 yQ.....y..u..... 0190 b7 51 61 cd 29 93 cf 0a 89 b9 8d 49 c3 fa 40 78 .Qa.)......I..@x 01a0 13 46 44 e7 1d af d5 bb 8e 90 03 c0 ee eb 72 a2 .FD...........r. 01b0 e4 03 f4 7f 4c a8 e8 96 d5 2d 18 92 b2 f9 23 24 ....L....-....#$ 01c0 f4 af c2 3d 2d 88 9b 33 46 b9 39 31 ff 9f b1 5e ...=-..3F.91...^ 01d0 49 5e 76 2a ae be 40 92 c6 81 6e 78 0f d4 94 9f I^v*..@...nx.... 01e0 9b d3 a7 0f fb 9f b4 71 64 c9 49 1a ef 93 d3 c4 .......qd.I..... 01f0 bc af dc d1 03 61 f6 b2 16 cd c6 ef 23 12 c6 26 .....a......#..& 0200 bf a4 1a 78 1d bd 45 f3 7a 43 61 f0 7a 12 36 0b ...x..E.zCa.z.6. 0210 83 66 18 54 67 22 3f 73 98 c5 e6 72 ff f0 d7 54 .f.Tg"?s...r...T 0220 38 47 57 1b d3 47 7c 7a 85 86 e4 c9 b6 25 29 dd 8GW..G|z.....%). 0230 8d c5 1f 08 b9 1b a6 b7 23 66 63 67 37 4e 4a 1b ........#fcg7NJ. 0240 c8 f5 04 4b a7 da 24 07 4c e9 fe bc ac 53 a9 76 ...K..$.L....S.v 0250 26 bb 48 0f e5 86 87 2d b8 b9 e5 77 cd 39 ba 56 &.H....-...w.9.V 0260 68 5c e3 5f 4d b7 d0 9c 21 c2 f1 5b e8 d4 c4 d9 h\._M...!..[.... 0270 06 69 01 0b 67 b5 ec 2a 51 f7 ca 73 e5 49 ae 1a .i..g..*Q..s.I.. 0280 c5 6b 35 da 05 95 22 23 c9 3c b1 94 44 dd fd 10 .k5..."#.<..D... 0290 68 5e 69 1e 79 3e 5f 64 3b d1 61 f3 82 fd a3 28 h^i.y>_d;.a....( 02a0 09 0b a3 98 7b f3 b8 82 03 f6 22 67 57 b4 20 23 ....{....."gW. # 02b0 ca a4 e8 6e b1 d8 84 33 50 df 73 85 9f d5 fe 3d ...n...3P.s....= 02c0 4b 73 83 fe 66 ba 8e 12 81 e9 b9 40 17 07 d8 c8 Ks..f......@.... 02d0 73 67 12 75 4d 9c 12 57 95 c0 77 32 97 0e ea 75 sg.uM..W..w2...u 02e0 da 57 75 ea ad 24 4c 3a b4 f1 9e 63 44 6c d7 dc .Wu..$L:...cDl.. 02f0 f2 b7 e8 c0 b9 95 e3 a3 1b b2 c3 80 ab ff 69 56 ..............iV 0300 19 0e 61 36 72 90 15 a9 44 f5 cf fd 21 1d 3c af ..a6r...D...!.<. 0310 89 d5 1c 32 f6 b7 c6 84 25 1c 41 46 28 e5 f6 d5 ...2....%.AF(... 0320 a5 34 bf 17 53 3c 0b dd 69 e1 d5 c7 f1 56 1d e0 .4..S<..i....V.. 0330 80 e4 77 0c 36 2f 84 2c 0e 5e 3f a4 bd 82 e6 0a ..w.6/.,.^?..... 0340 78 5f 97 c6 26 a0 04 56 19 b1 dd ed f9 9d bd ef x_..&..V........ 0350 b2 ba d5 68 18 75 02 8c 76 63 81 75 78 17 54 b6 ...h.u..vc.ux.T. 0360 3f e7 43 cd 9f 30 61 e9 8a f4 39 8e cb c7 e9 d9 ?.C..0a...9..... 0370 c6 5b 14 fe 5c ad 9e dd 64 5e 77 d5 2d 00 17 02 .[..\...d^w.-... 0380 5e 76 00 fa 48 ef d0 52 e4 94 ad b1 05 b1 0a f2 ^v..H..R........ 0390 2c 7a 14 72 6a a8 93 97 02 e9 19 f0 3c cc 5b a6 ,z.rj.......<.[. 03a0 ff 43 7d 3c c2 14 .C}<.. No. Time Source Destination Protocol Info 2789 821.662726 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=4869 Ack=43149 Win=16586 [TCP CHECKSUM INCORRECT] Len=134 Frame 2789 (188 bytes on wire, 188 bytes captured) Arrival Time: Nov 11, 2005 16:43:50.421230000 Time delta from previous packet: 0.081063000 seconds Time since reference or first frame: 821.662726000 seconds Frame Number: 2789 Packet Length: 188 bytes Capture Length: 188 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 174 Identification: 0x41f2 (16882) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3414] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 4869, Ack: 43149, Len: 134 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 4869 (relative sequence number) Next sequence number: 5003 (relative sequence number) Acknowledgement number: 43149 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16586 Checksum: 0x84e4 [incorrect, should be 0x7476] SEQ/ACK analysis This is an ACK to the segment in frame: 2788 The RTT to ACK the segment was: 0.081063000 seconds Data (134 bytes) 0000 bc ef 86 00 b5 fe 18 00 6c 00 00 21 15 33 32 0a ........l..!.32. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 0c bc 76 aa 3b b1 23 76 a.elr.....v.;.#v 0030 4e 34 71 28 64 30 07 f5 8b 4b 06 d5 a3 32 9f 84 N4q(d0...K...2.. 0040 78 14 0d c8 81 20 fa 3e 82 6b f3 0f d8 ea 53 d0 x.... .>.k....S. 0050 78 34 0b 2e 7d 30 88 fe 9a 4b 65 f1 ab 32 18 41 x4..}0...Ke..2.A 0060 e1 b0 60 2a 8b 84 6d 58 fc cf 9e e4 c6 4e d0 08 ..`*..mX.....N.. 0070 2d 90 66 a8 63 94 10 75 91 ef 6b 6e b2 32 ec a0 -.f.c..u..kn.2.. 0080 73 15 0f ec 86 00 s..... No. Time Source Destination Protocol Info 2790 821.663950 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=43149 Ack=5003 Win=7470 Len=1460 Frame 2790 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:43:50.422454000 Time delta from previous packet: 0.001224000 seconds Time since reference or first frame: 821.663950000 seconds Frame Number: 2790 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x8b57 (35671) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xe580 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 43149, Ack: 5003, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 43149 (relative sequence number) Next sequence number: 44609 (relative sequence number) Acknowledgement number: 5003 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7470 Checksum: 0xf7a1 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2789 The RTT to ACK the segment was: 0.001224000 seconds Data (1460 bytes) 0000 bc ef ce 08 b5 fe 18 00 dc 0a 12 21 33 ac 32 0a ...........!3.2. 0010 04 00 3c 2a 71 43 00 00 70 1a 0f f0 5b bf 76 4c ..<*qC..p...[.vL 0020 6f 01 75 3f 55 b5 49 d1 87 dd b4 11 21 37 6e b4 o.u?U.I.....!7n. 0030 6c 0a a5 2e 7a 94 0c 73 bf 76 c4 d0 83 32 d3 4e l...z..s.v...2.N 0040 ed d8 a4 6d d5 04 21 82 b7 70 30 77 67 47 80 9b ...m..!..p0wgG.. 0050 e8 f4 5b 29 48 8d bb db 9e ca aa dd c5 08 01 0d ..[)H........... 0060 29 08 c9 52 09 8c 3b d9 1e ef 9d 45 85 fe 09 1f )..R..;....E.... 0070 61 2c 85 3f ff da 78 73 89 cb 1a 28 34 76 fd 42 a,.?..xs...(4v.B 0080 5a 68 55 52 ae 32 ac 3f 9d e8 ef e2 98 75 3c eb ZhUR.2.?.....u<. 0090 d7 4b 15 37 5d 1f 8c 16 65 45 69 c1 df 03 0e 68 .K.7]...eEi....h 00a0 ab 7f dd d9 98 66 ec ae df ef ab db 0b 71 f8 70 .....f.......q.p 00b0 eb 48 56 4e 61 70 1c 2e 0c df 5f 5c 41 3a a8 05 .HVNap...._\A:.. 00c0 11 98 65 b4 0e 0a ad fa 85 66 65 7d ec f4 21 8a ..e......fe}..!. 00d0 f9 2a a3 e2 5b 98 3a 7a af 62 5a 6d c8 25 09 0b .*..[.:z.bZm.%.. 00e0 ec 82 ed bf f1 82 71 ef 19 d9 94 ac f2 8b 57 ca ......q.......W. 00f0 69 31 53 bf 0d 90 71 9e 69 9b 17 35 91 43 a5 b9 i1S...q.i..5.C.. 0100 15 1c 71 64 80 9d 86 60 bc bc 01 b1 e1 8a 48 40 ..qd...`......H@ 0110 dc 84 32 20 74 90 b1 30 ce 4d 0a cf 12 fe df 64 ..2 t..0.M.....d 0120 1e 08 28 ed d2 38 21 8c bc 28 41 49 78 08 0c ac ..(..8!..(AIx... 0130 64 c7 b3 f6 8b 98 22 3a 9f db f6 f4 ed 36 10 85 d.....":.....6.. 0140 47 d4 47 03 05 84 f9 f6 75 e8 60 cd ae 0b 2e 45 G.G.....u.`....E 0150 75 f4 66 a3 65 05 e8 36 80 a9 62 0d 26 ce ba 8c u.f.e..6..b.&... 0160 4f 15 a5 99 c7 9a 7b 82 32 2e 38 03 cc 54 53 a5 O.....{.2.8..TS. 0170 5e 34 ca d6 dd b6 8e ff 9f 5b ea eb 75 63 76 53 ^4.......[..ucvS 0180 95 07 80 33 f4 80 bf 4e e0 79 e9 fa b2 06 61 25 ...3...N.y....a% 0190 4e c9 33 68 5c 8e 38 93 fc f8 4f 0f 61 4e 0c db N.3h\.8...O.aN.. 01a0 4e d4 05 0d c3 7e f8 18 ce 03 46 c7 34 db d0 45 N....~....F.4..E 01b0 bf 5b a2 db 94 b1 41 07 d8 89 a1 cf db 73 89 d0 .[....A......s.. 01c0 cd b5 73 2e e4 37 5c 13 c1 61 2c 73 d7 35 95 dc ..s..7\..a,s.5.. 01d0 3f 61 6f 5e a1 dc 9c 04 dd 6f 31 64 d7 e6 b4 05 ?ao^.....o1d.... 01e0 50 88 64 1f 56 cd 4f 3c 93 58 2b 0d df 3f c1 a3 P.d.V.O<.X+..?.. 01f0 15 59 ab 03 ad 00 a0 56 35 3b 3f 7b 49 31 b5 d9 .Y.....V5;?{I1.. 0200 ee 71 8b 3b a8 9d e1 82 e5 20 87 94 c6 43 f4 7d .q.;..... ...C.} 0210 3d 04 55 2f 73 dd 76 1a 1d c9 91 df 13 25 60 4d =.U/s.v......%`M 0220 ae 9f 09 b5 0c dd 96 d9 ba 89 82 1c dd 1c b8 61 ...............a 0230 51 98 92 a4 2b 75 78 96 b0 54 ce d0 c5 0f a3 3b Q...+ux..T.....; 0240 1f c8 9b fa 56 ac 53 3d 75 a0 5f ed e7 a0 5b aa ....V.S=u._...[. 0250 07 90 67 3f e4 09 58 e2 b0 bb 82 a9 96 e8 db d1 ..g?..X......... 0260 25 aa 50 7f 6c b3 af ea e0 35 56 58 cc b4 ff 29 %.P.l....5VX...) 0270 e1 a9 55 89 83 0a b2 c8 80 f9 4b a8 7f 33 9a 7f ..U.......K..3.. 0280 c1 69 0b de 46 08 e7 b3 ab 9b b7 33 f0 06 bb f3 .i..F......3.... 0290 8f 48 11 f3 d0 95 85 10 a7 50 27 d4 64 aa 68 ee .H.......P'.d.h. 02a0 e3 7d 91 70 93 2f 1e 6b cf 09 eb e4 4b 33 8b d5 .}.p./.k....K3.. 02b0 58 52 a1 6c 27 ee fd 6f 4c 5f a8 5d 2b 25 1f 05 XR.l'..oL_.]+%.. 02c0 f3 1f 0d ba 00 a8 bb ff 3f ef b2 94 7f 73 19 1b ........?....s.. 02d0 3a 19 7f 32 d1 37 8d c8 2d 20 44 a8 e4 7c a1 69 :..2.7..- D..|.i 02e0 19 69 42 96 26 d8 60 fc 48 2b 9b 7a 64 7f f9 e5 .iB.&.`.H+.zd... 02f0 1c e7 41 f2 b9 8e 66 ac ff a5 ab de 91 a5 a5 eb ..A...f......... 0300 b2 9c 5e 81 89 a3 3a 1f d4 b4 9c 80 65 d3 ed 89 ..^...:.....e... 0310 3a f6 f9 41 d3 65 a0 b1 ad ff 71 f5 ff 0a b5 d1 :..A.e....q..... 0320 d4 8f 31 af 59 f7 d0 35 15 11 8b 7a bb be d0 aa ..1.Y..5...z.... 0330 66 63 1f 45 a2 54 f9 25 ce 95 24 6e 58 7f 9c a3 fc.E.T.%..$nX... 0340 38 40 ba fd 42 8e 49 09 eb 8d a4 e2 c6 78 be b1 8@..B.I......x.. 0350 6a 5e b4 c3 e9 78 3b 32 93 7d 45 87 b2 7a 6c f0 j^...x;2.}E..zl. 0360 5d ea e4 10 f5 8d bb 7f a3 86 39 6f 8b 84 cb fb ].........9o.... 0370 9f 9d 3f 62 30 e1 1a 2b ed 5f 78 68 67 20 5a 75 ..?b0..+._xhg Zu 0380 2e 95 0f 2a 9d a4 b7 c6 1c a7 4b 19 cf 63 9b 85 ...*......K..c.. 0390 58 0c c7 84 75 ee 41 9e 3f 47 b5 e4 1c c9 78 10 X...u.A.?G....x. 03a0 31 a3 bc a4 9e 7d 76 1a a5 15 0e 10 86 ae 59 64 1....}v.......Yd 03b0 56 d3 ed 39 eb 07 2e 06 7d a7 72 bc 48 d1 ad 76 V..9....}.r.H..v 03c0 77 fd 8d 69 e7 48 79 80 4b 33 29 c4 38 35 4e b1 w..i.Hy.K3).85N. 03d0 c0 f6 0d df 03 58 30 c4 f2 64 9e 32 8b 5a 00 0f .....X0..d.2.Z.. 03e0 0b e6 26 3f a8 81 4a a9 7b 02 f6 6a 69 32 14 2f ..&?..J.{..ji2./ 03f0 f0 bf 94 6f f9 e1 a0 59 8c b7 ce 82 7b 05 7a 25 ...o...Y....{.z% 0400 01 f8 64 28 76 3d 87 6f db 84 d8 2d 34 1c 72 8d ..d(v=.o...-4.r. 0410 2a 77 d8 4d 3e 21 87 d8 77 5e ff d1 4e ea a8 58 *w.M>!..w^..N..X 0420 0e 78 03 0f f6 30 7d 07 64 d0 0f 6f 31 92 9c 81 .x...0}.d..o1... 0430 8d 29 60 a6 0b 88 41 e2 2a 6d b0 28 07 68 0a 2c .)`...A.*m.(.h., 0440 7d b1 f9 90 78 05 d8 fb b3 bb 1f 9e 7e ff e7 ab }...x.......~... 0450 6c 17 84 f6 e0 d7 64 80 1f 3c 72 fb 2f a8 2a c3 l.....d.....K.C 04c0 43 e5 f4 51 85 d4 95 5f 9e b7 13 6a 32 0f 26 7c C..Q..._...j2.&| 04d0 8a 3f 31 77 e6 a5 97 60 7f 56 8e c5 9c 09 39 48 .?1w...`.V....9H 04e0 72 96 0b 74 11 7f 97 20 76 39 af 6c 94 20 8e 00 r..t... v9.l. .. 04f0 98 b3 40 54 5d a7 67 aa c1 1b ca 91 57 56 79 8f ..@T].g.....WVy. 0500 c7 74 ce 60 15 cf ba cd 98 70 03 0e f7 6a c3 5d .t.`.....p...j.] 0510 1b 2a bf 1f 26 7d a4 ea d2 58 82 27 39 b8 f8 13 .*..&}...X.'9... 0520 c7 a2 40 9f aa 5c 22 71 61 0f b1 80 69 2a bc ca ..@..\"qa...i*.. 0530 6e 07 d7 72 45 37 fe 4d 8f b6 6b 35 2e d8 3c 2f n..rE7.M..k5.. 1677 [ACK] Seq=5003 Ack=44609 Win=17520 [TCP CHECKSUM INCORRECT] Len=0 Frame 2791 (54 bytes on wire, 54 bytes captured) Arrival Time: Nov 11, 2005 16:43:50.540246000 Time delta from previous packet: 0.117792000 seconds Time since reference or first frame: 821.781742000 seconds Frame Number: 2791 Packet Length: 54 bytes Capture Length: 54 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x41f4 (16884) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3498] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 5003, Ack: 44609, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 5003 (relative sequence number) Acknowledgement number: 44609 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x845e [incorrect, should be 0x983f] SEQ/ACK analysis This is an ACK to the segment in frame: 2790 The RTT to ACK the segment was: 0.117792000 seconds No. Time Source Destination Protocol Info 2792 821.781966 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=44609 Ack=5003 Win=7470 Len=794 Frame 2792 (848 bytes on wire, 848 bytes captured) Arrival Time: Nov 11, 2005 16:43:50.540470000 Time delta from previous packet: 0.000224000 seconds Time since reference or first frame: 821.781966000 seconds Frame Number: 2792 Packet Length: 848 bytes Capture Length: 848 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 834 Identification: 0x8d57 (36183) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xe61a [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 44609, Ack: 5003, Len: 794 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 44609 (relative sequence number) Next sequence number: 45403 (relative sequence number) Acknowledgement number: 5003 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7470 Checksum: 0xd1b9 [correct] Data (794 bytes) 0000 7b d6 62 87 3d 66 56 57 01 ef 60 08 70 05 1f 1d {.b.=fVW..`.p... 0010 3b d4 53 fd d6 f4 9d 15 44 b0 6b 98 71 13 4f 32 ;.S.....D.k.q.O2 0020 72 0f 4e 14 c5 f1 d6 32 8b 2b 18 99 84 ee 01 47 r.N....2.+.....G 0030 e5 67 b1 39 1d 3f 99 08 44 cb 91 ee 7d 52 f6 11 .g.9.?..D...}R.. 0040 5f 9e 8b c6 a5 99 92 72 d1 f5 f1 bb 3f dd 4c 46 _......r....?.LF 0050 1c e7 7b e5 2c 93 13 90 be 3f 46 49 6b 9c 2c 19 ..{.,....?FIk.,. 0060 4e 78 83 21 b9 56 b8 7d 63 f2 a9 8c 6f fa 7a 0b Nx.!.V.}c...o.z. 0070 ba 2b f9 62 79 8f dd a6 24 ad 96 72 e3 91 ba 6c .+.by...$..r...l 0080 f9 90 e7 d8 8d 33 b8 1d 2a e9 48 4d 9c d6 b1 14 .....3..*.HM.... 0090 be 48 d5 b3 c0 ad e5 93 e7 35 fa 55 02 07 b3 ce .H.......5.U.... 00a0 a0 97 84 58 d7 48 6f 5c f4 6f 3c b2 bf c3 57 0c ...X.Ho\.o<...W. 00b0 85 bd 99 f9 a4 92 bb cd 72 0a c8 d2 cd 0a 65 a5 ........r.....e. 00c0 a3 bd 4a 20 eb f8 32 29 eb d3 30 9a 83 b8 ea c7 ..J ..2)..0..... 00d0 c9 57 8e f5 23 7b 05 73 e4 84 dd f8 4c b8 4b 4a .W..#{.s....L.KJ 00e0 72 07 15 c0 9f 12 4d bc 16 7d d1 2a 0b c7 75 99 r.....M..}.*..u. 00f0 0e 30 06 f4 3c a5 08 b8 5f 24 b9 b7 55 d2 13 8b .0..<..._$..U... 0100 92 1f 66 c9 1a 47 ab 01 ef dc 87 be 1b 7b 97 1e ..f..G.......{.. 0110 4e aa c2 7d 4f d0 c9 93 27 14 e2 39 b1 88 74 d9 N..}O...'..9..t. 0120 19 ac 0b b8 58 d1 f7 d8 37 6a 52 35 1c a3 56 ea ....X...7jR5..V. 0130 2f 2f e5 0a 03 96 6e 93 5b dc 37 52 4e 07 55 4f //....n.[.7RN.UO 0140 de 35 6d a6 8c 15 46 3b 2e 81 2a a8 d2 db 8d cf .5m...F;..*..... 0150 d1 9a 03 e7 cd b9 1b d3 a9 b8 9e fc 0b 5d 4d 51 .............]MQ 0160 fc 64 5f 39 68 6b 67 88 17 70 70 90 0e eb 72 7c .d_9hkg..pp...r| 0170 7f fe cf 9a 8a 74 72 8b ae 1c 7b 77 48 38 ac 78 .....tr...{wH8.x 0180 a9 a6 ee 23 5b bf 7a 49 9e 10 dc c7 f0 25 b9 f5 ...#[.zI.....%.. 0190 aa 4a 9b 94 47 2e c4 71 f5 b9 09 4a 7d bb c0 ae .J..G..q...J}... 01a0 67 7b d9 d7 de df 22 20 6b da 98 4d 37 7c be 32 g{...." k..M7|.2 01b0 f7 f8 05 aa 3d bf 65 8f 1b b4 5f 8c 69 cb 3b 88 ....=.e..._.i.;. 01c0 6f 82 ac 61 22 27 46 99 bb 70 88 bb 5f db f4 c2 o..a"'F..p.._... 01d0 6d a2 b3 ed c9 ec 52 3d 74 d2 fc b2 c7 c9 fd d5 m.....R=t....... 01e0 0f e4 ea a4 9a 1b 9c 21 a3 e5 38 42 30 32 18 30 .......!..8B02.0 01f0 73 26 d7 70 cb 39 06 d9 27 80 42 ad 8b 5f 5a 33 s&.p.9..'.B.._Z3 0200 94 c3 ef 38 fe 5b 58 61 89 e3 d0 7d c7 99 5e f0 ...8.[Xa...}..^. 0210 79 94 62 ef 26 ce 8f 5e a2 84 c5 7f 77 a3 46 bd y.b.&..^....w.F. 0220 e1 d4 14 e4 11 49 1b 12 ca 5e 2a 5f 0e 9a 04 a2 .....I...^*_.... 0230 39 71 b7 51 2c 3e a5 ad 32 39 b6 fd e7 0a 6c 4b 9q.Q,>..29....lK 0240 ad c1 9f 41 36 75 82 b3 07 61 57 5c 19 de 50 71 ...A6u...aW\..Pq 0250 11 9f ea 6c d4 8d 7f a8 ff 64 3c 76 ac 0f a2 89 ...l.....do..k....&.a 02e0 2d f3 ad 09 c2 d0 d6 cc f7 79 2d 9f 63 1f a8 a2 -........y-.c... 02f0 86 be d5 f9 d4 38 9f 01 07 0e d3 e4 4f 23 6b 79 .....8......O#ky 0300 7b 8b 3a 62 84 27 4a a5 a4 68 5a d4 bc 81 42 6c {.:b.'J..hZ...Bl 0310 2f 4a c4 ab e5 bf 10 78 ce 08 /J.....x.. No. Time Source Destination Protocol Info 2793 821.783530 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=5003 Ack=45403 Win=16726 [TCP CHECKSUM INCORRECT] Len=382 Frame 2793 (436 bytes on wire, 436 bytes captured) Arrival Time: Nov 11, 2005 16:43:50.542034000 Time delta from previous packet: 0.001564000 seconds Time since reference or first frame: 821.783530000 seconds Frame Number: 2793 Packet Length: 436 bytes Capture Length: 436 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 422 Identification: 0x41f5 (16885) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3319] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 5003, Ack: 45403, Len: 382 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 5003 (relative sequence number) Next sequence number: 5385 (relative sequence number) Acknowledgement number: 45403 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16726 Checksum: 0x85dc [incorrect, should be 0x95af] SEQ/ACK analysis This is an ACK to the segment in frame: 2792 The RTT to ACK the segment was: 0.001564000 seconds Data (382 bytes) 0000 bc ef 7e 01 b5 fe 18 00 62 01 02 21 85 d0 32 0a ..~.....b..!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 cc 6c 69 b4 08 9a 75 bc 0b 0e 7f 8b 73 32 a..li...u.....s2 0030 20 77 24 65 3c ea 31 a9 cc 0f 4b a7 ed 7b 9a 11 w$e<.1...K..{.. 0040 23 58 4c 8b dc c8 de e4 b4 37 a9 6a a9 3e 70 21 #XL......7.j.>p! 0050 2c 79 49 71 32 a5 d2 a9 d8 1c 62 f1 ab 32 18 41 ,yIq2.....b..2.A 0060 6f 14 67 2a 85 84 71 fc 85 6b 99 e4 cc 4e d0 09 o.g*..q..k...N.. 0070 6f 34 61 a8 69 94 00 75 8d 4b 16 6e b3 32 e4 a0 o4a.i..u.K.n.2.. 0080 5f 14 13 48 ad 84 8d 1a 85 6b ed 8f d4 4e 2c f4 _..H.....k...N,. 0090 5f 34 15 ae 51 94 fc 7f bd 4b 52 71 bb 32 18 c1 _4..Q....KRq.2.. 00a0 6f 14 57 aa 95 84 71 7c 85 6b a9 64 dc 4e d0 89 o.W...q|.k.d.N.. 00b0 6f 34 51 28 59 94 00 f5 8d 4b 26 ee 83 32 e4 20 o4Q(Y....K&..2. 00c0 7f 14 23 c8 bd 84 8d 9a 85 6b dd 0f e4 4e 2c 74 ..#......k...N,t 00d0 7f 34 25 2e 41 94 fc ff 9d 4b 42 f1 8b 32 18 41 .4%.A....KB..2.A 00e0 6f 14 47 2a a5 84 71 fc 85 6b b9 e4 ec 4e d0 09 o.G*..q..k...N.. 00f0 6f 34 41 a8 49 94 00 75 8d 4b 36 6e 93 32 e4 a0 o4A.I..u.K6n.2.. 0100 1f 14 33 48 cd 84 8d 1a 85 6b cd 8f f4 4e 2c f4 ..3H.....k...N,. 0110 1f 34 35 ae 31 94 fc 7f fd 4b 32 71 28 96 84 c1 .45.1....K2q(... 0120 68 14 bf ab b5 84 1e 18 f3 02 ac 15 8f 4e e3 27 h............N.' 0130 73 34 b6 37 3d 94 00 95 fa 22 28 0e 4d 96 78 40 s4.7=...."(.M.x@ 0140 7c 14 d3 29 dd 84 d8 ab c8 27 e2 ba b5 60 fa 5b |..).....'...`.[ 0150 28 34 c5 d1 21 94 67 5b 81 4b 28 f1 e8 32 88 e5 (4..!.g[.K(..2.. 0160 6e 14 ad 2b 90 84 ff 5a 82 6b d7 e2 90 ea 4c a7 n..+...Z.k....L. 0170 12 34 a0 b7 21 94 2c 14 91 ef ea 95 7e 01 .4..!.,.....~. No. Time Source Destination Protocol Info 2794 821.784274 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=45403 Ack=5385 Win=7604 Len=438 Frame 2794 (492 bytes on wire, 492 bytes captured) Arrival Time: Nov 11, 2005 16:43:50.542778000 Time delta from previous packet: 0.000744000 seconds Time since reference or first frame: 821.784274000 seconds Frame Number: 2794 Packet Length: 492 bytes Capture Length: 492 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 478 Identification: 0x8e57 (36439) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xe67e [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 45403, Ack: 5385, Len: 438 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 45403 (relative sequence number) Next sequence number: 45841 (relative sequence number) Acknowledgement number: 5385 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7604 Checksum: 0xa99f [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2793 The RTT to ACK the segment was: 0.000744000 seconds Data (438 bytes) 0000 bc ef b6 01 b4 fe 18 00 9a 01 02 21 5e 67 32 0a ...........!^g2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 e2 99 fa 42 ..<*qC..f......B 0020 68 04 75 2e 75 b4 bc 54 99 bc 0c f0 34 b1 2f 74 h.u.u..T....4./t 0030 00 52 07 47 1c e3 73 ff 3e ef 1a f0 a4 32 e0 42 .R.G..s.>....2.B 0040 7f 14 74 47 f3 84 23 54 99 6b fe f1 d4 4e 2c 72 ..tG..#T.k...N,r 0050 2a 67 48 7c 3e c7 cd b7 cb 0e 35 0f ab 32 18 43 *gH|>.....5..2.C 0060 f4 b0 7b 28 8f 84 72 ee 95 cf 98 96 c6 4e 85 8b ..{(..r......N.. 0070 e1 90 66 2e 67 94 1b ff 91 4b 1a f0 b2 39 e4 42 ..f.g....K...9.B 0080 29 15 0f 2e a3 84 12 54 99 6b e7 f1 c6 4e 25 72 )......T.k...N%r 0090 43 34 1d 30 59 94 5d 3d a1 4b 58 0f 8b 32 83 e7 C4.0Y.]=.KX..2.. 00a0 73 14 5d 28 96 84 ef 4a 99 6b a5 96 24 4e d0 8b s.](...J.k..$N.. 00b0 2c 0e 0d 6a 16 d7 55 b2 c8 35 17 ac c2 76 a9 0b ,..j..U..5...v.. 00c0 31 5d 5d 1f e1 c8 c2 b3 c4 27 8e 8f d5 12 78 17 1]]......'....x. 00d0 12 44 79 65 12 d9 b0 c6 ce 7a 6c 59 ce 65 18 43 .Dye.....zlY.e.C 00e0 6f 14 47 28 a5 84 71 ee 85 6b b9 96 ec 4e d0 8b o.G(..q..k...N.. 00f0 6f 34 41 2e 49 94 00 ff 8d 4b 36 f0 93 32 e4 42 o4A.I....K6..2.B 0100 1f 14 33 2e cd 84 8d f0 85 6b cd f1 f4 4e 2c 72 ..3......k...N,r 0110 1f 34 35 30 31 94 fc 99 fd 4b 32 0f 9b 32 98 43 .4501....K2..2.C 0120 6f 14 b7 29 b5 84 71 e8 85 6b c9 88 fc 4e 50 ed o..)..q..k...NP. 0130 6f 34 b1 d1 39 94 00 ff 8d 4b 46 f0 e3 32 64 42 o4..9....KF..2dB 0140 7f 14 c3 2f dd 84 8d f6 85 6b bd ef 84 4e ac 14 .../.....k...N.. 0150 7f 34 c5 cf 21 94 fc 99 9d 4b 22 0f eb 32 98 43 .4..!....K"..2.C 0160 6f 14 a7 29 c5 84 71 e8 85 6b d9 88 8c 4e 50 ed o..)..q..k...NP. 0170 6f 34 a1 d1 29 94 00 ff 8d 4b 56 f0 f3 32 64 42 o4..)....KV..2dB 0180 5f 14 d3 2f ed 84 8d f6 85 6b ad ef 94 4e ac 14 _../.....k...N.. 0190 5f 34 d5 cf 11 94 fc 99 bd 4b 12 0f fb 32 98 43 _4.......K...2.C 01a0 6f 14 97 29 d5 84 71 e8 18 cf f5 88 96 4e 50 ed o..)..q......NP. 01b0 cd 90 33 0a b6 01 ..3... No. Time Source Destination Protocol Info 2795 821.982022 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=5385 Ack=45841 Win=16288 [TCP CHECKSUM INCORRECT] Len=0 Frame 2795 (54 bytes on wire, 54 bytes captured) Arrival Time: Nov 11, 2005 16:43:50.740526000 Time delta from previous packet: 0.197748000 seconds Time since reference or first frame: 821.982022000 seconds Frame Number: 2795 Packet Length: 54 bytes Capture Length: 54 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x41f9 (16889) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3493] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 5385, Ack: 45841, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 5385 (relative sequence number) Acknowledgement number: 45841 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16288 Checksum: 0x845e [incorrect, should be 0x96c1] SEQ/ACK analysis This is an ACK to the segment in frame: 2794 The RTT to ACK the segment was: 0.197748000 seconds No. Time Source Destination Protocol Info 2796 821.982251 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=45841 Ack=5385 Win=7604 Len=812 Frame 2796 (866 bytes on wire, 866 bytes captured) Arrival Time: Nov 11, 2005 16:43:50.740755000 Time delta from previous packet: 0.000229000 seconds Time since reference or first frame: 821.982251000 seconds Frame Number: 2796 Packet Length: 866 bytes Capture Length: 866 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 852 Identification: 0x9557 (38231) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xde08 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 45841, Ack: 5385, Len: 812 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 45841 (relative sequence number) Next sequence number: 46653 (relative sequence number) Acknowledgement number: 5385 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7604 Checksum: 0x851b [correct] Data (812 bytes) 0000 bc ef f6 02 b0 fe 1c 00 01 0b 11 21 00 54 e0 0e ...........!.T.. 0010 3c ca 74 43 04 00 3c 2a 71 43 00 00 02 26 c5 f4 <.tC..<*qC...&.. 0020 6b bd e5 40 6c 85 0d 79 77 37 cf f0 95 bc 03 f0 k..@l..yw7...... 0030 cd b4 4d f8 5f 79 71 36 39 92 90 fe 3e 67 91 70 ..M._yq69...>g.p 0040 85 b1 ad 3a 7f 24 7c 2e 5d 8f 71 82 d1 12 1f f0 ...:.$|.].q..... 0050 7d ea b1 e8 72 6d 8a 51 a7 d5 c2 fe 8f f3 ee 91 }...rm.Q........ 0060 ab fe 62 40 fd ae a4 11 ab b4 f9 eb 82 fb 91 8f ..b@............ 0070 89 3f 78 db 46 78 a1 ca 13 f6 04 69 cc 8b cd bf .?x.Fx.....i.... 0080 f7 54 85 45 58 cb d2 22 8a 07 8e f3 15 f7 dd d7 .T.EX.."........ 0090 c4 cb 74 27 76 d6 49 3e 50 14 fa d5 8f 2b 93 2f ..t'v.I>P....+./ 00a0 ab 12 07 51 07 49 96 a9 87 44 77 ae 84 05 a7 9c ...Q.I...Dw..... 00b0 5c d1 28 97 a7 8c 46 57 39 e1 00 7f 46 ad 45 40 \.(...FW9...F.E@ 00c0 b9 b9 e5 36 91 c4 d8 2b bc c5 22 58 d6 73 6e 6f ...6...+.."X.sno 00d0 80 52 22 b6 5f fa 27 3c 62 84 1c 45 9d 72 a0 bf .R"._.'.}j.x.. 0120 5f 31 49 43 9d d0 b6 8d 41 ce fd 2c 19 ad ef be _1IC....A..,.... 0130 ca de b3 e1 53 e7 bd 58 1b 94 52 fe de eb 01 c0 ....S..X..R..... 0140 f9 2a 9d 4c 70 e6 03 b7 21 44 69 ce ba 94 73 f7 .*.Lp...!Di...s. 0150 1a 45 a8 20 54 3a e2 37 a3 d4 fe fb f4 df c4 7c .E. T:.7.......| 0160 db ab 54 e0 cf 54 a7 a4 5d e5 2f 88 c3 6b b5 ae ..T..T..]./..k.. 0170 81 42 57 60 0f cc e5 b5 01 6b cb e4 15 55 b9 0f .BW`.....k...U.. 0180 7d 34 e1 5d a5 d0 0c fd ab 75 5c 15 01 7a cd 6d }4.].....u\..z.m 0190 c4 4f bd 07 2b 4d 41 96 09 13 60 e6 9f 45 62 ce .O..+MA...`..Eb. 01a0 c7 72 5f f7 5e da 90 d6 2f a5 57 ec a7 14 f0 02 .r_.^.../.W..... 01b0 04 0d c4 8c 63 3b 6e 29 dd 0f d1 19 85 c2 56 bb ....c;n)......V. 01c0 c6 f6 53 60 32 eb 1c d0 02 62 9c 33 b4 4d bb 49 ..S`2....b.3.M.I 01d0 c4 c3 6d a8 47 b2 ed 0f fe 6b b7 75 5d d9 ed 2a ..m.G....k.u]..* 01e0 11 43 9b ff 4c 08 b6 13 de 87 8e 11 97 04 bf 10 .C..L........... 01f0 be 6a 90 41 60 24 5d 58 3e 6b ff 00 72 d3 7d e4 .j.A`$]X>k..r.}. 0200 43 ca 7d 66 3c 6b a7 a9 cd 73 72 f5 f5 fc c6 6f C.}f..<.tC..<*qC 0310 00 00 61 17 13 54 73 99 e1 42 6b 04 07 8a 74 b4 ..a..Ts..Bk...t. 0320 03 f0 85 bc 0b f0 20 15 62 8c 36 00 ...... .b.6. No. Time Source Destination Protocol Info 2797 822.182385 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=5385 Ack=46653 Win=17520 [TCP CHECKSUM INCORRECT] Len=0 Frame 2797 (54 bytes on wire, 54 bytes captured) Arrival Time: Nov 11, 2005 16:43:50.940889000 Time delta from previous packet: 0.200134000 seconds Time since reference or first frame: 822.182385000 seconds Frame Number: 2797 Packet Length: 54 bytes Capture Length: 54 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x41fb (16891) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3491] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 5385, Ack: 46653, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 5385 (relative sequence number) Acknowledgement number: 46653 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x845e [incorrect, should be 0x8ec5] SEQ/ACK analysis This is an ACK to the segment in frame: 2796 The RTT to ACK the segment was: 0.200134000 seconds No. Time Source Destination Protocol Info 2803 825.407859 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=5385 Ack=46653 Win=17520 [TCP CHECKSUM INCORRECT] Len=154 Frame 2803 (208 bytes on wire, 208 bytes captured) Arrival Time: Nov 11, 2005 16:43:54.166363000 Time delta from previous packet: 3.225474000 seconds Time since reference or first frame: 825.407859000 seconds Frame Number: 2803 Packet Length: 208 bytes Capture Length: 208 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 194 Identification: 0x422f (16943) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x33c3] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 5385, Ack: 46653, Len: 154 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 5385 (relative sequence number) Next sequence number: 5539 (relative sequence number) Acknowledgement number: 46653 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x84f8 [incorrect, should be 0x0b36] Data (154 bytes) 0000 bc ef 9a 00 b5 fe 18 00 80 00 00 21 5c 0f 32 0a ...........!\.2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9e bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 35 4f 28 7e 94 0a f5 15 4b 44 4a a4 32 ee 20 o5O(~....KDJ.2. 0040 7f 14 82 6c 9a 84 87 9a 15 6b 83 ab c3 4e 26 74 ...l.....k...N&t 0050 80 cb 8f 8a 66 94 ec ff 9d 4b 1f 55 ac 32 14 41 ....f....K.U.2.A 0060 6e 14 67 2a f2 20 76 fc 8b 6b 85 40 b3 ea d7 09 n.g*. v..k.@.... 0070 61 34 5f a8 75 94 0a 75 15 4b 0a ca 33 96 e3 a0 a4_.u..u.K..3... 0080 51 14 2d 48 b1 84 87 1a 1d 6b f1 2b c8 ea 51 f4 Q.-H.....k.+..Q. 0090 5e 34 1d ae 7d 95 e0 db 9a 00 ^4..}..... No. Time Source Destination Protocol Info 2804 825.408076 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=46653 Ack=5539 Win=9064 Len=0 Frame 2804 (60 bytes on wire, 60 bytes captured) Arrival Time: Nov 11, 2005 16:43:54.166580000 Time delta from previous packet: 0.000217000 seconds Time since reference or first frame: 825.408076000 seconds Frame Number: 2804 Packet Length: 60 bytes Capture Length: 60 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Trailer: 000000000000 Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0xf657 (63063) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x8034 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 46653, Ack: 5539, Len: 0 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 46653 (relative sequence number) Acknowledgement number: 5539 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 9064 Checksum: 0xaf33 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2803 The RTT to ACK the segment was: 0.000217000 seconds No. Time Source Destination Protocol Info 2805 825.408396 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=46653 Ack=5539 Win=9064 Len=126 Frame 2805 (180 bytes on wire, 180 bytes captured) Arrival Time: Nov 11, 2005 16:43:54.166900000 Time delta from previous packet: 0.000320000 seconds Time since reference or first frame: 825.408396000 seconds Frame Number: 2805 Packet Length: 180 bytes Capture Length: 180 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 166 Identification: 0xf757 (63319) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x7eb6 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 46653, Ack: 5539, Len: 126 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 46653 (relative sequence number) Next sequence number: 46779 (relative sequence number) Acknowledgement number: 5539 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 9064 Checksum: 0x28d1 [correct] Data (126 bytes) 0000 bc ef 7e 00 b5 fe 18 00 62 00 02 21 ed 97 32 0a ..~.....b..!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6e 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.n.].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 dd 96 e3 42 G.v.}.([.K.....B 0040 75 14 03 2e 17 20 8a f0 95 6b fd f1 b9 ea 2b 72 u.... ...k....+r 0050 73 34 04 30 61 94 d4 3d 9a 4b 66 0f 83 96 1f 43 s4.0a..=.Kf....C 0060 6b 14 4f 8c 82 84 75 ee ad cf 9e 96 c8 4e a2 2f k.O...u......N./ 0070 6e 34 6d 2e 69 94 00 ff 91 ef 0a 54 7e 00 n4m.i......T~. No. Time Source Destination Protocol Info 2806 825.498063 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=5539 Ack=46779 Win=17394 [TCP CHECKSUM INCORRECT] Len=314 Frame 2806 (368 bytes on wire, 368 bytes captured) Arrival Time: Nov 11, 2005 16:43:54.256567000 Time delta from previous packet: 0.089667000 seconds Time since reference or first frame: 825.498063000 seconds Frame Number: 2806 Packet Length: 368 bytes Capture Length: 368 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 354 Identification: 0x4231 (16945) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3321] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 5539, Ack: 46779, Len: 314 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 5539 (relative sequence number) Next sequence number: 5853 (relative sequence number) Acknowledgement number: 46779 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17394 Checksum: 0x8598 [incorrect, should be 0x4a90] SEQ/ACK analysis This is an ACK to the segment in frame: 2805 The RTT to ACK the segment was: 0.089667000 seconds Data (314 bytes) 0000 bc ef 3a 01 b5 fe 18 00 1e 01 02 21 f6 eb 32 0a ..:........!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a b7 bc 24 0e 3b b1 23 76 a.elr.....$.;.#v 0030 4a dd 71 28 04 30 07 f5 81 4b 06 ee a3 32 6a 84 J.q(.0...K...2j. 0040 78 14 0d c8 81 20 b9 9f 82 6b f1 0f c4 4e 2c 74 x.... ...k...N,t 0050 3e 31 02 2e 6d 94 fc ff 9d 4b 1e 55 ac 32 09 41 >1..m....K.U.2.A 0060 e7 14 67 2a 86 84 cf fc 85 6b 8d e4 c0 49 d1 09 ..g*.....k...I.. 0070 6f b4 7a a8 65 93 8f 74 25 8b 03 6e b9 35 1a b1 o.z.e..t%..n.5.. 0080 50 14 10 4f 0d 84 8d 1a 85 6b ed 8f d4 4e 2c f4 P..O.....k...N,. 0090 5f 34 15 ae 51 94 fc 7f bd 4b 52 71 bb 32 18 c1 _4..Q....KRq.2.. 00a0 6f 14 57 aa 95 84 71 7c 85 6b a9 64 dc 4e d0 89 o.W...q|.k.d.N.. 00b0 6f 34 51 28 59 94 00 f5 8d 4b 26 ee 83 32 e4 20 o4Q(Y....K&..2. 00c0 7f 14 23 c8 bd 84 8d 9a 85 6b dd 0f e4 4e 2c 74 ..#......k...N,t 00d0 7f 34 25 2e 41 94 fc ff 9d 4b 42 f1 8b 32 18 41 .4%.A....KB..2.A 00e0 6f 14 47 2a a5 84 71 fc 85 6b b9 e4 ec 4e d0 09 o.G*..q..k...N.. 00f0 6f 34 41 a8 49 94 00 75 8d 4b 36 6e 93 32 e4 a0 o4A.I..u.K6n.2.. 0100 1f 14 33 48 cd 84 8d 1a 85 6b cd 8f f4 4e 2c f4 ..3H.....k...N,. 0110 1f 34 35 ae 31 94 fc 7f fd 4b 32 71 9b 32 98 c1 .45.1....K2q.2.. 0120 6f 14 b7 ab b5 84 71 7e 99 cf d5 c6 81 4e 51 83 o.....q~.....NQ. 0130 67 34 9d 36 25 30 00 95 3a 01 g4.6%0..:. No. Time Source Destination Protocol Info 2807 825.499136 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=46779 Ack=5853 Win=8750 Len=110 Frame 2807 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:43:54.257640000 Time delta from previous packet: 0.001073000 seconds Time since reference or first frame: 825.499136000 seconds Frame Number: 2807 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0xf957 (63831) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x7cc6 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 46779, Ack: 5853, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 46779 (relative sequence number) Next sequence number: 46889 (relative sequence number) Acknowledgement number: 5853 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 8750 Checksum: 0x87f7 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2806 The RTT to ACK the segment was: 0.001073000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 54 00 00 21 f4 cf 32 0a ..n.....T..!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 47 2e 5a b4 08 f0 89 bc 2d 19 3c b1 52 d0 e.G.Z.....-.<.R. 0030 68 34 7d 2e 79 94 00 ff 03 ef 01 f0 ad 32 f8 e6 h4}.y........2.. 0040 4b 11 04 2e 91 84 d1 87 3b 68 bc f4 c3 4e 20 72 K.......;h...N r 0050 7f 34 05 30 49 30 fb 99 99 4b 4a ab ac 32 1c 43 .4.0I0...KJ..2.C 0060 1d b0 66 28 89 84 71 ee 85 6b 85 32 6e 00 ..f(..q..k.2n. No. Time Source Destination Protocol Info 2808 825.688976 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=5853 Ack=46889 Win=17284 [TCP CHECKSUM INCORRECT] Len=0 Frame 2808 (54 bytes on wire, 54 bytes captured) Arrival Time: Nov 11, 2005 16:43:54.447480000 Time delta from previous packet: 0.189840000 seconds Time since reference or first frame: 825.688976000 seconds Frame Number: 2808 Packet Length: 54 bytes Capture Length: 54 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x4235 (16949) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3457] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 5853, Ack: 46889, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 5853 (relative sequence number) Acknowledgement number: 46889 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17284 Checksum: 0x845e [incorrect, should be 0x8cf1] SEQ/ACK analysis This is an ACK to the segment in frame: 2807 The RTT to ACK the segment was: 0.189840000 seconds No. Time Source Destination Protocol Info 2832 826.696707 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=5853 Ack=46889 Win=17284 [TCP CHECKSUM INCORRECT] Len=130 Frame 2832 (184 bytes on wire, 184 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.455211000 Time delta from previous packet: 1.007731000 seconds Time since reference or first frame: 826.696707000 seconds Frame Number: 2832 Packet Length: 184 bytes Capture Length: 184 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 170 Identification: 0x4250 (16976) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x33ba] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 5853, Ack: 46889, Len: 130 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 5853 (relative sequence number) Next sequence number: 5983 (relative sequence number) Acknowledgement number: 46889 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17284 Checksum: 0x84e0 [incorrect, should be 0x784c] Data (130 bytes) 0000 bc ef 82 00 b5 fe 18 00 68 00 00 21 d8 71 32 0a ........h..!.q2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9c bc 30 aa 3b b1 29 76 a.elr.....0.;.)v 0030 47 94 71 28 3b 30 07 f5 87 4b 06 ee db 96 e3 20 G.q(;0...K..... 0040 6e 14 79 4a 9d 84 8e 9a 85 6b fd 0f bc cc 2b 74 n.yJ.....k....+t 0050 7c 34 05 2e 61 94 85 7d 9d 4b 6e f1 ab 32 18 41 |4..a..}.Kn..2.A 0060 6e 14 67 2a 89 84 71 fc 85 6b 85 40 b5 ea d7 09 n.g*..q..k.@.... 0070 65 34 63 a9 75 30 7d 75 8c 4b 1e 6e 9f 33 f8 04 e4c.u0}u.K.n.3.. 0080 82 00 .. No. Time Source Destination Protocol Info 2833 826.697048 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=46889 Ack=5983 Win=10524 Len=0 Frame 2833 (60 bytes on wire, 60 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.455552000 Time delta from previous packet: 0.000341000 seconds Time since reference or first frame: 826.697048000 seconds Frame Number: 2833 Packet Length: 60 bytes Capture Length: 60 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Trailer: 000000000000 Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x0e58 (3672) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x6834 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 46889, Ack: 5983, Len: 0 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 46889 (relative sequence number) Acknowledgement number: 5983 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10524 Checksum: 0xa6d7 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2832 The RTT to ACK the segment was: 0.000341000 seconds No. Time Source Destination Protocol Info 2834 826.697316 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=46889 Ack=5983 Win=10524 Len=190 Frame 2834 (244 bytes on wire, 244 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.455820000 Time delta from previous packet: 0.000268000 seconds Time since reference or first frame: 826.697316000 seconds Frame Number: 2834 Packet Length: 244 bytes Capture Length: 244 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 230 Identification: 0x0f58 (3928) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x6676 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 46889, Ack: 5983, Len: 190 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 46889 (relative sequence number) Next sequence number: 47079 (relative sequence number) Acknowledgement number: 5983 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10524 Checksum: 0xe529 [correct] Data (190 bytes) 0000 bc ef be 00 b5 fe 18 00 a2 00 02 21 1e b0 32 0a ...........!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6c 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.l.].....#T;.+t 0030 18 90 76 2e 77 94 7a 7d 91 4b 05 f0 8b 32 e4 42 ..v.w.z}.K...2.B 0040 7f 14 03 1f d5 86 8f f0 85 6b fd f1 8c 06 64 3a .........k....d: 0050 37 7c 4d 30 61 96 fc 99 9d 4b 62 0f ab 32 18 43 7|M0a....Kb..2.C 0060 6f 9c 65 28 85 84 71 ee fd e9 85 96 cf 4e ca 8b o.e(..q......N.. 0070 6f 34 61 2e 69 a5 48 fd 8f 4b 16 f0 b3 32 ac 0a o4a.i.H..K...2.. 0080 17 5c 5b 66 e5 84 8d f2 85 6b ed f1 ad cc 30 72 .\[f.....k....0r 0090 53 34 3c 30 51 94 fd 99 a1 4b 5e 0f aa 32 18 43 S4<0Q....K^..2.C 00a0 73 b0 7f 8c 92 84 75 ee ad cf ae 96 d8 4e a2 2f s.....u......N./ 00b0 6e 34 5d 2e 59 94 00 ff 91 ef d0 22 be 00 n4].Y......".. No. Time Source Destination Protocol Info 2835 826.704209 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=5983 Ack=47079 Win=17094 [TCP CHECKSUM INCORRECT] Len=130 Frame 2835 (184 bytes on wire, 184 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.462713000 Time delta from previous packet: 0.006893000 seconds Time since reference or first frame: 826.704209000 seconds Frame Number: 2835 Packet Length: 184 bytes Capture Length: 184 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 170 Identification: 0x4252 (16978) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x33b8] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 5983, Ack: 47079, Len: 130 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 5983 (relative sequence number) Next sequence number: 6113 (relative sequence number) Acknowledgement number: 47079 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17094 Checksum: 0x84e0 [incorrect, should be 0x77ca] SEQ/ACK analysis This is an ACK to the segment in frame: 2834 The RTT to ACK the segment was: 0.006893000 seconds Data (130 bytes) 0000 bc ef 82 00 b5 fe 18 00 68 00 00 21 d8 71 32 0a ........h..!.q2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9c bc 30 aa 3b b1 29 76 a.elr.....0.;.)v 0030 47 94 71 28 3b 30 07 f5 87 4b 06 ee db 96 e3 20 G.q(;0...K..... 0040 6e 14 79 4a 9d 84 8e 9a 85 6b fd 0f bc cc 2b 74 n.yJ.....k....+t 0050 7c 34 05 2e 61 94 85 7d 9d 4b 6e f1 ab 32 18 41 |4..a..}.Kn..2.A 0060 6e 14 67 2a 89 84 71 fc 85 6b 85 40 b5 ea d7 09 n.g*..q..k.@.... 0070 65 34 63 a9 75 30 7d 75 8c 4b 1e 6e 9f 33 f8 04 e4c.u0}u.K.n.3.. 0080 82 00 .. No. Time Source Destination Protocol Info 2836 826.704532 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=47079 Ack=6113 Win=10394 Len=190 Frame 2836 (244 bytes on wire, 244 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.463036000 Time delta from previous packet: 0.000323000 seconds Time since reference or first frame: 826.704532000 seconds Frame Number: 2836 Packet Length: 244 bytes Capture Length: 244 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 230 Identification: 0x1158 (4440) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x6476 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 47079, Ack: 6113, Len: 190 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 47079 (relative sequence number) Next sequence number: 47269 (relative sequence number) Acknowledgement number: 6113 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10394 Checksum: 0x9c0b [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2835 The RTT to ACK the segment was: 0.000323000 seconds Data (190 bytes) 0000 bc ef be 00 b5 fe 18 00 a2 00 02 21 40 60 32 0a ...........!@`2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6c 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.l.].....#T;.+t 0030 18 90 76 2e 77 94 7a 7d 91 4b 05 f0 8b 32 e4 42 ..v.w.z}.K...2.B 0040 7f 14 03 1f d5 86 8f f0 85 6b fd f1 8c 06 64 3a .........k....d: 0050 37 7c 4d 30 61 96 fc 99 9d 4b 62 0f ab 32 18 43 7|M0a....Kb..2.C 0060 6f 9c 65 28 85 84 71 ee fd e9 85 96 cf 4e ca 8b o.e(..q......N.. 0070 6f 34 61 2e 69 a5 48 fd 8f 4b 16 f0 b3 32 ac 0a o4a.i.H..K...2.. 0080 17 5c 5b 66 e5 84 8d f2 85 6b ed f1 ad cc 30 72 .\[f.....k....0r 0090 53 34 3c 30 51 94 fd 99 a1 4b 5e 0f aa 32 18 43 S4<0Q....K^..2.C 00a0 73 b0 7f 8c 92 84 75 ee ad cf ae 96 d8 4e a2 2f s.....u......N./ 00b0 6e 34 5d 2e 59 94 00 ff 91 ef f6 d2 be 00 n4].Y......... No. Time Source Destination Protocol Info 2837 826.705290 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=6113 Ack=47269 Win=16904 [TCP CHECKSUM INCORRECT] Len=234 Frame 2837 (288 bytes on wire, 288 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.463794000 Time delta from previous packet: 0.000758000 seconds Time since reference or first frame: 826.705290000 seconds Frame Number: 2837 Packet Length: 288 bytes Capture Length: 288 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 274 Identification: 0x4253 (16979) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x334f] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 6113, Ack: 47269, Len: 234 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 6113 (relative sequence number) Next sequence number: 6347 (relative sequence number) Acknowledgement number: 47269 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16904 Checksum: 0x8548 [incorrect, should be 0xca49] SEQ/ACK analysis This is an ACK to the segment in frame: 2836 The RTT to ACK the segment was: 0.000758000 seconds Data (234 bytes) 0000 bc ef ea 00 b5 fe 18 00 d0 00 00 21 5a 73 32 0a ...........!Zs2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 6c 4b 87 4a a4 32 ee 20 o0O(~...lK.J.2. 0040 7c 15 7c 6c 9a 84 83 9a d9 a8 e1 0f c1 4e 26 74 |.|l.........N&t 0050 7f 34 44 2e 25 94 aa ff ca 4b 62 f1 d8 f1 04 41 .4D.%....Kb....A 0060 6a 14 47 2a 85 84 3e fc c4 6b d2 e4 93 4e 94 09 j.G*..>..k...N.. 0070 20 34 2c a8 69 94 00 75 8d 4b 16 6e b3 32 e4 a0 4,.i..u.K.n.2.. 0080 5f 14 13 48 ad 84 03 d9 99 6b e8 8f c4 4e 2c f4 _..H.....k...N,. 0090 10 34 54 ae 1a 94 a3 7f ed 4b 1d 71 bb 32 18 c1 .4T......K.q.2.. 00a0 d6 d7 4b aa 97 84 61 7c 85 6b 98 64 e1 4d 91 89 ..K...a|.k.d.M.. 00b0 6f 34 51 28 59 94 00 f5 8d 4b 3a 4a 03 96 e3 20 o4Q(Y....K:J... 00c0 71 14 3f 6c c6 20 8a 9a 8b 6b c1 ab 6e ea 2b 74 q.?l. ...k..n.+t 00d0 6f 34 25 2e 3f 30 fb ff 97 4b 42 f1 97 96 65 41 o4%.?0...KB...eA 00e0 6e 14 4f 2a 89 85 6d 58 ea 00 n.O*..mX.. No. Time Source Destination Protocol Info 2838 826.705889 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=47269 Ack=6347 Win=10160 Len=430 Frame 2838 (484 bytes on wire, 484 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.464393000 Time delta from previous packet: 0.000599000 seconds Time since reference or first frame: 826.705889000 seconds Frame Number: 2838 Packet Length: 484 bytes Capture Length: 484 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 470 Identification: 0x1358 (4952) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x6186 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 47269, Ack: 6347, Len: 430 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 47269 (relative sequence number) Next sequence number: 47699 (relative sequence number) Acknowledgement number: 6347 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10160 Checksum: 0x93dd [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2837 The RTT to ACK the segment was: 0.000599000 seconds Data (430 bytes) 0000 bc ef ae 01 b5 fe 18 00 93 01 01 21 41 ba 32 0a ...........!A.2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e cd 72 {.+..........N.r 0050 16 34 05 30 61 94 a0 5a 81 4b 67 0f a3 32 18 43 .4.0a..Z.Kg..2.C 0060 2e 14 23 28 d3 84 26 ee f6 a8 85 96 c9 4e de 8b ..#(..&......N.. 0070 6f 34 2e 2e 28 94 4b ff d2 4b 52 f0 fc 32 a9 42 o4..(.K..KR..2.B 0080 d1 d7 0f 2e a8 84 81 f0 85 6b a2 f1 95 4e 67 72 .........k...Ngr 0090 00 34 45 30 1e 94 45 5a a1 4b 50 0f ba 32 18 43 .4E0..EZ.KP..2.C 00a0 5e a2 94 34 95 87 71 6a 85 6b a9 cd dc 44 d0 8b ^..4..qj.k...D.. 00b0 6f 34 51 2e 59 c9 00 f5 8d 4b 26 f0 83 32 e4 1d o4Q.Y....K&..2.. 00c0 7f 1e 23 2e bd 84 8d f0 85 22 dd fb e4 4e 2c 72 ..#......"...N,r 00d0 7f 34 25 0e 41 9e fc 99 9d 4b 42 0f 8b 11 18 49 .4%.A....KB....I 00e0 6f 14 47 28 a5 84 71 b7 85 61 b9 96 ec 4e d0 8b o.G(..q..a...N.. 00f0 6f 54 41 24 49 94 00 ff 8d 4b 36 ae 93 38 e4 42 oTA$I....K6..8.B 0100 1f 14 33 2e cd a2 8d fa 85 6b cd f1 f4 4e 2c e3 ..3......k...N,. 0110 1f 3e 35 30 31 94 fc 99 fd 4b 32 0f 9b 32 98 43 .>501....K2..2.C 0120 6f 14 b7 e9 b5 84 71 e8 85 6b c9 8a fc 4e 50 7d o.....q..k...NP} 0130 ac 28 b1 dd 39 5f 1b ff cd fe a8 ec e3 3e 64 1e .(..9_.......>d. 0140 c7 81 f8 57 2b 98 8d fc 85 6a bd 71 66 52 ac 11 ...W+....j.qfR.. 0150 7f 3a c5 cf 21 db fc d8 9d 00 22 50 eb 76 98 0c .:..!....."P.v.. 0160 6f 59 a7 78 06 98 71 e4 85 69 d9 88 8c c5 b6 f1 oY.x..q..i...... 0170 6f 33 a1 c7 29 94 00 d7 de 08 17 d9 d3 53 00 2f o3..)........S./ 0180 36 7a fd 5c 82 f0 e5 93 f7 1f c2 81 e7 52 08 14 6z.\.........R.. 0190 5f 4a 71 c8 11 9e fc 98 bd 63 b6 08 fb 36 98 31 _Jq......c...6.1 01a0 cb 15 97 25 d5 84 71 e8 85 77 4d 09 ae 01 ...%..q..wM... No. Time Source Destination Protocol Info 2839 826.706400 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=6347 Ack=47699 Win=16474 [TCP CHECKSUM INCORRECT] Len=210 Frame 2839 (264 bytes on wire, 264 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.464904000 Time delta from previous packet: 0.000511000 seconds Time since reference or first frame: 826.706400000 seconds Frame Number: 2839 Packet Length: 264 bytes Capture Length: 264 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 250 Identification: 0x4254 (16980) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3366] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 6347, Ack: 47699, Len: 210 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 6347 (relative sequence number) Next sequence number: 6557 (relative sequence number) Acknowledgement number: 47699 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16474 Checksum: 0x8530 [incorrect, should be 0xf409] SEQ/ACK analysis This is an ACK to the segment in frame: 2838 The RTT to ACK the segment was: 0.000511000 seconds Data (210 bytes) 0000 bc ef d2 00 b5 fe 18 00 b6 00 02 21 cc 81 32 0a ...........!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 6c 4b 87 4a a4 32 ee 20 o0O(~...lK.J.2. 0040 7c 15 7c 6c 9a 84 83 9a d9 a8 e1 0f c1 4e 26 74 |.|l.........N&t 0050 7f 34 44 2e 25 94 b0 ff df 4b 62 f1 d8 f1 04 41 .4D.%....Kb....A 0060 6a 14 47 2a 85 84 3e fc c4 6b d2 e4 93 4e 94 09 j.G*..>..k...N.. 0070 20 34 2c a8 69 94 00 75 8d 4b 16 6e b3 32 e4 a0 4,.i..u.K.n.2.. 0080 5f 14 13 48 ad 84 03 d9 99 6b e8 8f c4 4e 2c f4 _..H.....k...N,. 0090 10 34 54 ae 1a 94 a3 7f ed 4b 1d 71 bb 32 18 c1 .4T......K.q.2.. 00a0 73 b0 d7 0e 92 84 7f 7c 99 cf d2 c0 db 4e de 89 s......|.....N.. 00b0 73 90 db 8c 5e 94 10 f5 8d 4b 58 4a 84 32 ee 20 s...^....KXJ.2. 00c0 7f 14 3f 6c c0 84 8c 9a 8d 6b f1 0e f8 ea 2c 74 ..?l.....k....,t 00d0 d2 00 .. No. Time Source Destination Protocol Info 2840 826.706873 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=47699 Ack=6557 Win=10524 Len=294 Frame 2840 (348 bytes on wire, 348 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.465377000 Time delta from previous packet: 0.000473000 seconds Time since reference or first frame: 826.706873000 seconds Frame Number: 2840 Packet Length: 348 bytes Capture Length: 348 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 334 Identification: 0x1558 (5464) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x600e [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 47699, Ack: 6557, Len: 294 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 47699 (relative sequence number) Next sequence number: 47993 (relative sequence number) Acknowledgement number: 6557 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10524 Checksum: 0xee44 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2839 The RTT to ACK the segment was: 0.000473000 seconds Data (294 bytes) 0000 bc ef 26 01 b5 fe 18 00 0a 01 02 21 58 26 32 0a ..&........!X&2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e cd 72 {.+..........N.r 0050 62 35 05 30 61 94 a0 5a 81 4b 67 0f a3 32 18 43 b5.0a..Z.Kg..2.C 0060 2e 14 23 28 c9 84 33 ee f6 a8 85 96 c9 4e de 8b ..#(..3......N.. 0070 6f 34 2e 2e 28 94 4b ff d2 4b 52 f0 fc 32 a9 42 o4..(.K..KR..2.B 0080 d1 d7 0f 2e a8 84 81 f0 85 6b a2 f1 95 4e 67 72 .........k...Ngr 0090 00 34 45 30 1e 94 4a 5a a1 4b 51 0f bd 32 18 43 .4E0..JZ.KQ..2.C 00a0 6f 14 57 28 95 84 e1 2d 99 6b a5 96 17 55 d0 cb o.W(...-.k...U.. 00b0 da da 4d 2e 55 94 ad eb 8d 0b 5e 06 9f 32 ee 42 ..M.U.....^..2.B 00c0 7e 14 a8 c8 a1 84 8a f0 93 6b dd f1 cc 1d 6f 33 ~........k....o3 00d0 56 14 44 54 2c fd 92 b7 ee 24 36 67 ee 40 6c 2c V.DT,....$6g.@l, 00e0 01 67 d9 ca b9 84 74 ee 8b 6b b9 96 a3 4e 91 8b .g....t..k...N.. 00f0 24 34 1e 2e 0d 94 4f ff c0 4b 67 33 8f 32 e8 42 $4....O..Kg3.2.B 0100 1e 14 33 2e d1 20 8d f0 fb cf ca f1 fe 4e 2d 72 ..3.. .......N-r 0110 37 90 32 30 35 94 8e 3d fc 4b 3e 0f 9b 32 98 43 7.205..=.K>..2.C 0120 73 b0 00 c0 26 01 s...&. No. Time Source Destination Protocol Info 2841 826.707404 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=6557 Ack=47993 Win=16180 [TCP CHECKSUM INCORRECT] Len=162 Frame 2841 (216 bytes on wire, 216 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.465908000 Time delta from previous packet: 0.000531000 seconds Time since reference or first frame: 826.707404000 seconds Frame Number: 2841 Packet Length: 216 bytes Capture Length: 216 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 202 Identification: 0x4255 (16981) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3395] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 6557, Ack: 47993, Len: 162 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 6557 (relative sequence number) Next sequence number: 6719 (relative sequence number) Acknowledgement number: 47993 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16180 Checksum: 0x8500 [incorrect, should be 0xe4b1] SEQ/ACK analysis This is an ACK to the segment in frame: 2840 The RTT to ACK the segment was: 0.000531000 seconds Data (162 bytes) 0000 bc ef a2 00 b5 fe 18 00 86 00 02 21 dd c1 32 0a ...........!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 19 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 c4 4a 87 4a a4 32 ee 20 o0O(~....J.J.2. 0040 11 15 7e 6c 9a 84 81 9a 87 6b fd 0f bb ea 2b 74 ..~l.....k....+t 0050 71 34 19 8a e1 30 fb ff 93 4b 7e 55 d0 96 1f 41 q4...0...K~U...A 0060 61 14 8c e9 99 84 74 fc 85 6b 99 e4 5b ac cc 09 a.....t..k..[... 0070 6a 34 61 a8 69 94 1c d1 f3 ef 11 6e b9 32 80 a0 j4a.i......n.2.. 0080 b8 b0 14 48 a1 84 72 e5 7a 94 67 2b d3 4e 3c f4 ...H..r.z.g+.N<. 0090 5f 34 09 0a 2c 94 fd 7f b5 4b 7e 70 a7 96 18 c1 _4..,....K~p.... 00a0 a2 00 .. No. Time Source Destination Protocol Info 2842 826.707814 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=47993 Ack=6719 Win=10362 Len=170 Frame 2842 (224 bytes on wire, 224 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.466318000 Time delta from previous packet: 0.000410000 seconds Time since reference or first frame: 826.707814000 seconds Frame Number: 2842 Packet Length: 224 bytes Capture Length: 224 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 210 Identification: 0x1758 (5976) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x5e8a [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 47993, Ack: 6719, Len: 170 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 47993 (relative sequence number) Next sequence number: 48163 (relative sequence number) Acknowledgement number: 6719 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10362 Checksum: 0x9d39 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2841 The RTT to ACK the segment was: 0.000410000 seconds Data (170 bytes) 0000 bc ef aa 00 b5 fe 18 00 8e 00 02 21 5a 2f 32 0a ...........!Z/2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e9 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 ad cf fa f1 c0 4e 52 d6 {.+..........NR. 0050 78 34 0f 30 60 94 1b 3d 9a 4b 6e 0f 24 f8 1b 43 x4.0`..=.Kn.$..C 0060 e5 b0 60 28 95 84 38 ef d7 6b 99 96 cc 4e 3b 48 ..`(..8..k...N;H 0070 73 34 64 2e 67 94 00 ff c2 4b 57 f0 f8 32 bb 42 s4d.g....KW..2.B 0080 0c 14 4a 2e fe 84 1a 12 82 6b e8 f1 d4 4e 2c 72 ..J......k...N,r 0090 43 90 15 30 79 30 fb 99 b9 4b 20 ab ba 32 14 43 C..0y0...K ..2.C 00a0 63 43 57 28 89 20 90 c3 aa 00 cCW(. .... No. Time Source Destination Protocol Info 2843 826.708370 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=6719 Ack=48163 Win=17520 [TCP CHECKSUM INCORRECT] Len=74 Frame 2843 (128 bytes on wire, 128 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.466874000 Time delta from previous packet: 0.000556000 seconds Time since reference or first frame: 826.708370000 seconds Frame Number: 2843 Packet Length: 128 bytes Capture Length: 128 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 114 Identification: 0x4256 (16982) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x33ec] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 6719, Ack: 48163, Len: 74 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 6719 (relative sequence number) Next sequence number: 6793 (relative sequence number) Acknowledgement number: 48163 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x84a8 [incorrect, should be 0xf02b] SEQ/ACK analysis This is an ACK to the segment in frame: 2842 The RTT to ACK the segment was: 0.000556000 seconds Data (74 bytes) 0000 bc ef 4a 00 b5 fe 18 00 30 00 00 21 4b 7a 32 0a ..J.....0..!Kz2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a a0 bc 8a aa 3b b1 25 76 a.elr.......;.%v 0030 6f 34 96 8c 7e 94 0c f5 02 81 05 ee bf 96 99 20 o4..~.......... 0040 7e 14 0b c8 b1 85 91 3e 4a 00 ~......>J. No. Time Source Destination Protocol Info 2844 826.708576 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=48163 Ack=6793 Win=10288 Len=66 Frame 2844 (120 bytes on wire, 120 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.467080000 Time delta from previous packet: 0.000206000 seconds Time since reference or first frame: 826.708576000 seconds Frame Number: 2844 Packet Length: 120 bytes Capture Length: 120 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 106 Identification: 0x1958 (6488) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x5cf2 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 48163, Ack: 6793, Len: 66 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 48163 (relative sequence number) Next sequence number: 48229 (relative sequence number) Acknowledgement number: 6793 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10288 Checksum: 0x8011 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2843 The RTT to ACK the segment was: 0.000206000 seconds Data (66 bytes) 0000 bc ef 42 00 b5 fe 18 00 28 00 00 21 e9 33 32 0a ..B.....(..!.32. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 73 99 e1 42 ..<*qC..f...s..B 0020 6b 04 5d 8a 72 b4 0b f0 ad 18 0c f0 38 b1 07 d0 k.].r.......8... 0030 68 34 75 2e 0b 30 01 ff 81 4b 06 f0 a3 32 f8 e6 h4u..0...K...2.. 0040 42 00 B. No. Time Source Destination Protocol Info 2845 826.708938 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=6793 Ack=48229 Win=17454 [TCP CHECKSUM INCORRECT] Len=90 Frame 2845 (144 bytes on wire, 144 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.467442000 Time delta from previous packet: 0.000362000 seconds Time since reference or first frame: 826.708938000 seconds Frame Number: 2845 Packet Length: 144 bytes Capture Length: 144 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 130 Identification: 0x4257 (16983) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x33db] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 6793, Ack: 48229, Len: 90 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 6793 (relative sequence number) Next sequence number: 6883 (relative sequence number) Acknowledgement number: 48229 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17454 Checksum: 0x84b8 [incorrect, should be 0xaa84] SEQ/ACK analysis This is an ACK to the segment in frame: 2844 The RTT to ACK the segment was: 0.000362000 seconds Data (90 bytes) 0000 bc ef 5a 00 b5 fe 18 00 40 00 00 21 a0 ff 32 0a ..Z.....@..!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9d bc 30 aa 3b b1 29 76 a.elr.....0.;.)v 0030 72 35 71 28 3b 30 07 f5 87 4b 06 ee da 96 e3 20 r5q(;0...K..... 0040 75 14 01 cc 13 20 8a 9a 8b 6b e1 ab d8 ea 51 74 u.... ...k....Qt 0050 7e 34 0d 2e 4d 95 e0 5b 5a 00 ~4..M..[Z. No. Time Source Destination Protocol Info 2846 826.709184 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=48229 Ack=6883 Win=10198 Len=94 Frame 2846 (148 bytes on wire, 148 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.467688000 Time delta from previous packet: 0.000246000 seconds Time since reference or first frame: 826.709184000 seconds Frame Number: 2846 Packet Length: 148 bytes Capture Length: 148 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 134 Identification: 0x1b58 (7000) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x5ad6 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 48229, Ack: 6883, Len: 94 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 48229 (relative sequence number) Next sequence number: 48323 (relative sequence number) Acknowledgement number: 6883 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10198 Checksum: 0xbd6c [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2845 The RTT to ACK the segment was: 0.000246000 seconds Data (94 bytes) 0000 bc ef 5e 00 b5 fe 18 00 42 00 02 21 69 b3 32 0a ..^.....B..!i.2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6d 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.m.].....#T;.+t 0030 47 90 76 2e 7d 94 8e 5b 8a 4b 08 f0 ce 4f f8 42 G.v.}..[.K...O.B 0040 73 14 21 2e 9d 84 91 54 ad cf fa f1 c0 4e 5e d6 s.!....T.....N^. 0050 7e 34 09 30 61 94 fc 99 81 ef 0c 00 5e 00 ~4.0a.......^. No. Time Source Destination Protocol Info 2847 826.709531 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=6883 Ack=48323 Win=17360 [TCP CHECKSUM INCORRECT] Len=146 Frame 2847 (200 bytes on wire, 200 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.468035000 Time delta from previous packet: 0.000347000 seconds Time since reference or first frame: 826.709531000 seconds Frame Number: 2847 Packet Length: 200 bytes Capture Length: 200 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 186 Identification: 0x4258 (16984) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x33a2] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 6883, Ack: 48323, Len: 146 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 6883 (relative sequence number) Next sequence number: 7029 (relative sequence number) Acknowledgement number: 48323 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17360 Checksum: 0x84f0 [incorrect, should be 0xfdc8] SEQ/ACK analysis This is an ACK to the segment in frame: 2846 The RTT to ACK the segment was: 0.000347000 seconds Data (146 bytes) 0000 bc ef 92 00 b5 fe 18 00 76 00 02 21 65 3f 32 0a ........v..!e?2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 6c 4b 87 4a a4 32 ee 20 o0O(~...lK.J.2. 0040 7c 15 7c 6c 9a 84 83 9a d9 a8 e1 0f c1 4e 22 74 |.|l.........N"t 0050 7f 34 4b 2e 25 94 af ff e9 4b 0d f1 ef 32 4b 41 .4K.%....K...2KA 0060 73 b0 e7 8e 82 84 7f fc 99 cf e2 40 cb 4e de 09 s..........@.N.. 0070 73 90 eb 0c 6e 94 10 75 8d 4b 68 ca b4 32 ee a0 s...n..u.Kh..2.. 0080 5f 14 0f ec d0 84 8c 1a 8d 6b c1 8e c8 ea 2c f4 _........k....,. 0090 92 00 .. No. Time Source Destination Protocol Info 2848 826.709864 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=48323 Ack=7029 Win=10052 Len=110 Frame 2848 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.468368000 Time delta from previous packet: 0.000333000 seconds Time since reference or first frame: 826.709864000 seconds Frame Number: 2848 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0x1d58 (7512) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x58c6 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 48323, Ack: 7029, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 48323 (relative sequence number) Next sequence number: 48433 (relative sequence number) Acknowledgement number: 7029 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10052 Checksum: 0xc8e5 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2847 The RTT to ACK the segment was: 0.000333000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 b0 ba 32 0a ..n.....R..!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf e2 32 6e 00 n.k(..q....2n. No. Time Source Destination Protocol Info 2849 826.710181 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=7029 Ack=48433 Win=17250 [TCP CHECKSUM INCORRECT] Len=162 Frame 2849 (216 bytes on wire, 216 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.468685000 Time delta from previous packet: 0.000317000 seconds Time since reference or first frame: 826.710181000 seconds Frame Number: 2849 Packet Length: 216 bytes Capture Length: 216 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 202 Identification: 0x4259 (16985) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3391] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 7029, Ack: 48433, Len: 162 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 7029 (relative sequence number) Next sequence number: 7191 (relative sequence number) Acknowledgement number: 48433 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17250 Checksum: 0x8500 [incorrect, should be 0xa832] SEQ/ACK analysis This is an ACK to the segment in frame: 2848 The RTT to ACK the segment was: 0.000317000 seconds Data (162 bytes) 0000 bc ef a2 00 b5 fe 18 00 88 00 00 21 ae cd 32 0a ...........!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 44 4b 87 4a a4 32 ee 20 o0O(~...DK.J.2. 0040 97 14 7c 6c 9a 84 83 9a f6 a8 e1 0f c1 4e 0c 74 ..|l.........N.t 0050 7f 34 4a 2e 20 94 b7 ff c2 4b 26 f1 e4 32 55 41 .4J. ....K&..2UA 0060 6f 14 67 2a 85 84 71 fc 85 6b 99 e4 cc 4e d0 09 o.g*..q..k...N.. 0070 6f 34 7d 0c e9 30 07 75 83 4b 0a ca c8 96 e3 a0 o4}..0.u.K...... 0080 51 14 0f ec 27 20 8a 1a 95 6b ed 8f aa ea 2b f4 Q...' ...k....+. 0090 55 34 15 ae 4d 30 81 7f bc 4b 5a 71 97 33 04 65 U4..M0...KZq.3.e 00a0 a2 00 .. No. Time Source Destination Protocol Info 2850 826.710684 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=48433 Ack=7191 Win=10524 Len=918 Frame 2850 (972 bytes on wire, 972 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.469188000 Time delta from previous packet: 0.000503000 seconds Time since reference or first frame: 826.710684000 seconds Frame Number: 2850 Packet Length: 972 bytes Capture Length: 972 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 958 Identification: 0x1f58 (8024) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x539e [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 48433, Ack: 7191, Len: 918 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 48433 (relative sequence number) Next sequence number: 49351 (relative sequence number) Acknowledgement number: 7191 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10524 Checksum: 0x2594 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2849 The RTT to ACK the segment was: 0.000503000 seconds Data (918 bytes) 0000 bc ef 96 03 b5 fe 18 00 7b 03 01 21 d8 ac 32 0a ........{..!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e e5 72 {.+..........N.r 0050 23 34 05 30 61 94 8f 5a 81 4b 67 0f a5 32 18 43 #4.0a..Z.Kg..2.C 0060 20 14 26 28 ce 84 2e ee c1 6b d6 96 81 4e 0b 48 .&(.....k...N.H 0070 73 34 6d 2e b2 bc 96 c4 2f 88 0a f0 bf 32 e6 42 s4m...../....2.B 0080 5f 14 d4 ed b1 84 8e f0 7d 6b ed f1 d5 4e dc 72 _.......}k...N.r 0090 03 68 46 7f 05 dc cd c5 da 3c 3f 6e d2 5e 44 2e .hF.........<...Nf..2d. 01c0 7f 71 e3 49 fd e5 8d 83 85 07 9d 9b a4 6e ac 40 .q.I.........n.@ 01d0 7f 5d e5 a2 01 f1 fc b9 9d 11 02 60 cb 5c 98 26 .].........`.\.& 01e0 6f 75 44 35 e5 8e 71 e9 85 08 3a 94 ac 44 50 ed ouD5..q...:..DP. 01f0 6f c2 42 cd 09 9e 00 ff 8d a2 b5 ec d3 38 64 42 o.B..........8dB 0200 9f 68 15 33 0d 8b 8d ef 85 75 8d b3 e8 3b e3 40 .h.3.....u...;.@ 0210 d7 ec a9 a8 86 c7 9c f0 11 d6 9c 6e b2 99 38 25 ...........n..8% 0220 18 bf 65 42 5c 8d 13 f7 80 94 84 e9 bc 49 63 0a ..eB\........Ic. 0230 2e 3b c6 a8 a6 84 b8 60 c2 7d b7 10 b7 09 04 23 .;.....`.}.....# 0240 7a fb cc c8 1d b4 3c 8f c4 bd 34 71 1b b7 17 f3 z.....<...4q.... 0250 30 3b 48 b7 cf 84 3b 00 ca 7d 3d f1 78 eb db 45 0;H...;..}=.x..E 0260 2e fb 48 37 76 b4 9c 8f f1 bd 8f 70 29 b7 a1 f5 ..H7v......p)... 0270 1b 3b f2 a8 87 84 8f 60 1e 9f f6 10 36 eb 1e 23 .;.....`....6..# 0280 5f fb bd c8 6e b4 32 8f 15 7e 73 71 58 b7 98 e8 _...n.2..~sqX... 0290 5f 7b 6d 41 cd 84 76 00 be 7d f2 32 27 eb 9f 45 _{mA..v..}.2'..E 02a0 4b fb 56 37 53 f0 b0 c9 b5 88 94 40 71 87 e7 c0 K.V7S......@q... 02b0 2a 16 9d 98 e9 b4 d1 22 b9 3b 9c 3d 31 af 28 13 *......".;.=1.(. 02c0 49 bf ee f8 7f 80 43 bf 03 4b 43 71 6e b7 d9 f1 I.....C..KCqn... 02d0 2e f8 39 b7 cd 84 75 00 9d 7d 32 32 17 eb 9a 45 ..9...u..}22...E 02e0 78 fb 46 37 76 db 87 e7 e0 cf b3 1f 02 c4 f3 b0 x.F7v........... 02f0 02 5a d4 c4 e9 d7 85 13 f9 18 a7 9b f5 f7 18 24 .Z.............$ 0300 1f ed ce c8 4d 9c 20 cc c4 94 6f 10 10 da 3a 9d ....M. ...o...:. 0310 31 48 5a c3 d9 e1 0e 74 92 13 41 6f f9 f7 18 40 1HZ....t..Ao...@ 0320 6f f5 b6 36 35 fb f3 c8 85 f6 b7 31 7c f3 53 dc o..65......1|.S. 0330 6f 76 4d 2a 7a 98 fc 65 8d 55 ba 10 63 98 98 4c ovM*z..e.U..c..L 0340 7f 8f 3e a1 5d d1 73 fb 85 c9 3f 00 04 d9 d3 e6 ..>.].s...?..... 0350 7f 16 c5 3f a1 e5 7c 2e 9d 1e 22 9e 6b 86 18 6b ...?..|...".k..k 0360 6f 9a a6 43 45 59 30 95 85 b7 a7 6f 0c ea 90 8f o..CEY0....o.... 0370 6f 31 5d 55 a9 98 58 60 8d 03 0e 17 73 e1 98 22 o1]U..X`....s.." 0380 5f d3 8a ce 6d b0 73 fb 21 bc 2f 63 14 b7 d3 95 _...m.s.!./c.... 0390 5f 27 71 2e 96 03 _'q... No. Time Source Destination Protocol Info 2851 826.729620 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=7191 Ack=49351 Win=16332 [TCP CHECKSUM INCORRECT] Len=150 Frame 2851 (204 bytes on wire, 204 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.488124000 Time delta from previous packet: 0.018936000 seconds Time since reference or first frame: 826.729620000 seconds Frame Number: 2851 Packet Length: 204 bytes Capture Length: 204 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 190 Identification: 0x425a (16986) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x339c] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 7191, Ack: 49351, Len: 150 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 7191 (relative sequence number) Next sequence number: 7341 (relative sequence number) Acknowledgement number: 49351 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16332 Checksum: 0x84f4 [incorrect, should be 0xd5ef] SEQ/ACK analysis This is an ACK to the segment in frame: 2850 The RTT to ACK the segment was: 0.018936000 seconds Data (150 bytes) 0000 bc ef 96 00 b5 fe 18 00 7a 00 02 21 6c 6a 32 0a ........z..!lj2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9e bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6b 35 4f 28 7e 94 0a f5 e2 4a 44 4a a4 32 ee 20 k5O(~....JDJ.2. 0040 7f 14 82 6c 9a 84 87 9a ca 68 83 ab c3 4e 26 74 ...l.....h...N&t 0050 80 cb 8f 8a 66 94 ec ff 9d 4b 1f 55 ac 32 14 41 ....f....K.U.2.A 0060 6e 14 67 2a f2 20 76 fc 8b 6b c1 e4 de 4e d2 09 n.g*. v..k...N.. 0070 6f 34 61 a8 75 30 7f d1 8a 4b 18 6e af 96 64 04 o4a.u0...K.n..d. 0080 58 14 1d 48 b1 20 91 be f8 6b ec 8f dc 4e 00 f5 X..H. ...k...N.. 0090 43 90 3c ae 96 00 C.<... No. Time Source Destination Protocol Info 2852 826.730231 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=49351 Ack=7341 Win=10374 Len=338 Frame 2852 (392 bytes on wire, 392 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.488735000 Time delta from previous packet: 0.000611000 seconds Time since reference or first frame: 826.730231000 seconds Frame Number: 2852 Packet Length: 392 bytes Capture Length: 392 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 378 Identification: 0x2158 (8536) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x53e2 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 49351, Ack: 7341, Len: 338 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 49351 (relative sequence number) Next sequence number: 49689 (relative sequence number) Acknowledgement number: 7341 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10374 Checksum: 0xf7d0 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2851 The RTT to ACK the segment was: 0.000611000 seconds Data (338 bytes) 0000 bc ef 52 01 b5 fe 18 00 35 01 03 21 aa d7 32 0a ..R.....5..!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6e 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.n.].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 dd 96 e3 42 G.v.}.([.K.....B 0040 75 14 01 2e 17 20 8a f0 95 6b 92 f0 c5 4e 2c 72 u.... ...k...N,r 0050 7f 34 5d 30 7d 94 fe 99 95 4b 62 0f e8 5d 76 37 .4]0}....Kb..]v7 0060 0e 77 13 5b 99 84 6d ee 8f 6b 93 96 68 4f cc 8b .w.[..m..k..hO.. 0070 77 34 78 2e 69 94 2c c5 ad 78 78 d0 93 12 c4 60 w4x.i.,..xx....` 0080 39 34 2f 06 87 ea ac d0 a5 4b cd d0 f4 6e 0d 3f 94/......K...n.? 0090 5d 28 15 3d 51 99 36 0c 86 4a 52 13 bb 3e 18 41 ](.=Q.6..JR..>.A 00a0 6f 14 57 3a 95 98 71 e8 85 69 a9 96 dc 52 74 e4 o.W:..q..i...Rt. 00b0 6e 37 51 2e 59 94 00 a7 8d 57 26 f2 83 23 e4 42 n7Q.Y....W&..#.B 00c0 7f 52 51 4b cc f1 e8 9e f1 4b 9e 9e 8a 3a 4d 11 .RQK.....K...:M. 00d0 0b 47 39 30 5d 94 f6 99 9a 4b e6 0e 97 32 00 43 .G90]....K...2.C 00e0 76 14 47 28 89 bd 0f d5 d3 4b 99 b6 cc 6c b6 ab v.G(.....K...l.. 00f0 53 1c 6b 40 68 b4 20 df ad 68 16 d0 b2 7f e6 5e S.k@h. ..h.....^ 0100 1f 19 33 82 64 11 b6 f1 85 77 cd fd f4 4c 2c 72 ..3.d....w...L,r 0110 1f 26 35 2c 31 92 fc 9d fd 4b 32 13 3f 32 98 3e .&5,1....K2.?2.> 0120 cb 13 b7 25 b5 85 71 e8 85 43 6d 8f fc 4a 50 c5 ...%..q..Cm..JP. 0130 cb 33 b1 d5 39 bc a4 f8 8d 4f 46 d8 47 35 64 46 .3..9....OF.G5dF 0140 7f 66 67 2e dd 88 8d f6 85 6b bd f3 20 00 00 00 .fg......k.. ... 0150 52 01 R. No. Time Source Destination Protocol Info 2853 826.730769 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=7341 Ack=49689 Win=17520 [TCP CHECKSUM INCORRECT] Len=106 Frame 2853 (160 bytes on wire, 160 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.489273000 Time delta from previous packet: 0.000538000 seconds Time since reference or first frame: 826.730769000 seconds Frame Number: 2853 Packet Length: 160 bytes Capture Length: 160 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 146 Identification: 0x425b (16987) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x33c7] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 7341, Ack: 49689, Len: 106 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 7341 (relative sequence number) Next sequence number: 7447 (relative sequence number) Acknowledgement number: 49689 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x84c8 [incorrect, should be 0x7d19] SEQ/ACK analysis This is an ACK to the segment in frame: 2852 The RTT to ACK the segment was: 0.000538000 seconds Data (106 bytes) 0000 bc ef 6a 00 b5 fe 18 00 50 00 00 21 ed 85 32 0a ..j.....P..!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a a9 bc 46 0e 3b b1 25 76 a.elr.....F.;.%v 0030 6f 34 08 8c 7e 94 0a f5 8c 4a 44 4a a4 32 ee 20 o4..~....JDJ.2. 0040 7f 14 82 6c 9a 84 87 9a 59 6a 86 ab c3 4e 22 74 ...l....Yj...N"t 0050 63 90 49 2e 66 94 f0 ff 9d 4b 62 f1 b7 96 65 41 c.I.f....Kb...eA 0060 6e 14 6f 2a a9 85 6d 58 6a 00 n.o*..mXj. No. Time Source Destination Protocol Info 2854 826.731186 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=49689 Ack=7447 Win=10268 Len=130 Frame 2854 (184 bytes on wire, 184 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.489690000 Time delta from previous packet: 0.000417000 seconds Time since reference or first frame: 826.731186000 seconds Frame Number: 2854 Packet Length: 184 bytes Capture Length: 184 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 170 Identification: 0x2358 (9048) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x52b2 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 49689, Ack: 7447, Len: 130 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 49689 (relative sequence number) Next sequence number: 49819 (relative sequence number) Acknowledgement number: 7447 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10268 Checksum: 0xa14e [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2853 The RTT to ACK the segment was: 0.000417000 seconds Data (130 bytes) 0000 bc ef 82 00 b5 fe 18 00 66 00 02 21 1a 4e 32 0a ........f..!.N2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 59 2e 38 b4 08 f0 8f bc 0b f0 14 15 28 74 e.Y.8.........(t 0030 6b 34 59 8a 7e 94 04 ff a5 ef 01 f0 a7 32 9f e6 k4Y.~........2.. 0040 78 14 0d 2e 3f 85 91 f0 9d 6b fd f1 c4 4e 74 72 x...?....k...Ntr 0050 63 34 07 30 61 94 fc 99 40 4a 7e 0f a1 32 18 43 c4.0a...@J~..2.C 0060 73 b0 2b 28 82 84 7d ee 85 6b 99 96 e4 ea d7 8b s.+(..}..k...... 0070 6b 34 13 8a 68 94 0c ff 8d 4b 16 f0 af 96 20 22 k4..h....K.... " 0080 82 00 .. No. Time Source Destination Protocol Info 2855 826.732290 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=7447 Ack=49819 Win=17390 [TCP CHECKSUM INCORRECT] Len=90 Frame 2855 (144 bytes on wire, 144 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.490794000 Time delta from previous packet: 0.001104000 seconds Time since reference or first frame: 826.732290000 seconds Frame Number: 2855 Packet Length: 144 bytes Capture Length: 144 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 130 Identification: 0x425c (16988) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x33d6] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 7447, Ack: 49819, Len: 90 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 7447 (relative sequence number) Next sequence number: 7537 (relative sequence number) Acknowledgement number: 49819 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17390 Checksum: 0x84b8 [incorrect, should be 0xa200] SEQ/ACK analysis This is an ACK to the segment in frame: 2854 The RTT to ACK the segment was: 0.001104000 seconds Data (90 bytes) 0000 bc ef 5a 00 b5 fe 18 00 40 00 00 21 a0 ff 32 0a ..Z.....@..!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9d bc 30 aa 3b b1 29 76 a.elr.....0.;.)v 0030 72 35 71 28 3b 30 07 f5 87 4b 06 ee da 96 e3 20 r5q(;0...K..... 0040 75 14 01 cc 13 20 8a 9a 8b 6b e1 ab d8 ea 51 74 u.... ...k....Qt 0050 7e 34 0d 2e 4d 95 e0 5b 5a 00 ~4..M..[Z. No. Time Source Destination Protocol Info 2856 826.732615 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=49819 Ack=7537 Win=10178 Len=94 Frame 2856 (148 bytes on wire, 148 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.491119000 Time delta from previous packet: 0.000325000 seconds Time since reference or first frame: 826.732615000 seconds Frame Number: 2856 Packet Length: 148 bytes Capture Length: 148 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 134 Identification: 0x2558 (9560) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x50d6 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 49819, Ack: 7537, Len: 94 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 49819 (relative sequence number) Next sequence number: 49913 (relative sequence number) Acknowledgement number: 7537 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10178 Checksum: 0xb4bc [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2855 The RTT to ACK the segment was: 0.000325000 seconds Data (94 bytes) 0000 bc ef 5e 00 b5 fe 18 00 42 00 02 21 59 b3 32 0a ..^.....B..!Y.2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6d 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.m.].....#T;.+t 0030 47 90 76 2e 7d 94 8e 5b 8a 4b 08 f0 ce 4f f8 42 G.v.}..[.K...O.B 0040 73 14 21 2e 9d 84 91 54 ad cf fa f1 c0 4e 5e d6 s.!....T.....N^. 0050 7e 34 09 30 61 94 fc 99 81 ef 1c 00 5e 00 ~4.0a.......^. No. Time Source Destination Protocol Info 2857 826.733515 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=7537 Ack=49913 Win=17296 [TCP CHECKSUM INCORRECT] Len=150 Frame 2857 (204 bytes on wire, 204 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.492019000 Time delta from previous packet: 0.000900000 seconds Time since reference or first frame: 826.733515000 seconds Frame Number: 2857 Packet Length: 204 bytes Capture Length: 204 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 190 Identification: 0x425d (16989) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3399] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 7537, Ack: 49913, Len: 150 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 7537 (relative sequence number) Next sequence number: 7687 (relative sequence number) Acknowledgement number: 49913 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17296 Checksum: 0x84f4 [incorrect, should be 0xdaad] SEQ/ACK analysis This is an ACK to the segment in frame: 2856 The RTT to ACK the segment was: 0.000900000 seconds Data (150 bytes) 0000 bc ef 96 00 b5 fe 18 00 7a 00 02 21 87 67 32 0a ........z..!.g2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9e bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6b 35 4f 28 7e 94 0a f5 e2 4a 44 4a a4 32 ee 20 k5O(~....JDJ.2. 0040 7f 14 82 6c 9a 84 87 9a ca 68 83 ab c3 4e 26 74 ...l.....h...N&t 0050 80 cb 8f 8a 66 94 ec ff 9d 4b 1f 55 ac 32 14 41 ....f....K.U.2.A 0060 6e 14 67 2a f2 20 76 fc 8b 6b c1 e4 de 4e d2 09 n.g*. v..k...N.. 0070 6f 34 61 a8 75 30 7f d1 8a 4b 18 6e af 96 64 04 o4a.u0...K.n..d. 0080 58 14 1d 48 b1 20 91 be f8 6b ec 8f dc 4e 00 f5 X..H. ...k...N.. 0090 43 90 15 a3 96 00 C..... No. Time Source Destination Protocol Info 2858 826.734012 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=49913 Ack=7687 Win=10028 Len=338 Frame 2858 (392 bytes on wire, 392 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.492516000 Time delta from previous packet: 0.000497000 seconds Time since reference or first frame: 826.734012000 seconds Frame Number: 2858 Packet Length: 392 bytes Capture Length: 392 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 378 Identification: 0x2758 (10072) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x4de2 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 49913, Ack: 7687, Len: 338 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 49913 (relative sequence number) Next sequence number: 50251 (relative sequence number) Acknowledgement number: 7687 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10028 Checksum: 0xedde [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2857 The RTT to ACK the segment was: 0.000497000 seconds Data (338 bytes) 0000 bc ef 52 01 b5 fe 18 00 35 01 03 21 06 35 32 0a ..R.....5..!.52. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6e 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.n.].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 dd 96 e3 42 G.v.}.([.K.....B 0040 75 14 01 2e 17 20 8a f0 95 6b 92 f0 c5 4e 2c 72 u.... ...k...N,r 0050 7f 34 5d 30 7d 94 fe 99 95 4b 62 0f e8 5d 76 37 .4]0}....Kb..]v7 0060 0e 77 13 5b 99 84 6d ee 8f 6b 93 96 68 4f cc 8b .w.[..m..k..hO.. 0070 77 34 78 2e 69 94 2c c5 ad 78 78 d0 93 12 c4 60 w4x.i.,..xx....` 0080 39 34 2f 06 87 ea ac d0 a5 4b cd d0 f4 6e 0d 3f 94/......K...n.? 0090 5d 28 15 3d 51 99 36 0c 86 4a 52 13 bb 3e 18 41 ](.=Q.6..JR..>.A 00a0 6f 14 57 3a 95 98 71 e8 85 69 a9 96 dc 52 74 e4 o.W:..q..i...Rt. 00b0 6e 37 51 2e 59 94 00 a7 8d 57 26 f2 83 23 e4 42 n7Q.Y....W&..#.B 00c0 7f 52 51 4b cc f1 e8 9e f1 4b 9e 9e 8a 3a 4d 11 .RQK.....K...:M. 00d0 0b 47 39 30 5d 94 f6 99 9a 4b e6 0e 97 32 00 43 .G90]....K...2.C 00e0 76 14 47 28 89 bd 0f d5 d3 4b 99 b6 cc 6c b6 ab v.G(.....K...l.. 00f0 53 1c 6b 40 68 b4 20 df ad 68 16 d0 b2 7f e6 5e S.k@h. ..h.....^ 0100 1f 19 33 82 64 11 b6 f1 85 77 cd fd f4 4c 2c 72 ..3.d....w...L,r 0110 1f 26 35 2c 31 92 fc 9d fd 4b 32 13 3f 32 98 3e .&5,1....K2.?2.> 0120 cb 13 b7 25 b5 85 71 e8 85 43 6d 8f fc 4a 50 c5 ...%..q..Cm..JP. 0130 cb 33 b1 d5 39 bc a4 f8 8d 4f 46 d8 47 35 64 46 .3..9....OF.G5dF 0140 7f 66 67 2e dd 88 8d f6 85 6b bd f3 20 4e ac 14 .fg......k.. N.. 0150 52 01 R. No. Time Source Destination Protocol Info 2859 826.734483 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=7687 Ack=50251 Win=16958 [TCP CHECKSUM INCORRECT] Len=106 Frame 2859 (160 bytes on wire, 160 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.492987000 Time delta from previous packet: 0.000471000 seconds Time since reference or first frame: 826.734483000 seconds Frame Number: 2859 Packet Length: 160 bytes Capture Length: 160 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 146 Identification: 0x425e (16990) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x33c4] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 7687, Ack: 50251, Len: 106 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 7687 (relative sequence number) Next sequence number: 7793 (relative sequence number) Acknowledgement number: 50251 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16958 Checksum: 0x84c8 [incorrect, should be 0x05d0] SEQ/ACK analysis This is an ACK to the segment in frame: 2858 The RTT to ACK the segment was: 0.000471000 seconds Data (106 bytes) 0000 bc ef 6a 00 b5 fe 18 00 50 00 00 21 c6 55 32 0a ..j.....P..!.U2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9d bc 30 aa 3b b1 29 76 a.elr.....0.;.)v 0030 6e 34 71 28 3b 30 07 f5 87 4b 06 ee da 96 e3 20 n4q(;0...K..... 0040 75 14 07 c9 13 20 8a 9a 8b 6b e1 ab bc ea 2b 74 u.... ...k....+t 0050 6e 34 76 2f 61 94 e7 ff 81 ef 7e 55 b7 96 65 41 n4v/a.....~U..eA 0060 6e 14 6f 2a a9 85 6d 58 6a 00 n.o*..mXj. No. Time Source Destination Protocol Info 2860 826.734791 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=50251 Ack=7793 Win=10524 Len=90 Frame 2860 (144 bytes on wire, 144 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.493295000 Time delta from previous packet: 0.000308000 seconds Time since reference or first frame: 826.734791000 seconds Frame Number: 2860 Packet Length: 144 bytes Capture Length: 144 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 130 Identification: 0x2958 (10584) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x4cda [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 50251, Ack: 7793, Len: 90 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 50251 (relative sequence number) Next sequence number: 50341 (relative sequence number) Acknowledgement number: 7793 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10524 Checksum: 0x457b [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2859 The RTT to ACK the segment was: 0.000308000 seconds Data (90 bytes) 0000 bc ef 5a 00 b5 fe 18 00 3e 00 02 21 7a 84 32 0a ..Z.....>..!z.2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6d 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.m.].....#T;.+t 0030 47 90 76 2e 7d 94 8e 5b 8a 4b 08 f0 bf 96 cc e6 G.v.}..[.K...... 0040 78 14 07 2e b5 20 8a f0 81 6b 8f 55 c5 4e 20 72 x.... ...k.U.N r 0050 7f 34 05 30 7d 30 e7 99 5a 00 .4.0}0..Z. No. Time Source Destination Protocol Info 2861 826.735153 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=7793 Ack=50341 Win=16868 [TCP CHECKSUM INCORRECT] Len=106 Frame 2861 (160 bytes on wire, 160 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.493657000 Time delta from previous packet: 0.000362000 seconds Time since reference or first frame: 826.735153000 seconds Frame Number: 2861 Packet Length: 160 bytes Capture Length: 160 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 146 Identification: 0x425f (16991) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x33c3] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 7793, Ack: 50341, Len: 106 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 7793 (relative sequence number) Next sequence number: 7899 (relative sequence number) Acknowledgement number: 50341 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16868 Checksum: 0x84c8 [incorrect, should be 0x0626] SEQ/ACK analysis This is an ACK to the segment in frame: 2860 The RTT to ACK the segment was: 0.000362000 seconds Data (106 bytes) 0000 bc ef 6a 00 b5 fe 18 00 50 00 00 21 c7 95 32 0a ..j.....P..!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9d bc 30 aa 3b b1 29 76 a.elr.....0.;.)v 0030 6c 34 71 28 3b 30 07 f5 87 4b 06 ee da 96 e3 20 l4q(;0...K..... 0040 75 14 07 c9 13 20 8a 9a 8b 6b e1 ab bc ea 2b 74 u.... ...k....+t 0050 6e 34 76 2f 61 94 e7 ff 81 ef 7e 55 b7 96 65 41 n4v/a.....~U..eA 0060 6e 14 6f 2a a9 85 6d 58 6a 00 n.o*..mXj. No. Time Source Destination Protocol Info 2862 826.735418 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=50341 Ack=7899 Win=10418 Len=90 Frame 2862 (144 bytes on wire, 144 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.493922000 Time delta from previous packet: 0.000265000 seconds Time since reference or first frame: 826.735418000 seconds Frame Number: 2862 Packet Length: 144 bytes Capture Length: 144 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 130 Identification: 0x2b58 (11096) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x4ada [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 50341, Ack: 7899, Len: 90 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 50341 (relative sequence number) Next sequence number: 50431 (relative sequence number) Acknowledgement number: 7899 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10418 Checksum: 0x4521 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2861 The RTT to ACK the segment was: 0.000265000 seconds Data (90 bytes) 0000 bc ef 5a 00 b5 fe 18 00 3e 00 02 21 7a 84 32 0a ..Z.....>..!z.2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6d 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.m.].....#T;.+t 0030 47 90 76 2e 7d 94 8e 5b 8a 4b 08 f0 bf 96 cc e6 G.v.}..[.K...... 0040 78 14 07 2e b5 20 8a f0 81 6b 8f 55 c5 4e 20 72 x.... ...k.U.N r 0050 7f 34 05 30 7d 30 e7 99 5a 00 .4.0}0..Z. No. Time Source Destination Protocol Info 2863 826.736468 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=7899 Ack=50431 Win=16778 [TCP CHECKSUM INCORRECT] Len=138 Frame 2863 (192 bytes on wire, 192 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.494972000 Time delta from previous packet: 0.001050000 seconds Time since reference or first frame: 826.736468000 seconds Frame Number: 2863 Packet Length: 192 bytes Capture Length: 192 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 178 Identification: 0x4260 (16992) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x33a2] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 7899, Ack: 50431, Len: 138 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 7899 (relative sequence number) Next sequence number: 8037 (relative sequence number) Acknowledgement number: 50431 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16778 Checksum: 0x84e8 [incorrect, should be 0x7776] SEQ/ACK analysis This is an ACK to the segment in frame: 2862 The RTT to ACK the segment was: 0.001050000 seconds Data (138 bytes) 0000 bc ef 8a 00 b5 fe 18 00 70 00 00 21 a9 56 32 0a ........p..!.V2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9e bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6b 35 4f 28 7e 94 0a f5 fd 4a 44 4a a4 32 ee 20 k5O(~....JDJ.2. 0040 7f 14 82 6c 9a 84 87 9a 92 69 83 ab c3 4e 26 74 ...l.....i...N&t 0050 80 cb 8f 8a 66 94 ec ff 9d 4b 1f 55 ac 32 14 41 ....f....K.U.2.A 0060 6e 14 67 2a f2 20 76 fc 8b 6b 85 40 b3 ea d7 09 n.g*. v..k.@.... 0070 61 34 7d 0c e9 30 07 75 83 4b 0a ca af 96 99 a0 a4}..0.u.K...... 0080 5e 14 1b 48 81 85 91 be 8a 00 ^..H...... No. Time Source Destination Protocol Info 2864 826.736789 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=50431 Ack=8037 Win=10280 Len=126 Frame 2864 (180 bytes on wire, 180 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.495293000 Time delta from previous packet: 0.000321000 seconds Time since reference or first frame: 826.736789000 seconds Frame Number: 2864 Packet Length: 180 bytes Capture Length: 180 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 166 Identification: 0x2d58 (11608) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x48b6 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 50431, Ack: 8037, Len: 126 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 50431 (relative sequence number) Next sequence number: 50557 (relative sequence number) Acknowledgement number: 8037 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10280 Checksum: 0x0b8d [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2863 The RTT to ACK the segment was: 0.000321000 seconds Data (126 bytes) 0000 bc ef 7e 00 b5 fe 18 00 62 00 02 21 ed 97 32 0a ..~.....b..!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6e 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.n.].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 dd 96 e3 42 G.v.}.([.K.....B 0040 75 14 03 2e 17 20 8a f0 95 6b fd f1 b9 ea 2b 72 u.... ...k....+r 0050 73 34 04 30 61 94 d4 3d 9a 4b 66 0f 83 96 1f 43 s4.0a..=.Kf....C 0060 6b 14 4f 8c 82 84 75 ee ad cf 9e 96 c8 4e a2 2f k.O...u......N./ 0070 6e 34 6d 2e 69 94 00 ff 91 ef 0a 54 7e 00 n4m.i......T~. No. Time Source Destination Protocol Info 2865 826.737319 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=8037 Ack=50557 Win=16652 [TCP CHECKSUM INCORRECT] Len=150 Frame 2865 (204 bytes on wire, 204 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.495823000 Time delta from previous packet: 0.000530000 seconds Time since reference or first frame: 826.737319000 seconds Frame Number: 2865 Packet Length: 204 bytes Capture Length: 204 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 190 Identification: 0x4261 (16993) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3395] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 8037, Ack: 50557, Len: 150 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 8037 (relative sequence number) Next sequence number: 8187 (relative sequence number) Acknowledgement number: 50557 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16652 Checksum: 0x84f4 [incorrect, should be 0xd8b9] SEQ/ACK analysis This is an ACK to the segment in frame: 2864 The RTT to ACK the segment was: 0.000530000 seconds Data (150 bytes) 0000 bc ef 96 00 b5 fe 18 00 7a 00 02 21 87 67 32 0a ........z..!.g2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9e bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6b 35 4f 28 7e 94 0a f5 e2 4a 44 4a a4 32 ee 20 k5O(~....JDJ.2. 0040 7f 14 82 6c 9a 84 87 9a ca 68 83 ab c3 4e 26 74 ...l.....h...N&t 0050 80 cb 8f 8a 66 94 ec ff 9d 4b 1f 55 ac 32 14 41 ....f....K.U.2.A 0060 6e 14 67 2a f2 20 76 fc 8b 6b c1 e4 de 4e d2 09 n.g*. v..k...N.. 0070 6f 34 61 a8 75 30 7f d1 8a 4b 18 6e af 96 64 04 o4a.u0...K.n..d. 0080 58 14 1d 48 b1 20 91 be f8 6b ec 8f dc 4e 00 f5 X..H. ...k...N.. 0090 43 90 15 a3 96 00 C..... No. Time Source Destination Protocol Info 2866 826.737733 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=50557 Ack=8187 Win=10130 Len=338 Frame 2866 (392 bytes on wire, 392 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.496237000 Time delta from previous packet: 0.000414000 seconds Time since reference or first frame: 826.737733000 seconds Frame Number: 2866 Packet Length: 392 bytes Capture Length: 392 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 378 Identification: 0x2f58 (12120) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x45e2 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 50557, Ack: 8187, Len: 338 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 50557 (relative sequence number) Next sequence number: 50895 (relative sequence number) Acknowledgement number: 8187 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10130 Checksum: 0xf0c0 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2865 The RTT to ACK the segment was: 0.000414000 seconds Data (338 bytes) 0000 bc ef 52 01 b5 fe 18 00 35 01 03 21 aa d7 32 0a ..R.....5..!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6e 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.n.].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 dd 96 e3 42 G.v.}.([.K.....B 0040 75 14 01 2e 17 20 8a f0 95 6b 92 f0 c5 4e 2c 72 u.... ...k...N,r 0050 7f 34 5d 30 7d 94 fe 99 95 4b 62 0f e8 5d 76 37 .4]0}....Kb..]v7 0060 0e 77 13 5b 99 84 6d ee 8f 6b 93 96 68 4f cc 8b .w.[..m..k..hO.. 0070 77 34 78 2e 69 94 2c c5 ad 78 78 d0 93 12 c4 60 w4x.i.,..xx....` 0080 39 34 2f 06 87 ea ac d0 a5 4b cd d0 f4 6e 0d 3f 94/......K...n.? 0090 5d 28 15 3d 51 99 36 0c 86 4a 52 13 bb 3e 18 41 ](.=Q.6..JR..>.A 00a0 6f 14 57 3a 95 98 71 e8 85 69 a9 96 dc 52 74 e4 o.W:..q..i...Rt. 00b0 6e 37 51 2e 59 94 00 a7 8d 57 26 f2 83 23 e4 42 n7Q.Y....W&..#.B 00c0 7f 52 51 4b cc f1 e8 9e f1 4b 9e 9e 8a 3a 4d 11 .RQK.....K...:M. 00d0 0b 47 39 30 5d 94 f6 99 9a 4b e6 0e 97 32 00 43 .G90]....K...2.C 00e0 76 14 47 28 89 bd 0f d5 d3 4b 99 b6 cc 6c b6 ab v.G(.....K...l.. 00f0 53 1c 6b 40 68 b4 20 df ad 68 16 d0 b2 7f e6 5e S.k@h. ..h.....^ 0100 1f 19 33 82 64 11 b6 f1 85 77 cd fd f4 4c 2c 72 ..3.d....w...L,r 0110 1f 26 35 2c 31 92 fc 9d fd 4b 32 13 3f 32 98 3e .&5,1....K2.?2.> 0120 cb 13 b7 25 b5 85 71 e8 85 43 6d 8f fc 4a 50 c5 ...%..q..Cm..JP. 0130 cb 33 b1 d5 39 bc a4 f8 8d 4f 46 d8 47 35 64 46 .3..9....OF.G5dF 0140 7f 66 67 2e dd 88 8d f6 85 6b bd f3 20 00 00 00 .fg......k.. ... 0150 52 01 R. No. Time Source Destination Protocol Info 2867 826.738931 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=8187 Ack=50895 Win=16314 [TCP CHECKSUM INCORRECT] Len=98 Frame 2867 (152 bytes on wire, 152 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.497435000 Time delta from previous packet: 0.001198000 seconds Time since reference or first frame: 826.738931000 seconds Frame Number: 2867 Packet Length: 152 bytes Capture Length: 152 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 138 Identification: 0x4262 (16994) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x33c8] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 8187, Ack: 50895, Len: 98 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 8187 (relative sequence number) Next sequence number: 8285 (relative sequence number) Acknowledgement number: 50895 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16314 Checksum: 0x84c0 [incorrect, should be 0x30b2] SEQ/ACK analysis This is an ACK to the segment in frame: 2866 The RTT to ACK the segment was: 0.001198000 seconds Data (98 bytes) 0000 bc ef 62 00 b5 fe 18 00 48 00 00 21 8d f8 32 0a ..b.....H..!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9c bc 30 aa 3b b1 29 76 a.elr.....0.;.)v 0030 2e a8 71 28 3b 30 07 f5 87 4b 06 ee db 96 e3 20 ..q(;0...K..... 0040 6e 14 1f c9 9d 84 87 9a 85 6b e1 ab bd ea 2b 74 n........k....+t 0050 75 34 07 2f 7d 30 81 ff 9c 4b 6a f1 87 33 04 e5 u4./}0...Kj..3.. 0060 62 00 b. No. Time Source Destination Protocol Info 2868 826.739221 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=50895 Ack=8285 Win=10032 Len=90 Frame 2868 (144 bytes on wire, 144 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.497725000 Time delta from previous packet: 0.000290000 seconds Time since reference or first frame: 826.739221000 seconds Frame Number: 2868 Packet Length: 144 bytes Capture Length: 144 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 130 Identification: 0x3158 (12632) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x44da [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 50895, Ack: 8285, Len: 90 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 50895 (relative sequence number) Next sequence number: 50985 (relative sequence number) Acknowledgement number: 8285 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10032 Checksum: 0x6bee [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2867 The RTT to ACK the segment was: 0.000290000 seconds Data (90 bytes) 0000 bc ef 5a 00 b5 fe 18 00 40 00 00 21 c9 aa 32 0a ..Z.....@..!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6c 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.l.].....#T;.+t 0030 18 90 76 2e 77 94 1c fe 91 4b 0c f0 a1 32 f8 e6 ..v.w....K...2.. 0040 57 b0 04 2e 99 84 a5 54 82 6b f9 f1 b6 ea 2d 72 W......T.k....-r 0050 73 34 05 30 61 94 e0 3d 5a 00 s4.0a..=Z. No. Time Source Destination Protocol Info 2869 826.744458 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=8285 Ack=50985 Win=16224 [TCP CHECKSUM INCORRECT] Len=150 Frame 2869 (204 bytes on wire, 204 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.502962000 Time delta from previous packet: 0.005237000 seconds Time since reference or first frame: 826.744458000 seconds Frame Number: 2869 Packet Length: 204 bytes Capture Length: 204 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 190 Identification: 0x4263 (16995) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3393] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 8285, Ack: 50985, Len: 150 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 8285 (relative sequence number) Next sequence number: 8435 (relative sequence number) Acknowledgement number: 50985 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16224 Checksum: 0x84f4 [incorrect, should be 0xd7c1] SEQ/ACK analysis This is an ACK to the segment in frame: 2868 The RTT to ACK the segment was: 0.005237000 seconds Data (150 bytes) 0000 bc ef 96 00 b5 fe 18 00 7a 00 02 21 87 67 32 0a ........z..!.g2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9e bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6b 35 4f 28 7e 94 0a f5 e2 4a 44 4a a4 32 ee 20 k5O(~....JDJ.2. 0040 7f 14 82 6c 9a 84 87 9a ca 68 83 ab c3 4e 26 74 ...l.....h...N&t 0050 80 cb 8f 8a 66 94 ec ff 9d 4b 1f 55 ac 32 14 41 ....f....K.U.2.A 0060 6e 14 67 2a f2 20 76 fc 8b 6b c1 e4 de 4e d2 09 n.g*. v..k...N.. 0070 6f 34 61 a8 75 30 7f d1 8a 4b 18 6e af 96 64 04 o4a.u0...K.n..d. 0080 58 14 1d 48 b1 20 91 be f8 6b ec 8f dc 4e 00 f5 X..H. ...k...N.. 0090 43 90 15 a3 96 00 C..... No. Time Source Destination Protocol Info 2870 826.744892 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=50985 Ack=8435 Win=10524 Len=338 Frame 2870 (392 bytes on wire, 392 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.503396000 Time delta from previous packet: 0.000434000 seconds Time since reference or first frame: 826.744892000 seconds Frame Number: 2870 Packet Length: 392 bytes Capture Length: 392 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 378 Identification: 0x3358 (13144) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x41e2 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 50985, Ack: 8435, Len: 338 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 50985 (relative sequence number) Next sequence number: 51323 (relative sequence number) Acknowledgement number: 8435 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10524 Checksum: 0xe4d2 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2869 The RTT to ACK the segment was: 0.000434000 seconds Data (338 bytes) 0000 bc ef 52 01 b5 fe 18 00 35 01 03 21 06 35 32 0a ..R.....5..!.52. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6e 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.n.].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 dd 96 e3 42 G.v.}.([.K.....B 0040 75 14 01 2e 17 20 8a f0 95 6b 92 f0 c5 4e 2c 72 u.... ...k...N,r 0050 7f 34 5d 30 7d 94 fe 99 95 4b 62 0f e8 5d 76 37 .4]0}....Kb..]v7 0060 0e 77 13 5b 99 84 6d ee 8f 6b 93 96 68 4f cc 8b .w.[..m..k..hO.. 0070 77 34 78 2e 69 94 2c c5 ad 78 78 d0 93 12 c4 60 w4x.i.,..xx....` 0080 39 34 2f 06 87 ea ac d0 a5 4b cd d0 f4 6e 0d 3f 94/......K...n.? 0090 5d 28 15 3d 51 99 36 0c 86 4a 52 13 bb 3e 18 41 ](.=Q.6..JR..>.A 00a0 6f 14 57 3a 95 98 71 e8 85 69 a9 96 dc 52 74 e4 o.W:..q..i...Rt. 00b0 6e 37 51 2e 59 94 00 a7 8d 57 26 f2 83 23 e4 42 n7Q.Y....W&..#.B 00c0 7f 52 51 4b cc f1 e8 9e f1 4b 9e 9e 8a 3a 4d 11 .RQK.....K...:M. 00d0 0b 47 39 30 5d 94 f6 99 9a 4b e6 0e 97 32 00 43 .G90]....K...2.C 00e0 76 14 47 28 89 bd 0f d5 d3 4b 99 b6 cc 6c b6 ab v.G(.....K...l.. 00f0 53 1c 6b 40 68 b4 20 df ad 68 16 d0 b2 7f e6 5e S.k@h. ..h.....^ 0100 1f 19 33 82 64 11 b6 f1 85 77 cd fd f4 4c 2c 72 ..3.d....w...L,r 0110 1f 26 35 2c 31 92 fc 9d fd 4b 32 13 3f 32 98 3e .&5,1....K2.?2.> 0120 cb 13 b7 25 b5 85 71 e8 85 43 6d 8f fc 4a 50 c5 ...%..q..Cm..JP. 0130 cb 33 b1 d5 39 bc a4 f8 8d 4f 46 d8 47 35 64 46 .3..9....OF.G5dF 0140 7f 66 67 2e dd 88 8d f6 85 6b bd f3 20 4e ac 14 .fg......k.. N.. 0150 52 01 R. No. Time Source Destination Protocol Info 2871 826.745383 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=8435 Ack=51323 Win=17520 [TCP CHECKSUM INCORRECT] Len=106 Frame 2871 (160 bytes on wire, 160 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.503887000 Time delta from previous packet: 0.000491000 seconds Time since reference or first frame: 826.745383000 seconds Frame Number: 2871 Packet Length: 160 bytes Capture Length: 160 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 146 Identification: 0x4264 (16996) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x33be] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 8435, Ack: 51323, Len: 106 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 8435 (relative sequence number) Next sequence number: 8541 (relative sequence number) Acknowledgement number: 51323 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x84c8 [incorrect, should be 0xfc81] SEQ/ACK analysis This is an ACK to the segment in frame: 2870 The RTT to ACK the segment was: 0.000491000 seconds Data (106 bytes) 0000 bc ef 6a 00 b5 fe 18 00 50 00 00 21 c6 55 32 0a ..j.....P..!.U2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9d bc 30 aa 3b b1 29 76 a.elr.....0.;.)v 0030 6e 34 71 28 3b 30 07 f5 87 4b 06 ee da 96 e3 20 n4q(;0...K..... 0040 75 14 07 c9 13 20 8a 9a 8b 6b e1 ab bc ea 2b 74 u.... ...k....+t 0050 6e 34 76 2f 61 94 e7 ff 81 ef 7e 55 b7 96 65 41 n4v/a.....~U..eA 0060 6e 14 6f 2a a9 85 6d 58 6a 00 n.o*..mXj. No. Time Source Destination Protocol Info 2872 826.745670 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=51323 Ack=8541 Win=10418 Len=90 Frame 2872 (144 bytes on wire, 144 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.504174000 Time delta from previous packet: 0.000287000 seconds Time since reference or first frame: 826.745670000 seconds Frame Number: 2872 Packet Length: 144 bytes Capture Length: 144 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 130 Identification: 0x3558 (13656) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x40da [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 51323, Ack: 8541, Len: 90 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 51323 (relative sequence number) Next sequence number: 51413 (relative sequence number) Acknowledgement number: 8541 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10418 Checksum: 0x3ec9 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2871 The RTT to ACK the segment was: 0.000287000 seconds Data (90 bytes) 0000 bc ef 5a 00 b5 fe 18 00 3e 00 02 21 7a 84 32 0a ..Z.....>..!z.2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6d 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.m.].....#T;.+t 0030 47 90 76 2e 7d 94 8e 5b 8a 4b 08 f0 bf 96 cc e6 G.v.}..[.K...... 0040 78 14 07 2e b5 20 8a f0 81 6b 8f 55 c5 4e 20 72 x.... ...k.U.N r 0050 7f 34 05 30 7d 30 e7 99 5a 00 .4.0}0..Z. No. Time Source Destination Protocol Info 2873 826.746023 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=8541 Ack=51413 Win=17430 [TCP CHECKSUM INCORRECT] Len=106 Frame 2873 (160 bytes on wire, 160 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.504527000 Time delta from previous packet: 0.000353000 seconds Time since reference or first frame: 826.746023000 seconds Frame Number: 2873 Packet Length: 160 bytes Capture Length: 160 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 146 Identification: 0x4265 (16997) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x33bd] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 8541, Ack: 51413, Len: 106 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 8541 (relative sequence number) Next sequence number: 8647 (relative sequence number) Acknowledgement number: 51413 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17430 Checksum: 0x84c8 [incorrect, should be 0xfcd7] SEQ/ACK analysis This is an ACK to the segment in frame: 2872 The RTT to ACK the segment was: 0.000353000 seconds Data (106 bytes) 0000 bc ef 6a 00 b5 fe 18 00 50 00 00 21 c7 95 32 0a ..j.....P..!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9d bc 30 aa 3b b1 29 76 a.elr.....0.;.)v 0030 6c 34 71 28 3b 30 07 f5 87 4b 06 ee da 96 e3 20 l4q(;0...K..... 0040 75 14 07 c9 13 20 8a 9a 8b 6b e1 ab bc ea 2b 74 u.... ...k....+t 0050 6e 34 76 2f 61 94 e7 ff 81 ef 7e 55 b7 96 65 41 n4v/a.....~U..eA 0060 6e 14 6f 2a a9 85 6d 58 6a 00 n.o*..mXj. No. Time Source Destination Protocol Info 2874 826.746282 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=51413 Ack=8647 Win=10312 Len=90 Frame 2874 (144 bytes on wire, 144 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.504786000 Time delta from previous packet: 0.000259000 seconds Time since reference or first frame: 826.746282000 seconds Frame Number: 2874 Packet Length: 144 bytes Capture Length: 144 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 130 Identification: 0x3758 (14168) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x3eda [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 51413, Ack: 8647, Len: 90 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 51413 (relative sequence number) Next sequence number: 51503 (relative sequence number) Acknowledgement number: 8647 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10312 Checksum: 0x3e6f [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2873 The RTT to ACK the segment was: 0.000259000 seconds Data (90 bytes) 0000 bc ef 5a 00 b5 fe 18 00 3e 00 02 21 7a 84 32 0a ..Z.....>..!z.2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6d 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.m.].....#T;.+t 0030 47 90 76 2e 7d 94 8e 5b 8a 4b 08 f0 bf 96 cc e6 G.v.}..[.K...... 0040 78 14 07 2e b5 20 8a f0 81 6b 8f 55 c5 4e 20 72 x.... ...k.U.N r 0050 7f 34 05 30 7d 30 e7 99 5a 00 .4.0}0..Z. No. Time Source Destination Protocol Info 2875 826.746866 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=8647 Ack=51503 Win=17340 [TCP CHECKSUM INCORRECT] Len=262 Frame 2875 (316 bytes on wire, 316 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.505370000 Time delta from previous packet: 0.000584000 seconds Time since reference or first frame: 826.746866000 seconds Frame Number: 2875 Packet Length: 316 bytes Capture Length: 316 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 302 Identification: 0x4266 (16998) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3320] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 8647, Ack: 51503, Len: 262 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 8647 (relative sequence number) Next sequence number: 8909 (relative sequence number) Acknowledgement number: 51503 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17340 Checksum: 0x8564 [incorrect, should be 0x1a78] SEQ/ACK analysis This is an ACK to the segment in frame: 2874 The RTT to ACK the segment was: 0.000584000 seconds Data (262 bytes) 0000 bc ef 06 01 b5 fe 18 00 ec 00 00 21 3b b3 32 0a ...........!;.2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a a3 bc 76 aa 3b b1 23 76 a.elr.....v.;.#v 0030 7b 34 71 28 07 30 07 f5 87 4b ee ed 22 96 e3 20 {4q(.0...K..".. 0040 75 14 03 c8 17 20 8a 9a 95 6b fd 0f 23 ea 2b 74 u.... ...k..#.+t 0050 73 34 fa d1 9e 6b 09 5b 9a 4b 6c f1 bb 96 1f 41 s4...k.[.Kl....A 0060 65 14 43 2a fc 20 76 fc 8f 6b 9d e5 8e ea d7 09 e.C*. v..k...... 0070 65 34 61 a8 57 94 07 75 87 4b 16 6e ce 96 e3 a0 e4a.W..u.K.n.... 0080 53 14 12 48 ad 84 f6 be 82 6b e3 8f 76 4f 2c f4 S..H.....k..vO,. 0090 47 34 15 ae 51 94 e0 db c2 ef 55 71 b5 32 ba c0 G4..Q.....Uq.2.. 00a0 73 14 4f aa 8c 84 71 7c a9 52 d7 5f 8a 6e f0 a9 s.O...q|.R._.n.. 00b0 4f 16 37 08 65 bc 2a 9b ac 6b 06 ce a3 11 c4 00 O.7.e.*..k...... 00c0 4f 08 87 48 19 83 8d 94 85 c9 dc 13 e4 56 2c 6d O..H.........V,m 00d0 7f 34 25 02 78 ea c7 a9 bd 6b 62 d1 a9 54 38 7d .4%.x....kb..T8} 00e0 47 3e 29 0b 85 a4 51 dc a6 4b 99 d4 f0 ea 51 ad G>)...Q..K....Q. 00f0 68 34 4b a8 95 95 1c d1 91 ef 4b 6e 92 32 ec a0 h4K.......Kn.2.. 0100 33 15 2f ec 06 01 3./... No. Time Source Destination Protocol Info 2876 826.749525 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=51503 Ack=8909 Win=10050 Len=630 Frame 2876 (684 bytes on wire, 684 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.508029000 Time delta from previous packet: 0.002659000 seconds Time since reference or first frame: 826.749525000 seconds Frame Number: 2876 Packet Length: 684 bytes Capture Length: 684 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 670 Identification: 0x3958 (14680) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x3abe [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 51503, Ack: 8909, Len: 630 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 51503 (relative sequence number) Next sequence number: 52133 (relative sequence number) Acknowledgement number: 8909 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10050 Checksum: 0xd830 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2875 The RTT to ACK the segment was: 0.002659000 seconds Data (630 bytes) 0000 bc ef 76 02 b5 fe 18 00 22 0d 11 21 59 dd 32 0a ..v....."..!Y.2. 0010 04 00 3c 2a 71 43 00 00 70 1a 0f f0 5a 7f 76 4c ..<*qC..p...Z.vL 0020 6f 06 14 96 88 32 4e b0 87 8a 30 61 64 d5 0f 74 o....2N...0ad..t 0030 26 b4 70 54 2a 96 a8 7f ac 8b 06 90 a3 2b 21 60 &.pT*........+!` 0040 be dd fb 58 cb 94 ed a1 94 f3 bd cd d0 44 a1 b0 ...X.........D.. 0050 63 50 26 f1 e2 94 1e 0a c7 52 56 21 af e4 e7 bb cP&......RV!.... 0060 f2 a0 49 2c 53 7b 89 7b f1 45 9d 40 33 b6 59 bf ..I,S{.{.E.@3.Y. 0070 41 30 b7 d1 91 0f f4 d1 89 9d e9 08 25 06 ca 46 A0..........%..F 0080 89 eb eb b5 19 aa 89 26 7a 93 62 85 fa 4a fa 8b .......&z.b..J.. 0090 c0 bf 70 21 97 12 2a 63 ab bb 32 cc fc d5 c8 bc ..p!..*c..2..... 00a0 3d 8a d2 e8 0f 5b 8e ff 03 ee 69 0c 03 b1 c1 fd =....[....i..... 00b0 ea f4 cb f1 a6 87 1e 7a 4d d1 f9 0f 92 a4 61 82 .......zM.....a. 00c0 e5 cb dc 3d 23 01 4d 6a 5a 94 cc 7f 61 8e b6 ad ...=#.MjZ...a... 00d0 80 26 db b5 81 0e 23 66 8f 35 c7 cf 11 ed e7 52 .&....#f.5.....R 00e0 31 91 87 b2 7a 7b 62 d0 00 ab 23 49 13 5f ee 0e 1...z{b...#I._.. 00f0 af ae 9e d1 50 78 18 e4 d6 b4 d4 87 43 8a f7 19 ....Px......C... 0100 e0 f6 47 fe 75 97 d6 0f 67 48 1d 49 e7 15 d3 90 ..G.u...gH.I.... 0110 77 e4 8d 23 6a 6b 1e 8a 2d f3 21 54 64 d0 be 93 w..#jk..-.!Td... 0120 d7 07 ec d6 57 e6 a1 50 96 30 36 6a ad 9e e8 fe ....W..P.06j.... 0130 34 cb 53 95 e9 2c 13 a4 6a 0b 59 0f 19 1c 0c 1e 4.S..,..j.Y..... 0140 76 b9 3c de f1 6c d1 ff 28 94 4c f8 6c 12 a5 b9 v.<..l..(.L.l... 0150 80 c5 ec a7 7d 9d 51 66 6c 51 ca 53 e2 9f 67 b2 ....}.QflQ.S..g. 0160 74 7c fb 20 68 7b 80 f1 6d 37 d0 25 73 bf 7e 05 t|. h{..m7.%s.~. 0170 33 3d 0c 2e d8 b7 e8 a3 84 e6 a5 7d 34 cd 99 5f 3=.........}4.._ 0180 2b 3a d7 f9 12 7c 00 02 ab 6f 7b 10 6c d7 18 3a +:...|...o{.l..: 0190 5b e2 2a 37 88 e0 d2 9d 6b b4 ea 95 0f 1c 9c 95 [.*7....k....... 01a0 90 ec 1d 1d fb 80 a7 17 7d f5 9d a6 98 98 af 15 ........}....... 01b0 e4 40 bf d5 cf 6b f8 71 f9 65 62 26 3c ca e3 f6 .@...k.q.eb&<... 01c0 51 10 35 d0 0f d4 8d cd 55 d3 8e b4 5b 93 0c 4d Q.5.....U...[..M 01d0 de 44 c3 78 fe 50 27 38 ed 6d b5 f0 0f 8f 39 33 .D.x.P'8.m....93 01e0 49 a3 78 ed 8c 25 01 ce 32 94 3d 5d 0d 3e 76 5a I.x..%..2.=].>vZ 01f0 90 f0 52 70 79 b2 b7 00 49 00 d7 80 f5 85 9b 86 ..Rpy...I....... 0200 46 b2 83 09 ba 73 49 59 24 05 ab 58 4b ac 1b b5 F....sIY$..XK... 0210 ef fb 42 30 35 49 5c e9 5b 3d 0e cb aa 54 14 64 ..B05I\.[=...T.d 0220 d8 24 ce 8e 54 23 29 40 7a 50 7b 48 cc 6f 9b f5 .$..T#)@zP{H.o.. 0230 ab ce 2c d8 df 33 03 a4 10 dc 8a 36 94 25 84 7c ..,..3.....6.%.| 0240 80 0f 8e 18 a5 a7 28 70 67 cf af c9 57 ec ac 11 ......(pg...W... 0250 76 eb bd a4 ba 7b a5 d1 53 d9 61 71 2a 6b 9e 5e v....{..S.aq*k.^ 0260 47 fc 2f 14 11 35 c3 53 f7 ef e7 02 84 8d 24 9b G./..5.S......$. 0270 ff fb 9d 00 76 02 ....v. No. Time Source Destination Protocol Info 2877 826.751078 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=8909 Ack=52133 Win=16710 [TCP CHECKSUM INCORRECT] Len=74 Frame 2877 (128 bytes on wire, 128 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.509582000 Time delta from previous packet: 0.001553000 seconds Time since reference or first frame: 826.751078000 seconds Frame Number: 2877 Packet Length: 128 bytes Capture Length: 128 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 114 Identification: 0x4267 (16999) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x33db] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 8909, Ack: 52133, Len: 74 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 8909 (relative sequence number) Next sequence number: 8983 (relative sequence number) Acknowledgement number: 52133 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16710 Checksum: 0x84a8 [incorrect, should be 0xef49] SEQ/ACK analysis This is an ACK to the segment in frame: 2876 The RTT to ACK the segment was: 0.001553000 seconds Data (74 bytes) 0000 bc ef 4a 00 b5 fe 18 00 30 00 00 21 eb 75 32 0a ..J.....0..!.u2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a a0 bc 8a aa 3b b1 25 76 a.elr.......;.%v 0030 6f 34 96 8c 7e 94 0c f5 4e 81 05 ee bf 96 99 20 o4..~...N...... 0040 7e 14 0b c8 b1 85 91 3e 4a 00 ~......>J. No. Time Source Destination Protocol Info 2878 826.751321 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=52133 Ack=8983 Win=10524 Len=66 Frame 2878 (120 bytes on wire, 120 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.509825000 Time delta from previous packet: 0.000243000 seconds Time since reference or first frame: 826.751321000 seconds Frame Number: 2878 Packet Length: 120 bytes Capture Length: 120 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 106 Identification: 0x3b58 (15192) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x3af2 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 52133, Ack: 8983, Len: 66 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 52133 (relative sequence number) Next sequence number: 52199 (relative sequence number) Acknowledgement number: 8983 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10524 Checksum: 0x6715 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2877 The RTT to ACK the segment was: 0.000243000 seconds Data (66 bytes) 0000 bc ef 42 00 b5 fe 18 00 28 00 00 21 e9 33 32 0a ..B.....(..!.32. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 73 99 e1 42 ..<*qC..f...s..B 0020 6b 04 5d 8a 72 b4 0b f0 ad 18 0c f0 38 b1 07 d0 k.].r.......8... 0030 68 34 75 2e 0b 30 01 ff 81 4b 06 f0 a3 32 f8 e6 h4u..0...K...2.. 0040 42 00 B. No. Time Source Destination Protocol Info 2879 826.751971 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=8983 Ack=52199 Win=16644 [TCP CHECKSUM INCORRECT] Len=162 Frame 2879 (216 bytes on wire, 216 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.510475000 Time delta from previous packet: 0.000650000 seconds Time since reference or first frame: 826.751971000 seconds Frame Number: 2879 Packet Length: 216 bytes Capture Length: 216 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 202 Identification: 0x4268 (17000) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3382] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 8983, Ack: 52199, Len: 162 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 8983 (relative sequence number) Next sequence number: 9145 (relative sequence number) Acknowledgement number: 52199 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16644 Checksum: 0x8500 [incorrect, should be 0x112b] SEQ/ACK analysis This is an ACK to the segment in frame: 2878 The RTT to ACK the segment was: 0.000650000 seconds Data (162 bytes) 0000 bc ef a2 00 b5 fe 18 00 86 00 02 21 3d 11 32 0a ...........!=.2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a a3 bc 76 aa 3b b1 23 76 a.elr.....v.;.#v 0030 3f 34 71 28 07 30 07 f5 87 4b 07 ee 22 96 e3 20 ?4q(.0...K..".. 0040 75 14 03 c8 12 20 8a 9a 92 6b fd 0f c4 4e cb d0 u.... ...k...N.. 0050 78 34 09 2e 9e 6b 03 00 68 ef 65 f1 a5 32 08 e5 x4...k..h.e..2.. 0060 68 14 6d 2a a1 84 08 58 82 6b 93 e4 cc 4a 92 ad h.m*...X.k...J.. 0070 68 34 6b a8 69 94 3e 75 8a 4b 1c 6e 7e 32 99 04 h4k.i.>u.K.n~2.. 0080 58 14 1f 48 af 84 8d 1a 04 cf ea 8f de 4e 31 f5 X..H.........N1. 0090 43 90 09 0a 2c 94 fd 7f b5 4b 7e 70 a7 96 44 ac C...,....K~p..D. 00a0 a2 00 .. No. Time Source Destination Protocol Info 2880 826.752366 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=52199 Ack=9145 Win=10362 Len=106 Frame 2880 (160 bytes on wire, 160 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.510870000 Time delta from previous packet: 0.000395000 seconds Time since reference or first frame: 826.752366000 seconds Frame Number: 2880 Packet Length: 160 bytes Capture Length: 160 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 146 Identification: 0x3d58 (15704) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x38ca [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 52199, Ack: 9145, Len: 106 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 52199 (relative sequence number) Next sequence number: 52305 (relative sequence number) Acknowledgement number: 9145 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10362 Checksum: 0x09c9 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2879 The RTT to ACK the segment was: 0.000395000 seconds Data (106 bytes) 0000 bc ef 6a 00 b5 fe 18 00 4e 00 02 21 31 97 32 0a ..j.....N..!1.2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 73 99 e1 42 ..<*qC..f...s..B 0020 6b 04 5d 8a 72 b4 0b f0 fb 18 0c f0 36 b1 2e 74 k.].r.......6..t 0030 47 90 76 2e 7d 94 8f 5b 8a 4b 11 f0 3b 32 e4 42 G.v.}..[.K..;2.B 0040 7f 14 03 2e 7a 20 8a f0 89 6b 37 3b c7 4e 04 d6 ....z ...k7;.N.. 0050 78 34 01 30 49 30 fb 99 99 4b 10 ab aa 32 14 43 x4.0I0...K...2.C 0060 6f 14 67 28 99 20 08 4a 6a 00 o.g(. .Jj. No. Time Source Destination Protocol Info 2881 826.752858 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=9145 Ack=52305 Win=16538 [TCP CHECKSUM INCORRECT] Len=102 Frame 2881 (156 bytes on wire, 156 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.511362000 Time delta from previous packet: 0.000492000 seconds Time since reference or first frame: 826.752858000 seconds Frame Number: 2881 Packet Length: 156 bytes Capture Length: 156 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 142 Identification: 0x4269 (17001) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x33bd] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 9145, Ack: 52305, Len: 102 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 9145 (relative sequence number) Next sequence number: 9247 (relative sequence number) Acknowledgement number: 52305 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16538 Checksum: 0x84c4 [incorrect, should be 0xaf16] SEQ/ACK analysis This is an ACK to the segment in frame: 2880 The RTT to ACK the segment was: 0.000492000 seconds Data (102 bytes) 0000 bc ef 66 00 b5 fe 18 00 4c 00 00 21 93 54 32 0a ..f.....L..!.T2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a a3 bc 76 aa 3b b1 23 76 a.elr.....v.;.#v 0030 cf 34 71 28 07 30 07 f5 87 4b 07 ee 22 96 e3 20 .4q(.0...K..".. 0040 75 14 03 c8 12 20 8a 9a 92 6b fd 0f c4 4e cb d0 u.... ...k...N.. 0050 78 34 09 2e ab 5e ff ff 81 ef 1f f1 aa 32 10 41 x4...^.......2.A 0060 43 15 7b 8e 66 00 C.{.f. No. Time Source Destination Protocol Info 2882 826.753237 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=52305 Ack=9247 Win=10260 Len=94 Frame 2882 (148 bytes on wire, 148 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.511741000 Time delta from previous packet: 0.000379000 seconds Time since reference or first frame: 826.753237000 seconds Frame Number: 2882 Packet Length: 148 bytes Capture Length: 148 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 134 Identification: 0x3f58 (16216) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x36d6 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 52305, Ack: 9247, Len: 94 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 52305 (relative sequence number) Next sequence number: 52399 (relative sequence number) Acknowledgement number: 9247 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10260 Checksum: 0xb937 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2881 The RTT to ACK the segment was: 0.000379000 seconds Data (94 bytes) 0000 bc ef 5e 00 b5 fe 18 00 44 00 00 21 ee 70 32 0a ..^.....D..!.p2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 73 99 e1 42 ..<*qC..f...s..B 0020 6b 04 5d 8a 72 b4 0b f0 fb 18 0c f0 36 b1 2e 74 k.].r.......6..t 0030 47 90 76 2e 7d 94 8f 5b 8a 4b 11 f0 08 32 e4 42 G.v.}..[.K...2.B 0040 7f 14 03 2e b5 20 8a f0 81 6b d5 55 c3 4e 28 72 ..... ...k.U.N(r 0050 0d 90 04 30 6d 94 fc 99 9d 4b 7e ab 5e 00 ...0m....K~.^. No. Time Source Destination Protocol Info 2883 826.753686 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=9247 Ack=52399 Win=16444 [TCP CHECKSUM INCORRECT] Len=74 Frame 2883 (128 bytes on wire, 128 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.512190000 Time delta from previous packet: 0.000449000 seconds Time since reference or first frame: 826.753686000 seconds Frame Number: 2883 Packet Length: 128 bytes Capture Length: 128 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 114 Identification: 0x426a (17002) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x33d8] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 9247, Ack: 52399, Len: 74 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 9247 (relative sequence number) Next sequence number: 9321 (relative sequence number) Acknowledgement number: 52399 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16444 Checksum: 0x84a8 [incorrect, should be 0xbcf9] SEQ/ACK analysis This is an ACK to the segment in frame: 2882 The RTT to ACK the segment was: 0.000449000 seconds Data (74 bytes) 0000 bc ef 4a 00 b5 fe 18 00 30 00 00 21 23 74 32 0a ..J.....0..!#t2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a a0 bc 8a aa 3b b1 25 76 a.elr.......;.%v 0030 6f 34 96 8c 7e 94 0c f5 47 81 05 ee bf 96 99 20 o4..~...G...... 0040 7e 14 0b c8 b1 85 91 3e 4a 00 ~......>J. No. Time Source Destination Protocol Info 2884 826.753898 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=52399 Ack=9321 Win=10186 Len=66 Frame 2884 (120 bytes on wire, 120 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.512402000 Time delta from previous packet: 0.000212000 seconds Time since reference or first frame: 826.753898000 seconds Frame Number: 2884 Packet Length: 120 bytes Capture Length: 120 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 106 Identification: 0x4158 (16728) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x34f2 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 52399, Ack: 9321, Len: 66 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 52399 (relative sequence number) Next sequence number: 52465 (relative sequence number) Acknowledgement number: 9321 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10186 Checksum: 0x660b [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2883 The RTT to ACK the segment was: 0.000212000 seconds Data (66 bytes) 0000 bc ef 42 00 b5 fe 18 00 28 00 00 21 e9 33 32 0a ..B.....(..!.32. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 73 99 e1 42 ..<*qC..f...s..B 0020 6b 04 5d 8a 72 b4 0b f0 ad 18 0c f0 38 b1 07 d0 k.].r.......8... 0030 68 34 75 2e 0b 30 01 ff 81 4b 06 f0 a3 32 f8 e6 h4u..0...K...2.. 0040 42 00 B. No. Time Source Destination Protocol Info 2885 826.889132 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=9321 Ack=52465 Win=16378 [TCP CHECKSUM INCORRECT] Len=0 Frame 2885 (54 bytes on wire, 54 bytes captured) Arrival Time: Nov 11, 2005 16:43:55.647636000 Time delta from previous packet: 0.135234000 seconds Time since reference or first frame: 826.889132000 seconds Frame Number: 2885 Packet Length: 54 bytes Capture Length: 54 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x426c (17004) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3420] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 9321, Ack: 52465, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 9321 (relative sequence number) Acknowledgement number: 52465 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16378 Checksum: 0x845e [incorrect, should be 0x6d27] SEQ/ACK analysis This is an ACK to the segment in frame: 2884 The RTT to ACK the segment was: 0.135234000 seconds No. Time Source Destination Protocol Info 2892 829.503472 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=9321 Ack=52465 Win=16378 [TCP CHECKSUM INCORRECT] Len=286 Frame 2892 (340 bytes on wire, 340 bytes captured) Arrival Time: Nov 11, 2005 16:43:58.261976000 Time delta from previous packet: 2.614340000 seconds Time since reference or first frame: 829.503472000 seconds Frame Number: 2892 Packet Length: 340 bytes Capture Length: 340 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 326 Identification: 0x4295 (17045) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x32d9] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 9321, Ack: 52465, Len: 286 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 9321 (relative sequence number) Next sequence number: 9607 (relative sequence number) Acknowledgement number: 52465 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16378 Checksum: 0x857c [incorrect, should be 0x3191] Data (286 bytes) 0000 bc ef 1e 01 b5 fe 18 00 01 01 03 21 0b 9d 32 0a ...........!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a a3 bc 76 aa 3b b1 23 76 a.elr.....v.;.#v 0030 7b 34 71 28 07 30 07 f5 87 4b ee ed 22 96 e3 20 {4q(.0...K..".. 0040 75 14 03 c8 17 20 8a 9a 95 6b fd 0f 23 ea 2b 74 u.... ...k..#.+t 0050 73 34 fa d1 9e 6b 09 5b 9a 4b 6c f1 bb 96 1f 41 s4...k.[.Kl....A 0060 65 14 43 2a fc 20 76 fc 8f 6b 9d e5 8e ea d7 09 e.C*. v..k...... 0070 65 34 61 a8 57 94 07 75 87 4b 16 6e ce 96 e3 a0 e4a.W..u.K.n.... 0080 53 14 12 48 ad 84 f6 be 82 6b e3 8f 76 4f 2c f4 S..H.....k..vO,. 0090 47 34 15 ae 51 94 e0 db ca ef 55 71 b5 32 40 c1 G4..Q.....Uq.2@. 00a0 76 14 55 aa 96 84 71 7c f5 08 a9 78 78 31 74 8e v.U...q|...xx1t. 00b0 6f 3a 51 8a 58 88 00 ed 8d 52 26 ee 83 1e dd 5e o:Q.X....R&....^ 00c0 44 42 03 e8 9d a4 af fc a5 57 f5 25 8a 6f 0c 54 DB.......W.%.o.T 00d0 5f 14 06 0e 61 a4 e0 5b 1d ef 45 f1 85 32 ba 40 _...a..[..E..2.@ 00e0 73 14 5f 2a bc 84 71 fc a9 52 c7 df ba 6e f0 29 s._*..q..R...n.) 00f0 4f 16 27 88 75 bc 2a 1b ac 6b 16 4e b3 11 c4 80 O.'.u.*..k.N.... 0100 2f 08 97 c9 69 83 8d 10 85 b7 cc 93 50 52 88 89 /...i.......PR.. 0110 1f 35 35 a6 31 b8 fd 63 59 f3 21 2a 1e 01 .55.1..cY.!*.. No. Time Source Destination Protocol Info 2893 829.503726 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=52465 Ack=9607 Win=11984 Len=0 Frame 2893 (60 bytes on wire, 60 bytes captured) Arrival Time: Nov 11, 2005 16:43:58.262230000 Time delta from previous packet: 0.000254000 seconds Time since reference or first frame: 829.503726000 seconds Frame Number: 2893 Packet Length: 60 bytes Capture Length: 60 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Trailer: 000000000000 Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x595a (22874) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x1d32 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 52465, Ack: 9607, Len: 0 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 52465 (relative sequence number) Acknowledgement number: 9607 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 11984 Checksum: 0x7d33 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2892 The RTT to ACK the segment was: 0.000254000 seconds No. Time Source Destination Protocol Info 2894 829.504170 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=52465 Ack=9607 Win=11984 Len=146 Frame 2894 (200 bytes on wire, 200 bytes captured) Arrival Time: Nov 11, 2005 16:43:58.262674000 Time delta from previous packet: 0.000444000 seconds Time since reference or first frame: 829.504170000 seconds Frame Number: 2894 Packet Length: 200 bytes Capture Length: 200 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 186 Identification: 0x5a5a (23130) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x1ba0 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 52465, Ack: 9607, Len: 146 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 52465 (relative sequence number) Next sequence number: 52611 (relative sequence number) Acknowledgement number: 9607 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 11984 Checksum: 0x305e [correct] Data (146 bytes) 0000 bc ef 92 00 b5 fe 18 00 75 00 03 21 9c 57 32 0a ........u..!.W2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 73 99 e1 42 ..<*qC..f...s..B 0020 6b 04 5d 8a 72 b4 0b f0 fb 18 0c f0 36 b1 2e 74 k.].r.......6..t 0030 47 90 76 2e 7d 94 8a 5b 8a 4b 16 f0 30 32 81 42 G.v.}..[.K..02.B 0040 7f 14 03 2e 3f 85 91 f0 9d 6b e4 f1 c4 4e 00 4b ....?....k...N.K 0050 01 0f 53 10 41 b4 dc bb fb 6b 5e 27 81 5c 39 63 ..S.A....k^'.\9c 0060 4f 34 47 0b a5 a4 41 f2 21 6b 99 71 68 49 d0 87 O4G...A.!k.qhI.. 0070 6f e0 ab 2d 69 bc a4 f8 8d 4f 16 d8 17 35 e4 46 o..-i....O...5.F 0080 5f 66 b7 2f ad 88 8d fe d4 6b ed ed 70 4f 2c 72 _f./.....k..pO,r 0090 92 00 .. No. Time Source Destination Protocol Info 2895 829.504753 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=9607 Ack=52611 Win=16232 [TCP CHECKSUM INCORRECT] Len=74 Frame 2895 (128 bytes on wire, 128 bytes captured) Arrival Time: Nov 11, 2005 16:43:58.263257000 Time delta from previous packet: 0.000583000 seconds Time since reference or first frame: 829.504753000 seconds Frame Number: 2895 Packet Length: 128 bytes Capture Length: 128 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 114 Identification: 0x4296 (17046) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x33ac] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 9607, Ack: 52611, Len: 74 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 9607 (relative sequence number) Next sequence number: 9681 (relative sequence number) Acknowledgement number: 52611 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16232 Checksum: 0x84a8 [incorrect, should be 0x1990] SEQ/ACK analysis This is an ACK to the segment in frame: 2894 The RTT to ACK the segment was: 0.000583000 seconds Data (74 bytes) 0000 bc ef 4a 00 b5 fe 18 00 30 00 00 21 b3 75 32 0a ..J.....0..!.u2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a a0 bc 8a aa 3b b1 25 76 a.elr.......;.%v 0030 6f 34 96 8c 7e 94 0c f5 59 81 05 ee bf 96 99 20 o4..~...Y...... 0040 7e 14 0b c8 b1 85 91 3e 4a 00 ~......>J. No. Time Source Destination Protocol Info 2896 829.504989 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=52611 Ack=9681 Win=11910 Len=66 Frame 2896 (120 bytes on wire, 120 bytes captured) Arrival Time: Nov 11, 2005 16:43:58.263493000 Time delta from previous packet: 0.000236000 seconds Time since reference or first frame: 829.504989000 seconds Frame Number: 2896 Packet Length: 120 bytes Capture Length: 120 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 106 Identification: 0x5c5a (23642) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x19f0 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 52611, Ack: 9681, Len: 66 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 52611 (relative sequence number) Next sequence number: 52677 (relative sequence number) Acknowledgement number: 9681 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 11910 Checksum: 0x5d13 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2895 The RTT to ACK the segment was: 0.000236000 seconds Data (66 bytes) 0000 bc ef 42 00 b5 fe 18 00 28 00 00 21 e9 33 32 0a ..B.....(..!.32. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 73 99 e1 42 ..<*qC..f...s..B 0020 6b 04 5d 8a 72 b4 0b f0 ad 18 0c f0 38 b1 07 d0 k.].r.......8... 0030 68 34 75 2e 0b 30 01 ff 81 4b 06 f0 a3 32 f8 e6 h4u..0...K...2.. 0040 42 00 B. No. Time Source Destination Protocol Info 2897 829.505369 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=9681 Ack=52677 Win=16166 [TCP CHECKSUM INCORRECT] Len=126 Frame 2897 (180 bytes on wire, 180 bytes captured) Arrival Time: Nov 11, 2005 16:43:58.263873000 Time delta from previous packet: 0.000380000 seconds Time since reference or first frame: 829.505369000 seconds Frame Number: 2897 Packet Length: 180 bytes Capture Length: 180 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 166 Identification: 0x4297 (17047) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3377] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 9681, Ack: 52677, Len: 126 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 9681 (relative sequence number) Next sequence number: 9807 (relative sequence number) Acknowledgement number: 52677 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16166 Checksum: 0x84dc [incorrect, should be 0x1570] SEQ/ACK analysis This is an ACK to the segment in frame: 2896 The RTT to ACK the segment was: 0.000380000 seconds Data (126 bytes) 0000 bc ef 7e 00 b5 fe 18 00 64 00 00 21 c9 da 32 0a ..~.....d..!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9f bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6b 35 33 8c 7e 94 0a f5 8d 4b 7e 4a a4 32 f5 20 k53.~....K~J.2. 0040 63 b0 7e 6c 9a 84 81 9a 80 6b fd 0f ba ea 2b 74 c.~l.....k....+t 0050 75 34 05 2e eb 30 fb ff 8d 4b f1 f1 ce 32 18 41 u4...0...K...2.A 0060 6f 14 7b 8e 16 84 1a fc 85 6b 99 e4 d0 ea d0 09 o.{......k...... 0070 73 90 1c a8 68 94 08 75 a1 4a 0a ca 7e 00 s...h..u.J..~. No. Time Source Destination Protocol Info 2898 829.505793 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=52677 Ack=9807 Win=11784 Len=682 Frame 2898 (736 bytes on wire, 736 bytes captured) Arrival Time: Nov 11, 2005 16:43:58.264297000 Time delta from previous packet: 0.000424000 seconds Time since reference or first frame: 829.505793000 seconds Frame Number: 2898 Packet Length: 736 bytes Capture Length: 736 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 722 Identification: 0x5e5a (24154) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x1588 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 52677, Ack: 9807, Len: 682 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 52677 (relative sequence number) Next sequence number: 53359 (relative sequence number) Acknowledgement number: 9807 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 11784 Checksum: 0x068c [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2897 The RTT to ACK the segment was: 0.000424000 seconds Data (682 bytes) 0000 bc ef aa 02 b5 fe 18 00 8e 02 02 21 fd 28 32 0a ...........!.(2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6f 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.o.].....#T;.+t 0030 47 90 76 2e 7d 94 7d 5b 8a 4b 0a f0 a6 32 e4 42 G.v.}.}[.K...2.B 0040 01 b0 04 2e 97 84 8f f0 0f cf fa f1 d4 4e bf 72 .............N.r 0050 1a 34 05 30 61 94 a4 99 81 4b 60 0f a1 32 18 43 .4.0a....K`..2.C 0060 1f 77 14 68 e6 e5 5f 8d ea 06 85 96 d0 4e da 8b .w.h.._......N.. 0070 69 34 bc 2f 75 94 0a ff 1e 4b b4 f1 af 32 fc 42 i4./u....K...2.B 0080 46 14 13 2e 81 bd f3 cb d3 4b cd d1 f4 6c 4a 52 F........K...lJR 0090 63 1c 3f 5e 70 b4 dc b9 9d 68 72 2f 8b 1e 18 5f c.?^p....hr/..._ 00a0 6f 1e 57 29 95 a9 71 f2 85 66 a9 42 51 55 93 2f o.W)..q..f.BQU./ 00b0 6e 28 51 36 59 8d 00 ff 8d 66 48 c3 c2 4e c4 62 n(Q6Y....fH..N.b 00c0 5f 34 01 48 9d b8 a5 da eb 4a fd d1 c4 6f 0a 52 _4.H.....J...o.R 00d0 5f 15 68 32 5d 94 f1 99 c1 1b 36 4c 8a 32 04 43 _.h2].....6L.2.C 00e0 63 14 49 28 a5 84 3f ee 99 6b b4 96 b0 1e a4 c8 c.I(..?..k...... 00f0 6b 34 5d 2e 45 94 0d ff 8d 4b 06 f3 8f 32 e6 42 k4].E....K...2.B 0100 15 14 33 2e bd e7 fe b0 e6 0a e3 92 9b 23 ad 77 ..3..........#.w 0110 03 34 37 30 3b 94 fc 99 8d 28 41 4f f8 53 b6 20 .470;....(AO.S. 0120 00 79 37 29 a9 84 74 e8 83 6b c9 88 8c 4e 33 ed .y7)..t..k...N3. 0130 1c 34 8a d2 25 94 05 ff 81 4b 46 f0 80 32 05 42 .4..%....KF..2.B 0140 51 14 a0 2f b2 84 e0 f6 22 6a a1 ef 86 4e a6 14 Q../...."j...N.. 0150 7f 34 b5 ac 52 d4 9f f8 b3 28 4d 62 f7 96 0b 43 .4..R....(Mb...C 0160 04 14 a7 29 c5 84 29 e8 99 6b db 88 9c 4e 50 ed ...)..)..k...NP. 0170 1d 5a ce b2 41 f1 40 9c e4 38 35 9f dd 51 0b 2f .Z..A.@..85..Q./ 0180 43 14 cf 2f e7 84 8b f6 58 6a b1 ef 9e 4e 3f 14 C../....Xj...N?. 0190 fd 35 c9 cf 09 94 e5 99 bd 4b 3e 36 85 09 ce 63 .5.......K>6...c 01a0 4f 34 b7 0b b3 a4 4d c0 af 05 c8 a8 bc 6e 70 ce O4....M......np. 01b0 4f 14 a1 fd 19 88 00 f5 8d 4a 66 dd c3 2e 64 4f O........Jf...dO 01c0 7f bb d4 64 be 20 8c ea 85 73 9d f6 a4 4e ac 39 ...d. ...s...N.9 01d0 0e 44 a9 ae 21 b4 dc b9 bf 2d 22 33 e3 18 f6 62 .D..!....-"3...b 01e0 4f 34 a7 08 c9 a4 51 c9 c8 69 e5 88 a1 4e 2e a4 O4....Q..i...N.. 01f0 24 77 80 d1 15 94 0c ff 8e 4b 76 f0 9d 32 78 42 $w.......Kv..2xB 0200 92 13 8d 66 46 cf 89 f6 99 75 81 ef b6 68 ac 14 ...fF....u...h.. 0210 af de e9 cf f3 aa ed 99 7d 8a 83 61 b4 96 0c 27 ........}..a...' 0220 2f b8 63 5c 96 3c 21 94 ea f9 0b ec a0 49 2e 0a /.c\. 1677 [ACK] Seq=9807 Ack=53359 Win=17520 [TCP CHECKSUM INCORRECT] Len=0 Frame 2899 (54 bytes on wire, 54 bytes captured) Arrival Time: Nov 11, 2005 16:43:58.451624000 Time delta from previous packet: 0.187327000 seconds Time since reference or first frame: 829.693120000 seconds Frame Number: 2899 Packet Length: 54 bytes Capture Length: 54 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x429b (17051) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x33f1] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 9807, Ack: 53359, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 9807 (relative sequence number) Acknowledgement number: 53359 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x845e [incorrect, should be 0x634d] SEQ/ACK analysis This is an ACK to the segment in frame: 2898 The RTT to ACK the segment was: 0.187327000 seconds No. Time Source Destination Protocol Info 2948 846.891528 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=9807 Ack=53359 Win=17520 [TCP CHECKSUM INCORRECT] Len=134 Frame 2948 (188 bytes on wire, 188 bytes captured) Arrival Time: Nov 11, 2005 16:44:15.650032000 Time delta from previous packet: 17.198408000 seconds Time since reference or first frame: 846.891528000 seconds Frame Number: 2948 Packet Length: 188 bytes Capture Length: 188 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 174 Identification: 0x43b5 (17333) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3251] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 9807, Ack: 53359, Len: 134 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 9807 (relative sequence number) Next sequence number: 9941 (relative sequence number) Acknowledgement number: 53359 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x84e4 [incorrect, should be 0xbba3] Data (134 bytes) 0000 bc ef 86 00 b5 fe 18 00 6c 00 00 21 dd 33 32 0a ........l..!.32. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 0c bc 76 aa 3b b1 23 76 a.elr.....v.;.#v 0030 4e 34 71 28 64 30 07 f5 8b 4b b8 d4 a3 32 9f 84 N4q(d0...K...2.. 0040 78 14 0d c8 81 20 fa 3e 82 6b f3 0f d8 ea 53 d0 x.... .>.k....S. 0050 78 34 0b 2e 7d 30 88 fe 9a 4b 65 f1 ab 32 18 41 x4..}0...Ke..2.A 0060 e1 b0 60 2a 8b 84 6d 58 fc cf 9e e4 c6 4e d0 08 ..`*..mX.....N.. 0070 2d 90 66 a8 63 94 10 75 91 ef 6b 6e b2 32 ec a0 -.f.c..u..kn.2.. 0080 73 15 0f ec 86 00 s..... No. Time Source Destination Protocol Info 2949 846.891772 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=53359 Ack=9941 Win=13444 Len=0 Frame 2949 (60 bytes on wire, 60 bytes captured) Arrival Time: Nov 11, 2005 16:44:15.650276000 Time delta from previous packet: 0.000244000 seconds Time since reference or first frame: 846.891772000 seconds Frame Number: 2949 Packet Length: 60 bytes Capture Length: 60 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Trailer: 000000000000 Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x0d74 (3444) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x6918 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 53359, Ack: 9941, Len: 0 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 53359 (relative sequence number) Acknowledgement number: 9941 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 13444 Checksum: 0x72b3 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2948 The RTT to ACK the segment was: 0.000244000 seconds No. Time Source Destination Protocol Info 2950 846.893392 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=53359 Ack=9941 Win=13444 Len=1460 Frame 2950 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:44:15.651896000 Time delta from previous packet: 0.001620000 seconds Time since reference or first frame: 846.893392000 seconds Frame Number: 2950 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x0e74 (3700) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x6264 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 53359, Ack: 9941, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 53359 (relative sequence number) Next sequence number: 54819 (relative sequence number) Acknowledgement number: 9941 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 13444 Checksum: 0xa8c1 [correct] Data (1460 bytes) 0000 bc ef b2 16 b5 fe 18 00 b6 1b 12 21 df 9e 32 0a ...........!..2. 0010 04 00 3c 2a 71 43 00 00 70 1a 0f f0 5b bf 76 4c ..<*qC..p...[.vL 0020 6f 01 75 3f 55 b5 49 d1 87 dd b4 11 21 37 6e b4 o.u?U.I.....!7n. 0030 6c 4a a5 2e 1b 94 66 e6 97 47 c0 33 b2 8b f0 c0 lJ....f..G.3.... 0040 3c 03 0d 28 1e a7 db b1 61 73 dd 2a 4c 8c 3c 12 <..(....as.*L.<. 0050 24 bc 44 90 61 be f8 5b de 71 00 9f bb 32 89 c5 $.D.a..[.q...2.. 0060 27 d3 14 08 6d c4 32 d4 19 a5 1f 65 a5 da 34 ab '...m.2....e..4. 0070 46 a9 2f 29 6a ed c8 17 ad 62 0f be 94 61 ca 12 F./)j....b...a.. 0080 4f 18 55 b6 bd ee bc e8 09 ef ee f0 5c ce 76 52 O.U.........\.vR 0090 75 24 5d 72 53 f5 d8 1d ef 6b c6 84 99 30 0f cf u$]rS....k...0.. 00a0 4a 81 1d 2c 07 f5 7d 70 c8 43 ba 9e 79 0c f9 0c J..,..}p.C..y... 00b0 ca b5 ad 1c 65 a1 1b f2 2b d8 47 43 1f 22 ea 24 ....e...+.GC.".$ 00c0 8c b5 80 20 cb 07 fc 3c df 1c ed 7a 68 30 0c 2e ... ...<...zh0.. 00d0 1e 0e aa b7 fb 08 e9 78 0c 5a 69 3b 83 36 1c 9e .......x.Zi;.6.. 00e0 09 1c c3 33 da a7 18 5a 6d 05 8b 0b e2 be 58 86 ...3...Zm.....X. 00f0 08 09 ee ae 25 93 af ff 2d 4a 10 25 15 53 66 63 ....%...-J.%.Sfc 0100 63 0f b3 28 91 b6 fa 77 47 19 cd eb 34 49 1c 72 c..(...wG...4I.r 0110 a7 34 56 f6 08 37 ec db dd 71 b2 0c 01 d4 86 45 .4V..7...q.....E 0120 6b da af 3a d9 80 41 24 c7 e8 af f1 c8 af cc fc k..:..A$........ 0130 d5 07 b1 7a 7d 56 14 fc eb d4 b8 7a 11 2b 70 a1 ...z}V.....z.+p. 0140 7d 56 91 09 bf 9c 2b f6 99 59 da 2a e5 4d a6 15 }V....+..Y.*.M.. 0150 43 b2 c1 cb 40 87 4a 88 48 53 8a 9d 85 08 f6 0b C...@.J.HS...... 0160 3b b2 6a ca 46 82 c8 cd 7f cc da 08 cf d0 92 f4 ;.j.F........... 0170 70 d2 a1 ae 41 0c c1 ee 29 c7 f0 91 62 be 38 72 p...A...)...b.8r 0180 9f 84 42 2f 93 17 f2 09 7b a1 95 bb a4 a2 9c 90 ..B/....{....... 0190 1e b8 dc c1 d3 d5 ba 9d 9a cb 1a 2f f9 6a 98 fd .........../.j.. 01a0 6f 36 f5 bb bd 84 a0 7a fe 8b 0a 84 0a ac 29 12 o6.....z......). 01b0 aa e9 c2 50 ef 85 61 e0 25 8c 59 b8 1b b7 49 66 ...P..a.%.Y...If 01c0 72 19 01 b7 71 8c b5 5b 2d 23 dd 99 c4 8a c5 8f r...q..[-#...... 01d0 4b d6 e6 e8 e8 5c a4 89 7c cf 60 53 8f fa a6 a1 K....\..|.`S.... 01e0 5c 24 9b 5a e9 2e 5d e0 50 39 1b 08 6c 4e 63 67 \$.Z..].P9..lNcg 01f0 2a 93 b3 71 d1 4b 20 5c 8f 42 3e 52 d1 0a d4 b0 *..q.K \.B>R.... 0200 c1 03 11 ae 34 8b 93 7e d1 2f ae a8 4b 6a 8c 8e ....4..~./..Kj.. 0210 0c 95 b3 2f 78 13 7b a4 b5 8e d4 87 b8 59 64 e0 .../x.{......Yd. 0220 c9 78 b8 76 77 5f 55 f0 a1 94 78 a5 70 45 0d a0 .x.vw_U...x.pE.. 0230 5f e4 63 b5 1c b4 4a d1 2b 5d 06 ef ba eb e1 a6 _.c...J.+]...... 0240 7b df 2e de 91 3c cd 61 c9 ec 5d 8c 78 1e 64 0b {....<.a..].x.d. 0250 7d 57 2c c6 f7 8c f6 b9 0b 5a 4d 03 18 7f f1 d3 }W,......ZM..... 0260 5c 7b 48 19 6b 96 d2 09 a6 a7 85 78 dc 26 7c c5 \{H.k......x.&|. 0270 4b d9 a2 57 39 c5 c4 ff c3 08 e6 83 31 a6 53 de K..W9.......1.S. 0280 f8 f5 87 21 a3 f7 b0 3e 01 5b 1c 41 d8 b1 17 f0 ...!...>.[.A.... 0290 43 d2 27 da 5f ec ee 51 b6 27 11 f6 0f 7b 6f c1 C.'._..Q.'...{o. 02a0 ba f7 e7 3d c6 b6 bb 5f 4a ef bf fe 85 51 94 33 ...=..._J....Q.3 02b0 67 f8 bf 2e df c4 f5 fa 94 ff fa ab 30 a8 0d 6f g...........0..o 02c0 ae 35 e6 6a 58 e1 6d 83 c4 af ee 28 76 03 16 79 .5.jX.m....(v..y 02d0 8e a9 44 3d 31 16 1d 8a ab 7d 75 13 c3 1b 5d 5b ..D=1....}u...][ 02e0 2d bc d8 af a7 f3 68 07 21 c4 38 98 2c 8a 32 bc -.....h.!.8.,.2. 02f0 71 01 82 51 d8 80 5f 89 1c d6 fa d7 ab 2f 19 7f q..Q.._....../.. 0300 59 80 4d 7e a8 33 73 14 0b e3 cf 62 ec 39 1d 11 Y.M~.3s....b.9.. 0310 26 04 bd 7f 5b 0e 70 87 d5 0c 2b e1 3b f8 d0 24 &...[.p...+.;..$ 0320 b6 dc 04 3a 1c b1 e1 19 75 be b9 6a 08 70 6b 53 ...:....u..j.pkS 0330 ea 13 da c6 64 a3 fa 27 f9 65 b0 43 e3 7b 78 bf ....d..'.e.C.{x. 0340 27 94 7f 4d 16 bf b4 f4 b6 b8 a4 97 41 29 93 97 '..M........A).. 0350 7d c2 0d 74 b5 51 12 8b 5e 6b f1 40 b9 e9 18 5f }..t.Q..^k.@..._ 0360 ae 06 ae 95 c5 b0 37 a8 82 3e f7 9c a5 81 60 8f ......7..>....`. 0370 61 7a 67 2a 87 58 8f f0 41 3c d8 c3 5e d9 0e 54 azg*.X..A<..^..T 0380 c2 70 4b da 95 40 ad 96 f3 07 6e 8e 87 14 fb 65 .pK..@....n....e 0390 84 25 64 5a 7e 02 77 28 69 71 69 49 e5 5f df 57 .%dZ~.w(iqiI._.W 03a0 6e cb 06 7a 9b fe eb 19 c3 d0 82 64 ad 33 48 f1 n..z.......d.3H. 03b0 f7 fa 2b 90 d2 11 8c 9a a7 d6 46 11 d5 38 a8 49 ..+.......F..8.I 03c0 8c f7 bb 83 11 26 d3 14 31 f3 30 de ba 1a 40 7d .....&..1.0...@} 03d0 87 cf 53 74 87 92 3b f6 45 9d c0 52 23 7a 50 08 ..St..;.E..R#zP. 03e0 a8 2b 43 24 87 c8 76 94 aa 4d 1e 72 2a d3 24 34 .+C$..v..M.r*.$4 03f0 66 9d d8 f6 fc 96 89 37 33 6a 03 b6 d2 73 d6 19 f......73j...s.. 0400 d9 ef 8c 08 7c 97 1b 61 bc e4 9a 79 12 47 d8 24 ....|..a...y.G.$ 0410 b7 47 e4 da d5 b5 66 58 5c e9 7b 69 6d b9 e1 72 .G....fX\.{im..r 0420 3e 57 33 05 0c dd c1 81 b8 36 58 88 ac a3 5b 02 >W3......6X...[. 0430 1f 05 5a e4 8c c5 19 12 8f 09 fc 87 69 ac c0 4c ..Z.........i..L 0440 99 ea 71 69 82 b4 96 25 d8 5b aa f0 52 2c f5 3e ..qi...%.[..R,.> 0450 a5 b2 6d dc 55 93 3e 8b 7b ce 0e 26 f5 9d a8 9c ..m.U.>.{..&.... 0460 ce 48 e6 82 c1 5c 8f 79 01 9e b4 19 30 43 64 59 .H...\.y....0CdY 0470 75 f8 fc 29 f2 5c 40 bc 95 7a 38 fc f6 ba f1 2a u..).\@..z8....* 0480 e7 fa f8 ed 2d 4c dd 3d ff 84 7b 6f 95 dc 87 f6 ....-L.=..{o.... 0490 d6 5b 23 64 3b 97 57 84 7f 34 ec 4e 7b ca f8 ea .[#d;.W..4.N{... 04a0 5f c0 c7 40 35 76 d3 00 fc a4 2b f1 c5 a9 11 29 _..@5v....+....) 04b0 cc e0 bf 2a d8 48 7a 11 80 57 57 7f a7 0a 78 86 ...*.Hz..WW...x. 04c0 9e f0 c7 13 db 21 78 82 0b 75 aa 43 b6 fe 61 65 .....!x..u.C..ae 04d0 be be c8 a7 68 da 19 b7 54 75 7a cd c8 41 86 ab ....h...Tuz..A.. 04e0 bc 61 9b 6f 0f bd 61 f7 a5 cd b4 80 be 4c e6 37 .a.o..a......L.7 04f0 3e b1 29 b9 39 33 b5 1d 14 26 a1 11 d3 86 78 ea >.).93...&....x. 0500 5f 69 48 7d 8a af be 61 41 87 0d 9c 9b 8b 81 47 _iH}...aA......G 0510 0a 51 09 cf 75 b2 68 d8 1a 2a f9 d1 9d 04 7d c2 .Q..u.h..*....}. 0520 21 36 42 ae 51 9f ca a7 29 ac 12 47 66 b2 51 2c !6B.Q...)..Gf.Q, 0530 02 15 92 14 4d 76 08 90 cc 69 32 93 2b 5d 52 11 ....Mv...i2.+]R. 0540 af 26 91 d4 89 96 d6 e3 48 f5 05 fb c6 47 80 c3 .&......H....G.. 0550 70 13 34 60 d9 63 57 14 14 ae 2c 17 4a 3f ca ce p.4`.cW...,.J?.. 0560 21 51 28 ed 93 be 12 cd ae 86 13 b2 c8 e0 62 60 !Q(...........b` 0570 19 33 87 72 68 49 dc 02 b8 dd aa 10 c1 ed 3f 33 .3.rhI........?3 0580 a6 c6 e6 a2 d4 a3 f8 20 ed b5 ef 40 3c df ed 1d ....... ...@<... 0590 02 09 d5 af 64 46 ff 4e a2 ae 38 95 12 4e 3e bb ....dF.N..8..N>. 05a0 4d 76 93 a3 a7 ae ba 63 a1 87 01 ad 19 32 69 2c Mv.....c.....2i, 05b0 31 43 d9 56 1C.V No. Time Source Destination Protocol Info 2951 846.893515 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=54819 Ack=9941 Win=13444 Len=1460 Frame 2951 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:44:15.652019000 Time delta from previous packet: 0.000123000 seconds Time since reference or first frame: 846.893515000 seconds Frame Number: 2951 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x0f74 (3956) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x6164 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 54819, Ack: 9941, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 54819 (relative sequence number) Next sequence number: 56279 (relative sequence number) Acknowledgement number: 9941 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 13444 Checksum: 0x4b8c [correct] Data (1460 bytes) 0000 8f c2 c8 94 ff 39 23 f5 77 79 d9 bf 3c d1 0f 50 .....9#.wy..<..P 0010 08 db 10 9e 9e af 5f b3 05 f3 ed 9d 33 26 71 0a ......_.....3&q. 0020 22 47 85 d8 f1 38 2c f2 86 8a 29 6f 89 6c 6d 9d "G...8,...)o.lm. 0030 61 f7 e2 59 2c 6d 07 9f 9b 77 1a 2e 41 32 9f 45 a..Y,m...w..A2.E 0040 1c 01 dd 31 19 17 ef 7b d8 6c 7a e3 86 82 2e b2 ...1...{.lz..... 0050 36 80 b1 78 52 06 6f ac 7e ff 55 2f b7 0b 31 d7 6..xR.o.~.U/..1. 0060 32 4c 31 7a 3d 21 e0 32 db be 19 fa 1d 0e 3e 0c 2L1z=!.2......>. 0070 7a 50 51 95 ac 34 ab f5 37 a2 30 80 ee 46 75 9d zPQ..4..7.0..Fu. 0080 f2 2e ed e3 df dd fa c1 61 e5 dd b5 19 46 67 94 ........a....Fg. 0090 58 fd be 27 b7 b9 c9 c9 04 e0 b2 ec 21 df 08 5c X..'........!..\ 00a0 fe 97 70 08 5d 0b ca 45 eb 40 ab e0 ef 7d f5 69 ..p.]..E.@...}.i 00b0 6c 0b de 91 54 7f 82 b0 48 71 37 b1 6b 15 4d 2a l...T...Hq7.k.M* 00c0 75 c0 d0 55 4e 2e 44 36 6d e9 82 6f 3a da c7 33 u..UN.D6m..o:..3 00d0 8a d8 de 2a 23 cc d4 ed 86 87 75 83 05 9e e2 31 ...*#.....u....1 00e0 d1 3a 33 00 f7 ac 7d 7d ed a9 b9 91 1b 3f bb 76 .:3...}}.....?.v 00f0 09 2f 53 c9 55 52 51 6d c6 a4 25 a7 e7 e7 88 b2 ./S.URQm..%..... 0100 d3 38 6e ea 9e 70 ce 55 f5 fb e9 77 b7 9a 4e 96 .8n..p.U...w..N. 0110 5f 23 09 06 f7 26 3d 10 a8 f6 34 97 ef ff 75 49 _#...&=...4...uI 0120 8d f5 e5 2a 50 7e 42 56 d3 a7 34 61 67 fd 82 49 ...*P~BV..4ag..I 0130 94 a5 9d df 95 db 14 b8 d0 8c 77 31 f9 f6 5f f8 ..........w1.._. 0140 3f 3a 3c 38 ef c4 95 ef 34 64 31 78 b0 05 da 7e ?:<8....4d1x...~ 0150 65 ce 9a 6b ad c4 ff 04 4f 92 73 3d e1 fe 75 f3 e..k....O.s=..u. 0160 88 d4 ce 96 5b 67 9b 69 9a c0 b3 bc 90 0a 37 a5 ....[g.i......7. 0170 4a 07 77 8c 90 c0 67 70 39 e8 93 2f 40 37 28 ed J.w...gp9../@7(. 0180 e3 91 59 75 e3 7f aa 01 d0 f9 55 b6 ad 75 65 76 ..Yu......U..uev 0190 7c 7d 56 f8 26 f4 51 fd 3f 7c f1 54 39 38 5e 17 |}V.&.Q.?|.T98^. 01a0 74 24 70 1a fa 69 b9 3c 86 1a d0 2f 01 c0 c5 13 t$p..i.<.../.... 01b0 81 7a 50 4a c5 e3 79 90 2e 67 fd e0 dc 77 27 9b .zPJ..y..g...w'. 01c0 cd 03 a6 63 fd 9e ba 0f 14 f1 1c f5 15 fb bc 7e ...c...........~ 01d0 15 9e 48 7e 5e 3e ab 55 40 7c bb ec d4 69 3c 52 ..H~^>.U@|...ief..f 04a0 cf 18 ba 86 ca ef 83 6b 96 89 b7 0b ee bc 85 dd .......k........ 04b0 c7 6e a8 bc 11 3e 72 78 b9 9b 2c c7 c9 ef 97 18 .n...>rx..,..... 04c0 24 ec 78 8b 9c 65 8a 03 be 7d 50 f7 0e 0e 82 a3 $.x..e...}P..... 04d0 52 2f 94 cd 06 93 bc 23 b7 58 51 cb 79 7f 91 28 R/.....#.XQ.y..( 04e0 f1 8a dd 71 22 8e 4b 7f bd 11 b8 2a f0 53 fd d4 ...q".K....*.S.. 04f0 22 3c 79 34 49 8d 12 67 23 49 9c cd 3d b1 12 54 " 1677 [ACK] Seq=9941 Ack=56279 Win=17520 [TCP CHECKSUM INCORRECT] Len=0 Frame 2952 (54 bytes on wire, 54 bytes captured) Arrival Time: Nov 11, 2005 16:44:15.652045000 Time delta from previous packet: 0.000026000 seconds Time since reference or first frame: 846.893541000 seconds Frame Number: 2952 Packet Length: 54 bytes Capture Length: 54 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x43b6 (17334) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x32d6] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 9941, Ack: 56279, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 9941 (relative sequence number) Acknowledgement number: 56279 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x845e [incorrect, should be 0x575f] SEQ/ACK analysis This is an ACK to the segment in frame: 2951 The RTT to ACK the segment was: 0.000026000 seconds No. Time Source Destination Protocol Info 2953 846.893638 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=56279 Ack=9941 Win=13444 Len=1460 Frame 2953 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:44:15.652142000 Time delta from previous packet: 0.000097000 seconds Time since reference or first frame: 846.893638000 seconds Frame Number: 2953 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x1074 (4212) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x6064 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 56279, Ack: 9941, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 56279 (relative sequence number) Next sequence number: 57739 (relative sequence number) Acknowledgement number: 9941 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 13444 Checksum: 0x7b6c [correct] Data (1460 bytes) 0000 25 7d 8a ed c8 32 f5 f9 8f 55 13 02 39 83 9e 80 %}...2...U..9... 0010 fd 3d d2 86 4f cb d6 2d 9a 38 86 6b a6 a3 dd 4e .=..O..-.8.k...N 0020 03 9a 54 5c 64 b6 ae 2c d7 10 15 13 21 80 85 9c ..T\d..,....!... 0030 cd 73 43 6e e6 24 d9 e4 0b a5 b0 01 d4 fa 7d f8 .sCn.$........}. 0040 5d 70 e7 41 48 33 54 b1 6c c8 a1 fe 95 45 ff 81 ]p.AH3T.l....E.. 0050 90 c2 92 9e 12 32 48 2f 09 04 e3 c4 25 e4 48 f6 .....2H/....%.H. 0060 7b 98 87 8a c4 a5 92 3b 4e 3d 5e 89 85 ed ca c9 {......;N=^..... 0070 42 93 10 22 6f 39 19 e1 6f 96 34 56 4b b6 fd 89 B.."o9..o.4VK... 0080 86 91 94 ed 08 9a ac 6c 8b e3 7e 9d d6 46 2b ad .......l..~..F+. 0090 8d 74 c6 49 4c b6 91 28 60 01 12 cb 7f a0 cb 8d .t.IL..(`....... 00a0 00 7c ae 9f fe ea d1 d6 e4 82 13 f0 1f 91 ef 89 .|.............. 00b0 4b 97 bf 42 5e af 9a dc ee 1a 96 65 f9 1e 8e 68 K..B^......e...h 00c0 d6 d2 84 d6 10 f3 5b 5a 49 b6 5e 86 bc 6b 39 f1 ......[ZI.^..k9. 00d0 79 0d 23 4f a0 2d 32 c6 b4 f2 dc 18 e6 8e 24 43 y.#O.-2.......$C 00e0 d6 af 72 eb 04 f4 ab aa 68 1c 9c f8 53 2c 38 68 ..r.....h...S,8h 00f0 b0 14 59 60 c8 3d 2b 96 31 0d 9f 1c ca 5d d5 e7 ..Y`.=+.1....].. 0100 31 5f 44 b4 7f 74 74 2d 7c 7b 47 58 3e 29 65 0f 1_D..tt-|{GX>)e. 0110 3d 9f a3 e9 d2 b4 3b e6 f9 5c 86 bf d7 5f 2b f6 =.....;..\..._+. 0120 d7 fc 3b 6a 99 0f 0e 2e 51 eb 1d d7 69 de 00 27 ..;j....Q...i..' 0130 d3 dc d2 d4 6f 7b 5d 5a 5e 81 6f 64 19 93 fa 02 ....o{]Z^.od.... 0140 b9 94 29 72 8d dc 33 22 bf 82 d6 84 44 8f 19 91 ..)r..3"....D... 0150 f5 b5 ae 8c ee d2 11 c9 5e aa 4e ac 70 f9 62 fd ........^.N.p.b. 0160 cd 0e 97 66 fe 88 5b 88 7e 5f 74 5f d1 2f a9 33 ...f..[.~_t_./.3 0170 a6 bf e8 60 70 04 9c 5d 12 4c 42 e8 76 07 ce fd ...`p..].LB.v... 0180 6f 9a 5b 36 29 82 10 5b cd 10 1f 12 da 6b a8 51 o.[6)..[.....k.Q 0190 b5 65 28 23 90 bd 76 35 34 ba 38 01 b4 88 68 92 .e(#..v54.8...h. 01a0 c5 0e 9a dc 9c 86 c8 43 7e d9 be bd 0b 91 54 3a .......C~.....T: 01b0 6e 14 76 d1 7b 9f b2 4c 50 ae 1b 6c 97 5f 7f bf n.v.{..LP..l._.. 01c0 9e b3 2c 58 ce 6f db 22 92 19 f4 cd 50 37 de 39 ..,X.o."....P7.9 01d0 fa 14 4a f5 1f 98 a4 bf 97 ee 6f f7 8f a8 39 d0 ..J.......o...9. 01e0 c8 3e 1e bf 08 e7 c5 3a f8 f1 e4 fa 01 ff cc 37 .>.....:.......7 01f0 d2 c5 2e dd 2e 9a 8d da 1a 85 ba a6 74 11 e5 b9 ............t... 0200 60 e4 f2 63 a3 93 42 ba ac dd e6 84 93 b7 a7 cc `..c..B......... 0210 05 71 8b 09 67 55 d0 09 e2 38 e2 b2 85 46 4d df .q..gU...8...FM. 0220 db 2e 2a fe 17 ad 43 06 f5 6d 53 4a 5c 91 d4 c9 ..*...C..mSJ\... 0230 f7 2d e9 e9 69 23 df a2 f3 74 bf 6e 73 6f d4 26 .-..i#...t.nso.& 0240 2e 48 73 c2 e4 27 0f e7 c8 b9 1d 41 1c d2 6d 73 .Hs..'.....A..ms 0250 2e fb e9 cf ff 1e 89 39 e5 ba 58 f3 38 d1 18 c8 .......9..X.8... 0260 39 26 5c 90 06 15 d1 77 5c 23 32 00 55 47 05 3a 9&\....w\#2.UG.: 0270 ab 50 a6 b7 87 8a 4b 22 63 70 78 ba 7e 59 e4 99 .P....K"cpx.~Y.. 0280 d5 e7 78 c6 2f f9 91 eb 2d 6e 7f 52 6b 84 3e 92 ..x./...-n.Rk.>. 0290 52 6c 8d 76 9a ad 1a e7 c1 50 5c 3a 9a 15 fe 89 Rl.v.....P\:.... 02a0 86 b1 13 ae 9a 02 49 fe 27 54 45 60 b6 6f bc a2 ......I.'TE`.o.. 02b0 2d 60 d4 d8 62 de 1a 13 b6 0b b7 c7 bf a4 64 a8 -`..b.........d. 02c0 ec c2 75 97 15 82 16 17 36 27 02 24 6a 11 7d c5 ..u.....6'.$j.}. 02d0 95 42 6b 30 32 76 95 32 99 60 e0 af 0b 4e dc 62 .Bk02v.2.`...N.b 02e0 82 2f 74 50 33 fb 23 0c 76 42 ca d6 c6 2a f9 6d ./tP3.#.vB...*.m 02f0 c9 79 41 4f f5 55 77 1f 7b 65 f2 02 32 02 e9 82 .yAO.Uw.{e..2... 0300 e6 3b 50 76 76 d3 46 44 fb 71 71 1e d7 a1 24 c3 .;Pvv.FD.qq...$. 0310 a7 46 3a 9c 97 cd b2 1e 85 ea 90 43 64 38 4b da .F:........Cd8K. 0320 0f b8 e4 72 86 ac 4a d1 9f 01 82 0a 4b d9 04 f6 ...r..J.....K... 0330 26 67 d3 ac 02 e2 b6 69 78 d3 d0 42 9e 86 9b 53 &g.....ix..B...S 0340 0f ed 60 83 94 64 a8 e5 62 e9 ee c1 ad 27 58 1a ..`..d..b....'X. 0350 33 72 be b7 63 e6 de 7c 61 87 e1 e9 fe 1c e7 a2 3r..c..|a....... 0360 e7 0f f8 fe ac b9 ec df a9 45 68 ca 04 c6 55 3b .........Eh...U; 0370 c0 51 a5 eb 80 46 40 32 c6 83 a5 5b 4d 56 1f 3c .Q...F@2...[MV.< 0380 64 1b 40 1b 2f ff e6 a5 e3 d7 10 e8 0f 8d 98 e1 d.@./........... 0390 0c 83 d4 eb 1d 74 31 61 6f 67 b4 45 17 34 a6 c5 .....t1aog.E.4.. 03a0 15 17 e2 bc d5 b2 80 89 25 3e 13 93 fe b2 53 2b ........%>....S+ 03b0 a7 9f c9 a3 78 27 9a 97 55 1f 69 99 43 a6 66 5d ....x'..U.i.C.f] 03c0 a9 5a c9 d1 34 99 92 54 79 78 54 b5 65 47 68 d1 .Z..4..TyxT.eGh. 03d0 f0 79 26 bd ca 1e fc 9a 9e e7 89 6e 70 41 22 ee .y&........npA". 03e0 d1 fb b1 66 28 c0 2f 59 d4 70 d0 8c e3 77 d4 08 ...f(./Y.p...w.. 03f0 01 02 cb 70 17 2a 68 19 f8 31 a6 34 35 53 cc c0 ...p.*h..1.45S.. 0400 cc 8f 06 1f 7e 69 cb a2 27 19 f0 62 ac fa 7d e8 ....~i..'..b..}. 0410 31 77 d3 64 28 44 c9 53 92 27 d3 d2 91 1e 93 b3 1w.d(D.S.'...... 0420 09 e5 be 70 7d 36 3b 34 c8 d2 eb 77 41 36 c0 2a ...p}6;4...wA6.* 0430 9d d7 2e db ad f5 ce 60 a3 d3 07 38 95 d8 6d b0 .......`...8..m. 0440 23 1d 36 a7 01 00 96 ae b2 17 4d dc 54 b7 8e b9 #.6.......M.T... 0450 52 c9 4e 4e 43 02 b4 5b d1 ac ad 2a a5 e6 bc 38 R.NNC..[...*...8 0460 93 a6 02 eb 97 19 5e 02 a6 4d 9b ba 46 ca f9 0c ......^..M..F... 0470 b7 d6 64 5c 11 79 b6 7f 7b 05 89 55 6c 4d 61 02 ..d\.y..{..UlMa. 0480 15 56 52 1a 03 74 1c a9 bb ca 44 71 07 16 fe 8b .VR..t....Dq.... 0490 c7 4b 1a 35 d5 bf 95 51 9c 67 d1 81 64 7a 6c 53 .K.5...Q.g..dzlS 04a0 1a 07 4f 2e 0e d6 2b d1 de 8e 7d e4 41 39 48 32 ..O...+...}.A9H2 04b0 74 fa fb 90 66 2a 43 61 c2 2b 70 d5 76 c4 be 1e t...f*Ca.+p.v... 04c0 cc a8 7b 7c c8 9c 6c 6a ee e3 28 ec dc 24 b4 39 ..{|..lj..(..$.9 04d0 a7 87 f7 29 6c 23 37 f4 0a aa 1c 97 88 6c 98 f8 ...)l#7......l.. 04e0 0d 13 34 93 b0 15 68 ea b8 8e 40 1d fb 56 cf c6 ..4...h...@..V.. 04f0 d0 64 98 7c 65 e4 db 06 2e fd 82 2d 25 44 72 60 .d.|e......-%Dr` 0500 8c 9a b6 78 6d 8a 6a 7d 08 ba d7 db f8 31 14 e1 ...xm.j}.....1.. 0510 0a 9c e0 97 d7 88 0d e9 3d 5f 5d 6f f9 2c e6 94 ........=_]o.,.. 0520 bc 10 e7 85 a4 b3 b6 d8 9a 16 a1 77 1d 66 20 97 ...........w.f . 0530 b3 6c d4 2f 37 76 57 31 7e d9 d0 25 bd 02 a0 70 .l./7vW1~..%...p 0540 59 14 96 41 9f fb ad 2c f7 de 6f 91 4b 11 d0 db Y..A...,..o.K... 0550 87 ca 84 2c e2 32 35 ba fe e7 fb a1 cb cc 6b 1b ...,.25.......k. 0560 8b 5a b8 77 02 f9 4c 50 66 de ad 56 c4 c1 ce 66 .Z.w..LPf..V...f 0570 cb 99 fd 40 b3 e9 d1 b6 4e f7 b6 70 3b 35 2b ad ...@....N..p;5+. 0580 84 65 a9 03 c4 0a a9 26 ca 31 df d3 bb 29 09 29 .e.....&.1...).) 0590 c2 e3 8e 88 b3 97 5e f5 5b c2 5f 55 e7 e4 c1 63 ......^.[._U...c 05a0 3d 91 e2 ea 78 db 4f 9a d7 8a b0 f8 a5 d2 36 bb =...x.O.......6. 05b0 0d 12 86 e9 .... No. Time Source Destination Protocol Info 2954 847.018028 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=9941 Ack=57739 Win=17520 [TCP CHECKSUM INCORRECT] Len=0 Frame 2954 (54 bytes on wire, 54 bytes captured) Arrival Time: Nov 11, 2005 16:44:15.776532000 Time delta from previous packet: 0.124390000 seconds Time since reference or first frame: 847.018028000 seconds Frame Number: 2954 Packet Length: 54 bytes Capture Length: 54 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x43b8 (17336) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x32d4] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 9941, Ack: 57739, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 9941 (relative sequence number) Acknowledgement number: 57739 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x845e [incorrect, should be 0x51ab] SEQ/ACK analysis This is an ACK to the segment in frame: 2953 The RTT to ACK the segment was: 0.124390000 seconds No. Time Source Destination Protocol Info 2955 847.018288 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=57739 Ack=9941 Win=13444 Len=1430 Frame 2955 (1484 bytes on wire, 1484 bytes captured) Arrival Time: Nov 11, 2005 16:44:15.776792000 Time delta from previous packet: 0.000260000 seconds Time since reference or first frame: 847.018288000 seconds Frame Number: 2955 Packet Length: 1484 bytes Capture Length: 1484 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1470 Identification: 0x3274 (12916) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x3e82 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 57739, Ack: 9941, Len: 1430 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 57739 (relative sequence number) Next sequence number: 59169 (relative sequence number) Acknowledgement number: 9941 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 13444 Checksum: 0xa3b3 [correct] Data (1430 bytes) 0000 c4 00 7a fe 4c 4c 33 58 db c8 74 4e 28 d1 1b ac ..z.LL3X..tN(... 0010 2c dc 2b 6a ec f5 4f c5 d9 d4 48 6d 3a 8b d5 a8 ,.+j..O...Hm:... 0020 eb f3 bd 8a 5c 83 a1 0a e8 ca e8 1d 00 8a e6 af ....\........... 0030 c5 63 87 98 27 1b 7c 26 2e 9d 1f 97 ed 15 67 04 .c..'.|&......g. 0040 6c 64 c9 1d dc 09 3b db a8 6a fd c8 51 f8 f3 db ld....;..j..Q... 0050 9c 13 a7 ec e9 47 95 c4 d7 07 21 10 47 a9 7d da .....G....!.G.}. 0060 be 6e ad f2 fa ab e9 fa 3e 6d 32 47 b8 e1 54 aa .n......>m2G..T. 0070 36 c2 4d 92 af ef c0 27 fd 62 16 bb 99 6d 95 80 6.M....'.b...m.. 0080 e6 60 06 4a ea e2 42 cb 72 72 15 5d b7 e3 68 a8 .`.J..B.rr.]..h. 0090 ce 1a a2 87 88 f7 64 64 58 26 e0 45 43 50 5a 12 ......ddX&.ECPZ. 00a0 1b 4c 27 7a af 85 f2 c6 d5 c1 da 3d b9 9d c3 db .L'z.......=.... 00b0 71 d8 1d ad 0f 74 58 25 9b 40 d7 3c e6 2b e8 31 q....tX%.@.<.+.1 00c0 8a 1f f4 bb 8b 97 a6 08 41 89 d3 ca 04 e1 f0 15 ........A....... 00d0 94 df 28 59 ea 54 09 26 8c e1 4d 59 57 89 b9 b9 ..(Y.T.&..MYW... 00e0 df 24 56 4c 8e 01 f6 d0 8e f9 7d 48 a6 5c 4d 15 .$VL......}H.\M. 00f0 cb c6 a0 a7 e9 0c e6 1e ac f1 5c 5e 7e 96 3a 2c ..........\^~.:, 0100 8b e8 3c 2c 74 47 7b 79 bb 9e a6 94 23 57 85 d1 ..<,tG{y....#W.. 0110 68 16 89 2d 42 ff de dc 50 f9 95 b1 16 11 4a 69 h..-B...P.....Ji 0120 06 5f f1 b6 b7 3a 89 a0 66 15 5b 17 a1 72 02 cb ._...:..f.[..r.. 0130 91 a5 85 7d f9 31 b1 c7 a2 c5 4f 28 8d d8 0e b8 ...}.1....O(.... 0140 98 a6 5c c6 47 ff 87 4b 62 01 ca 18 b3 5a a8 76 ..\.G..Kb....Z.v 0150 cf c9 c6 c3 33 df 63 20 21 dd f0 40 4c 0f 92 24 ....3.c !..@L..$ 0160 e2 f7 bd 66 5b f3 7f 37 75 09 89 63 e2 f7 00 e2 ...f[..7u..c.... 0170 66 db 75 54 71 88 e8 11 be f2 f4 b1 af 26 ed 96 f.uTq........&.. 0180 7d d8 06 eb 0a db 2b 2d 00 86 63 b4 82 ed bb 91 }.....+-..c..... 0190 1d 93 e6 42 42 22 da 78 13 d4 1b cc 9a d7 8c 48 ...BB".x.......H 01a0 0e d7 ab cb 27 16 94 11 c8 d2 a4 aa 9d 6b 32 bc ....'........k2. 01b0 41 c0 7d d3 7d 53 19 77 e3 b9 7e 83 28 4c df 85 A.}.}S.w..~.(L.. 01c0 46 27 70 a8 82 66 ea 8a c7 52 8f b0 47 84 5a f1 F'p..f...R..G.Z. 01d0 aa d5 13 a2 2b e4 28 79 c5 42 5e b0 4d 8e ff 5c ....+.(y.B^.M..\ 01e0 33 5a 8f 18 92 81 60 7d 49 1c 8f 4f 9a b1 56 19 3Z....`}I..O..V. 01f0 7e 2f 17 c3 59 8b 1d 31 d1 e8 0b 83 53 e7 51 45 ~/..Y..1....S.QE 0200 7e 76 ce 1a 05 01 4f e5 fe b7 02 94 b5 4f 32 ae ~v....O......O2. 0210 d4 8c 95 89 ce de 27 64 94 8f 64 c5 dc cc 86 76 ......'d..d....v 0220 0e 4f 74 be 71 65 22 38 07 d9 9d 3b 0e 8d 54 5a .Ot.qe"8...;..TZ 0230 5c 27 f1 33 7a 60 5d 5b 40 a4 cd fe d4 f7 d0 97 \'.3z`][@....... 0240 7d 56 d8 f0 78 be 7b 81 44 11 e8 06 4f 59 d1 78 }V..x.{.D...OY.x 0250 89 8b b0 9f 93 b5 ea 56 05 bb bb b4 d6 a5 60 2f .......V......`/ 0260 63 4f 20 fa a9 c9 80 ee b8 f9 d0 9c e4 3c b0 36 cO ..........<.6 0270 a6 18 ea c2 9b 45 5c aa e1 ce 05 ad 18 e7 aa 71 .....E\........q 0280 a3 1f 2d 0a 1e 8a 3b 65 30 62 a1 7d b8 a8 c5 b0 ..-...;e0b.}.... 0290 58 df 5a 84 11 f8 cd 75 9a 66 bf 99 14 1b d1 64 X.Z....u.f.....d 02a0 e0 0f a2 bb 47 f7 da 03 10 e4 f2 22 60 5d 1c 2d ....G......"`].- 02b0 45 8d c6 77 57 f4 83 3a d3 d9 d3 c2 5e c7 bd d8 E..wW..:....^... 02c0 1f ef 38 f1 65 6d b9 0f e5 d8 fd 6b 94 76 27 34 ..8.em.....k.v'4 02d0 dc 1a 29 25 e0 bb 90 16 e9 6b e2 64 d9 ff 03 8f ..)%.....k.d.... 02e0 40 d7 8f e5 81 9e 74 9e 39 4b 8d 58 5c e6 c8 a9 @.....t.9K.X\... 02f0 3f 9b 0a 10 7f fe 96 a2 6d 22 9d e8 79 13 c4 cf ?.......m"..y... 0300 f7 4c e5 63 1f aa 6a 54 15 6b fa 10 27 5d c5 55 .L.c..jT.k..'].U 0310 12 f0 d1 62 e5 95 71 b3 07 e0 9b 5a c1 cb 3d a3 ...b..q....Z..=. 0320 a7 a7 b8 e1 fd 34 11 87 fc c3 4f 61 a8 8c 13 8a .....4....Oa.... 0330 d5 fb b0 fe 59 b3 3b 17 35 63 9d 1a 9f 7d 28 92 ....Y.;.5c...}(. 0340 ab 88 74 1b ab c0 4a 30 05 e1 f1 79 86 2e 18 a3 ..t...J0...y.... 0350 c9 35 51 a2 e6 6a 7b 2b 58 14 dc 74 06 a3 73 54 .5Q..j{+X..t..sT 0360 02 eb a4 bd 1b 17 e8 a5 4f 12 38 08 c6 67 15 90 ........O.8..g.. 0370 d7 25 45 fd cc e2 b1 e4 4b 21 9c 7e 31 c9 13 2b .%E.....K!.~1..+ 0380 31 6e c3 bd af 25 bd 74 6a d1 bc f4 ab cf e8 71 1n...%.tj......q 0390 49 eb f2 42 ee a2 d2 87 6f 44 f3 51 13 a9 21 75 I..B....oD.Q..!u 03a0 8d 77 1e 35 c2 c4 a0 be 25 5f bf 92 bc d2 a9 b4 .w.5....%_...... 03b0 dc ca 10 7d 9a ac f8 d2 41 21 b0 e0 99 89 2a 64 ...}....A!....*d 03c0 ca a0 ef 80 4f c0 2c 32 e2 9d 91 1d d4 69 26 6b ....O.,2.....i&k 03d0 6a 6a 31 51 57 ab cd a2 8c a7 0b 78 c9 5d 8a 62 jj1QW......x.].b 03e0 1a 57 ee 0b ef 29 1c 51 ce 28 39 4c 91 38 5f ff .W...).Q.(9L.8_. 03f0 37 d2 39 e0 3f 76 cb f8 2e f1 75 d9 fd a9 0c 1b 7.9.?v....u..... 0400 d6 ef 3c eb 4c e3 70 21 e9 eb 61 a0 28 bc 18 ed ..<.L.p!..a.(... 0410 7a db ec 55 eb ce 2d 4c f8 14 95 b1 39 bf 6f 22 z..U..-L....9.o" 0420 75 55 d3 a4 e2 42 b8 d9 4b 15 18 f7 77 e5 2d d7 uU...B..K...w.-. 0430 8a dc 9d cd 48 82 db e9 4a 2e d1 3e 7b 4b 87 47 ....H...J..>{K.G 0440 3d 09 76 bd 29 75 2d 4b 21 84 a8 13 a9 92 02 c2 =.v.)u-K!....... 0450 0c 21 a6 f0 0e 7e f3 2d 2d 23 1d 67 6c 05 90 b0 .!...~.--#.gl... 0460 9e f9 21 9f 8d 69 51 10 eb d4 d4 74 c3 78 b1 9b ..!..iQ....t.x.. 0470 e6 58 ed 2c 0f ea 9d d2 68 f9 53 98 b3 ff 29 44 .X.,....h.S...)D 0480 d9 0f d9 10 34 b6 29 74 47 2b 51 57 b1 ab ec a3 ....4.)tG+QW.... 0490 19 df 0a df 95 ec 73 f3 13 e9 6a 59 4d 53 8c 34 ......s...jYMS.4 04a0 f7 53 c4 3b 9d 37 da 79 d1 77 b6 94 73 dd 14 24 .S.;.7.y.w..s..$ 04b0 c1 c6 ec 47 3d 40 7a af 07 e3 a7 bc 81 7a d6 43 ...G=@z......z.C 04c0 ec 1b 89 97 c4 65 fa a2 27 dd 4d ab 98 43 f1 e8 .....e..'.M..C.. 04d0 7c 0a 0d ae 24 ee 99 8b e4 87 16 c2 97 eb 70 9b |...$.........p. 04e0 0c d3 23 14 72 4b e6 97 72 2f 76 9a ac f2 ce 95 ..#.rK..r/v..... 04f0 a6 07 88 42 a5 46 01 40 70 62 00 bc 1d a3 ff 1d ...B.F.@pb...... 0500 9b 5f ed 55 d4 2e 94 b4 6d 2d 72 a5 b6 e4 fa 08 ._.U....m-r..... 0510 b2 3b 1f 05 81 f2 a2 65 bd 55 96 71 63 f4 fc d5 .;.....e.U.qc... 0520 ac 79 7d 7f 23 e5 90 2f 22 28 61 19 6d 6b 20 ab .y}.#../"(a.mk . 0530 25 df 45 05 70 d7 78 68 70 05 9b 52 95 a8 1a 56 %.E.p.xhp..R...V 0540 41 5b ed 5f 2b a2 9b 59 0e 20 a8 e8 15 d6 57 f3 A[._+..Y. ....W. 0550 54 8b 92 83 4d 92 6b 53 6b ab 19 fe 99 ad c9 0b T...M.kSk....... 0560 52 04 61 1c 47 27 fb 1e 26 5b c6 80 04 df 13 6a R.a.G'..&[.....j 0570 b1 d0 20 67 16 17 6a 3b 91 17 dc ec 10 6b a2 96 .. g..j;.....k.. 0580 2a 26 c4 da 26 2b 2e 78 93 23 c8 2a c0 16 c7 73 *&..&+.x.#.*...s 0590 9c c8 4d 55 b2 16 ..MU.. No. Time Source Destination Protocol Info 2980 847.049874 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=9941 Ack=59169 Win=16090 [TCP CHECKSUM INCORRECT] Len=386 Frame 2980 (440 bytes on wire, 440 bytes captured) Arrival Time: Nov 11, 2005 16:44:15.808378000 Time delta from previous packet: 0.031586000 seconds Time since reference or first frame: 847.049874000 seconds Frame Number: 2980 Packet Length: 440 bytes Capture Length: 440 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 426 Identification: 0x43c5 (17349) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3145] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 9941, Ack: 59169, Len: 386 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 9941 (relative sequence number) Next sequence number: 10327 (relative sequence number) Acknowledgement number: 59169 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16090 Checksum: 0x85e0 [incorrect, should be 0x7101] SEQ/ACK analysis This is an ACK to the segment in frame: 2955 The RTT to ACK the segment was: 0.031586000 seconds Data (386 bytes) 0000 bc ef 82 01 b5 fe 18 00 66 01 02 21 ab 29 32 0a ........f..!.)2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 40 4b 87 4a a4 32 ee 20 o0O(~...@K.J.2. 0040 7e 15 7c 6c 9a 84 83 9a 1c a8 e1 0f c1 4e 3e 74 ~.|l.........N>t 0050 7f 34 6f 2e 0d 94 91 ff f4 4b 0e f1 c7 32 7d 41 .4o......K...2}A 0060 1d 14 67 2a 99 20 f1 58 82 6b 97 e4 d0 ea ab ad ..g*. .X.k...... 0070 68 34 6f a8 1a 57 00 75 88 4b 16 6e b3 32 6a 63 h4o..W.u.K.n.2jc 0080 5f 14 16 48 ad 84 8d 1a 1e a8 ed 8f de 4e 2c f4 _..H.........N,. 0090 29 f7 15 ae 56 94 fc 7f bd 4b fc b2 bb 32 1a c1 )...V....K...2.. 00a0 6f 14 57 aa 38 47 71 7c 87 6b a9 64 dc 4e 7b 4a o.W.8Gq|.k.d.N{J 00b0 6f 34 53 28 59 94 00 f5 2d 88 26 ee 84 32 e4 20 o4S(Y...-.&..2. 00c0 7f 14 92 0b bd 84 8a 9a 85 6b dd 0f 7e 8d 2c 74 .........k..~.,t 00d0 75 34 25 2e 31 57 fc ff 9f 4b 42 f1 8b 32 8c 82 u4%.1W...KB..2.. 00e0 6f 14 42 2a a5 84 71 fc 10 a8 b9 e4 e9 4e d0 09 o.B*..q......N.. 00f0 6f 34 d7 6b 49 94 05 75 8d 4b 36 6e 27 f1 e4 a0 o4.kI..u.K6n'... 0100 15 14 33 48 54 47 8d 1a 80 6b cd 8f f4 4e b0 37 ..3HTG...k...N.7 0110 1f 34 3f ae 31 94 73 bb fd 4b 37 71 9b 32 98 c1 .4?.1.s..K7q.2.. 0120 ff d0 b7 ab b9 84 71 7e 85 6b 57 a1 fc 4e 55 83 ......q~.kW..NU. 0130 6f 34 b1 37 55 57 00 95 87 4b 46 0e 79 d0 64 40 o4.7UW...KF.y.d@ 0140 7a 14 c3 29 dd 84 d0 3b 85 6b b7 e9 84 4e d1 dd z..)...;.k...N.. 0150 7f 34 c0 d1 21 94 fc ff 70 88 22 f1 e1 32 98 41 .4..!...p."..2.A 0160 73 b0 2d 8f c2 84 61 fe 85 6b a7 46 8b 4e 5a 03 s.-...a..k.F.NZ. 0170 6f 34 bd 13 54 94 01 15 85 4b 7a 8f ef 96 38 f0 o4..T....Kz...8. 0180 82 01 .. No. Time Source Destination Protocol Info 2981 847.051239 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=59169 Ack=10327 Win=13058 Len=530 Frame 2981 (584 bytes on wire, 584 bytes captured) Arrival Time: Nov 11, 2005 16:44:15.809743000 Time delta from previous packet: 0.001365000 seconds Time since reference or first frame: 847.051239000 seconds Frame Number: 2981 Packet Length: 584 bytes Capture Length: 584 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 570 Identification: 0x3f74 (16244) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x3506 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 59169, Ack: 10327, Len: 530 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 59169 (relative sequence number) Next sequence number: 59699 (relative sequence number) Acknowledgement number: 10327 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 13058 Checksum: 0xcf8e [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2980 The RTT to ACK the segment was: 0.001365000 seconds Data (530 bytes) 0000 bc ef 12 02 b5 fe 18 00 f5 01 03 21 bc 71 32 0a ...........!.q2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e e1 72 {.+..........N.r 0050 e5 34 05 30 61 94 8f 5a 81 4b 67 0f a5 32 18 43 .4.0a..Z.Kg..2.C 0060 20 14 26 28 ce 84 2e ee c1 6b d6 96 81 4e 5e 48 .&(.....k...N^H 0070 73 34 64 2e 65 94 00 ff c2 4b 57 f0 f8 32 bb 42 s4d.e....KW..2.B 0080 0f 14 5c 2e 36 47 91 f0 8f 6b eb f1 a2 8d 30 72 ..\.6G...k....0r 0090 58 34 16 30 51 94 8c f4 d2 e5 91 13 bb 30 18 50 X4.0Q........0.P 00a0 6f 14 57 42 f9 e9 18 82 e9 0e db b8 af 21 a4 e3 o.WB.........!.. 00b0 0a 46 25 41 37 e7 ad 3c 91 4b 24 f0 85 32 e4 42 .F%A7..<.K$..2.B 00c0 32 7d 4f 42 d8 f6 26 33 99 6b df f1 e7 4e 2c 72 2}OB..&3.k...N,r 00d0 35 5b 4b 90 82 88 fc 9e 9d 6f 42 0f 8b 0a 5a 76 5[K......oB...Zv 00e0 57 51 74 6a 95 a9 41 da b3 5b 94 a6 dc 7e e0 a6 WQtj..A..[...~.. 00f0 57 70 77 1e 64 a2 30 bb be 7a 04 c0 a3 02 d4 72 Wpw.d.0..z.....r 0100 2f a5 f0 29 cd 83 8d f0 85 6b cd 6b 37 49 2c 78 /..).....k.k7I,x 0110 1f 34 35 40 f2 93 fc 9b fd 4b 32 0f 9b a6 5b 44 .45@.....K2...[D 0120 6f 11 b7 29 b5 84 71 7d 46 6c c9 8d fc 4e 50 ed o..)..q}Fl...NP. 0130 6f a2 72 d6 39 91 00 ff 8d 4b 46 44 20 35 64 48 o.r.9....KFD 5dH 0140 7f 14 c3 b6 1e 98 8d f3 85 7b bd ef 84 24 ac 78 .........{...$.x 0150 7f 59 c5 a6 21 f8 fc f5 9d 2e 22 7d eb ae 5b 5f .Y..!....."}..[_ 0160 6f 1e a7 2b c5 0b b5 ef 85 6e d9 88 8c 4e 50 7d o..+.....n...NP} 0170 ab 28 a1 dd 29 94 00 ff 8d d5 95 f7 f3 37 64 42 .(..)........7dB 0180 5f 14 d3 43 2e 83 8d fc 85 6b ad 29 57 49 ac 11 _..C.....k.)WI.. 0190 5f 34 d5 cf 11 c9 3f 85 bd 41 12 0d fb 4f 5b 5f _4....?..A...O[_ 01a0 6f 11 97 11 d5 84 71 9b 85 04 e9 fc 9c 26 50 88 o.....q......&P. 01b0 6f 46 91 a5 19 fb 00 91 8d 38 66 dd c3 45 64 23 oF.......8f..Ed# 01c0 7f 3a e3 4c fd eb 8d 9b 85 45 9d 8e a4 3b ac 14 .:.L.....E...;.. 01d0 7f 34 e5 cf 01 94 fc 99 9d 4b 02 0f cb 32 98 ae .4.......K...2.. 01e0 ac 08 87 23 e5 85 71 65 73 77 f9 82 ac 4f 50 f1 ...#..qesw...OP. 01f0 cb 34 81 af ad 93 00 f5 8d 4a 76 d8 77 35 64 46 .4.......Jv.w5dF 0200 9f 61 57 2e 0d 80 8d f6 85 75 8d f3 10 02 20 9a .aW......u.... . 0210 12 02 .. No. Time Source Destination Protocol Info 2982 847.051958 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=10327 Ack=59699 Win=17520 [TCP CHECKSUM INCORRECT] Len=198 Frame 2982 (252 bytes on wire, 252 bytes captured) Arrival Time: Nov 11, 2005 16:44:15.810462000 Time delta from previous packet: 0.000719000 seconds Time since reference or first frame: 847.051958000 seconds Frame Number: 2982 Packet Length: 252 bytes Capture Length: 252 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 238 Identification: 0x43c6 (17350) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3200] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 10327, Ack: 59699, Len: 198 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 10327 (relative sequence number) Next sequence number: 10525 (relative sequence number) Acknowledgement number: 59699 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x8524 [incorrect, should be 0x279a] SEQ/ACK analysis This is an ACK to the segment in frame: 2981 The RTT to ACK the segment was: 0.000719000 seconds Data (198 bytes) 0000 bc ef c6 00 b5 fe 18 00 aa 00 02 21 00 3a 32 0a ...........!.:2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 c7 4a 87 4a a4 32 ee 20 o0O(~....J.J.2. 0040 0c 15 7c 6c 9a 84 83 9a 6e a8 e1 0f c1 4e 1c 74 ..|l....n....N.t 0050 7f 34 68 2e 0c 94 88 ff f3 4b 07 f1 df 32 6f 41 .4h......K...2oA 0060 00 14 15 2a ee 84 02 fc ab 6b fa e4 a3 4e bd 09 ...*.....k...N.. 0070 41 34 00 a8 1c 94 00 75 8d 4b 16 6e 8d 32 e4 a0 A4.....u.K.n.2.. 0080 5f 14 0f ec 2d 20 8a 1a 8b 6b f1 2b af ea 2b f4 _...- ...k.+..+. 0090 51 34 fe 6d 51 94 f9 7f bd 4b 52 71 db c4 18 c1 Q4.mQ....KRq.... 00a0 65 14 57 aa 89 20 fb d8 82 6b b9 64 dc 4e ae 2d e.W.. ...k.d.N.- 00b0 68 34 5b 28 59 94 1c 51 f0 4b 27 ee 8b 32 c8 21 h4[(Y..Q.K'..2.! 00c0 63 b0 4f a4 c6 00 c.O... No. Time Source Destination Protocol Info 2983 847.052343 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=59699 Ack=10525 Win=13444 Len=110 Frame 2983 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:44:15.810847000 Time delta from previous packet: 0.000385000 seconds Time since reference or first frame: 847.052343000 seconds Frame Number: 2983 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0x4174 (16756) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x34aa [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 59699, Ack: 10525, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 59699 (relative sequence number) Next sequence number: 59809 (relative sequence number) Acknowledgement number: 10525 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 13444 Checksum: 0x411d [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2982 The RTT to ACK the segment was: 0.000385000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 d8 c6 32 0a ..n.....R..!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf fa 96 6e 00 n.k(..q.....n. No. Time Source Destination Protocol Info 2984 847.052767 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=10525 Ack=59809 Win=17410 [TCP CHECKSUM INCORRECT] Len=294 Frame 2984 (348 bytes on wire, 348 bytes captured) Arrival Time: Nov 11, 2005 16:44:15.811271000 Time delta from previous packet: 0.000424000 seconds Time since reference or first frame: 847.052767000 seconds Frame Number: 2984 Packet Length: 348 bytes Capture Length: 348 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 334 Identification: 0x43c7 (17351) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x319f] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 10525, Ack: 59809, Len: 294 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 10525 (relative sequence number) Next sequence number: 10819 (relative sequence number) Acknowledgement number: 59809 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17410 Checksum: 0x8584 [incorrect, should be 0x4cb4] SEQ/ACK analysis This is an ACK to the segment in frame: 2983 The RTT to ACK the segment was: 0.000424000 seconds Data (294 bytes) 0000 bc ef 26 01 b5 fe 18 00 0a 01 02 21 7b 3a 32 0a ..&........!{:2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a a3 bc 76 aa 3b b1 23 76 a.elr.....v.;.#v 0030 7f 34 71 28 07 30 07 f5 87 4b 62 ee 22 96 e3 20 .4q(.0...Kb.".. 0040 75 14 03 c8 12 20 8a 9a 92 6b fd 0f c4 4e cb d0 u.... ...k...N.. 0050 78 34 09 2e 9e 6b 03 00 68 ef 65 f1 a5 32 08 e5 x4...k..h.e..2.. 0060 68 14 6d 2a a1 84 08 58 82 6b 93 e4 cc 4a 92 ad h.m*...X.k...J.. 0070 68 34 6b a8 69 94 3e 75 8a 4b 1c 6e f9 33 99 04 h4k.i.>u.K.n.3.. 0080 58 14 1f 48 ad 84 8d 1a fa cf ea 8f da 4e c7 37 X..H.........N.7 0090 43 34 10 ae 61 94 fc 7f d0 4b 3f 71 cf 32 76 c1 C4..a....K?q.2v. 00a0 0a 14 23 aa e2 84 1e 7c f7 6b c2 64 af 4e fe 89 ..#....|.k.d.N.. 00b0 0c 34 3e 28 34 94 2e f5 ec 4b 53 ee 83 32 e4 20 .4>(4....KS..2. 00c0 7f 14 1d c8 bd 84 8d 9a 99 cf 5d ab e3 4e 22 74 ..........]..N"t 00d0 94 f7 39 2e 44 94 cc ff 9d 4b 2f f1 e6 32 6c 41 ..9.D....K/..2lA 00e0 01 14 22 2a d1 84 06 fc ea 6b cb e4 87 4e a3 09 .."*.....k...N.. 00f0 41 34 22 a8 26 94 6d 75 a3 4b 57 6e e6 32 e4 a0 A4".&.mu.KWn.2.. 0100 1f 14 33 48 f3 84 8d 1a 85 6b d1 2b 75 ea 2b f4 ..3H.....k.+u.+. 0110 15 34 46 af 2d 30 e0 db 80 4b 33 71 93 32 b4 c0 .4F.-0...K3q.2.. 0120 73 b0 b7 ab 26 01 s...&. No. Time Source Destination Protocol Info 2985 847.053134 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=59809 Ack=10819 Win=13150 Len=102 Frame 2985 (156 bytes on wire, 156 bytes captured) Arrival Time: Nov 11, 2005 16:44:15.811638000 Time delta from previous packet: 0.000367000 seconds Time since reference or first frame: 847.053134000 seconds Frame Number: 2985 Packet Length: 156 bytes Capture Length: 156 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 142 Identification: 0x4374 (17268) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x32b2 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 59809, Ack: 10819, Len: 102 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 59809 (relative sequence number) Next sequence number: 59911 (relative sequence number) Acknowledgement number: 10819 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 13150 Checksum: 0xe63a [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2984 The RTT to ACK the segment was: 0.000367000 seconds Data (102 bytes) 0000 bc ef 66 00 b5 fe 18 00 4a 00 02 21 a4 d5 32 0a ..f.....J..!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 73 99 e1 42 ..<*qC..f...s..B 0020 6b 04 5d 8a 72 b4 0b f0 fb 18 0c f0 36 b1 2f 74 k.].r.......6./t 0030 47 90 76 2e 7d 94 8f 5b 8a 4b 11 f0 a3 32 e4 42 G.v.}..[.K...2.B 0040 98 b0 04 2e 91 84 6a 3a 86 6b d5 55 c3 4e 28 72 ......j:.k.U.N(r 0050 57 90 02 30 65 94 8e 3d 9c 4b 6e 0f a5 63 18 43 W..0e..=.Kn..c.C 0060 73 b0 6d 28 66 00 s.m(f. No. Time Source Destination Protocol Info 2986 847.053656 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=10819 Ack=59911 Win=17308 [TCP CHECKSUM INCORRECT] Len=74 Frame 2986 (128 bytes on wire, 128 bytes captured) Arrival Time: Nov 11, 2005 16:44:15.812160000 Time delta from previous packet: 0.000522000 seconds Time since reference or first frame: 847.053656000 seconds Frame Number: 2986 Packet Length: 128 bytes Capture Length: 128 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 114 Identification: 0x43c8 (17352) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x327a] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 10819, Ack: 59911, Len: 74 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 10819 (relative sequence number) Next sequence number: 10893 (relative sequence number) Acknowledgement number: 59911 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17308 Checksum: 0x84a8 [incorrect, should be 0x8b1c] SEQ/ACK analysis This is an ACK to the segment in frame: 2985 The RTT to ACK the segment was: 0.000522000 seconds Data (74 bytes) 0000 bc ef 4a 00 b5 fe 18 00 30 00 00 21 0b 75 32 0a ..J.....0..!.u2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a a0 bc 8a aa 3b b1 25 76 a.elr.......;.%v 0030 6f 34 96 8c 7e 94 0c f5 6a 81 05 ee bf 96 99 20 o4..~...j...... 0040 7e 14 0b c8 b1 85 91 3e 4a 00 ~......>J. No. Time Source Destination Protocol Info 2987 847.053863 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=59911 Ack=10893 Win=13076 Len=66 Frame 2987 (120 bytes on wire, 120 bytes captured) Arrival Time: Nov 11, 2005 16:44:15.812367000 Time delta from previous packet: 0.000207000 seconds Time since reference or first frame: 847.053863000 seconds Frame Number: 2987 Packet Length: 120 bytes Capture Length: 120 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 106 Identification: 0x4574 (17780) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x30d6 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 59911, Ack: 10893, Len: 66 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 59911 (relative sequence number) Next sequence number: 59977 (relative sequence number) Acknowledgement number: 10893 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 13076 Checksum: 0x3745 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2986 The RTT to ACK the segment was: 0.000207000 seconds Data (66 bytes) 0000 bc ef 42 00 b5 fe 18 00 28 00 00 21 e9 33 32 0a ..B.....(..!.32. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 73 99 e1 42 ..<*qC..f...s..B 0020 6b 04 5d 8a 72 b4 0b f0 ad 18 0c f0 38 b1 07 d0 k.].r.......8... 0030 68 34 75 2e 0b 30 01 ff 81 4b 06 f0 a3 32 f8 e6 h4u..0...K...2.. 0040 42 00 B. No. Time Source Destination Protocol Info 2988 847.054406 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=10893 Ack=59977 Win=17242 [TCP CHECKSUM INCORRECT] Len=386 Frame 2988 (440 bytes on wire, 440 bytes captured) Arrival Time: Nov 11, 2005 16:44:15.812910000 Time delta from previous packet: 0.000543000 seconds Time since reference or first frame: 847.054406000 seconds Frame Number: 2988 Packet Length: 440 bytes Capture Length: 440 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 426 Identification: 0x43c9 (17353) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3141] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 10893, Ack: 59977, Len: 386 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 10893 (relative sequence number) Next sequence number: 11279 (relative sequence number) Acknowledgement number: 59977 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17242 Checksum: 0x85e0 [incorrect, should be 0xd83b] SEQ/ACK analysis This is an ACK to the segment in frame: 2987 The RTT to ACK the segment was: 0.000543000 seconds Data (386 bytes) 0000 bc ef 82 01 b5 fe 18 00 66 01 02 21 9b b8 32 0a ........f..!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 40 4b 87 4a a4 32 ee 20 o0O(~...@K.J.2. 0040 01 15 7c 6c 9a 84 83 9a 0a af e1 0f c1 4e 3e 74 ..|l.........N>t 0050 7f 34 6f 2e 0d 94 91 ff f4 4b 0e f1 c7 32 7d 41 .4o......K...2}A 0060 1d 14 67 2a 99 20 f1 58 82 6b 97 e4 d0 ea ab ad ..g*. .X.k...... 0070 68 34 6f a8 1a 57 00 75 88 4b 16 6e b3 32 6a 63 h4o..W.u.K.n.2jc 0080 5f 14 16 48 ad 84 8d 1a 1e a8 ed 8f de 4e 2c f4 _..H.........N,. 0090 29 f7 15 ae 56 94 fc 7f bd 4b fc b2 bb 32 1a c1 )...V....K...2.. 00a0 6f 14 57 aa 38 47 71 7c 87 6b a9 64 dc 4e 7b 4a o.W.8Gq|.k.d.N{J 00b0 6f 34 53 28 59 94 00 f5 2d 88 26 ee 84 32 e4 20 o4S(Y...-.&..2. 00c0 7f 14 92 0b bd 84 8a 9a 85 6b dd 0f 7e 8d 2c 74 .........k..~.,t 00d0 75 34 25 2e 31 57 fc ff 9f 4b 42 f1 8b 32 8c 82 u4%.1W...KB..2.. 00e0 6f 14 42 2a a5 84 71 fc 10 a8 b9 e4 e9 4e d0 09 o.B*..q......N.. 00f0 6f 34 d7 6b 49 94 05 75 8d 4b 36 6e 27 f1 e4 a0 o4.kI..u.K6n'... 0100 15 14 33 48 54 47 8d 1a 80 6b cd 8f f4 4e b0 37 ..3HTG...k...N.7 0110 1f 34 3f ae 31 94 73 bb fd 4b 37 71 9b 32 98 c1 .4?.1.s..K7q.2.. 0120 ff d0 b7 ab b9 84 71 7e 85 6b 57 a1 fc 4e 55 83 ......q~.kW..NU. 0130 6f 34 b1 37 55 57 00 95 87 4b 46 0e 79 d0 64 40 o4.7UW...KF.y.d@ 0140 7a 14 c3 29 dd 84 d0 3b 85 6b b7 e9 84 4e d1 dd z..)...;.k...N.. 0150 7f 34 c0 d1 21 94 fc ff 70 88 22 f1 e1 32 98 41 .4..!...p."..2.A 0160 73 b0 2d 8f c2 84 61 fe 85 6b a7 46 8b 4e 5a 03 s.-...a..k.F.NZ. 0170 6f 34 bd 13 54 94 01 15 85 4b 7a 8f ef 96 64 c0 o4..T....Kz...d. 0180 82 01 .. No. Time Source Destination Protocol Info 2989 847.054846 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=59977 Ack=11279 Win=13444 Len=110 Frame 2989 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:44:15.813350000 Time delta from previous packet: 0.000440000 seconds Time since reference or first frame: 847.054846000 seconds Frame Number: 2989 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0x4774 (18292) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x2eaa [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 59977, Ack: 11279, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 59977 (relative sequence number) Next sequence number: 60087 (relative sequence number) Acknowledgement number: 11279 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 13444 Checksum: 0xfb14 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2988 The RTT to ACK the segment was: 0.000440000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 7d c7 32 0a ..n.....R..!}.2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf 97 96 6e 00 n.k(..q.....n. No. Time Source Destination Protocol Info 2990 847.055263 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=11279 Ack=60087 Win=17132 [TCP CHECKSUM INCORRECT] Len=390 Frame 2990 (444 bytes on wire, 444 bytes captured) Arrival Time: Nov 11, 2005 16:44:15.813767000 Time delta from previous packet: 0.000417000 seconds Time since reference or first frame: 847.055263000 seconds Frame Number: 2990 Packet Length: 444 bytes Capture Length: 444 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 430 Identification: 0x43ca (17354) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x313c] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 11279, Ack: 60087, Len: 390 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 11279 (relative sequence number) Next sequence number: 11669 (relative sequence number) Acknowledgement number: 60087 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17132 Checksum: 0x85e4 [incorrect, should be 0xbd56] SEQ/ACK analysis This is an ACK to the segment in frame: 2989 The RTT to ACK the segment was: 0.000417000 seconds Data (390 bytes) 0000 bc ef 86 01 b5 fe 18 00 69 01 03 21 67 47 32 0a ........i..!gG2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 40 4b 87 4a a4 32 ee 20 o0O(~...@K.J.2. 0040 0e 15 7c 6c 9a 84 83 9a 99 cf 7d ab c3 4e 22 74 ..|l......}..N"t 0050 d4 f7 1d 2e 63 94 ff ff 9d 4b 08 db ab 9f db 59 ....c....K.....Y 0060 6f 16 67 22 85 84 71 90 e8 02 f5 88 a9 3c d0 15 o.g"..q......<.. 0070 cb 4f c5 af 69 9a 00 06 4e 4b 16 6b b3 32 e4 a0 .O..i...NK.k.2.. 0080 5f 9a d0 48 ad 81 8d 1a 85 6b ed 14 17 4e 2c fe _..H.....k...N,. 0090 5f 34 15 d8 92 94 fc 78 bd 4b 52 71 bb 9c db c1 _4.....x.KRq.... 00a0 6f 16 57 aa 95 84 71 d1 46 6b a9 66 dc 4e d0 89 o.W...q.Fk.f.N.. 00b0 6f 9f 92 28 59 96 00 f5 8d 4b 26 4e 40 32 e4 27 o..(Y....K&N@2.' 00c0 7f 14 23 c8 bd 35 4e 9a 85 6c dd 0f e4 4e 2c ee ..#..5N..l...N,. 00d0 bc 34 25 24 41 94 fc 8f 5e 4b 42 f3 8b 32 18 41 .4%$A...^KB..2.A 00e0 6f 80 84 2a a5 81 71 fc 85 6b b9 71 2f 4e d0 0c o..*..q..k.q/N.. 00f0 6f 34 41 a8 49 02 c3 75 8d 4e 36 6e 93 32 e4 14 o4A.I..u.N6n.2.. 0100 dc 14 33 42 cd 84 8d 83 46 6b cd 8a f4 4e 2c f4 ..3B....Fk...N,. 0110 1f a8 f6 ae 31 9e fc 7f fd c4 f6 71 9b 37 98 c1 ....1......q.7.. 0120 6f 14 b7 3b 71 84 71 72 85 6b c9 62 fc d0 93 83 o..;q.qr.k.b.... 0130 6f 31 b1 37 39 94 00 f9 4e 4b 46 04 e3 32 64 da o1.79...NKF..2d. 0140 9d 14 c3 2c dd 84 8d f8 85 36 7e e9 84 44 ac 1e ...,.....6~..D.. 0150 7f 49 06 d1 21 91 fc ff 9d 4b 22 1c 28 32 98 4b .I..!....K".(2.K 0160 6f 14 a7 37 61 0e d5 f9 85 7b d9 e2 8c 30 f4 04 o..7a....{...0.. 0170 6f 3e a1 b7 29 88 a4 68 8d 4a 56 86 f3 1e 65 dc o>..)..h.JV...e. 0180 fb 15 d3 c5 86 01 ...... No. Time Source Destination Protocol Info 2991 847.055692 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=60087 Ack=11669 Win=13054 Len=110 Frame 2991 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:44:15.814196000 Time delta from previous packet: 0.000429000 seconds Time since reference or first frame: 847.055692000 seconds Frame Number: 2991 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0x4974 (18804) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x2caa [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 60087, Ack: 11669, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 60087 (relative sequence number) Next sequence number: 60197 (relative sequence number) Acknowledgement number: 11669 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 13054 Checksum: 0x3aa7 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2990 The RTT to ACK the segment was: 0.000429000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 df 62 32 0a ..n.....R..!.b2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf f5 fa 6e 00 n.k(..q.....n. No. Time Source Destination Protocol Info 2992 847.056097 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=11669 Ack=60197 Win=17022 [TCP CHECKSUM INCORRECT] Len=386 Frame 2992 (440 bytes on wire, 440 bytes captured) Arrival Time: Nov 11, 2005 16:44:15.814601000 Time delta from previous packet: 0.000405000 seconds Time since reference or first frame: 847.056097000 seconds Frame Number: 2992 Packet Length: 440 bytes Capture Length: 440 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 426 Identification: 0x43cb (17355) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x313f] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 11669, Ack: 60197, Len: 386 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 11669 (relative sequence number) Next sequence number: 12055 (relative sequence number) Acknowledgement number: 60197 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17022 Checksum: 0x85e0 [incorrect, should be 0x542f] SEQ/ACK analysis This is an ACK to the segment in frame: 2991 The RTT to ACK the segment was: 0.000405000 seconds Data (386 bytes) 0000 bc ef 82 01 b5 fe 18 00 67 01 01 21 27 76 32 0a ........g..!'v2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 40 4b 87 4a a4 32 ee 20 o0O(~...@K.J.2. 0040 0e 15 7c 6c 9a 84 83 9a 99 cf 7d ab c3 4e 22 74 ..|l......}..N"t 0050 d4 f7 16 2e 63 94 fc ff 9d 4b cf 32 b3 32 1a 41 ....c....K.2.2.A 0060 66 14 67 2a ef e8 1c 95 e9 07 fc 96 cc 52 74 72 f.g*.........Rtr 0070 cb 33 61 a6 69 e7 c3 75 8d 4e 16 6e b3 32 e4 2e .3a.i..u.N.n.2.. 0080 9c 14 13 4d ad 84 8d 1a 85 f0 2e 8f d4 44 2c f4 ...M.........D,. 0090 5f 42 d6 ae 51 93 fc 7f bd 4b 52 df 78 32 18 c3 _B..Q....KR.x2.. 00a0 6f 14 57 aa 95 29 b2 7c 85 69 a9 64 dc 4e d0 22 o.W..).|.i.d.N." 00b0 ac 34 51 2a 59 94 00 f5 8d eb e5 ee 83 35 e4 20 .4Q*Y........5. 00c0 7f 14 23 79 7e 84 8d 9d 85 6b dd 0f e4 d4 ef 74 ..#y~....k.....t 00d0 7f 3e 25 2e 41 e4 3f ff 9d 49 42 f1 8b 32 18 d5 .>%.A.?..IB..2.. 00e0 ac 14 47 2f a5 84 71 fc 85 fe 7a e4 ec 4b d0 09 ..G/..q...z..K.. 00f0 6f 34 41 3e 8a 94 00 70 8d 4b 36 6e 93 86 27 a0 o4A>...p.K6n..'. 0100 1f 1e 33 48 cd 1d 4e 1a 85 6e cd 8f f4 4e 2c 68 ..3H..N..n...N,h 0110 dc 34 35 a4 31 94 fc f0 39 4b 32 74 9b 32 98 c1 .45.1...9K2t.2.. 0120 6f 84 73 ab b5 88 71 7e 85 6b c9 fc 3f 4e 50 86 o.s...q~.k..?NP. 0130 6f 34 b1 37 39 f8 c3 95 8d 41 46 0e e3 a8 86 40 o4.79....AF....@ 0140 7f 11 c3 29 dd 84 8d a5 46 6b bd e3 84 4e ac 63 ...)....Fk...N.c 0150 bc 34 c5 d4 21 94 fc ff 9d a6 e1 f1 eb 38 98 41 .4..!........8.A 0160 6f 08 03 a1 61 83 71 ee 85 6b d9 9c 28 49 50 09 o...a.q..k..(IP. 0170 6f 34 a1 ab 8d e9 00 14 8d 43 56 a2 f2 2e c0 1c o4.......CV..... 0180 82 01 .. No. Time Source Destination Protocol Info 2993 847.056506 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=60197 Ack=12055 Win=13444 Len=110 Frame 2993 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:44:15.815010000 Time delta from previous packet: 0.000409000 seconds Time since reference or first frame: 847.056506000 seconds Frame Number: 2993 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0x4b74 (19316) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x2aaa [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 60197, Ack: 12055, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 60197 (relative sequence number) Next sequence number: 60307 (relative sequence number) Acknowledgement number: 12055 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 13444 Checksum: 0x3935 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2992 The RTT to ACK the segment was: 0.000409000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 d6 74 32 0a ..n.....R..!.t2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf fc e4 6e 00 n.k(..q.....n. No. Time Source Destination Protocol Info 2994 847.056876 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=12055 Ack=60307 Win=16912 [TCP CHECKSUM INCORRECT] Len=386 Frame 2994 (440 bytes on wire, 440 bytes captured) Arrival Time: Nov 11, 2005 16:44:15.815380000 Time delta from previous packet: 0.000370000 seconds Time since reference or first frame: 847.056876000 seconds Frame Number: 2994 Packet Length: 440 bytes Capture Length: 440 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 426 Identification: 0x43cc (17356) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x313e] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 12055, Ack: 60307, Len: 386 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 12055 (relative sequence number) Next sequence number: 12441 (relative sequence number) Acknowledgement number: 60307 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16912 Checksum: 0x85e0 [incorrect, should be 0xc2c6] SEQ/ACK analysis This is an ACK to the segment in frame: 2993 The RTT to ACK the segment was: 0.000370000 seconds Data (386 bytes) 0000 bc ef 82 01 b5 fe 18 00 67 01 01 21 84 a5 32 0a ........g..!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 40 4b 87 4a a4 32 ee 20 o0O(~...@K.J.2. 0040 0f 15 7c 6c 9a 84 83 9a 99 cf 7d ab c3 4e 22 74 ..|l......}..N"t 0050 d4 f7 1d 2e 63 94 f5 ff 9d 4b 08 9d c6 5b 74 2d ....c....K...[t- 0060 0a 66 67 87 46 97 71 fe 85 6b 99 e4 cc 52 74 72 .fg.F.q..k...Rtr 0070 cb 33 61 a6 69 e7 c3 75 8d 4e 16 6e b3 32 e4 2e .3a.i..u.N.n.2.. 0080 9c 14 13 4d ad 84 8d 1a 85 f0 2e 8f d4 44 2c f4 ...M.........D,. 0090 5f 42 d6 ae 51 93 fc 7f bd 4b 52 df 78 32 18 c3 _B..Q....KR.x2.. 00a0 6f 14 57 aa 95 29 b2 7c 85 69 a9 64 dc 4e d0 22 o.W..).|.i.d.N." 00b0 ac 34 51 2a 59 94 00 f5 8d eb e5 ee 83 35 e4 20 .4Q*Y........5. 00c0 7f 14 23 79 7e 84 8d 9d 85 6b dd 0f e4 d4 ef 74 ..#y~....k.....t 00d0 7f 3e 25 2e 41 e4 3f ff 9d 49 42 f1 8b 32 18 d5 .>%.A.?..IB..2.. 00e0 ac 14 47 2f a5 84 71 fc 85 fe 7a e4 ec 4b d0 09 ..G/..q...z..K.. 00f0 6f 34 41 3e 8a 94 00 70 8d 4b 36 6e 93 86 27 a0 o4A>...p.K6n..'. 0100 1f 1e 33 48 cd 1d 4e 1a 85 6e cd 8f f4 4e 2c 68 ..3H..N..n...N,h 0110 dc 34 35 a4 31 94 fc f0 39 4b 32 74 9b 32 98 c1 .45.1...9K2t.2.. 0120 6f 84 73 ab b5 88 71 7e 85 6b c9 fc 3f 4e 50 86 o.s...q~.k..?NP. 0130 6f 34 b1 37 39 f8 c3 95 8d 41 46 0e e3 a8 86 40 o4.79....AF....@ 0140 7f 11 c3 29 dd 84 8d a5 46 6b bd e3 84 4e ac 63 ...)....Fk...N.c 0150 bc 34 c5 d4 21 94 fc ff 9d a6 e1 f1 eb 38 98 41 .4..!........8.A 0160 6f 08 03 a1 61 83 71 ee 85 6b d9 9c 28 49 50 09 o...a.q..k..(IP. 0170 6f 34 a1 ab 8d e9 00 14 8d 43 56 a2 f2 2e c0 dc o4.......CV..... 0180 82 01 .. No. Time Source Destination Protocol Info 2995 847.057280 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=60307 Ack=12441 Win=13058 Len=110 Frame 2995 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:44:15.815784000 Time delta from previous packet: 0.000404000 seconds Time since reference or first frame: 847.057280000 seconds Frame Number: 2995 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0x4d74 (19828) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x28aa [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 60307, Ack: 12441, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 60307 (relative sequence number) Next sequence number: 60417 (relative sequence number) Acknowledgement number: 12441 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 13058 Checksum: 0xf6c2 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 2994 The RTT to ACK the segment was: 0.000404000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 7b c7 32 0a ..n.....R..!{.2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf 99 96 6e 00 n.k(..q.....n. No. Time Source Destination Protocol Info 2998 847.218360 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=12441 Ack=60417 Win=16802 [TCP CHECKSUM INCORRECT] Len=0 Frame 2998 (54 bytes on wire, 54 bytes captured) Arrival Time: Nov 11, 2005 16:44:15.976864000 Time delta from previous packet: 0.161080000 seconds Time since reference or first frame: 847.218360000 seconds Frame Number: 2998 Packet Length: 54 bytes Capture Length: 54 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x43d0 (17360) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x32bc] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 12441, Ack: 60417, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 12441 (relative sequence number) Acknowledgement number: 60417 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x845e [incorrect, should be 0x403f] SEQ/ACK analysis This is an ACK to the segment in frame: 2995 The RTT to ACK the segment was: 0.161080000 seconds No. Time Source Destination Protocol Info 3032 856.969288 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=12441 Ack=60417 Win=16802 [TCP CHECKSUM INCORRECT] Len=90 Frame 3032 (144 bytes on wire, 144 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.727792000 Time delta from previous packet: 9.750928000 seconds Time since reference or first frame: 856.969288000 seconds Frame Number: 3032 Packet Length: 144 bytes Capture Length: 144 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 130 Identification: 0x4472 (17522) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x31c0] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 12441, Ack: 60417, Len: 90 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 12441 (relative sequence number) Next sequence number: 12531 (relative sequence number) Acknowledgement number: 60417 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x84b8 [incorrect, should be 0xe91d] Data (90 bytes) 0000 bc ef 5a 00 b5 fe 18 00 40 00 00 21 1d 46 32 0a ..Z.....@..!.F2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9d bc 30 aa 3b b1 29 76 a.elr.....0.;.)v 0030 6d 37 70 28 3b 30 07 f5 87 4b 0c ee da 96 e3 20 m7p(;0...K..... 0040 75 14 03 ca 13 20 8a 9a 8b 6b e1 ab d8 ea 51 74 u.... ...k....Qt 0050 7e 34 0d 2e 4d 95 e0 5b 5a 00 ~4..M..[Z. No. Time Source Destination Protocol Info 3033 856.969477 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=60417 Ack=12531 Win=14904 Len=0 Frame 3033 (60 bytes on wire, 60 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.727981000 Time delta from previous packet: 0.000189000 seconds Time since reference or first frame: 856.969477000 seconds Frame Number: 3033 Packet Length: 60 bytes Capture Length: 60 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Trailer: 000000000000 Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3d7e (15742) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x390e [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 60417, Ack: 12531, Len: 0 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 60417 (relative sequence number) Acknowledgement number: 12531 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14904 Checksum: 0x474f [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3032 The RTT to ACK the segment was: 0.000189000 seconds No. Time Source Destination Protocol Info 3034 856.969750 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=60417 Ack=12531 Win=14904 Len=566 Frame 3034 (620 bytes on wire, 620 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.728254000 Time delta from previous packet: 0.000273000 seconds Time since reference or first frame: 856.969750000 seconds Frame Number: 3034 Packet Length: 620 bytes Capture Length: 620 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 606 Identification: 0x3e7e (15998) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x35d8 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 60417, Ack: 12531, Len: 566 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 60417 (relative sequence number) Next sequence number: 60983 (relative sequence number) Acknowledgement number: 12531 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14904 Checksum: 0x9c8d [correct] Data (566 bytes) 0000 bc ef 36 02 b5 fe 18 00 1b 02 01 21 c6 c5 32 0a ..6........!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6d 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.m.].....#T;.+t 0030 47 90 76 2e 7d 94 8e 5b 8a 4b 08 f0 cc 32 f8 42 G.v.}..[.K...2.B 0040 78 14 0f 2e 9d 84 b9 c3 b3 5a ca b4 85 0d 02 4a x........Z.....J 0050 4b 07 6f 30 7d 94 f6 99 96 4b 0f 0f b7 32 12 43 K.o0}....K...2.C 0060 2c 0c 13 28 99 84 73 ee c1 6b 99 96 8f 3b a3 ff ,..(..s..k...;.. 0070 00 59 04 5c 49 c7 75 8f fd 24 64 84 93 60 81 33 .Y.\I.u..$d..`.3 0080 2a 71 60 5a 8d b5 b9 c4 b1 5e dc c0 e6 6e 1c 43 *q`Z.....^...n.C 0090 7f 19 35 64 10 d6 dc d5 f4 09 00 4e e9 6b 38 01 ..5d.......N.k8. 00a0 2e 57 1c 7d c5 a4 38 a0 c6 24 e4 c6 90 0b 84 ce .W.}..8..$...... 00b0 0e 34 4d 2e 5b 94 1d ff 8d 4b 1a 9a ef 5f 8d 2e .4M.[....K..._.. 00c0 13 71 51 6e d0 e9 f9 9e e0 1f aa 9e 96 25 5f 5c .qQn.........%_\ 00d0 1c 5b 48 1e 20 e1 c2 a4 9d 57 42 0d 8b 22 18 43 .[H. ....WB..".C 00e0 6f 28 31 49 d6 f7 10 de b7 2b da f7 c2 2d bf e6 o(1I.....+...-.. 00f0 51 2f 42 32 49 91 00 f3 8d 4b 36 93 93 53 e4 6c Q/B2I....K6..S.l 0100 1f 77 33 41 cd e9 8d ec 86 77 cd fb f4 4e 2c 00 .w3A.....w...N,. 0110 1f 28 35 35 31 9a fc 99 fd 3d 32 6e 9b 41 98 30 .(551....=2n.A.0 0120 6f 75 b7 19 b5 b6 71 a4 85 77 c9 84 fc 4f 50 ed ou....q..w...OP. 0130 6f 53 b1 cd 39 98 00 bf 8d 4b 46 83 e3 2e 64 4a oS..9....KF...dJ 0140 7f 14 c3 02 dd 98 8d fb 85 c7 c3 8e c7 6c ac 08 .............l.. 0150 7f 39 c5 63 5f f5 bf ac 9d 57 22 02 eb 9e e6 22 .9.c_....W"...." 0160 2c 0f a7 35 c5 88 71 e5 89 6b d9 ee 8c 52 50 e7 ,..5..q..k...RP. 0170 6f 50 a1 9c 29 88 00 f5 8d 4b 56 80 f3 2e 64 4a oP..)....KV...dJ 0180 5f 16 d3 52 ed 98 8d fe 85 0f ad 9e 94 52 ac 18 _..R.........R.. 0190 5f 34 d5 cf 11 30 fd 85 bd 53 12 16 fb 32 98 6e _4...0...S...2.n 01a0 1c 40 a1 46 f5 a4 51 c8 a0 2e c9 cf b0 37 0e cc .@.F..Q......7.. 01b0 4f 14 b6 91 62 b4 20 de 2f 4a 7a f0 db 32 7d 42 O...b. ./Jz..2}B 01c0 7f 14 ce 5c a9 b2 e2 d6 a5 4b bd ca e1 6e eb 38 ...\.....K...n.8 01d0 06 6a c4 ef 21 b3 bc e2 bd 6b 20 40 cb 2e 98 45 .j..!....k @...E 01e0 6f eb 85 28 e5 cb 71 f4 85 6d f9 88 af 4f 50 6f o..(..q..m...OPo 01f0 6f 28 81 d7 09 95 03 fe 8d 04 76 ec d3 34 64 43 o(........v..4dC 0200 9c 12 f3 76 0d 90 8d fc 85 71 ad a2 b6 74 ac 19 ...v.....q...t.. 0210 9f 1a 8b ae b2 ab fd 85 7d 86 f1 0e db f5 64 5e ........}.....d^ 0220 cb f3 ae 28 f5 57 0f 85 21 95 8a e5 bc 49 2c 0a ...(.W..!....I,. 0230 6f 27 29 1d 36 02 o').6. No. Time Source Destination Protocol Info 3035 856.970277 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=12531 Ack=60983 Win=16236 [TCP CHECKSUM INCORRECT] Len=134 Frame 3035 (188 bytes on wire, 188 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.728781000 Time delta from previous packet: 0.000527000 seconds Time since reference or first frame: 856.970277000 seconds Frame Number: 3035 Packet Length: 188 bytes Capture Length: 188 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 174 Identification: 0x4473 (17523) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3193] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 12531, Ack: 60983, Len: 134 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 12531 (relative sequence number) Next sequence number: 12665 (relative sequence number) Acknowledgement number: 60983 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16236 Checksum: 0x84e4 [incorrect, should be 0xdae0] SEQ/ACK analysis This is an ACK to the segment in frame: 3034 The RTT to ACK the segment was: 0.000527000 seconds Data (134 bytes) 0000 bc ef 86 00 b5 fe 18 00 6c 00 00 21 55 73 32 0a ........l..!Us2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 0c bc 76 aa 3b b1 23 76 a.elr.....v.;.#v 0030 4e 34 71 28 64 30 07 f5 8b 4b 04 ed a2 32 9f 84 N4q(d0...K...2.. 0040 78 14 0d c8 81 20 fa 3e 82 6b f3 0f d8 ea 53 d0 x.... .>.k....S. 0050 78 34 0b 2e 7d 30 88 fe 9a 4b 65 f1 ab 32 18 41 x4..}0...Ke..2.A 0060 e1 b0 60 2a 8b 84 6d 58 fc cf 9e e4 c6 4e d0 0b ..`*..mX.....N.. 0070 2d 90 66 a8 63 94 0a 75 91 ef 6b 6e b2 32 ec a0 -.f.c..u..kn.2.. 0080 73 15 0f ec 86 00 s..... No. Time Source Destination Protocol Info 3036 856.971012 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=60983 Ack=12665 Win=14770 Len=1460 Frame 3036 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.729516000 Time delta from previous packet: 0.000735000 seconds Time since reference or first frame: 856.971012000 seconds Frame Number: 3036 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x407e (16510) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x305a [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 60983, Ack: 12665, Len: 1460 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 60983 (relative sequence number) Next sequence number: 62443 (relative sequence number) Acknowledgement number: 12665 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14770 Checksum: 0x462c [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3035 The RTT to ACK the segment was: 0.000735000 seconds Data (1460 bytes) 0000 bc ef 7e 0a b5 fe 18 00 7e 0c 13 21 30 ca 32 0a ..~.....~..!0.2. 0010 04 00 3c 2a 71 43 00 00 70 1a 0f f0 5b bf 76 4c ..<*qC..p...[.vL 0020 6f 01 75 3f 55 b5 49 d1 87 dd b4 11 21 37 6e b4 o.u?U.I.....!7n. 0030 6c 4c 71 2c 79 50 00 32 55 4b 1c fc 65 f1 f5 fb lLq,yP.2UK..e... 0040 6b 96 40 39 93 b5 cc 5b a9 99 fd a9 c4 95 a4 b0 k.@9...[........ 0050 67 54 ec b8 21 d4 fe bf 04 6a ff 41 cc 71 61 f7 gT..!....j.A.qa. 0060 a5 66 77 3c 4b 23 72 6f 39 8f ed 86 d8 c2 77 98 .fw.A 0100 3f 15 00 1e 20 88 ac 71 89 93 61 d1 96 d2 cd f8 ?... ..q..a..... 0110 1e 2c b1 6b b9 d5 5c 9c 9c b3 f0 4c 8a 50 24 05 .,.k..\....L.P$. 0120 d7 bb a7 f7 9c 5c 71 37 0f 0d 0c b6 bc 86 50 cb .....\q7......P. 0130 8d 07 b3 cd 08 9b 00 7a bd 36 82 96 83 0a 86 5f .......z.6....._ 0140 44 95 97 af c1 d4 95 f6 83 1a f5 5b 62 1a b7 0f D..........[b... 0150 bb 2c d1 85 64 84 ed 5c 1a d9 d2 88 ff 3b 50 44 .,..d..\.....;PD 0160 d3 3c 86 78 ad 7b 99 ac 97 88 48 23 cf d0 bc 29 .<.x.{....H#...) 0170 6e 68 e7 aa aa 22 e5 78 8d d0 04 96 fb 70 2d 8e nh...".x.....p-. 0180 18 33 a2 33 72 40 e9 83 c0 6d ee 7b ac c2 24 04 .3.3r@...m.{..$. 0190 56 d0 e5 23 82 4d fa 8d 3f c2 5a 77 fa b5 9a 79 V..#.M..?.Zw...y 01a0 0c 88 f7 6b 41 cf b9 06 05 57 c9 cb 84 44 03 6d ...kA....W...D.m 01b0 ff d4 0d 89 76 d5 84 b4 86 8c 1e 60 c3 81 1b 4a ....v......`...J 01c0 cc dc e3 6f a2 bd 8a 74 1f c6 4c 97 c6 9e aa 94 ...o...t..L..... 01d0 ad 36 e5 d5 c0 69 f4 3a 1d 4f c6 2e cc b1 c8 b1 .6...i.:.O...... 01e0 c6 22 b4 35 eb c5 4b 95 ab b7 8a 18 60 0f 22 3e .".5..K.....`."> 01f0 42 06 17 a6 94 1f 65 ec 75 bf a8 ef a5 88 25 a3 B.....e.u.....%. 0200 0c b0 db df d6 92 3c e4 6a f3 86 c7 60 64 d7 ac ......<.j...`d.. 0210 01 7d f7 9d b1 8c ef 90 e4 43 b2 1d d3 38 c6 e3 .}.......C...8.. 0220 39 eb 89 43 a6 4b 27 2f 6c e6 24 f6 f9 1c 57 8a 9..C.K'/l.$...W. 0230 5d e1 eb a5 a7 e5 68 c9 c0 ef ae 03 95 62 dd d5 ].....h......b.. 0240 4c 2e 4c b5 02 aa e5 48 05 7f b7 8f 9f ab 4b a7 L.L....H......K. 0250 12 29 2c be 59 7e 64 a2 c1 32 f2 52 8e 15 8b 66 .),.Y~d..2.R...f 0260 ef 37 e8 c3 e4 80 27 3b ab 1f a9 da bb 75 22 c1 .7....';.....u". 0270 bf 08 94 6f a1 46 6c 38 b3 59 a7 0d 34 c0 2a 81 ...o.Fl8.Y..4.*. 0280 9b 25 ef be 08 bb f1 bd d1 3b 6c 3a 50 85 c2 c0 .%.......;l:P... 0290 79 f1 7a 91 db b1 c4 a5 f2 50 54 bf fc 5a dd a9 y.z......PT..Z.. 02a0 5d f9 e7 36 1b b3 19 66 1b 15 cb de 1c f9 43 27 ]..6...f......C' 02b0 b6 73 56 a5 c5 46 fd 97 ae 9d e6 aa 48 57 d2 80 .sV..F......HW.. 02c0 6d 28 aa 0e 66 e5 6e 82 e3 3f 97 20 18 61 2e 69 m(..f.n..?. .a.i 02d0 b4 f5 e3 ac 15 b2 3c 15 35 e0 6d 60 db 6f e2 3b ......<.5.m`.o.; 02e0 70 65 d0 dd 46 ec af bf b6 c6 f0 eb ef b7 39 a8 pe..F.........9. 02f0 c7 91 80 89 1e 84 ee a7 3d 62 ff c9 5c ac 2a b3 ........=b..\.*. 0300 f7 d6 b4 57 1c 98 45 55 e8 ff 0a 01 ec fe 74 24 ...W..EU......t$ 0310 c7 3f 19 a2 b7 83 3e 2d 09 65 56 ef f4 c8 37 c6 .?....>-.eV...7. 0320 6c d8 6e 72 41 cf a1 80 4d 9a 81 77 b8 83 fb a6 l.nrA...M..w.... 0330 d7 a8 c8 d5 32 00 d6 07 80 e7 ea 3d b5 d0 b9 f5 ....2......=.... 0340 d2 b2 1a 00 fa b2 62 3d c5 18 42 f9 db 93 f1 75 ......b=..B....u 0350 8a 35 6d 33 06 ca 11 75 9f d5 00 b9 6b 6a db 88 .5m3...u....kj.. 0360 ca b0 4a e2 b0 f2 df d9 c0 7f 7e 4b fa d2 3c 3f ..J.......~K.. 1677 [ACK] Seq=12665 Ack=62443 Win=17520 [TCP CHECKSUM INCORRECT] Len=0 Frame 3037 (54 bytes on wire, 54 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.891175000 Time delta from previous packet: 0.161659000 seconds Time since reference or first frame: 857.132671000 seconds Frame Number: 3037 Packet Length: 54 bytes Capture Length: 54 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x4476 (17526) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3216] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 12665, Ack: 62443, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 12665 (relative sequence number) Acknowledgement number: 62443 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x845e [incorrect, should be 0x34a7] SEQ/ACK analysis This is an ACK to the segment in frame: 3036 The RTT to ACK the segment was: 0.161659000 seconds No. Time Source Destination Protocol Info 3038 857.132972 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=62443 Ack=12665 Win=14770 Len=1226 Frame 3038 (1280 bytes on wire, 1280 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.891476000 Time delta from previous packet: 0.000301000 seconds Time since reference or first frame: 857.132972000 seconds Frame Number: 3038 Packet Length: 1280 bytes Capture Length: 1280 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1266 Identification: 0x427e (17022) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x2f44 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 62443, Ack: 12665, Len: 1226 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 62443 (relative sequence number) Next sequence number: 63669 (relative sequence number) Acknowledgement number: 12665 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14770 Checksum: 0x0557 [correct] Data (1226 bytes) 0000 e6 9d e4 a7 76 55 5c 40 94 16 97 d0 2a 36 93 73 ....vU\@....*6.s 0010 0d 73 27 a4 24 f7 ce a0 44 b6 d2 61 4e 26 bc 75 .s'.$...D..aN&.u 0020 29 60 c6 02 81 ff d3 ea ff 5d ff 71 d3 78 2c 5a )`.......].q.x,Z 0030 85 8c 49 fc df ad c6 51 dd de ef a2 b0 16 7b 91 ..I....Q......{. 0040 ea 33 cf cc c1 87 30 25 d6 26 79 d6 b2 c1 6f 8a .3....0%.&y...o. 0050 39 72 d0 c7 cd da 2f c1 ba a4 d2 8c ee a1 38 4c 9r..../.......8L 0060 51 8e 56 87 ff cd cb 8d 63 f2 d5 f6 23 7d f7 d0 Q.V.....c...#}.. 0070 40 9a 6d bc 1d b7 56 94 d6 a2 15 03 02 0f 1f 73 @.m...V........s 0080 6e dd e9 e0 7a 7d 7b 8d 89 99 52 98 e9 ab d6 79 n...z}{...R....y 0090 84 1d 44 55 69 f7 8a a8 f9 e0 15 c6 bc 66 d7 1c ..DUi........f.. 00a0 9f 12 2e 8a db 1d 06 bc e6 b8 89 4d 68 8c f7 dd ...........Mh... 00b0 13 16 bf f8 73 bf 23 f7 4b f1 63 05 4a dd 7e 8a ....s.#.K.c.J.~. 00c0 6d a2 ab fc 19 f7 ba 41 53 a0 c4 41 c8 6d 29 22 m......AS..A.m)" 00d0 25 fd 8d a3 e0 a9 b8 bd 93 7d 52 63 24 51 26 d6 %........}Rc$Q&. 00e0 fb 04 a5 c1 37 9c 22 c5 f8 c0 39 d0 93 81 bf 56 ....7."...9....V 00f0 99 ba b0 6e 67 e7 a9 a4 72 3d c5 31 6e c0 00 19 ...ng...r=.1n... 0100 d6 f8 47 65 08 5a 30 55 fb 0c 2c b0 bc 78 7f 15 ..Ge.Z0U..,..x.. 0110 29 2f dc ae 85 37 52 b0 f6 48 d9 2b 62 24 a6 8f )/...7R..H.+b$.. 0120 13 dd 21 20 9a 34 54 72 44 9b 43 8b 9b e2 2e 93 ..! .4TrD.C..... 0130 2e 90 04 ff f1 2b 02 1d d4 89 d9 3f b6 9a 7e 25 .....+.....?..~% 0140 f4 cf d7 5d b9 3c 23 82 a0 28 8e a4 2a ed 0b d8 ...].<#..(..*... 0150 c8 ee 23 99 d0 a5 6e 59 38 d1 f8 51 97 91 5a fd ..#...nY8..Q..Z. 0160 e8 80 39 a2 b5 93 11 93 83 24 12 e3 b7 3e b0 9b ..9......$...>.. 0170 53 27 ac 6a 35 da 81 0b 7f 71 a1 94 5d 84 87 8a S'.j5....q..]... 0180 8b 21 a0 a7 1e 67 64 f4 0b e9 03 ee ea 93 33 ac .!...gd.......3. 0190 77 ca 58 26 89 0f ac b7 02 e8 de 7a 25 72 a6 7d w.X&.......z%r.} 01a0 5d 39 52 15 0d 3b cc c5 a8 c4 64 5d 7a 53 ed c4 ]9R..;....d]zS.. 01b0 95 bd 6e 50 c3 ae 3b e6 42 34 d4 72 8d a9 e8 b0 ..nP..;.B4.r.... 01c0 5a 86 c2 fb a4 c8 82 38 d1 da 88 bf 0d f3 88 ec Z......8........ 01d0 77 a5 70 41 73 18 18 a4 3e 64 dd 62 13 19 e6 d7 w.pAs...>d.b.... 01e0 29 41 5f 10 2d dc c6 f0 96 5e e3 5e f9 f5 bc f8 )A_.-....^.^.... 01f0 5e 81 9b 23 ea 9a cb 28 8e 2d 0b 0d eb 6c c1 bc ^..#...(.-...l.. 0200 3a 62 d4 24 03 30 de 3c d3 ee 20 5c f8 78 04 1b :b.$.0.<.. \.x.. 0210 49 f6 23 e9 1c 98 58 f7 a9 85 9c b3 33 6f f2 80 I.#...X.....3o.. 0220 8a 64 bd 0b 54 7d 8d 93 6a 7a dc 02 fe 57 2a 1c .d..T}..jz...W*. 0230 69 1f 65 4e 92 e5 07 19 f2 f5 ca 2d af 39 07 d0 i.eN.......-.9.. 0240 87 6a 93 df 8e bf b8 a0 43 20 f3 65 82 f2 6e 30 .j......C .e..n0 0250 2e 8b df bc c4 b9 0c a6 16 8f ab e7 55 28 56 3e ............U(V> 0260 bc 84 1c 4d 21 06 ca 78 1c 26 99 5d d6 98 98 2a ...M!..x.&.]...* 0270 5b 32 b4 c4 6e 12 c6 69 99 a7 88 7a 2b bc 0a 78 [2..n..i...z+..x 0280 ea 69 1b 91 41 27 5f 4b 94 e6 91 63 5d c9 6c f8 .i..A'_K...c].l. 0290 b4 94 7f 7f 71 e7 a7 11 1f aa 5e a5 b3 ed 77 32 ....q.....^...w2 02a0 51 c4 1c 1e 13 97 87 d0 d6 7e 2f 77 bf 84 da 13 Q........~/w.... 02b0 0f 35 c6 95 95 77 cb 1d 53 fb 1c 69 6d 00 8b 2f .5...w..S..im../ 02c0 5b a2 a3 46 8b d5 33 08 14 fa 0b be 99 4a d6 ad [..F..3......J.. 02d0 01 4c 0e b8 c1 9d 1f 90 c5 60 d4 32 5c e3 15 cd .L.......`.2\... 02e0 23 3f 9a 2f c7 49 18 b0 6c 09 4c e8 2a 9b 68 ff #?./.I..l.L.*.h. 02f0 33 d5 28 2b 91 2a 36 b7 0e df 90 2e 6f ec bb 1f 3.(+.*6.....o... 0300 e5 a2 06 77 8d 58 29 a0 23 e2 3f 6b 40 77 15 09 ...w.X).#.?k@w.. 0310 04 ef db 06 c3 af cc e1 c1 ac 72 3c 1d 77 1b 5a ..........r<.w.Z 0320 46 64 24 4c 37 3b 82 52 57 aa 7c 1f fe 9e 1f 53 Fd$L7;.RW.|....S 0330 3b ff 7e a5 6c 53 2f 6f 95 9a ca e7 b9 3a c9 bd ;.~.lS/o.....:.. 0340 5d f8 c2 ec a0 fa f9 2b db d1 48 8d 4d 17 bd e7 ]......+..H.M... 0350 a0 f6 d8 bb 53 17 81 ba e5 32 52 72 c6 7c 38 0f ....S....2Rr.|8. 0360 2e d0 ba 97 04 e1 ed 76 8e 97 fe 20 c2 ec ca 75 .......v... ...u 0370 71 d7 42 81 eb 8f 95 88 99 83 82 5d ad 57 d8 bf q.B........].W.. 0380 4e 1e 9d ea a7 80 c2 8c 93 4d 8d 5d 83 bd aa 99 N........M.].... 0390 17 9b 89 d3 ad 1e 60 ea 7b 24 b1 18 1a 36 bd 04 ......`.{$...6.. 03a0 ee 86 73 4c de 3e 3d f9 f6 17 e2 70 6f ec 1d 8b ..sL.>=....po... 03b0 c5 fa b1 19 86 07 7e 5b 6f f5 eb 78 33 02 4d 7d ......~[o..x3.M} 03c0 84 d7 ad e0 0b 6f 17 ae f8 65 1b e1 47 de 03 96 .....o...e..G... 03d0 db 3c 36 b7 77 7f 99 c6 88 38 9b 8a ed d3 28 87 .<6.w....8....(. 03e0 ea a6 e1 19 1d 6d 13 43 b9 3b 3b 48 6f 7a f4 9a .....m.C.;;Hoz.. 03f0 c9 02 cb ca 81 20 d5 95 5d b5 59 46 11 a3 a8 65 ..... ..].YF...e 0400 cc ed 81 16 0f 1b 29 18 05 28 73 fb bf e9 b5 68 ......)..(s....h 0410 e3 3a d3 ea 90 0b 04 0f a3 e2 fd 2b 0f 39 6f b0 .:.........+.9o. 0420 36 a2 b6 cc ff 9d 3a f7 54 dd 33 dd 2e 1f 5d d2 6.....:.T.3...]. 0430 4f 57 97 1d 80 b0 14 76 51 26 46 26 d5 b0 f1 19 OW.....vQ&F&.... 0440 08 c7 7c 3b 8e f6 05 5e 06 28 44 be 30 db 84 09 ..|;...^.(D.0... 0450 cd 56 f3 60 ad c5 cb 89 a9 3d 54 5d de af 5e e8 .V.`.....=T]..^. 0460 7e 88 32 f6 1f 9e 74 08 a8 fb cf c5 dc 9b 7b c6 ~.2...t.......{. 0470 cd 55 ef 2c be 87 6c f1 fe 7f 6f b9 04 39 14 b6 .U.,..l...o..9.. 0480 1a 37 66 80 d7 d4 f6 1c 67 ee ff ba 29 e2 7d be .7f.....g...).}. 0490 cd 62 f5 42 97 3f 44 0e 55 3f 68 89 7e b5 da 4a .b.B.?D.U?h.~..J 04a0 40 6d 76 47 f2 82 a6 40 37 15 9a 4d 5a 3d 46 e2 @mvG...@7..MZ=F. 04b0 7d d6 7e f9 47 b1 68 bb 5b 87 ed 93 74 e9 3c ac }.~.G.h.[...t.<. 04c0 93 46 25 83 8d 18 60 11 7e 0a .F%...`.~. No. Time Source Destination Protocol Info 3039 857.143410 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=12665 Ack=63669 Win=16294 [TCP CHECKSUM INCORRECT] Len=90 Frame 3039 (144 bytes on wire, 144 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.901914000 Time delta from previous packet: 0.010438000 seconds Time since reference or first frame: 857.143410000 seconds Frame Number: 3039 Packet Length: 144 bytes Capture Length: 144 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 130 Identification: 0x4477 (17527) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x31bb] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 12665, Ack: 63669, Len: 90 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 12665 (relative sequence number) Next sequence number: 12755 (relative sequence number) Acknowledgement number: 63669 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16294 Checksum: 0x84b8 [incorrect, should be 0xdd85] SEQ/ACK analysis This is an ACK to the segment in frame: 3038 The RTT to ACK the segment was: 0.010438000 seconds Data (90 bytes) 0000 bc ef 5a 00 b5 fe 18 00 40 00 00 21 1d 46 32 0a ..Z.....@..!.F2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 9d bc 30 aa 3b b1 29 76 a.elr.....0.;.)v 0030 6d 37 70 28 3b 30 07 f5 87 4b 0c ee da 96 e3 20 m7p(;0...K..... 0040 75 14 03 ca 13 20 8a 9a 8b 6b e1 ab d8 ea 51 74 u.... ...k....Qt 0050 7e 34 0d 2e 4d 95 e0 5b 5a 00 ~4..M..[Z. No. Time Source Destination Protocol Info 3040 857.143870 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=63669 Ack=12755 Win=14680 Len=566 Frame 3040 (620 bytes on wire, 620 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.902374000 Time delta from previous packet: 0.000460000 seconds Time since reference or first frame: 857.143870000 seconds Frame Number: 3040 Packet Length: 620 bytes Capture Length: 620 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 606 Identification: 0x437e (17278) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x30d8 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 63669, Ack: 12755, Len: 566 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 63669 (relative sequence number) Next sequence number: 64235 (relative sequence number) Acknowledgement number: 12755 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14680 Checksum: 0x8fb9 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3039 The RTT to ACK the segment was: 0.000460000 seconds Data (566 bytes) 0000 bc ef 36 02 b5 fe 18 00 1b 02 01 21 c6 f5 32 0a ..6........!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 6d 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e.m.].....#T;.+t 0030 47 90 76 2e 7d 94 8e 5b 8a 4b 08 f0 cc 32 f8 42 G.v.}..[.K...2.B 0040 78 14 0f 2e 9d 84 b9 c3 b3 5a ca b4 85 0d 02 4a x........Z.....J 0050 4b 07 6f 30 7d 94 f6 99 96 4b 0f 0f b7 32 12 43 K.o0}....K...2.C 0060 2c 0c 13 28 99 84 73 ee c1 6b 99 96 8f 3b a3 ff ,..(..s..k...;.. 0070 00 59 04 5c 49 c7 75 8f fd 24 64 84 93 60 81 33 .Y.\I.u..$d..`.3 0080 2a 71 60 5a 8d b5 b9 c4 b1 5e dc c0 e6 6e 1c 43 *q`Z.....^...n.C 0090 7f 19 35 64 10 d6 dc d5 f4 09 00 4e e9 6b 38 01 ..5d.......N.k8. 00a0 2e 57 1c 7d c5 a4 38 a0 c6 24 e4 c6 90 0b 84 ce .W.}..8..$...... 00b0 0e 34 4d 2e 5b 94 1d ff 8d 4b 1a 9a ef 5f 8d 2e .4M.[....K..._.. 00c0 13 71 51 6e d0 e9 f9 9e e0 1f aa 9e 96 25 5f 5c .qQn.........%_\ 00d0 1c 5b 48 1e 20 e1 c2 a4 9d 57 42 0d 8b 22 18 43 .[H. ....WB..".C 00e0 6f 28 31 49 d6 f7 10 de b7 2b da f7 c2 2d bf e6 o(1I.....+...-.. 00f0 51 2f 42 32 49 91 00 f3 8d 4b 36 93 93 53 e4 6c Q/B2I....K6..S.l 0100 1f 77 33 41 cd e9 8d ec 86 77 cd fb f4 4e 2c 00 .w3A.....w...N,. 0110 1f 28 35 35 31 9a fc 99 fd 3d 32 6e 9b 41 98 30 .(551....=2n.A.0 0120 6f 75 b7 19 b5 b6 71 a4 85 77 c9 84 fc 4f 50 ed ou....q..w...OP. 0130 6f 53 b1 cd 39 98 00 bf 8d 4b 46 83 e3 2e 64 4a oS..9....KF...dJ 0140 7f 14 c3 02 dd 98 8d fb 85 c7 c3 8e c7 6c ac 08 .............l.. 0150 7f 39 c5 63 5f f5 bf ac 9d 57 22 02 eb 9e e6 22 .9.c_....W"...." 0160 2c 0f a7 35 c5 88 71 e5 89 6b d9 ee 8c 52 50 e7 ,..5..q..k...RP. 0170 6f 50 a1 9c 29 88 00 f5 8d 4b 56 80 f3 2e 64 4a oP..)....KV...dJ 0180 5f 16 d3 52 ed 98 8d fe 85 0f ad 9e 94 52 ac 18 _..R.........R.. 0190 5f 34 d5 cf 11 30 fd 85 bd 53 12 16 fb 32 98 6e _4...0...S...2.n 01a0 1c 40 a1 46 f5 a4 51 c8 a0 2e c9 cf b0 37 0e cc .@.F..Q......7.. 01b0 4f 14 b6 91 62 b4 20 de 2f 4a 7a f0 db 32 7d 42 O...b. ./Jz..2}B 01c0 7f 14 ce 5c a9 b2 e2 d6 a5 4b bd ca e1 6e eb 38 ...\.....K...n.8 01d0 06 6a c4 ef 21 b3 bc e2 bd 6b 20 40 cb 2e 98 45 .j..!....k @...E 01e0 6f eb 85 28 e5 cb 71 f4 85 6d f9 88 af 4f 50 6f o..(..q..m...OPo 01f0 6f 28 81 d7 09 95 03 fe 8d 04 76 ec d3 34 64 43 o(........v..4dC 0200 9c 12 f3 76 0d 90 8d fc 85 71 ad a2 b6 74 ac 19 ...v.....q...t.. 0210 9f 1a 8b ae b2 ab fd 85 7d 86 f1 0e db f5 64 5e ........}.....d^ 0220 cb f3 ae 28 f5 57 0f 85 21 95 8a e5 bc 49 2c 0a ...(.W..!....I,. 0230 6f 27 29 0d 36 02 o').6. No. Time Source Destination Protocol Info 3041 857.146514 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=12755 Ack=64235 Win=17520 [TCP CHECKSUM INCORRECT] Len=386 Frame 3041 (440 bytes on wire, 440 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.905018000 Time delta from previous packet: 0.002644000 seconds Time since reference or first frame: 857.146514000 seconds Frame Number: 3041 Packet Length: 440 bytes Capture Length: 440 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 426 Identification: 0x4478 (17528) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3092] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 12755, Ack: 64235, Len: 386 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 12755 (relative sequence number) Next sequence number: 13141 (relative sequence number) Acknowledgement number: 64235 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x85e0 [incorrect, should be 0xec82] SEQ/ACK analysis This is an ACK to the segment in frame: 3040 The RTT to ACK the segment was: 0.002644000 seconds Data (386 bytes) 0000 bc ef 82 01 b5 fe 18 00 66 01 02 21 df 71 32 0a ........f..!.q2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 40 4b 87 4a a4 32 ee 20 o0O(~...@K.J.2. 0040 7e 15 7c 6c 9a 84 83 9a 1c a8 e1 0f c1 4e 3e 74 ~.|l.........N>t 0050 7f 34 6f 2e 0d 94 91 ff f4 4b 0e f1 c7 32 7d 41 .4o......K...2}A 0060 1d 14 67 2a 99 20 f1 58 82 6b 97 e4 d0 ea ab ad ..g*. .X.k...... 0070 68 34 6f a8 1a 57 00 75 88 4b 16 6e b3 32 6a 63 h4o..W.u.K.n.2jc 0080 5f 14 16 48 ad 84 8d 1a 1e a8 ed 8f de 4e 2c f4 _..H.........N,. 0090 29 f7 15 ae 56 94 fc 7f bd 4b fc b2 bb 32 1a c1 )...V....K...2.. 00a0 6f 14 57 aa 38 47 71 7c 87 6b a9 64 dc 4e 7b 4a o.W.8Gq|.k.d.N{J 00b0 6f 34 53 28 59 94 00 f5 2d 88 26 ee 84 32 e4 20 o4S(Y...-.&..2. 00c0 7f 14 92 0b bd 84 8a 9a 85 6b dd 0f 7e 8d 2c 74 .........k..~.,t 00d0 75 34 25 2e 31 57 fc ff 9f 4b 42 f1 8b 32 8c 82 u4%.1W...KB..2.. 00e0 6f 14 42 2a a5 84 71 fc 10 a8 b9 e4 e9 4e d0 09 o.B*..q......N.. 00f0 6f 34 d7 6b 49 94 05 75 8d 4b 36 6e 27 f1 e4 a0 o4.kI..u.K6n'... 0100 15 14 33 48 54 47 8d 1a 80 6b cd 8f f4 4e b0 37 ..3HTG...k...N.7 0110 1f 34 3f ae 31 94 73 bb fd 4b 37 71 9b 32 98 c1 .4?.1.s..K7q.2.. 0120 ff d0 b7 ab b9 84 71 7e 85 6b 57 a1 fc 4e 55 83 ......q~.kW..NU. 0130 6f 34 b1 37 55 57 00 95 87 4b 46 0e 79 d0 64 40 o4.7UW...KF.y.d@ 0140 7a 14 c3 29 dd 84 d0 3b 85 6b b7 e9 84 4e d1 dd z..)...;.k...N.. 0150 7f 34 c0 d1 21 94 fc ff 70 88 22 f1 e1 32 98 41 .4..!...p."..2.A 0160 73 b0 2d 8f c2 84 61 fe 85 6b a7 46 8b 4e 5a 03 s.-...a..k.F.NZ. 0170 6f 34 bd 13 54 94 01 15 85 4b 7a 8f ef 96 64 c8 o4..T....Kz...d. 0180 82 01 .. No. Time Source Destination Protocol Info 3042 857.147765 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=64235 Ack=13141 Win=14904 Len=530 Frame 3042 (584 bytes on wire, 584 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.906269000 Time delta from previous packet: 0.001251000 seconds Time since reference or first frame: 857.147765000 seconds Frame Number: 3042 Packet Length: 584 bytes Capture Length: 584 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 570 Identification: 0x457e (17790) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x2efc [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 64235, Ack: 13141, Len: 530 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 64235 (relative sequence number) Next sequence number: 64765 (relative sequence number) Acknowledgement number: 13141 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14904 Checksum: 0xa97e [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3041 The RTT to ACK the segment was: 0.001251000 seconds Data (530 bytes) 0000 bc ef 12 02 b5 fe 18 00 f5 01 03 21 dc f6 32 0a ...........!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e e1 72 {.+..........N.r 0050 e5 34 05 30 61 94 8f 5a 81 4b 67 0f a5 32 18 43 .4.0a..Z.Kg..2.C 0060 20 14 26 28 ce 84 2e ee c1 6b d6 96 81 4e 5e 48 .&(.....k...N^H 0070 73 34 64 2e 65 94 00 ff c2 4b 57 f0 f8 32 bb 42 s4d.e....KW..2.B 0080 0f 14 5c 2e 36 47 91 f0 8f 6b eb f1 a2 8d 30 72 ..\.6G...k....0r 0090 58 34 16 30 51 94 8c f4 d2 e5 91 13 bb 30 18 50 X4.0Q........0.P 00a0 6f 14 57 42 f9 e9 18 82 e9 0e db b8 af 21 a4 e3 o.WB.........!.. 00b0 0a 46 25 41 37 e7 ad 3c 91 4b 24 f0 85 32 e4 42 .F%A7..<.K$..2.B 00c0 32 7d 4f 42 d8 f6 26 33 99 6b df f1 e7 4e 2c 72 2}OB..&3.k...N,r 00d0 35 5b 4b 90 82 88 fc 9e 9d 6f 42 0f 8b 0a 5a 76 5[K......oB...Zv 00e0 57 51 74 6a 95 a9 41 da b3 5b 94 a6 dc 7e e0 a6 WQtj..A..[...~.. 00f0 57 70 77 1e 64 a2 30 bb be 7a 04 c0 a3 02 d4 72 Wpw.d.0..z.....r 0100 2f a5 f0 29 cd 83 8d f0 85 6b cd 6b 37 49 2c 78 /..).....k.k7I,x 0110 1f 34 35 40 f2 93 fc 9b fd 4b 32 0f 9b a6 5b 44 .45@.....K2...[D 0120 6f 11 b7 29 b5 84 71 7d 46 6c c9 8d fc 4e 50 ed o..)..q}Fl...NP. 0130 6f a2 72 d6 39 91 00 ff 8d 4b 46 44 20 35 64 48 o.r.9....KFD 5dH 0140 7f 14 c3 b6 1e 98 8d f3 85 7b bd ef 84 24 ac 78 .........{...$.x 0150 7f 59 c5 a6 21 f8 fc f5 9d 2e 22 7d eb ae 5b 5f .Y..!....."}..[_ 0160 6f 1e a7 2b c5 0b b5 ef 85 6e d9 88 8c 4e 50 7d o..+.....n...NP} 0170 ab 28 a1 dd 29 94 00 ff 8d d5 95 f7 f3 37 64 42 .(..)........7dB 0180 5f 14 d3 43 2e 83 8d fc 85 6b ad 29 57 49 ac 11 _..C.....k.)WI.. 0190 5f 34 d5 cf 11 c9 3f 85 bd 41 12 0d fb 4f 5b 5f _4....?..A...O[_ 01a0 6f 11 97 11 d5 84 71 9b 85 04 e9 fc 9c 26 50 88 o.....q......&P. 01b0 6f 46 91 a5 19 fb 00 91 8d 38 66 dd c3 45 64 23 oF.......8f..Ed# 01c0 7f 3a e3 4c fd eb 8d 9b 85 45 9d 8e a4 3b ac 14 .:.L.....E...;.. 01d0 7f 34 e5 cf 01 94 fc 99 9d 4b 02 0f cb 32 98 ae .4.......K...2.. 01e0 ac 08 87 23 e5 85 71 65 73 77 f9 82 ac 4f 50 f1 ...#..qesw...OP. 01f0 cb 34 81 af ad 93 00 f5 8d 4a 76 d8 77 35 64 46 .4.......Jv.w5dF 0200 9f 61 57 2e 0d 80 8d f6 85 75 8d f3 10 1c 00 0d .aW......u...... 0210 12 02 .. No. Time Source Destination Protocol Info 3043 857.148439 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=13141 Ack=64765 Win=16990 [TCP CHECKSUM INCORRECT] Len=198 Frame 3043 (252 bytes on wire, 252 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.906943000 Time delta from previous packet: 0.000674000 seconds Time since reference or first frame: 857.148439000 seconds Frame Number: 3043 Packet Length: 252 bytes Capture Length: 252 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 238 Identification: 0x4479 (17529) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x314d] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 13141, Ack: 64765, Len: 198 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 13141 (relative sequence number) Next sequence number: 13339 (relative sequence number) Acknowledgement number: 64765 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16990 Checksum: 0x8524 [incorrect, should be 0x0ae4] SEQ/ACK analysis This is an ACK to the segment in frame: 3042 The RTT to ACK the segment was: 0.000674000 seconds Data (198 bytes) 0000 bc ef c6 00 b5 fe 18 00 aa 00 02 21 00 3a 32 0a ...........!.:2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 c7 4a 87 4a a4 32 ee 20 o0O(~....J.J.2. 0040 0c 15 7c 6c 9a 84 83 9a 6e a8 e1 0f c1 4e 1c 74 ..|l....n....N.t 0050 7f 34 68 2e 0c 94 88 ff f3 4b 07 f1 df 32 6f 41 .4h......K...2oA 0060 00 14 15 2a ee 84 02 fc ab 6b fa e4 a3 4e bd 09 ...*.....k...N.. 0070 41 34 00 a8 1c 94 00 75 8d 4b 16 6e 8d 32 e4 a0 A4.....u.K.n.2.. 0080 5f 14 0f ec 2d 20 8a 1a 8b 6b f1 2b af ea 2b f4 _...- ...k.+..+. 0090 51 34 fe 6d 51 94 f9 7f bd 4b 52 71 db c4 18 c1 Q4.mQ....KRq.... 00a0 65 14 57 aa 89 20 fb d8 82 6b b9 64 dc 4e ae 2d e.W.. ...k.d.N.- 00b0 68 34 5b 28 59 94 1c 51 f0 4b 27 ee 8b 32 c8 21 h4[(Y..Q.K'..2.! 00c0 63 b0 4f a4 c6 00 c.O... No. Time Source Destination Protocol Info 3044 857.148821 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=64765 Ack=13339 Win=14706 Len=110 Frame 3044 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.907325000 Time delta from previous packet: 0.000382000 seconds Time since reference or first frame: 857.148821000 seconds Frame Number: 3044 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0x477e (18302) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x2ea0 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 64765, Ack: 13339, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 64765 (relative sequence number) Next sequence number: 64875 (relative sequence number) Acknowledgement number: 13339 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14706 Checksum: 0x1d67 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3043 The RTT to ACK the segment was: 0.000382000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 d8 c6 32 0a ..n.....R..!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf fa 96 6e 00 n.k(..q.....n. No. Time Source Destination Protocol Info 3045 857.149206 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=13339 Ack=64875 Win=16880 [TCP CHECKSUM INCORRECT] Len=294 Frame 3045 (348 bytes on wire, 348 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.907710000 Time delta from previous packet: 0.000385000 seconds Time since reference or first frame: 857.149206000 seconds Frame Number: 3045 Packet Length: 348 bytes Capture Length: 348 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 334 Identification: 0x447a (17530) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x30ec] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 13339, Ack: 64875, Len: 294 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 13339 (relative sequence number) Next sequence number: 13633 (relative sequence number) Acknowledgement number: 64875 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16880 Checksum: 0x8584 [incorrect, should be 0x2ffe] SEQ/ACK analysis This is an ACK to the segment in frame: 3044 The RTT to ACK the segment was: 0.000385000 seconds Data (294 bytes) 0000 bc ef 26 01 b5 fe 18 00 0a 01 02 21 7b 3a 32 0a ..&........!{:2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a a3 bc 76 aa 3b b1 23 76 a.elr.....v.;.#v 0030 7f 34 71 28 07 30 07 f5 87 4b 62 ee 22 96 e3 20 .4q(.0...Kb.".. 0040 75 14 03 c8 12 20 8a 9a 92 6b fd 0f c4 4e cb d0 u.... ...k...N.. 0050 78 34 09 2e 9e 6b 03 00 68 ef 65 f1 a5 32 08 e5 x4...k..h.e..2.. 0060 68 14 6d 2a a1 84 08 58 82 6b 93 e4 cc 4a 92 ad h.m*...X.k...J.. 0070 68 34 6b a8 69 94 3e 75 8a 4b 1c 6e f9 33 99 04 h4k.i.>u.K.n.3.. 0080 58 14 1f 48 ad 84 8d 1a fa cf ea 8f da 4e c7 37 X..H.........N.7 0090 43 34 10 ae 61 94 fc 7f d0 4b 3f 71 cf 32 76 c1 C4..a....K?q.2v. 00a0 0a 14 23 aa e2 84 1e 7c f7 6b c2 64 af 4e fe 89 ..#....|.k.d.N.. 00b0 0c 34 3e 28 34 94 2e f5 ec 4b 53 ee 83 32 e4 20 .4>(4....KS..2. 00c0 7f 14 1d c8 bd 84 8d 9a 99 cf 5d ab e3 4e 22 74 ..........]..N"t 00d0 94 f7 39 2e 44 94 cc ff 9d 4b 2f f1 e6 32 6c 41 ..9.D....K/..2lA 00e0 01 14 22 2a d1 84 06 fc ea 6b cb e4 87 4e a3 09 .."*.....k...N.. 00f0 41 34 22 a8 26 94 6d 75 a3 4b 57 6e e6 32 e4 a0 A4".&.mu.KWn.2.. 0100 1f 14 33 48 f3 84 8d 1a 85 6b d1 2b 75 ea 2b f4 ..3H.....k.+u.+. 0110 15 34 46 af 2d 30 e0 db 80 4b 33 71 93 32 b4 c0 .4F.-0...K3q.2.. 0120 73 b0 b7 ab 26 01 s...&. No. Time Source Destination Protocol Info 3046 857.149571 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=64875 Ack=13633 Win=14412 Len=102 Frame 3046 (156 bytes on wire, 156 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.908075000 Time delta from previous packet: 0.000365000 seconds Time since reference or first frame: 857.149571000 seconds Frame Number: 3046 Packet Length: 156 bytes Capture Length: 156 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 142 Identification: 0x497e (18814) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x2ca8 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 64875, Ack: 13633, Len: 102 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 64875 (relative sequence number) Next sequence number: 64977 (relative sequence number) Acknowledgement number: 13633 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14412 Checksum: 0xa900 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3045 The RTT to ACK the segment was: 0.000365000 seconds Data (102 bytes) 0000 bc ef 66 00 b5 fe 18 00 4a 00 02 21 a4 58 32 0a ..f.....J..!.X2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 73 99 e1 42 ..<*qC..f...s..B 0020 6b 04 5d 8a 72 b4 0b f0 fb 18 0c f0 36 b1 2f 74 k.].r.......6./t 0030 47 90 76 2e 7d 94 8f 5b 8a 4b 11 f0 a3 32 e4 42 G.v.}..[.K...2.B 0040 98 b0 04 2e 91 84 84 3b 86 6b d5 55 c3 4e 28 72 .......;.k.U.N(r 0050 57 90 02 30 65 94 8e 3d 9c 4b 6e 0f a5 63 18 43 W..0e..=.Kn..c.C 0060 73 b0 6d 28 66 00 s.m(f. No. Time Source Destination Protocol Info 3047 857.150076 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=13633 Ack=64977 Win=16778 [TCP CHECKSUM INCORRECT] Len=74 Frame 3047 (128 bytes on wire, 128 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.908580000 Time delta from previous packet: 0.000505000 seconds Time since reference or first frame: 857.150076000 seconds Frame Number: 3047 Packet Length: 128 bytes Capture Length: 128 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 114 Identification: 0x447b (17531) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x31c7] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 13633, Ack: 64977, Len: 74 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 13633 (relative sequence number) Next sequence number: 13707 (relative sequence number) Acknowledgement number: 64977 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16778 Checksum: 0x84a8 [incorrect, should be 0x045e] SEQ/ACK analysis This is an ACK to the segment in frame: 3046 The RTT to ACK the segment was: 0.000505000 seconds Data (74 bytes) 0000 bc ef 4a 00 b5 fe 18 00 30 00 00 21 5b 7e 32 0a ..J.....0..![~2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a a0 bc 8a aa 3b b1 25 76 a.elr.......;.%v 0030 6f 34 96 8c 7e 94 0c f5 84 80 05 ee bf 96 99 20 o4..~.......... 0040 7e 14 0b c8 b1 85 91 3e 4a 00 ~......>J. No. Time Source Destination Protocol Info 3048 857.150284 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=64977 Ack=13707 Win=14904 Len=66 Frame 3048 (120 bytes on wire, 120 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.908788000 Time delta from previous packet: 0.000208000 seconds Time since reference or first frame: 857.150284000 seconds Frame Number: 3048 Packet Length: 120 bytes Capture Length: 120 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 106 Identification: 0x4b7e (19326) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x2acc [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 64977, Ack: 13707, Len: 66 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 64977 (relative sequence number) Next sequence number: 65043 (relative sequence number) Acknowledgement number: 13707 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14904 Checksum: 0x1159 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3047 The RTT to ACK the segment was: 0.000208000 seconds Data (66 bytes) 0000 bc ef 42 00 b5 fe 18 00 28 00 00 21 e9 33 32 0a ..B.....(..!.32. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 73 99 e1 42 ..<*qC..f...s..B 0020 6b 04 5d 8a 72 b4 0b f0 ad 18 0c f0 38 b1 07 d0 k.].r.......8... 0030 68 34 75 2e 0b 30 01 ff 81 4b 06 f0 a3 32 f8 e6 h4u..0...K...2.. 0040 42 00 B. No. Time Source Destination Protocol Info 3049 857.150674 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=13707 Ack=65043 Win=16712 [TCP CHECKSUM INCORRECT] Len=386 Frame 3049 (440 bytes on wire, 440 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.909178000 Time delta from previous packet: 0.000390000 seconds Time since reference or first frame: 857.150674000 seconds Frame Number: 3049 Packet Length: 440 bytes Capture Length: 440 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 426 Identification: 0x447c (17532) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x308e] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 13707, Ack: 65043, Len: 386 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 13707 (relative sequence number) Next sequence number: 14093 (relative sequence number) Acknowledgement number: 65043 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16712 Checksum: 0x85e0 [incorrect, should be 0xbb85] SEQ/ACK analysis This is an ACK to the segment in frame: 3048 The RTT to ACK the segment was: 0.000390000 seconds Data (386 bytes) 0000 bc ef 82 01 b5 fe 18 00 66 01 02 21 9b b8 32 0a ........f..!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 40 4b 87 4a a4 32 ee 20 o0O(~...@K.J.2. 0040 01 15 7c 6c 9a 84 83 9a 0a af e1 0f c1 4e 3e 74 ..|l.........N>t 0050 7f 34 6f 2e 0d 94 91 ff f4 4b 0e f1 c7 32 7d 41 .4o......K...2}A 0060 1d 14 67 2a 99 20 f1 58 82 6b 97 e4 d0 ea ab ad ..g*. .X.k...... 0070 68 34 6f a8 1a 57 00 75 88 4b 16 6e b3 32 6a 63 h4o..W.u.K.n.2jc 0080 5f 14 16 48 ad 84 8d 1a 1e a8 ed 8f de 4e 2c f4 _..H.........N,. 0090 29 f7 15 ae 56 94 fc 7f bd 4b fc b2 bb 32 1a c1 )...V....K...2.. 00a0 6f 14 57 aa 38 47 71 7c 87 6b a9 64 dc 4e 7b 4a o.W.8Gq|.k.d.N{J 00b0 6f 34 53 28 59 94 00 f5 2d 88 26 ee 84 32 e4 20 o4S(Y...-.&..2. 00c0 7f 14 92 0b bd 84 8a 9a 85 6b dd 0f 7e 8d 2c 74 .........k..~.,t 00d0 75 34 25 2e 31 57 fc ff 9f 4b 42 f1 8b 32 8c 82 u4%.1W...KB..2.. 00e0 6f 14 42 2a a5 84 71 fc 10 a8 b9 e4 e9 4e d0 09 o.B*..q......N.. 00f0 6f 34 d7 6b 49 94 05 75 8d 4b 36 6e 27 f1 e4 a0 o4.kI..u.K6n'... 0100 15 14 33 48 54 47 8d 1a 80 6b cd 8f f4 4e b0 37 ..3HTG...k...N.7 0110 1f 34 3f ae 31 94 73 bb fd 4b 37 71 9b 32 98 c1 .4?.1.s..K7q.2.. 0120 ff d0 b7 ab b9 84 71 7e 85 6b 57 a1 fc 4e 55 83 ......q~.kW..NU. 0130 6f 34 b1 37 55 57 00 95 87 4b 46 0e 79 d0 64 40 o4.7UW...KF.y.d@ 0140 7a 14 c3 29 dd 84 d0 3b 85 6b b7 e9 84 4e d1 dd z..)...;.k...N.. 0150 7f 34 c0 d1 21 94 fc ff 70 88 22 f1 e1 32 98 41 .4..!...p."..2.A 0160 73 b0 2d 8f c2 84 61 fe 85 6b a7 46 8b 4e 5a 03 s.-...a..k.F.NZ. 0170 6f 34 bd 13 54 94 01 15 85 4b 7a 8f ef 96 64 c0 o4..T....Kz...d. 0180 82 01 .. No. Time Source Destination Protocol Info 3050 857.151060 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=65043 Ack=14093 Win=14518 Len=110 Frame 3050 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.909564000 Time delta from previous packet: 0.000386000 seconds Time since reference or first frame: 857.151060000 seconds Frame Number: 3050 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0x4d7e (19838) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x28a0 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 65043, Ack: 14093, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 65043 (relative sequence number) Next sequence number: 65153 (relative sequence number) Acknowledgement number: 14093 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14518 Checksum: 0xd81a [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3049 The RTT to ACK the segment was: 0.000386000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 7d c7 32 0a ..n.....R..!}.2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf 97 96 6e 00 n.k(..q.....n. No. Time Source Destination Protocol Info 3051 857.151418 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=14093 Ack=65153 Win=16602 [TCP CHECKSUM INCORRECT] Len=390 Frame 3051 (444 bytes on wire, 444 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.909922000 Time delta from previous packet: 0.000358000 seconds Time since reference or first frame: 857.151418000 seconds Frame Number: 3051 Packet Length: 444 bytes Capture Length: 444 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 430 Identification: 0x447d (17533) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3089] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 14093, Ack: 65153, Len: 390 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 14093 (relative sequence number) Next sequence number: 14483 (relative sequence number) Acknowledgement number: 65153 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16602 Checksum: 0x85e4 [incorrect, should be 0xa0a0] SEQ/ACK analysis This is an ACK to the segment in frame: 3050 The RTT to ACK the segment was: 0.000358000 seconds Data (390 bytes) 0000 bc ef 86 01 b5 fe 18 00 69 01 03 21 67 47 32 0a ........i..!gG2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 40 4b 87 4a a4 32 ee 20 o0O(~...@K.J.2. 0040 0e 15 7c 6c 9a 84 83 9a 99 cf 7d ab c3 4e 22 74 ..|l......}..N"t 0050 d4 f7 1d 2e 63 94 ff ff 9d 4b 08 db ab 9f db 59 ....c....K.....Y 0060 6f 16 67 22 85 84 71 90 e8 02 f5 88 a9 3c d0 15 o.g"..q......<.. 0070 cb 4f c5 af 69 9a 00 06 4e 4b 16 6b b3 32 e4 a0 .O..i...NK.k.2.. 0080 5f 9a d0 48 ad 81 8d 1a 85 6b ed 14 17 4e 2c fe _..H.....k...N,. 0090 5f 34 15 d8 92 94 fc 78 bd 4b 52 71 bb 9c db c1 _4.....x.KRq.... 00a0 6f 16 57 aa 95 84 71 d1 46 6b a9 66 dc 4e d0 89 o.W...q.Fk.f.N.. 00b0 6f 9f 92 28 59 96 00 f5 8d 4b 26 4e 40 32 e4 27 o..(Y....K&N@2.' 00c0 7f 14 23 c8 bd 35 4e 9a 85 6c dd 0f e4 4e 2c ee ..#..5N..l...N,. 00d0 bc 34 25 24 41 94 fc 8f 5e 4b 42 f3 8b 32 18 41 .4%$A...^KB..2.A 00e0 6f 80 84 2a a5 81 71 fc 85 6b b9 71 2f 4e d0 0c o..*..q..k.q/N.. 00f0 6f 34 41 a8 49 02 c3 75 8d 4e 36 6e 93 32 e4 14 o4A.I..u.N6n.2.. 0100 dc 14 33 42 cd 84 8d 83 46 6b cd 8a f4 4e 2c f4 ..3B....Fk...N,. 0110 1f a8 f6 ae 31 9e fc 7f fd c4 f6 71 9b 37 98 c1 ....1......q.7.. 0120 6f 14 b7 3b 71 84 71 72 85 6b c9 62 fc d0 93 83 o..;q.qr.k.b.... 0130 6f 31 b1 37 39 94 00 f9 4e 4b 46 04 e3 32 64 da o1.79...NKF..2d. 0140 9d 14 c3 2c dd 84 8d f8 85 36 7e e9 84 44 ac 1e ...,.....6~..D.. 0150 7f 49 06 d1 21 91 fc ff 9d 4b 22 1c 28 32 98 4b .I..!....K".(2.K 0160 6f 14 a7 37 61 0e d5 f9 85 7b d9 e2 8c 30 f4 04 o..7a....{...0.. 0170 6f 3e a1 b7 29 88 a4 68 8d 4a 56 86 f3 1e 65 dc o>..)..h.JV...e. 0180 fb 15 d3 c5 86 01 ...... No. Time Source Destination Protocol Info 3052 857.151834 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=65153 Ack=14483 Win=14904 Len=110 Frame 3052 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.910338000 Time delta from previous packet: 0.000416000 seconds Time since reference or first frame: 857.151834000 seconds Frame Number: 3052 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0x4f7e (20350) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x26a0 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 65153, Ack: 14483, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 65153 (relative sequence number) Next sequence number: 65263 (relative sequence number) Acknowledgement number: 14483 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14904 Checksum: 0x14a5 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3051 The RTT to ACK the segment was: 0.000416000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 df 62 32 0a ..n.....R..!.b2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf f5 fa 6e 00 n.k(..q.....n. No. Time Source Destination Protocol Info 3053 857.152204 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=14483 Ack=65263 Win=16492 [TCP CHECKSUM INCORRECT] Len=386 Frame 3053 (440 bytes on wire, 440 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.910708000 Time delta from previous packet: 0.000370000 seconds Time since reference or first frame: 857.152204000 seconds Frame Number: 3053 Packet Length: 440 bytes Capture Length: 440 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 426 Identification: 0x447e (17534) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x308c] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 14483, Ack: 65263, Len: 386 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 14483 (relative sequence number) Next sequence number: 14869 (relative sequence number) Acknowledgement number: 65263 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16492 Checksum: 0x85e0 [incorrect, should be 0x3779] SEQ/ACK analysis This is an ACK to the segment in frame: 3052 The RTT to ACK the segment was: 0.000370000 seconds Data (386 bytes) 0000 bc ef 82 01 b5 fe 18 00 67 01 01 21 27 76 32 0a ........g..!'v2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 40 4b 87 4a a4 32 ee 20 o0O(~...@K.J.2. 0040 0e 15 7c 6c 9a 84 83 9a 99 cf 7d ab c3 4e 22 74 ..|l......}..N"t 0050 d4 f7 16 2e 63 94 fc ff 9d 4b cf 32 b3 32 1a 41 ....c....K.2.2.A 0060 66 14 67 2a ef e8 1c 95 e9 07 fc 96 cc 52 74 72 f.g*.........Rtr 0070 cb 33 61 a6 69 e7 c3 75 8d 4e 16 6e b3 32 e4 2e .3a.i..u.N.n.2.. 0080 9c 14 13 4d ad 84 8d 1a 85 f0 2e 8f d4 44 2c f4 ...M.........D,. 0090 5f 42 d6 ae 51 93 fc 7f bd 4b 52 df 78 32 18 c3 _B..Q....KR.x2.. 00a0 6f 14 57 aa 95 29 b2 7c 85 69 a9 64 dc 4e d0 22 o.W..).|.i.d.N." 00b0 ac 34 51 2a 59 94 00 f5 8d eb e5 ee 83 35 e4 20 .4Q*Y........5. 00c0 7f 14 23 79 7e 84 8d 9d 85 6b dd 0f e4 d4 ef 74 ..#y~....k.....t 00d0 7f 3e 25 2e 41 e4 3f ff 9d 49 42 f1 8b 32 18 d5 .>%.A.?..IB..2.. 00e0 ac 14 47 2f a5 84 71 fc 85 fe 7a e4 ec 4b d0 09 ..G/..q...z..K.. 00f0 6f 34 41 3e 8a 94 00 70 8d 4b 36 6e 93 86 27 a0 o4A>...p.K6n..'. 0100 1f 1e 33 48 cd 1d 4e 1a 85 6e cd 8f f4 4e 2c 68 ..3H..N..n...N,h 0110 dc 34 35 a4 31 94 fc f0 39 4b 32 74 9b 32 98 c1 .45.1...9K2t.2.. 0120 6f 84 73 ab b5 88 71 7e 85 6b c9 fc 3f 4e 50 86 o.s...q~.k..?NP. 0130 6f 34 b1 37 39 f8 c3 95 8d 41 46 0e e3 a8 86 40 o4.79....AF....@ 0140 7f 11 c3 29 dd 84 8d a5 46 6b bd e3 84 4e ac 63 ...)....Fk...N.c 0150 bc 34 c5 d4 21 94 fc ff 9d a6 e1 f1 eb 38 98 41 .4..!........8.A 0160 6f 08 03 a1 61 83 71 ee 85 6b d9 9c 28 49 50 09 o...a.q..k..(IP. 0170 6f 34 a1 ab 8d e9 00 14 8d 43 56 a2 f2 2e c0 1c o4.......CV..... 0180 82 01 .. No. Time Source Destination Protocol Info 3054 857.152609 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=65263 Ack=14869 Win=14518 Len=110 Frame 3054 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.911113000 Time delta from previous packet: 0.000405000 seconds Time since reference or first frame: 857.152609000 seconds Frame Number: 3054 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0x517e (20862) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x24a0 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 65263, Ack: 14869, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 65263 (relative sequence number) Next sequence number: 65373 (relative sequence number) Acknowledgement number: 14869 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14518 Checksum: 0x163b [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3053 The RTT to ACK the segment was: 0.000405000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 d6 74 32 0a ..n.....R..!.t2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf fc e4 6e 00 n.k(..q.....n. No. Time Source Destination Protocol Info 3055 857.152972 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=14869 Ack=65373 Win=16382 [TCP CHECKSUM INCORRECT] Len=386 Frame 3055 (440 bytes on wire, 440 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.911476000 Time delta from previous packet: 0.000363000 seconds Time since reference or first frame: 857.152972000 seconds Frame Number: 3055 Packet Length: 440 bytes Capture Length: 440 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 426 Identification: 0x447f (17535) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x308b] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 14869, Ack: 65373, Len: 386 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 14869 (relative sequence number) Next sequence number: 15255 (relative sequence number) Acknowledgement number: 65373 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16382 Checksum: 0x85e0 [incorrect, should be 0xa610] SEQ/ACK analysis This is an ACK to the segment in frame: 3054 The RTT to ACK the segment was: 0.000363000 seconds Data (386 bytes) 0000 bc ef 82 01 b5 fe 18 00 67 01 01 21 84 a5 32 0a ........g..!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 40 4b 87 4a a4 32 ee 20 o0O(~...@K.J.2. 0040 0f 15 7c 6c 9a 84 83 9a 99 cf 7d ab c3 4e 22 74 ..|l......}..N"t 0050 d4 f7 1d 2e 63 94 f5 ff 9d 4b 08 9d c6 5b 74 2d ....c....K...[t- 0060 0a 66 67 87 46 97 71 fe 85 6b 99 e4 cc 52 74 72 .fg.F.q..k...Rtr 0070 cb 33 61 a6 69 e7 c3 75 8d 4e 16 6e b3 32 e4 2e .3a.i..u.N.n.2.. 0080 9c 14 13 4d ad 84 8d 1a 85 f0 2e 8f d4 44 2c f4 ...M.........D,. 0090 5f 42 d6 ae 51 93 fc 7f bd 4b 52 df 78 32 18 c3 _B..Q....KR.x2.. 00a0 6f 14 57 aa 95 29 b2 7c 85 69 a9 64 dc 4e d0 22 o.W..).|.i.d.N." 00b0 ac 34 51 2a 59 94 00 f5 8d eb e5 ee 83 35 e4 20 .4Q*Y........5. 00c0 7f 14 23 79 7e 84 8d 9d 85 6b dd 0f e4 d4 ef 74 ..#y~....k.....t 00d0 7f 3e 25 2e 41 e4 3f ff 9d 49 42 f1 8b 32 18 d5 .>%.A.?..IB..2.. 00e0 ac 14 47 2f a5 84 71 fc 85 fe 7a e4 ec 4b d0 09 ..G/..q...z..K.. 00f0 6f 34 41 3e 8a 94 00 70 8d 4b 36 6e 93 86 27 a0 o4A>...p.K6n..'. 0100 1f 1e 33 48 cd 1d 4e 1a 85 6e cd 8f f4 4e 2c 68 ..3H..N..n...N,h 0110 dc 34 35 a4 31 94 fc f0 39 4b 32 74 9b 32 98 c1 .45.1...9K2t.2.. 0120 6f 84 73 ab b5 88 71 7e 85 6b c9 fc 3f 4e 50 86 o.s...q~.k..?NP. 0130 6f 34 b1 37 39 f8 c3 95 8d 41 46 0e e3 a8 86 40 o4.79....AF....@ 0140 7f 11 c3 29 dd 84 8d a5 46 6b bd e3 84 4e ac 63 ...)....Fk...N.c 0150 bc 34 c5 d4 21 94 fc ff 9d a6 e1 f1 eb 38 98 41 .4..!........8.A 0160 6f 08 03 a1 61 83 71 ee 85 6b d9 9c 28 49 50 09 o...a.q..k..(IP. 0170 6f 34 a1 ab 8d e9 00 14 8d 43 56 a2 f2 2e c0 dc o4.......CV..... 0180 82 01 .. No. Time Source Destination Protocol Info 3056 857.153426 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=65373 Ack=15255 Win=14904 Len=110 Frame 3056 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.911930000 Time delta from previous packet: 0.000454000 seconds Time since reference or first frame: 857.153426000 seconds Frame Number: 3056 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0x537e (21374) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x22a0 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 65373, Ack: 15255, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 65373 (relative sequence number) Next sequence number: 65483 (relative sequence number) Acknowledgement number: 15255 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14904 Checksum: 0xd0c4 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3055 The RTT to ACK the segment was: 0.000454000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 7b c7 32 0a ..n.....R..!{.2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf 99 96 6e 00 n.k(..q.....n. No. Time Source Destination Protocol Info 3057 857.153942 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=15255 Ack=65483 Win=16272 [TCP CHECKSUM INCORRECT] Len=382 Frame 3057 (436 bytes on wire, 436 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.912446000 Time delta from previous packet: 0.000516000 seconds Time since reference or first frame: 857.153942000 seconds Frame Number: 3057 Packet Length: 436 bytes Capture Length: 436 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 422 Identification: 0x4480 (17536) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x308e] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 15255, Ack: 65483, Len: 382 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 15255 (relative sequence number) Next sequence number: 15637 (relative sequence number) Acknowledgement number: 65483 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16272 Checksum: 0x85dc [incorrect, should be 0x5aa4] SEQ/ACK analysis This is an ACK to the segment in frame: 3056 The RTT to ACK the segment was: 0.000516000 seconds Data (382 bytes) 0000 bc ef 7e 01 b5 fe 18 00 64 01 00 21 1d 22 32 0a ..~.....d..!."2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 40 4b 87 4a a4 32 ee 20 o0O(~...@K.J.2. 0040 7e 15 7c 6c 9a 84 83 9a 1c a8 e1 0f c1 4e 3c 74 ~.|l.........N 4605 [PSH, ACK] Seq=65483 Ack=15637 Win=14522 Len=110 Frame 3058 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.912857000 Time delta from previous packet: 0.000411000 seconds Time since reference or first frame: 857.154353000 seconds Frame Number: 3058 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0x557e (21886) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x20a0 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 65483, Ack: 15637, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 65483 (relative sequence number) Next sequence number: 65593 (relative sequence number) Acknowledgement number: 15637 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14522 Checksum: 0x10c7 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3057 The RTT to ACK the segment was: 0.000411000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 4f bb 32 0a ..n.....R..!O.2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf 85 32 6e 00 n.k(..q....2n. No. Time Source Destination Protocol Info 3059 857.154725 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=15637 Ack=65593 Win=16162 [TCP CHECKSUM INCORRECT] Len=382 Frame 3059 (436 bytes on wire, 436 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.913229000 Time delta from previous packet: 0.000372000 seconds Time since reference or first frame: 857.154725000 seconds Frame Number: 3059 Packet Length: 436 bytes Capture Length: 436 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 422 Identification: 0x4481 (17537) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x308d] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 15637, Ack: 65593, Len: 382 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 15637 (relative sequence number) Next sequence number: 16019 (relative sequence number) Acknowledgement number: 65593 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16162 Checksum: 0x85dc [incorrect, should be 0x403f] SEQ/ACK analysis This is an ACK to the segment in frame: 3058 The RTT to ACK the segment was: 0.000372000 seconds Data (382 bytes) 0000 bc ef 7e 01 b5 fe 18 00 64 01 00 21 c5 02 32 0a ..~.....d..!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 40 4b 87 4a a4 32 ee 20 o0O(~...@K.J.2. 0040 01 15 7c 6c 9a 84 83 9a 0a af e1 0f c1 4e 3c 74 ..|l.........N 4605 [PSH, ACK] Seq=65593 Ack=16019 Win=14904 Len=110 Frame 3060 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.913612000 Time delta from previous packet: 0.000383000 seconds Time since reference or first frame: 857.155108000 seconds Frame Number: 3060 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0x577e (22398) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x1ea0 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 65593, Ack: 16019, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 65593 (relative sequence number) Next sequence number: 65703 (relative sequence number) Acknowledgement number: 16019 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14904 Checksum: 0x0d5d [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3059 The RTT to ACK the segment was: 0.000383000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 4f bb 32 0a ..n.....R..!O.2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf 85 32 6e 00 n.k(..q....2n. No. Time Source Destination Protocol Info 3061 857.155461 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=16019 Ack=65703 Win=17520 [TCP CHECKSUM INCORRECT] Len=386 Frame 3061 (440 bytes on wire, 440 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.913965000 Time delta from previous packet: 0.000353000 seconds Time since reference or first frame: 857.155461000 seconds Frame Number: 3061 Packet Length: 440 bytes Capture Length: 440 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 426 Identification: 0x4482 (17538) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3088] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 16019, Ack: 65703, Len: 386 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 16019 (relative sequence number) Next sequence number: 16405 (relative sequence number) Acknowledgement number: 65703 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x85e0 [incorrect, should be 0x9c6b] SEQ/ACK analysis This is an ACK to the segment in frame: 3060 The RTT to ACK the segment was: 0.000353000 seconds Data (386 bytes) 0000 bc ef 82 01 b5 fe 18 00 68 01 00 21 b2 82 32 0a ........h..!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 40 4b 87 4a a4 32 ee 20 o0O(~...@K.J.2. 0040 0e 15 7c 6c 9a 84 83 9a 99 cf 7d ab c3 4e 22 74 ..|l......}..N"t 0050 d4 f7 1d 2e 63 94 ff ff 9d 4b 14 db ab 9f db 59 ....c....K.....Y 0060 6f 16 67 2d 85 84 71 9d f6 18 f8 d4 fe 4e cc ad o.g-..q......N.. 0070 14 90 66 a8 67 94 73 b6 8d 4b 13 6e b3 32 e4 a0 ..f.g.s..K.n.2.. 0080 d1 d7 13 48 a8 84 8d 1a 85 6b 76 4c d4 4e 26 f4 ...H.....kvL.N&. 0090 5f 34 63 6d 51 94 fb 7f bd 4b 52 71 15 f1 18 c1 _4cmQ....KRq.... 00a0 6d 14 57 aa 95 84 dc bf 85 6b ab 64 dc 4e d0 89 m.W......k.d.N.. 00b0 c4 f7 51 28 5b 94 00 f5 8d 4b 86 2d 83 32 e3 20 ..Q([....K.-.2. 00c0 7f 14 23 c8 0c 47 8d 9a 82 6b dd 0f e4 4e b6 b7 ..#..G...k...N.. 00d0 7f 34 2f 2e 41 94 8c 3c 9d 4b 40 f1 8b 32 18 41 .4/.A..<.K@..2.A 00e0 fb d7 47 2a a0 84 71 fc 85 6b 2c 27 ec 4e d5 09 ..G*..q..k,'.N.. 00f0 6f 34 41 a8 df 57 00 75 88 4b 36 6e 93 32 50 63 o4A..W.u.K6n.2Pc 0100 1f 14 39 48 cd 84 14 d9 85 6b c8 8f f4 4e 2c f4 ..9H.....k...N,. 0110 83 f7 35 ae 3b 94 fc 7f 72 8f 32 71 9e 32 98 c1 ..5.;...r.2q.2.. 0120 6f 14 27 6f b5 84 7d 7e 85 6b c9 62 62 8d 50 83 o.'o..}~.k.bb.P. 0130 6a 34 b1 37 39 94 6c 56 8d 4b 4c 0e e3 32 fe a2 j4.79.lV.KL..2.. 0140 7f 14 c6 29 dd 84 8d f8 d8 a8 bd e9 8e 4e ac 1e ...).........N.. 0150 02 f7 c5 d1 24 94 fc ff 9d 4b cf 32 eb 32 92 41 ....$....K.2.2.A 0160 6f 14 bb 8f 4f 20 76 fe 95 6b d9 e2 f2 ea 57 03 o...O v..k....W. 0170 65 34 a1 b7 35 30 7d 15 8c 4b 5e 8e df 33 78 64 e4..50}..K^..3xd 0180 82 01 .. No. Time Source Destination Protocol Info 3062 857.155868 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=65703 Ack=16405 Win=14518 Len=110 Frame 3062 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.914372000 Time delta from previous packet: 0.000407000 seconds Time since reference or first frame: 857.155868000 seconds Frame Number: 3062 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0x597e (22910) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x1ca0 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 65703, Ack: 16405, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 65703 (relative sequence number) Next sequence number: 65813 (relative sequence number) Acknowledgement number: 16405 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14518 Checksum: 0x0eff [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3061 The RTT to ACK the segment was: 0.000407000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 da 36 32 0a ..n.....R..!.62. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf f8 a6 6e 00 n.k(..q.....n. No. Time Source Destination Protocol Info 3063 857.156219 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=16405 Ack=65813 Win=17410 [TCP CHECKSUM INCORRECT] Len=386 Frame 3063 (440 bytes on wire, 440 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.914723000 Time delta from previous packet: 0.000351000 seconds Time since reference or first frame: 857.156219000 seconds Frame Number: 3063 Packet Length: 440 bytes Capture Length: 440 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 426 Identification: 0x4483 (17539) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3087] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 16405, Ack: 65813, Len: 386 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 16405 (relative sequence number) Next sequence number: 16791 (relative sequence number) Acknowledgement number: 65813 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17410 Checksum: 0x85e0 [incorrect, should be 0x01d6] SEQ/ACK analysis This is an ACK to the segment in frame: 3062 The RTT to ACK the segment was: 0.000351000 seconds Data (386 bytes) 0000 bc ef 82 01 b5 fe 18 00 66 01 02 21 92 91 32 0a ........f..!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 40 4b 87 4a a4 32 ee 20 o0O(~...@K.J.2. 0040 0e 15 7c 6c 9a 84 83 9a 99 cf 7d ab c3 4e 22 74 ..|l......}..N"t 0050 d4 f7 16 2e 63 94 fc ff 9d 4b cf 32 b3 32 1a 41 ....c....K.2.2.A 0060 67 14 67 2a f3 e5 02 8f e4 5b ab e4 d0 ea ab ad g.g*.....[...... 0070 68 34 6f a8 1a 57 00 75 88 4b 16 6e b3 32 6a 63 h4o..W.u.K.n.2jc 0080 5f 14 16 48 ad 84 8d 1a 1e a8 ed 8f de 4e 2c f4 _..H.........N,. 0090 29 f7 15 ae 56 94 fc 7f bd 4b fc b2 bb 32 1a c1 )...V....K...2.. 00a0 6f 14 57 aa 38 47 71 7c 87 6b a9 64 dc 4e 7b 4a o.W.8Gq|.k.d.N{J 00b0 6f 34 53 28 59 94 00 f5 2d 88 26 ee 84 32 e4 20 o4S(Y...-.&..2. 00c0 7f 14 92 0b bd 84 8a 9a 85 6b dd 0f 7e 8d 2c 74 .........k..~.,t 00d0 75 34 25 2e 31 57 fc ff 9f 4b 42 f1 8b 32 8c 82 u4%.1W...KB..2.. 00e0 6f 14 42 2a a5 84 71 fc 10 a8 b9 e4 e9 4e d0 09 o.B*..q......N.. 00f0 6f 34 d7 6b 49 94 05 75 8d 4b 36 6e 27 f1 e4 a0 o4.kI..u.K6n'... 0100 15 14 33 48 54 47 8d 1a 80 6b cd 8f f4 4e b0 37 ..3HTG...k...N.7 0110 1f 34 3f ae 31 94 73 bb fd 4b 37 71 9b 32 98 c1 .4?.1.s..K7q.2.. 0120 ff d0 b7 ab b9 84 71 7e 85 6b 57 a1 fc 4e 55 83 ......q~.kW..NU. 0130 6f 34 b1 37 55 57 00 95 87 4b 46 0e 79 d0 64 40 o4.7UW...KF.y.d@ 0140 7a 14 c3 29 dd 84 d0 3b 85 6b b7 e9 84 4e d1 dd z..)...;.k...N.. 0150 7f 34 c0 d1 21 94 fc ff 70 88 22 f1 e1 32 98 41 .4..!...p."..2.A 0160 73 b0 2d 8f c2 84 61 fe 85 6b a7 46 8b 4e 5a 03 s.-...a..k.F.NZ. 0170 6f 34 bd 13 54 94 01 15 85 4b 7a 8f ef 96 1c a4 o4..T....Kz..... 0180 82 01 .. No. Time Source Destination Protocol Info 3064 857.156623 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=65813 Ack=16791 Win=14904 Len=110 Frame 3064 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.915127000 Time delta from previous packet: 0.000404000 seconds Time since reference or first frame: 857.156623000 seconds Frame Number: 3064 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0x5b7e (23422) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x1aa0 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 65813, Ack: 16791, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 65813 (relative sequence number) Next sequence number: 65923 (relative sequence number) Acknowledgement number: 16791 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14904 Checksum: 0xc90c [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3063 The RTT to ACK the segment was: 0.000404000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 69 c7 32 0a ..n.....R..!i.2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf ab 96 6e 00 n.k(..q.....n. No. Time Source Destination Protocol Info 3065 857.156990 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=16791 Ack=65923 Win=17300 [TCP CHECKSUM INCORRECT] Len=386 Frame 3065 (440 bytes on wire, 440 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.915494000 Time delta from previous packet: 0.000367000 seconds Time since reference or first frame: 857.156990000 seconds Frame Number: 3065 Packet Length: 440 bytes Capture Length: 440 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 426 Identification: 0x4484 (17540) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3086] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 16791, Ack: 65923, Len: 386 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 16791 (relative sequence number) Next sequence number: 17177 (relative sequence number) Acknowledgement number: 65923 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17300 Checksum: 0x85e0 [incorrect, should be 0x9ee2] SEQ/ACK analysis This is an ACK to the segment in frame: 3064 The RTT to ACK the segment was: 0.000367000 seconds Data (386 bytes) 0000 bc ef 82 01 b5 fe 18 00 66 01 02 21 d1 ca 32 0a ........f..!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 40 4b 87 4a a4 32 ee 20 o0O(~...@K.J.2. 0040 0f 15 7c 6c 9a 84 83 9a 99 cf 7d ab c3 4e 22 74 ..|l......}..N"t 0050 d4 f7 1d 2e 63 94 f4 ff 9d 4b 14 90 d8 41 79 71 ....c....K...Ayq 0060 5d 14 ca e9 96 84 73 fc 85 6b 99 e4 d0 ea ab ad ].....s..k...... 0070 68 34 6f a8 1a 57 00 75 88 4b 16 6e b3 32 6a 63 h4o..W.u.K.n.2jc 0080 5f 14 16 48 ad 84 8d 1a 1e a8 ed 8f de 4e 2c f4 _..H.........N,. 0090 29 f7 15 ae 56 94 fc 7f bd 4b fc b2 bb 32 1a c1 )...V....K...2.. 00a0 6f 14 57 aa 38 47 71 7c 87 6b a9 64 dc 4e 7b 4a o.W.8Gq|.k.d.N{J 00b0 6f 34 53 28 59 94 00 f5 2d 88 26 ee 84 32 e4 20 o4S(Y...-.&..2. 00c0 7f 14 92 0b bd 84 8a 9a 85 6b dd 0f 7e 8d 2c 74 .........k..~.,t 00d0 75 34 25 2e 31 57 fc ff 9f 4b 42 f1 8b 32 8c 82 u4%.1W...KB..2.. 00e0 6f 14 42 2a a5 84 71 fc 10 a8 b9 e4 e9 4e d0 09 o.B*..q......N.. 00f0 6f 34 d7 6b 49 94 05 75 8d 4b 36 6e 27 f1 e4 a0 o4.kI..u.K6n'... 0100 15 14 33 48 54 47 8d 1a 80 6b cd 8f f4 4e b0 37 ..3HTG...k...N.7 0110 1f 34 3f ae 31 94 73 bb fd 4b 37 71 9b 32 98 c1 .4?.1.s..K7q.2.. 0120 ff d0 b7 ab b9 84 71 7e 85 6b 57 a1 fc 4e 55 83 ......q~.kW..NU. 0130 6f 34 b1 37 55 57 00 95 87 4b 46 0e 79 d0 64 40 o4.7UW...KF.y.d@ 0140 7a 14 c3 29 dd 84 d0 3b 85 6b b7 e9 84 4e d1 dd z..)...;.k...N.. 0150 7f 34 c0 d1 21 94 fc ff 70 88 22 f1 e1 32 98 41 .4..!...p."..2.A 0160 73 b0 2d 8f c2 84 61 fe 85 6b a7 46 8b 4e 5a 03 s.-...a..k.F.NZ. 0170 6f 34 bd 13 54 94 01 15 85 4b 7a 8f ef 96 78 64 o4..T....Kz...xd 0180 82 01 .. No. Time Source Destination Protocol Info 3066 857.157392 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=65923 Ack=17177 Win=14518 Len=110 Frame 3066 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.915896000 Time delta from previous packet: 0.000402000 seconds Time since reference or first frame: 857.157392000 seconds Frame Number: 3066 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0x5d7e (23934) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x18a0 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 65923, Ack: 17177, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 65923 (relative sequence number) Next sequence number: 66033 (relative sequence number) Acknowledgement number: 17177 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14518 Checksum: 0xc89e [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3065 The RTT to ACK the segment was: 0.000402000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 7b c7 32 0a ..n.....R..!{.2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf 99 96 6e 00 n.k(..q.....n. No. Time Source Destination Protocol Info 3067 857.157738 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=17177 Ack=66033 Win=17190 [TCP CHECKSUM INCORRECT] Len=166 Frame 3067 (220 bytes on wire, 220 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.916242000 Time delta from previous packet: 0.000346000 seconds Time since reference or first frame: 857.157738000 seconds Frame Number: 3067 Packet Length: 220 bytes Capture Length: 220 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 206 Identification: 0x4485 (17541) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3161] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 17177, Ack: 66033, Len: 166 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 17177 (relative sequence number) Next sequence number: 17343 (relative sequence number) Acknowledgement number: 66033 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17190 Checksum: 0x8504 [incorrect, should be 0xc601] SEQ/ACK analysis This is an ACK to the segment in frame: 3066 The RTT to ACK the segment was: 0.000346000 seconds Data (166 bytes) 0000 bc ef a6 00 b5 fe 18 00 8a 00 02 21 f3 ba 32 0a ...........!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 c7 4a 87 4a a4 32 ee 20 o0O(~....J.J.2. 0040 0c 15 7c 6c 9a 84 83 9a 6e a8 e1 0f c1 4e 3c 74 ..|l....n....N 4605 [PSH, ACK] Seq=66033 Ack=17343 Win=14904 Len=110 Frame 3068 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.916578000 Time delta from previous packet: 0.000336000 seconds Time since reference or first frame: 857.158074000 seconds Frame Number: 3068 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0x5f7e (24446) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x16a0 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 66033, Ack: 17343, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 66033 (relative sequence number) Next sequence number: 66143 (relative sequence number) Acknowledgement number: 17343 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14904 Checksum: 0x0679 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3067 The RTT to ACK the segment was: 0.000336000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 4f bb 32 0a ..n.....R..!O.2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf 85 32 6e 00 n.k(..q....2n. No. Time Source Destination Protocol Info 3069 857.158430 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=17343 Ack=66143 Win=17080 [TCP CHECKSUM INCORRECT] Len=230 Frame 3069 (284 bytes on wire, 284 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.916934000 Time delta from previous packet: 0.000356000 seconds Time since reference or first frame: 857.158430000 seconds Frame Number: 3069 Packet Length: 284 bytes Capture Length: 284 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 270 Identification: 0x4486 (17542) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3120] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 17343, Ack: 66143, Len: 230 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 17343 (relative sequence number) Next sequence number: 17573 (relative sequence number) Acknowledgement number: 66143 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17080 Checksum: 0x8544 [incorrect, should be 0x5485] SEQ/ACK analysis This is an ACK to the segment in frame: 3068 The RTT to ACK the segment was: 0.000356000 seconds Data (230 bytes) 0000 bc ef e6 00 b5 fe 18 00 ca 00 02 21 a0 3d 32 0a ...........!.=2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a a3 bc 76 aa 3b b1 23 76 a.elr.....v.;.#v 0030 7f 34 71 28 07 30 07 f5 87 4b 62 ee 22 96 e3 20 .4q(.0...Kb.".. 0040 75 14 03 c8 12 20 8a 9a 92 6b fd 0f c4 4e cb d0 u.... ...k...N.. 0050 78 34 09 2e 9e 6b 03 00 68 ef 65 f1 a5 32 08 e5 x4...k..h.e..2.. 0060 68 14 6d 2a a1 84 08 58 82 6b 93 e4 cc 4a 92 ad h.m*...X.k...J.. 0070 68 34 6b a8 69 94 3e 75 8a 4b 1c 6e f9 33 99 04 h4k.i.>u.K.n.3.. 0080 58 14 1f 48 ad 84 8d 1a fa cf ea 8f da 4e c7 37 X..H.........N.7 0090 43 34 10 ae 41 94 fc 7f de 4b 33 71 95 32 7b c1 C4..A....K3q.2{. 00a0 00 14 3a aa 95 84 71 7c 99 cf 29 c0 db 4e de 89 ..:...q|..)..N.. 00b0 84 f7 4d 28 5c 94 10 f5 8d 4b 45 ee e2 32 ca 20 ..M(\....KE..2. 00c0 1c 14 4c c8 d0 84 8d 9a 85 6b c1 ab 65 ea 2b 74 ..L......k..e.+t 00d0 75 34 56 2f 5d 30 e0 5b e0 4b 43 f1 83 32 34 40 u4V/]0.[.KC..24@ 00e0 73 b0 05 00 e6 00 s..... No. Time Source Destination Protocol Info 3070 857.158775 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=66143 Ack=17573 Win=14674 Len=102 Frame 3070 (156 bytes on wire, 156 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.917279000 Time delta from previous packet: 0.000345000 seconds Time since reference or first frame: 857.158775000 seconds Frame Number: 3070 Packet Length: 156 bytes Capture Length: 156 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 142 Identification: 0x617e (24958) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x14a8 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 66143, Ack: 17573, Len: 102 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 66143 (relative sequence number) Next sequence number: 66245 (relative sequence number) Acknowledgement number: 17573 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14674 Checksum: 0xf452 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3069 The RTT to ACK the segment was: 0.000345000 seconds Data (102 bytes) 0000 bc ef 66 00 b5 fe 18 00 4a 00 02 21 24 a8 32 0a ..f.....J..!$.2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 73 99 e1 42 ..<*qC..f...s..B 0020 6b 04 5d 8a 72 b4 0b f0 fb 18 0c f0 36 b1 2f 74 k.].r.......6./t 0030 47 90 76 2e 7d 94 8f 5b 8a 4b 11 f0 a3 32 e4 42 G.v.}..[.K...2.B 0040 98 b0 04 2e 91 84 a3 3b 86 6b d5 55 c3 4e 28 72 .......;.k.U.N(r 0050 57 90 02 30 65 94 8e 3d 9c 4b 6e 0f a5 63 18 43 W..0e..=.Kn..c.C 0060 73 b0 6d 28 66 00 s.m(f. No. Time Source Destination Protocol Info 3071 857.159262 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=17573 Ack=66245 Win=16978 [TCP CHECKSUM INCORRECT] Len=74 Frame 3071 (128 bytes on wire, 128 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.917766000 Time delta from previous packet: 0.000487000 seconds Time since reference or first frame: 857.159262000 seconds Frame Number: 3071 Packet Length: 128 bytes Capture Length: 128 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 114 Identification: 0x4487 (17543) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x31bb] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 17573, Ack: 66245, Len: 74 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 17573 (relative sequence number) Next sequence number: 17647 (relative sequence number) Acknowledgement number: 66245 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16978 Checksum: 0x84a8 [incorrect, should be 0xe83c] SEQ/ACK analysis This is an ACK to the segment in frame: 3070 The RTT to ACK the segment was: 0.000487000 seconds Data (74 bytes) 0000 bc ef 4a 00 b5 fe 18 00 30 00 00 21 43 7f 32 0a ..J.....0..!C.2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a a0 bc 8a aa 3b b1 25 76 a.elr.......;.%v 0030 6f 34 96 8c 7e 94 0c f5 a3 80 05 ee bf 96 99 20 o4..~.......... 0040 7e 14 0b c8 b1 85 91 3e 4a 00 ~......>J. No. Time Source Destination Protocol Info 3072 857.159464 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=66245 Ack=17647 Win=14600 Len=66 Frame 3072 (120 bytes on wire, 120 bytes captured) Arrival Time: Nov 11, 2005 16:44:25.917968000 Time delta from previous packet: 0.000202000 seconds Time since reference or first frame: 857.159464000 seconds Frame Number: 3072 Packet Length: 120 bytes Capture Length: 120 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 106 Identification: 0x637e (25470) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x12cc [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 66245, Ack: 17647, Len: 66 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 66245 (relative sequence number) Next sequence number: 66311 (relative sequence number) Acknowledgement number: 17647 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14600 Checksum: 0xfe30 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3071 The RTT to ACK the segment was: 0.000202000 seconds Data (66 bytes) 0000 bc ef 42 00 b5 fe 18 00 28 00 00 21 e9 33 32 0a ..B.....(..!.32. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 73 99 e1 42 ..<*qC..f...s..B 0020 6b 04 5d 8a 72 b4 0b f0 ad 18 0c f0 38 b1 07 d0 k.].r.......8... 0030 68 34 75 2e 0b 30 01 ff 81 4b 06 f0 a3 32 f8 e6 h4u..0...K...2.. 0040 42 00 B. No. Time Source Destination Protocol Info 3073 857.332841 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=17647 Ack=66311 Win=16912 [TCP CHECKSUM INCORRECT] Len=0 Frame 3073 (54 bytes on wire, 54 bytes captured) Arrival Time: Nov 11, 2005 16:44:26.091345000 Time delta from previous packet: 0.173377000 seconds Time since reference or first frame: 857.332841000 seconds Frame Number: 3073 Packet Length: 54 bytes Capture Length: 54 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x448c (17548) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x3200] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 17647, Ack: 66311, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 17647 (relative sequence number) Acknowledgement number: 66311 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16912 Checksum: 0x845e [incorrect, should be 0x1475] SEQ/ACK analysis This is an ACK to the segment in frame: 3072 The RTT to ACK the segment was: 0.173377000 seconds No. Time Source Destination Protocol Info 3405 914.184174 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=17647 Ack=66311 Win=16912 [TCP CHECKSUM INCORRECT] Len=374 Frame 3405 (428 bytes on wire, 428 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.942678000 Time delta from previous packet: 56.851333000 seconds Time since reference or first frame: 914.184174000 seconds Frame Number: 3405 Packet Length: 428 bytes Capture Length: 428 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 414 Identification: 0x488a (18570) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2c8c] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 17647, Ack: 66311, Len: 374 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 17647 (relative sequence number) Next sequence number: 18021 (relative sequence number) Acknowledgement number: 66311 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16912 Checksum: 0x85d4 [incorrect, should be 0xe9c1] Data (374 bytes) 0000 bc ef 76 01 b5 fe 18 00 5c 01 00 21 a2 19 32 0a ..v.....\..!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 40 4b 87 4a a4 32 ee 20 o0O(~...@K.J.2. 0040 7e 15 7c 6c 9a 84 83 9a 1c a8 e1 0f c1 4e 24 74 ~.|l.........N$t 0050 7f 34 75 2e 02 94 8f ff 9d 4b 7e 55 2b 96 1f 41 .4u......K~U+..A 0060 61 14 7b 8e fe 20 76 fc 8b 6b ea 27 cc 4e d5 09 a.{.. v..k.'.N.. 0070 6f 34 61 a8 e7 57 00 75 88 4b 16 6e b3 32 7f 63 o4a..W.u.K.n.2.c 0080 5f 14 19 48 ad 84 fb d9 85 6b ea 8f d4 4e 2c f4 _..H.....k...N,. 0090 f1 f7 15 ae 53 94 fc 7f bd 4b ff b2 bb 32 1a c1 ....S....K...2.. 00a0 6f 14 57 aa 3e 47 71 7c 87 6b a9 64 dc 4e 70 4a o.W.>Gq|.k.d.NpJ 00b0 6f 34 56 28 59 94 00 f5 3c 88 26 ee 84 32 e4 20 o4V(Y...<.&..2. 00c0 7f 14 b9 0b bd 84 87 9a 85 6b ad cc e4 4e 2e 74 .........k...N.t 00d0 7f 34 25 2e d5 57 fc ff 98 4b 42 f1 8b 32 8d 82 .4%..W...KB..2.. 00e0 6f 14 42 2a a5 84 71 fc 13 a8 b9 e4 e9 4e d0 09 o.B*..q......N.. 00f0 6f 34 f5 6b 49 94 0a 75 8d 4b af ad 93 32 e1 a0 o4.kI..u.K...2.. 0100 1f 14 33 48 51 47 8d 1a 8f 6b cd 8f 7b 8a 2c f4 ..3HQG...k..{.,. 0110 1a 34 35 ae 31 94 6c bb fd 4b 3e 71 9b 32 98 c1 .45.1.l..K>q.2.. 0120 f1 d7 b7 ab b0 84 71 7e 85 6b a5 a1 fc 4e 5a 83 ......q~.k...NZ. 0130 6f 34 2b d5 39 94 05 95 8d 4b 46 0e be f1 64 40 o4+.9....KF...d@ 0140 75 14 c3 29 a0 47 8d f8 80 6b bd e9 84 4e 41 dd u..).G...k...NA. 0150 7f 34 cf d1 21 94 e0 5b 17 ef 25 f1 fb 32 98 41 .4..!..[..%..2.A 0160 11 b0 a0 2b cf 84 71 fe 99 cf a4 e2 8d 4e 58 03 ...+..q......NX. 0170 43 35 bd 13 76 01 C5..v. No. Time Source Destination Protocol Info 3406 914.184590 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=66311 Ack=18021 Win=16364 Len=0 Frame 3406 (60 bytes on wire, 60 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.943094000 Time delta from previous packet: 0.000416000 seconds Time since reference or first frame: 914.184590000 seconds Frame Number: 3406 Packet Length: 60 bytes Capture Length: 60 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Trailer: 000000000000 Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0xe08e (57486) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x95fd [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 66311, Ack: 18021, Len: 0 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 66311 (relative sequence number) Acknowledgement number: 18021 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16364 Checksum: 0x1523 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3405 The RTT to ACK the segment was: 0.000416000 seconds No. Time Source Destination Protocol Info 3407 914.184910 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=66311 Ack=18021 Win=16364 Len=110 Frame 3407 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.943414000 Time delta from previous packet: 0.000320000 seconds Time since reference or first frame: 914.184910000 seconds Frame Number: 3407 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0xe18e (57742) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x948f [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 66311, Ack: 18021, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 66311 (relative sequence number) Next sequence number: 66421 (relative sequence number) Acknowledgement number: 18021 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16364 Checksum: 0x3f19 [correct] Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 a8 87 32 0a ..n.....R..!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf ea 55 6e 00 n.k(..q....Un. No. Time Source Destination Protocol Info 3408 914.185549 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=18021 Ack=66421 Win=16802 [TCP CHECKSUM INCORRECT] Len=374 Frame 3408 (428 bytes on wire, 428 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.944053000 Time delta from previous packet: 0.000639000 seconds Time since reference or first frame: 914.185549000 seconds Frame Number: 3408 Packet Length: 428 bytes Capture Length: 428 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 414 Identification: 0x488b (18571) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2c8b] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 18021, Ack: 66421, Len: 374 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 18021 (relative sequence number) Next sequence number: 18395 (relative sequence number) Acknowledgement number: 66421 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x85d4 [incorrect, should be 0xce1f] SEQ/ACK analysis This is an ACK to the segment in frame: 3407 The RTT to ACK the segment was: 0.000639000 seconds Data (374 bytes) 0000 bc ef 76 01 b5 fe 18 00 5c 01 00 21 4b 3f 32 0a ..v.....\..!K?2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 40 4b 87 4a a4 32 ee 20 o0O(~...@K.J.2. 0040 01 15 7c 6c 9a 84 83 9a 0a af e1 0f c1 4e 24 74 ..|l.........N$t 0050 7f 34 75 2e 02 94 8f ff 9d 4b 7e 55 2b 96 1f 41 .4u......K~U+..A 0060 61 14 7b 8e fe 20 76 fc 8b 6b ea 27 cc 4e d5 09 a.{.. v..k.'.N.. 0070 6f 34 61 a8 e7 57 00 75 88 4b 16 6e b3 32 7f 63 o4a..W.u.K.n.2.c 0080 5f 14 19 48 ad 84 fb d9 85 6b ea 8f d4 4e 2c f4 _..H.....k...N,. 0090 f1 f7 15 ae 53 94 fc 7f bd 4b ff b2 bb 32 1a c1 ....S....K...2.. 00a0 6f 14 57 aa 3e 47 71 7c 87 6b a9 64 dc 4e 70 4a o.W.>Gq|.k.d.NpJ 00b0 6f 34 56 28 59 94 00 f5 3c 88 26 ee 84 32 e4 20 o4V(Y...<.&..2. 00c0 7f 14 b9 0b bd 84 87 9a 85 6b ad cc e4 4e 2e 74 .........k...N.t 00d0 7f 34 25 2e d5 57 fc ff 98 4b 42 f1 8b 32 8d 82 .4%..W...KB..2.. 00e0 6f 14 42 2a a5 84 71 fc 13 a8 b9 e4 e9 4e d0 09 o.B*..q......N.. 00f0 6f 34 f5 6b 49 94 0a 75 8d 4b af ad 93 32 e1 a0 o4.kI..u.K...2.. 0100 1f 14 33 48 51 47 8d 1a 8f 6b cd 8f 7b 8a 2c f4 ..3HQG...k..{.,. 0110 1a 34 35 ae 31 94 6c bb fd 4b 3e 71 9b 32 98 c1 .45.1.l..K>q.2.. 0120 f1 d7 b7 ab b0 84 71 7e 85 6b a5 a1 fc 4e 5a 83 ......q~.k...NZ. 0130 6f 34 2b d5 39 94 05 95 8d 4b 46 0e be f1 64 40 o4+.9....KF...d@ 0140 75 14 c3 29 a0 47 8d f8 80 6b bd e9 84 4e 41 dd u..).G...k...NA. 0150 7f 34 cf d1 21 94 e0 5b 17 ef 25 f1 fb 32 98 41 .4..!..[..%..2.A 0160 11 b0 a0 2b cf 84 71 fe 99 cf a4 e2 8d 4e 58 03 ...+..q......NX. 0170 43 35 bd 13 76 01 C5..v. No. Time Source Destination Protocol Info 3409 914.185959 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=66421 Ack=18395 Win=15990 Len=110 Frame 3409 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.944463000 Time delta from previous packet: 0.000410000 seconds Time since reference or first frame: 914.185959000 seconds Frame Number: 3409 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0xe38e (58254) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x928f [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 66421, Ack: 18395, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 66421 (relative sequence number) Next sequence number: 66531 (relative sequence number) Acknowledgement number: 18395 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 15990 Checksum: 0x3eab [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3408 The RTT to ACK the segment was: 0.000410000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 a8 87 32 0a ..n.....R..!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf ea 55 6e 00 n.k(..q....Un. No. Time Source Destination Protocol Info 3410 914.186443 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=18395 Ack=66531 Win=16692 [TCP CHECKSUM INCORRECT] Len=382 Frame 3410 (436 bytes on wire, 436 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.944947000 Time delta from previous packet: 0.000484000 seconds Time since reference or first frame: 914.186443000 seconds Frame Number: 3410 Packet Length: 436 bytes Capture Length: 436 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 422 Identification: 0x488c (18572) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2c82] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 18395, Ack: 66531, Len: 382 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 18395 (relative sequence number) Next sequence number: 18777 (relative sequence number) Acknowledgement number: 66531 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16692 Checksum: 0x85dc [incorrect, should be 0x8cea] SEQ/ACK analysis This is an ACK to the segment in frame: 3409 The RTT to ACK the segment was: 0.000484000 seconds Data (382 bytes) 0000 bc ef 7e 01 b5 fe 18 00 64 01 00 21 23 41 32 0a ..~.....d..!#A2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 40 4b 87 4a a4 32 ee 20 o0O(~...@K.J.2. 0040 0e 15 7c 6c 9a 84 83 9a 99 cf 7d ab c3 4e 22 74 ..|l......}..N"t 0050 d4 f7 1d 2e 63 94 ff ff 9d 4b 12 db ab 9f db 59 ....c....K.....Y 0060 6f 16 67 29 85 84 71 9f f6 6b 85 40 b7 ea d7 09 o.g)..q..k.@.... 0070 61 34 12 6b 69 94 05 75 8d 4b 16 6e 3d f1 e4 a0 a4.ki..u.K.n=... 0080 5a 14 13 48 ad 84 16 d9 85 6b e7 8f d4 4e 5a 37 Z..H.....k...NZ7 0090 5f 34 12 ae 51 94 fc 7f 13 88 52 71 b9 32 18 c1 _4..Q.....Rq.2.. 00a0 6f 14 fa 69 95 84 73 7c 85 6b a9 64 77 8d d0 89 o..i..s|.k.dw... 00b0 6d 34 51 28 59 94 a0 36 8d 4b 21 ee 83 32 e4 20 m4Q(Y..6.K!..2. 00c0 ce d7 23 c8 ba 84 8d 9a 85 6b 47 cc e4 4e 26 74 ..#......kG..N&t 00d0 7f 34 55 ed 41 94 fe ff 9d 4b 42 f1 1f f1 18 41 .4U.A....KB....A 00e0 6a 14 47 2a a5 84 e4 3f 85 6b bc e4 ec 4e d0 09 j.G*...?.k...N.. 00f0 f9 f7 41 a8 4c 94 00 75 8d 4b 82 ad 93 32 ee a0 ..A.L..u.K...2.. 0100 1f 14 aa 8b cd 84 88 1a 85 6b cd 8f 68 8d 2c f4 .........k..h.,. 0110 15 34 35 ae be 50 fc 7f f8 4b 32 71 9b 32 08 05 .45..P...K2q.2.. 0120 6f 14 bb ab b5 84 71 7e 1b a8 c9 62 f9 4e 50 83 o.....q~...b.NP. 0130 6f 34 dd f4 39 94 0a 95 8d 4b dc ec e3 32 61 40 o4..9....K...2a@ 0140 7f 14 c3 29 80 47 8d f8 8f 6b bd e9 f9 8d ac 1e ...).G...k...... 0150 7a 34 c5 d1 21 94 11 3c 9d 4b 28 f1 eb 32 84 e5 z4..!..<.K(..2.. 0160 e5 b0 a0 2b d5 84 71 fe fb cf de e2 86 4e 50 03 ...+..q......NP. 0170 73 90 dc b7 28 94 08 15 a1 4a 4a 2a 7e 01 s...(....JJ*~. No. Time Source Destination Protocol Info 3411 914.186864 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=66531 Ack=18777 Win=16364 Len=110 Frame 3411 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.945368000 Time delta from previous packet: 0.000421000 seconds Time since reference or first frame: 914.186864000 seconds Frame Number: 3411 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0xe58e (58766) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x908f [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 66531, Ack: 18777, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 66531 (relative sequence number) Next sequence number: 66641 (relative sequence number) Acknowledgement number: 18777 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16364 Checksum: 0xf938 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3410 The RTT to ACK the segment was: 0.000421000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 4f bb 32 0a ..n.....R..!O.2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf 85 32 6e 00 n.k(..q....2n. No. Time Source Destination Protocol Info 3412 914.187687 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=18777 Ack=66641 Win=16582 [TCP CHECKSUM INCORRECT] Len=382 Frame 3412 (436 bytes on wire, 436 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.946191000 Time delta from previous packet: 0.000823000 seconds Time since reference or first frame: 914.187687000 seconds Frame Number: 3412 Packet Length: 436 bytes Capture Length: 436 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 422 Identification: 0x488d (18573) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2c81] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 18777, Ack: 66641, Len: 382 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 18777 (relative sequence number) Next sequence number: 19159 (relative sequence number) Acknowledgement number: 66641 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16582 Checksum: 0x85dc [incorrect, should be 0x85a5] SEQ/ACK analysis This is an ACK to the segment in frame: 3411 The RTT to ACK the segment was: 0.000823000 seconds Data (382 bytes) 0000 bc ef 7e 01 b5 fe 18 00 62 01 02 21 d9 75 32 0a ..~.....b..!.u2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 40 4b 87 4a a4 32 ee 20 o0O(~...@K.J.2. 0040 0e 15 7c 6c 9a 84 83 9a 99 cf 7d ab c3 4e 22 74 ..|l......}..N"t 0050 d4 f7 16 2e 63 94 fc ff 9d 4b cf 32 b3 32 1a 41 ....c....K.2.2.A 0060 6b 14 67 2a f5 e7 02 fc 99 cf e2 40 cb 4e de 09 k.g*.......@.N.. 0070 1c f7 61 a8 6c 94 00 75 8d 4b 98 ad b3 32 e1 a0 ..a.l..u.K...2.. 0080 5f 14 13 48 36 47 8d 1a 8f 6b ed 8f a2 8d 2c f4 _..H6G...k....,. 0090 58 34 15 ae 51 94 52 bc bd 4b 50 71 bb 32 18 c1 X4..Q.R..KPq.2.. 00a0 c2 d7 57 aa 97 84 71 7c 85 6b 02 a7 dc 4e d2 89 ..W...q|.k...N.. 00b0 6f 34 51 28 f9 57 00 f5 8a 4b 26 ee 83 32 55 e3 o4Q(.W...K&..2U. 00c0 7f 14 24 c8 bd 84 8d 9a 1f a8 dd 0f ee 4e 2c 74 ..$..........N,t 00d0 0f f7 25 2e 43 94 fc ff 9d 4b d6 32 8b 32 1d 41 ..%.C....K.2.2.A 00e0 6f 14 47 2a 30 47 71 fc 80 6b b9 e4 ec 4e 46 ca o.G*0Gq..k...NF. 00f0 6f 34 44 a8 49 94 00 75 39 88 36 6e 99 32 e4 a0 o4D.I..u9.6n.2.. 0100 86 d7 33 48 c8 84 8d 1a 85 6b 51 4c f4 4e 26 f4 ..3H.....kQL.N&. 0110 1f 34 ba 6a 31 94 f9 7f fd 4b 32 71 0b f6 98 c1 .4.j1....K2q.... 0120 63 14 b7 ab b5 84 ef bd 85 6b cc 62 fc 4e 50 83 c........k.b.NP. 0130 03 f7 b1 37 33 94 00 95 17 a9 46 0e e6 32 64 40 ...73.....F..2d@ 0140 7f 14 9e ea dd 84 87 f8 85 6b c0 2a 84 4e a9 1e .........k.*.N.. 0150 7f 34 c5 d1 cc 57 fc ff 97 4b 22 f1 f7 96 12 e5 .4...W...K"..... 0160 68 14 b7 2b c5 84 0f 5a 82 6b d3 e2 8c 4e 4c a7 h..+...Z.k...NL. 0170 12 34 a0 b7 21 94 2c 14 91 ef 1c a4 7e 01 .4..!.,.....~. No. Time Source Destination Protocol Info 3413 914.188101 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=66641 Ack=19159 Win=15982 Len=110 Frame 3413 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.946605000 Time delta from previous packet: 0.000414000 seconds Time since reference or first frame: 914.188101000 seconds Frame Number: 3413 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0xe78e (59278) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x8e8f [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 66641, Ack: 19159, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 66641 (relative sequence number) Next sequence number: 66751 (relative sequence number) Acknowledgement number: 19159 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 15982 Checksum: 0x3acb [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3412 The RTT to ACK the segment was: 0.000414000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 b0 ba 32 0a ..n.....R..!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf e2 32 6e 00 n.k(..q....2n. No. Time Source Destination Protocol Info 3414 914.189126 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=19159 Ack=66751 Win=16472 [TCP CHECKSUM INCORRECT] Len=382 Frame 3414 (436 bytes on wire, 436 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.947630000 Time delta from previous packet: 0.001025000 seconds Time since reference or first frame: 914.189126000 seconds Frame Number: 3414 Packet Length: 436 bytes Capture Length: 436 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 422 Identification: 0x488e (18574) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2c80] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 19159, Ack: 66751, Len: 382 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 19159 (relative sequence number) Next sequence number: 19541 (relative sequence number) Acknowledgement number: 66751 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16472 Checksum: 0x85dc [incorrect, should be 0x0d75] SEQ/ACK analysis This is an ACK to the segment in frame: 3413 The RTT to ACK the segment was: 0.001025000 seconds Data (382 bytes) 0000 bc ef 7e 01 b5 fe 18 00 62 01 02 21 0d 64 32 0a ..~.....b..!.d2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 40 4b 87 4a a4 32 ee 20 o0O(~...@K.J.2. 0040 0f 15 7c 6c 9a 84 83 9a 99 cf 7d ab c3 4e 22 74 ..|l......}..N"t 0050 d4 f7 1d 2e 63 94 f8 ff 9d 4b 12 92 d8 32 b5 82 ....c....K...2.. 0060 7c 14 65 2a 85 84 71 fc 99 cf e2 40 cb 4e de 09 |.e*..q....@.N.. 0070 1c f7 61 a8 6c 94 00 75 8d 4b 98 ad b3 32 e1 a0 ..a.l..u.K...2.. 0080 5f 14 13 48 36 47 8d 1a 8f 6b ed 8f a2 8d 2c f4 _..H6G...k....,. 0090 58 34 15 ae 51 94 52 bc bd 4b 50 71 bb 32 18 c1 X4..Q.R..KPq.2.. 00a0 c2 d7 57 aa 97 84 71 7c 85 6b 02 a7 dc 4e d2 89 ..W...q|.k...N.. 00b0 6f 34 51 28 f9 57 00 f5 8a 4b 26 ee 83 32 55 e3 o4Q(.W...K&..2U. 00c0 7f 14 24 c8 bd 84 8d 9a 1f a8 dd 0f ee 4e 2c 74 ..$..........N,t 00d0 0f f7 25 2e 43 94 fc ff 9d 4b d6 32 8b 32 1d 41 ..%.C....K.2.2.A 00e0 6f 14 47 2a 30 47 71 fc 80 6b b9 e4 ec 4e 46 ca o.G*0Gq..k...NF. 00f0 6f 34 44 a8 49 94 00 75 39 88 36 6e 99 32 e4 a0 o4D.I..u9.6n.2.. 0100 86 d7 33 48 c8 84 8d 1a 85 6b 51 4c f4 4e 26 f4 ..3H.....kQL.N&. 0110 1f 34 ba 6a 31 94 f9 7f fd 4b 32 71 0b f6 98 c1 .4.j1....K2q.... 0120 63 14 b7 ab b5 84 ef bd 85 6b cc 62 fc 4e 50 83 c........k.b.NP. 0130 03 f7 b1 37 33 94 00 95 17 a9 46 0e e6 32 64 40 ...73.....F..2d@ 0140 7f 14 9e ea dd 84 87 f8 85 6b c0 2a 84 4e a9 1e .........k.*.N.. 0150 7f 34 c5 d1 cc 57 fc ff 97 4b 22 f1 f7 96 12 e5 .4...W...K"..... 0160 68 14 b7 2b c5 84 0f 5a 82 6b d3 e2 8c 4e 4c a7 h..+...Z.k...NL. 0170 12 34 a0 b7 21 94 2c 14 91 ef 4a 2a 7e 01 .4..!.,...J*~. No. Time Source Destination Protocol Info 3415 914.189559 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=66751 Ack=19541 Win=16364 Len=110 Frame 3415 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.948063000 Time delta from previous packet: 0.000433000 seconds Time since reference or first frame: 914.189559000 seconds Frame Number: 3415 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0xe98e (59790) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x8c8f [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 66751, Ack: 19541, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 66751 (relative sequence number) Next sequence number: 66861 (relative sequence number) Acknowledgement number: 19541 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16364 Checksum: 0x3761 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3414 The RTT to ACK the segment was: 0.000433000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 b0 ba 32 0a ..n.....R..!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf e2 32 6e 00 n.k(..q....2n. No. Time Source Destination Protocol Info 3416 914.190139 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=19541 Ack=66861 Win=16362 [TCP CHECKSUM INCORRECT] Len=166 Frame 3416 (220 bytes on wire, 220 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.948643000 Time delta from previous packet: 0.000580000 seconds Time since reference or first frame: 914.190139000 seconds Frame Number: 3416 Packet Length: 220 bytes Capture Length: 220 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 206 Identification: 0x488f (18575) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2d57] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 19541, Ack: 66861, Len: 166 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 19541 (relative sequence number) Next sequence number: 19707 (relative sequence number) Acknowledgement number: 66861 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16362 Checksum: 0x8504 [incorrect, should be 0xbcc5] SEQ/ACK analysis This is an ACK to the segment in frame: 3415 The RTT to ACK the segment was: 0.000580000 seconds Data (166 bytes) 0000 bc ef a6 00 b5 fe 18 00 8a 00 02 21 f3 ba 32 0a ...........!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 c7 4a 87 4a a4 32 ee 20 o0O(~....J.J.2. 0040 0c 15 7c 6c 9a 84 83 9a 6e a8 e1 0f c1 4e 3c 74 ..|l....n....N 4605 [PSH, ACK] Seq=66861 Ack=19707 Win=16198 Len=110 Frame 3417 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.948992000 Time delta from previous packet: 0.000349000 seconds Time since reference or first frame: 914.190488000 seconds Frame Number: 3417 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0xeb8e (60302) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x8a8f [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 66861, Ack: 19707, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 66861 (relative sequence number) Next sequence number: 66971 (relative sequence number) Acknowledgement number: 19707 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16198 Checksum: 0xf4f2 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3416 The RTT to ACK the segment was: 0.000349000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 4f bb 32 0a ..n.....R..!O.2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf 85 32 6e 00 n.k(..q....2n. No. Time Source Destination Protocol Info 3418 914.192053 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=19707 Ack=66971 Win=16252 [TCP CHECKSUM INCORRECT] Len=230 Frame 3418 (284 bytes on wire, 284 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.950557000 Time delta from previous packet: 0.001565000 seconds Time since reference or first frame: 914.192053000 seconds Frame Number: 3418 Packet Length: 284 bytes Capture Length: 284 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 270 Identification: 0x4890 (18576) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2d16] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 19707, Ack: 66971, Len: 230 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 19707 (relative sequence number) Next sequence number: 19937 (relative sequence number) Acknowledgement number: 66971 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16252 Checksum: 0x8544 [incorrect, should be 0x3349] SEQ/ACK analysis This is an ACK to the segment in frame: 3417 The RTT to ACK the segment was: 0.001565000 seconds Data (230 bytes) 0000 bc ef e6 00 b5 fe 18 00 ca 00 02 21 bd 3d 32 0a ...........!.=2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a a3 bc 76 aa 3b b1 23 76 a.elr.....v.;.#v 0030 7f 34 71 28 07 30 07 f5 87 4b 62 ee 22 96 e3 20 .4q(.0...Kb.".. 0040 75 14 03 c8 12 20 8a 9a 92 6b fd 0f c4 4e cb d0 u.... ...k...N.. 0050 78 34 09 2e 9e 6b 03 00 68 ef 65 f1 a5 32 08 e5 x4...k..h.e..2.. 0060 68 14 6d 2a a1 84 08 58 82 6b 93 e4 cc 4a 92 ad h.m*...X.k...J.. 0070 68 34 6b a8 69 94 3e 75 8a 4b 1c 6e f9 33 99 04 h4k.i.>u.K.n.3.. 0080 58 14 1f 48 ad 84 8d 1a fa cf ea 8f da 4e c7 37 X..H.........N.7 0090 43 34 10 ae 41 94 fc 7f de 4b 33 71 95 32 7b c1 C4..A....K3q.2{. 00a0 00 14 3a aa 95 84 71 7c 99 cf 29 c0 db 4e de 89 ..:...q|..)..N.. 00b0 84 f7 4d 28 5c 94 10 f5 8d 4b 45 ee e2 32 ca 20 ..M(\....KE..2. 00c0 1c 14 4c c8 d0 84 8d 9a 85 6b c1 ab 65 ea 2b 74 ..L......k..e.+t 00d0 75 34 56 2f 5d 30 e0 5b e0 4b 43 f1 83 32 34 40 u4V/]0.[.KC..24@ 00e0 73 b0 00 00 e6 00 s..... No. Time Source Destination Protocol Info 3419 914.192412 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=66971 Ack=19937 Win=15968 Len=102 Frame 3419 (156 bytes on wire, 156 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.950916000 Time delta from previous packet: 0.000359000 seconds Time since reference or first frame: 914.192412000 seconds Frame Number: 3419 Packet Length: 156 bytes Capture Length: 156 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 142 Identification: 0xed8e (60814) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x8897 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 66971, Ack: 19937, Len: 102 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 66971 (relative sequence number) Next sequence number: 67073 (relative sequence number) Acknowledgement number: 19937 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 15968 Checksum: 0x3bef [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3418 The RTT to ACK the segment was: 0.000359000 seconds Data (102 bytes) 0000 bc ef 66 00 b5 fe 18 00 4a 00 02 21 a4 85 32 0a ..f.....J..!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 73 99 e1 42 ..<*qC..f...s..B 0020 6b 04 5d 8a 72 b4 0b f0 fb 18 0c f0 36 b1 2f 74 k.].r.......6./t 0030 47 90 76 2e 7d 94 8f 5b 8a 4b 11 f0 a3 32 e4 42 G.v.}..[.K...2.B 0040 98 b0 04 2e 91 84 ca 3b 86 6b d5 55 c3 4e 28 72 .......;.k.U.N(r 0050 57 90 02 30 65 94 8e 3d 9c 4b 6e 0f a5 63 18 43 W..0e..=.Kn..c.C 0060 73 b0 6d 28 66 00 s.m(f. No. Time Source Destination Protocol Info 3420 914.193083 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=19937 Ack=67073 Win=16150 [TCP CHECKSUM INCORRECT] Len=74 Frame 3420 (128 bytes on wire, 128 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.951587000 Time delta from previous packet: 0.000671000 seconds Time since reference or first frame: 914.193083000 seconds Frame Number: 3420 Packet Length: 128 bytes Capture Length: 128 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 114 Identification: 0x4891 (18577) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2db1] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 19937, Ack: 67073, Len: 74 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 19937 (relative sequence number) Next sequence number: 20011 (relative sequence number) Acknowledgement number: 67073 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16150 Checksum: 0x84a8 [incorrect, should be 0xf007] SEQ/ACK analysis This is an ACK to the segment in frame: 3419 The RTT to ACK the segment was: 0.000671000 seconds Data (74 bytes) 0000 bc ef 4a 00 b5 fe 18 00 30 00 00 21 0b 78 32 0a ..J.....0..!.x2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a a0 bc 8a aa 3b b1 25 76 a.elr.......;.%v 0030 6f 34 96 8c 7e 94 0c f5 ca 80 05 ee bf 96 99 20 o4..~.......... 0040 7e 14 0b c8 b1 85 91 3e 4a 00 ~......>J. No. Time Source Destination Protocol Info 3421 914.193291 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=67073 Ack=20011 Win=15894 Len=66 Frame 3421 (120 bytes on wire, 120 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.951795000 Time delta from previous packet: 0.000208000 seconds Time since reference or first frame: 914.193291000 seconds Frame Number: 3421 Packet Length: 120 bytes Capture Length: 120 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 106 Identification: 0xef8e (61326) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x86bb [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 67073, Ack: 20011, Len: 66 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 67073 (relative sequence number) Next sequence number: 67139 (relative sequence number) Acknowledgement number: 20011 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 15894 Checksum: 0xecaa [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3420 The RTT to ACK the segment was: 0.000208000 seconds Data (66 bytes) 0000 bc ef 42 00 b5 fe 18 00 28 00 00 21 e9 33 32 0a ..B.....(..!.32. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 73 99 e1 42 ..<*qC..f...s..B 0020 6b 04 5d 8a 72 b4 0b f0 ad 18 0c f0 38 b1 07 d0 k.].r.......8... 0030 68 34 75 2e 0b 30 01 ff 81 4b 06 f0 a3 32 f8 e6 h4u..0...K...2.. 0040 42 00 B. No. Time Source Destination Protocol Info 3422 914.195227 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=20011 Ack=67139 Win=16084 [TCP CHECKSUM INCORRECT] Len=374 Frame 3422 (428 bytes on wire, 428 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.953731000 Time delta from previous packet: 0.001936000 seconds Time since reference or first frame: 914.195227000 seconds Frame Number: 3422 Packet Length: 428 bytes Capture Length: 428 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 414 Identification: 0x4892 (18578) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2c84] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 20011, Ack: 67139, Len: 374 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 20011 (relative sequence number) Next sequence number: 20385 (relative sequence number) Acknowledgement number: 67139 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16084 Checksum: 0x85d4 [incorrect, should be 0xe085] SEQ/ACK analysis This is an ACK to the segment in frame: 3421 The RTT to ACK the segment was: 0.001936000 seconds Data (374 bytes) 0000 bc ef 76 01 b5 fe 18 00 5c 01 00 21 a2 19 32 0a ..v.....\..!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 40 4b 87 4a a4 32 ee 20 o0O(~...@K.J.2. 0040 7e 15 7c 6c 9a 84 83 9a 1c a8 e1 0f c1 4e 24 74 ~.|l.........N$t 0050 7f 34 75 2e 02 94 8f ff 9d 4b 7e 55 2b 96 1f 41 .4u......K~U+..A 0060 61 14 7b 8e fe 20 76 fc 8b 6b ea 27 cc 4e d5 09 a.{.. v..k.'.N.. 0070 6f 34 61 a8 e7 57 00 75 88 4b 16 6e b3 32 7f 63 o4a..W.u.K.n.2.c 0080 5f 14 19 48 ad 84 fb d9 85 6b ea 8f d4 4e 2c f4 _..H.....k...N,. 0090 f1 f7 15 ae 53 94 fc 7f bd 4b ff b2 bb 32 1a c1 ....S....K...2.. 00a0 6f 14 57 aa 3e 47 71 7c 87 6b a9 64 dc 4e 70 4a o.W.>Gq|.k.d.NpJ 00b0 6f 34 56 28 59 94 00 f5 3c 88 26 ee 84 32 e4 20 o4V(Y...<.&..2. 00c0 7f 14 b9 0b bd 84 87 9a 85 6b ad cc e4 4e 2e 74 .........k...N.t 00d0 7f 34 25 2e d5 57 fc ff 98 4b 42 f1 8b 32 8d 82 .4%..W...KB..2.. 00e0 6f 14 42 2a a5 84 71 fc 13 a8 b9 e4 e9 4e d0 09 o.B*..q......N.. 00f0 6f 34 f5 6b 49 94 0a 75 8d 4b af ad 93 32 e1 a0 o4.kI..u.K...2.. 0100 1f 14 33 48 51 47 8d 1a 8f 6b cd 8f 7b 8a 2c f4 ..3HQG...k..{.,. 0110 1a 34 35 ae 31 94 6c bb fd 4b 3e 71 9b 32 98 c1 .45.1.l..K>q.2.. 0120 f1 d7 b7 ab b0 84 71 7e 85 6b a5 a1 fc 4e 5a 83 ......q~.k...NZ. 0130 6f 34 2b d5 39 94 05 95 8d 4b 46 0e be f1 64 40 o4+.9....KF...d@ 0140 75 14 c3 29 a0 47 8d f8 80 6b bd e9 84 4e 41 dd u..).G...k...NA. 0150 7f 34 cf d1 21 94 e0 5b 17 ef 25 f1 fb 32 98 41 .4..!..[..%..2.A 0160 11 b0 a0 2b cf 84 71 fe 99 cf a4 e2 8d 4e 58 03 ...+..q......NX. 0170 43 35 bd 13 76 01 C5..v. No. Time Source Destination Protocol Info 3423 914.195628 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=67139 Ack=20385 Win=16364 Len=110 Frame 3423 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.954132000 Time delta from previous packet: 0.000401000 seconds Time since reference or first frame: 914.195628000 seconds Frame Number: 3423 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0xf18e (61838) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x848f [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 67139, Ack: 20385, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 67139 (relative sequence number) Next sequence number: 67249 (relative sequence number) Acknowledgement number: 20385 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16364 Checksum: 0x32a1 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3422 The RTT to ACK the segment was: 0.000401000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 a8 87 32 0a ..n.....R..!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf ea 55 6e 00 n.k(..q....Un. No. Time Source Destination Protocol Info 3424 914.196144 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=20385 Ack=67249 Win=17520 [TCP CHECKSUM INCORRECT] Len=374 Frame 3424 (428 bytes on wire, 428 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.954648000 Time delta from previous packet: 0.000516000 seconds Time since reference or first frame: 914.196144000 seconds Frame Number: 3424 Packet Length: 428 bytes Capture Length: 428 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 414 Identification: 0x4893 (18579) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2c83] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 20385, Ack: 67249, Len: 374 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 20385 (relative sequence number) Next sequence number: 20759 (relative sequence number) Acknowledgement number: 67249 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x85d4 [incorrect, should be 0xbed9] SEQ/ACK analysis This is an ACK to the segment in frame: 3423 The RTT to ACK the segment was: 0.000516000 seconds Data (374 bytes) 0000 bc ef 76 01 b5 fe 18 00 5c 01 00 21 4b 3f 32 0a ..v.....\..!K?2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 40 4b 87 4a a4 32 ee 20 o0O(~...@K.J.2. 0040 01 15 7c 6c 9a 84 83 9a 0a af e1 0f c1 4e 24 74 ..|l.........N$t 0050 7f 34 75 2e 02 94 8f ff 9d 4b 7e 55 2b 96 1f 41 .4u......K~U+..A 0060 61 14 7b 8e fe 20 76 fc 8b 6b ea 27 cc 4e d5 09 a.{.. v..k.'.N.. 0070 6f 34 61 a8 e7 57 00 75 88 4b 16 6e b3 32 7f 63 o4a..W.u.K.n.2.c 0080 5f 14 19 48 ad 84 fb d9 85 6b ea 8f d4 4e 2c f4 _..H.....k...N,. 0090 f1 f7 15 ae 53 94 fc 7f bd 4b ff b2 bb 32 1a c1 ....S....K...2.. 00a0 6f 14 57 aa 3e 47 71 7c 87 6b a9 64 dc 4e 70 4a o.W.>Gq|.k.d.NpJ 00b0 6f 34 56 28 59 94 00 f5 3c 88 26 ee 84 32 e4 20 o4V(Y...<.&..2. 00c0 7f 14 b9 0b bd 84 87 9a 85 6b ad cc e4 4e 2e 74 .........k...N.t 00d0 7f 34 25 2e d5 57 fc ff 98 4b 42 f1 8b 32 8d 82 .4%..W...KB..2.. 00e0 6f 14 42 2a a5 84 71 fc 13 a8 b9 e4 e9 4e d0 09 o.B*..q......N.. 00f0 6f 34 f5 6b 49 94 0a 75 8d 4b af ad 93 32 e1 a0 o4.kI..u.K...2.. 0100 1f 14 33 48 51 47 8d 1a 8f 6b cd 8f 7b 8a 2c f4 ..3HQG...k..{.,. 0110 1a 34 35 ae 31 94 6c bb fd 4b 3e 71 9b 32 98 c1 .45.1.l..K>q.2.. 0120 f1 d7 b7 ab b0 84 71 7e 85 6b a5 a1 fc 4e 5a 83 ......q~.k...NZ. 0130 6f 34 2b d5 39 94 05 95 8d 4b 46 0e be f1 64 40 o4+.9....KF...d@ 0140 75 14 c3 29 a0 47 8d f8 80 6b bd e9 84 4e 41 dd u..).G...k...NA. 0150 7f 34 cf d1 21 94 e0 5b 17 ef 25 f1 fb 32 98 41 .4..!..[..%..2.A 0160 11 b0 a0 2b cf 84 71 fe 99 cf a4 e2 8d 4e 58 03 ...+..q......NX. 0170 43 35 bd 13 76 01 C5..v. No. Time Source Destination Protocol Info 3425 914.196545 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=67249 Ack=20759 Win=15990 Len=110 Frame 3425 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.955049000 Time delta from previous packet: 0.000401000 seconds Time since reference or first frame: 914.196545000 seconds Frame Number: 3425 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0xf38e (62350) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x828f [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 67249, Ack: 20759, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 67249 (relative sequence number) Next sequence number: 67359 (relative sequence number) Acknowledgement number: 20759 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 15990 Checksum: 0x3233 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3424 The RTT to ACK the segment was: 0.000401000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 a8 87 32 0a ..n.....R..!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf ea 55 6e 00 n.k(..q....Un. No. Time Source Destination Protocol Info 3426 914.197074 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=20759 Ack=67359 Win=17410 [TCP CHECKSUM INCORRECT] Len=382 Frame 3426 (436 bytes on wire, 436 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.955578000 Time delta from previous packet: 0.000529000 seconds Time since reference or first frame: 914.197074000 seconds Frame Number: 3426 Packet Length: 436 bytes Capture Length: 436 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 422 Identification: 0x4894 (18580) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2c7a] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 20759, Ack: 67359, Len: 382 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 20759 (relative sequence number) Next sequence number: 21141 (relative sequence number) Acknowledgement number: 67359 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17410 Checksum: 0x85dc [incorrect, should be 0x7da4] SEQ/ACK analysis This is an ACK to the segment in frame: 3425 The RTT to ACK the segment was: 0.000529000 seconds Data (382 bytes) 0000 bc ef 7e 01 b5 fe 18 00 64 01 00 21 23 41 32 0a ..~.....d..!#A2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 40 4b 87 4a a4 32 ee 20 o0O(~...@K.J.2. 0040 0e 15 7c 6c 9a 84 83 9a 99 cf 7d ab c3 4e 22 74 ..|l......}..N"t 0050 d4 f7 1d 2e 63 94 ff ff 9d 4b 12 db ab 9f db 59 ....c....K.....Y 0060 6f 16 67 29 85 84 71 9f f6 6b 85 40 b7 ea d7 09 o.g)..q..k.@.... 0070 61 34 12 6b 69 94 05 75 8d 4b 16 6e 3d f1 e4 a0 a4.ki..u.K.n=... 0080 5a 14 13 48 ad 84 16 d9 85 6b e7 8f d4 4e 5a 37 Z..H.....k...NZ7 0090 5f 34 12 ae 51 94 fc 7f 13 88 52 71 b9 32 18 c1 _4..Q.....Rq.2.. 00a0 6f 14 fa 69 95 84 73 7c 85 6b a9 64 77 8d d0 89 o..i..s|.k.dw... 00b0 6d 34 51 28 59 94 a0 36 8d 4b 21 ee 83 32 e4 20 m4Q(Y..6.K!..2. 00c0 ce d7 23 c8 ba 84 8d 9a 85 6b 47 cc e4 4e 26 74 ..#......kG..N&t 00d0 7f 34 55 ed 41 94 fe ff 9d 4b 42 f1 1f f1 18 41 .4U.A....KB....A 00e0 6a 14 47 2a a5 84 e4 3f 85 6b bc e4 ec 4e d0 09 j.G*...?.k...N.. 00f0 f9 f7 41 a8 4c 94 00 75 8d 4b 82 ad 93 32 ee a0 ..A.L..u.K...2.. 0100 1f 14 aa 8b cd 84 88 1a 85 6b cd 8f 68 8d 2c f4 .........k..h.,. 0110 15 34 35 ae be 50 fc 7f f8 4b 32 71 9b 32 08 05 .45..P...K2q.2.. 0120 6f 14 bb ab b5 84 71 7e 1b a8 c9 62 f9 4e 50 83 o.....q~...b.NP. 0130 6f 34 dd f4 39 94 0a 95 8d 4b dc ec e3 32 61 40 o4..9....K...2a@ 0140 7f 14 c3 29 80 47 8d f8 8f 6b bd e9 f9 8d ac 1e ...).G...k...... 0150 7a 34 c5 d1 21 94 11 3c 9d 4b 28 f1 eb 32 84 e5 z4..!..<.K(..2.. 0160 e5 b0 a0 2b d5 84 71 fe fb cf de e2 86 4e 50 03 ...+..q......NP. 0170 73 90 dc b7 28 94 08 15 a1 4a 4a 2a 7e 01 s...(....JJ*~. No. Time Source Destination Protocol Info 3427 914.197489 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=67359 Ack=21141 Win=16364 Len=110 Frame 3427 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.955993000 Time delta from previous packet: 0.000415000 seconds Time since reference or first frame: 914.197489000 seconds Frame Number: 3427 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0xf58e (62862) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x808f [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 67359, Ack: 21141, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 67359 (relative sequence number) Next sequence number: 67469 (relative sequence number) Acknowledgement number: 21141 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16364 Checksum: 0xecc0 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3426 The RTT to ACK the segment was: 0.000415000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 4f bb 32 0a ..n.....R..!O.2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf 85 32 6e 00 n.k(..q....2n. No. Time Source Destination Protocol Info 3428 914.198005 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=21141 Ack=67469 Win=17300 [TCP CHECKSUM INCORRECT] Len=382 Frame 3428 (436 bytes on wire, 436 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.956509000 Time delta from previous packet: 0.000516000 seconds Time since reference or first frame: 914.198005000 seconds Frame Number: 3428 Packet Length: 436 bytes Capture Length: 436 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 422 Identification: 0x4895 (18581) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2c79] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 21141, Ack: 67469, Len: 382 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 21141 (relative sequence number) Next sequence number: 21523 (relative sequence number) Acknowledgement number: 67469 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17300 Checksum: 0x85dc [incorrect, should be 0x765f] SEQ/ACK analysis This is an ACK to the segment in frame: 3427 The RTT to ACK the segment was: 0.000516000 seconds Data (382 bytes) 0000 bc ef 7e 01 b5 fe 18 00 62 01 02 21 d9 75 32 0a ..~.....b..!.u2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 40 4b 87 4a a4 32 ee 20 o0O(~...@K.J.2. 0040 0e 15 7c 6c 9a 84 83 9a 99 cf 7d ab c3 4e 22 74 ..|l......}..N"t 0050 d4 f7 16 2e 63 94 fc ff 9d 4b cf 32 b3 32 1a 41 ....c....K.2.2.A 0060 6b 14 67 2a f5 e7 02 fc 99 cf e2 40 cb 4e de 09 k.g*.......@.N.. 0070 1c f7 61 a8 6c 94 00 75 8d 4b 98 ad b3 32 e1 a0 ..a.l..u.K...2.. 0080 5f 14 13 48 36 47 8d 1a 8f 6b ed 8f a2 8d 2c f4 _..H6G...k....,. 0090 58 34 15 ae 51 94 52 bc bd 4b 50 71 bb 32 18 c1 X4..Q.R..KPq.2.. 00a0 c2 d7 57 aa 97 84 71 7c 85 6b 02 a7 dc 4e d2 89 ..W...q|.k...N.. 00b0 6f 34 51 28 f9 57 00 f5 8a 4b 26 ee 83 32 55 e3 o4Q(.W...K&..2U. 00c0 7f 14 24 c8 bd 84 8d 9a 1f a8 dd 0f ee 4e 2c 74 ..$..........N,t 00d0 0f f7 25 2e 43 94 fc ff 9d 4b d6 32 8b 32 1d 41 ..%.C....K.2.2.A 00e0 6f 14 47 2a 30 47 71 fc 80 6b b9 e4 ec 4e 46 ca o.G*0Gq..k...NF. 00f0 6f 34 44 a8 49 94 00 75 39 88 36 6e 99 32 e4 a0 o4D.I..u9.6n.2.. 0100 86 d7 33 48 c8 84 8d 1a 85 6b 51 4c f4 4e 26 f4 ..3H.....kQL.N&. 0110 1f 34 ba 6a 31 94 f9 7f fd 4b 32 71 0b f6 98 c1 .4.j1....K2q.... 0120 63 14 b7 ab b5 84 ef bd 85 6b cc 62 fc 4e 50 83 c........k.b.NP. 0130 03 f7 b1 37 33 94 00 95 17 a9 46 0e e6 32 64 40 ...73.....F..2d@ 0140 7f 14 9e ea dd 84 87 f8 85 6b c0 2a 84 4e a9 1e .........k.*.N.. 0150 7f 34 c5 d1 cc 57 fc ff 97 4b 22 f1 f7 96 12 e5 .4...W...K"..... 0160 68 14 b7 2b c5 84 0f 5a 82 6b d3 e2 8c 4e 4c a7 h..+...Z.k...NL. 0170 12 34 a0 b7 21 94 2c 14 91 ef 1c a4 7e 01 .4..!.,.....~. No. Time Source Destination Protocol Info 3429 914.198414 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=67469 Ack=21523 Win=15982 Len=110 Frame 3429 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.956918000 Time delta from previous packet: 0.000409000 seconds Time since reference or first frame: 914.198414000 seconds Frame Number: 3429 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0xf78e (63374) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x7e8f [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 67469, Ack: 21523, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 67469 (relative sequence number) Next sequence number: 67579 (relative sequence number) Acknowledgement number: 21523 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 15982 Checksum: 0x2e53 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3428 The RTT to ACK the segment was: 0.000409000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 b0 ba 32 0a ..n.....R..!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf e2 32 6e 00 n.k(..q....2n. No. Time Source Destination Protocol Info 3430 914.198869 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=21523 Ack=67579 Win=17190 [TCP CHECKSUM INCORRECT] Len=382 Frame 3430 (436 bytes on wire, 436 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.957373000 Time delta from previous packet: 0.000455000 seconds Time since reference or first frame: 914.198869000 seconds Frame Number: 3430 Packet Length: 436 bytes Capture Length: 436 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 422 Identification: 0x4896 (18582) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2c78] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 21523, Ack: 67579, Len: 382 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 21523 (relative sequence number) Next sequence number: 21905 (relative sequence number) Acknowledgement number: 67579 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17190 Checksum: 0x85dc [incorrect, should be 0xfe2e] SEQ/ACK analysis This is an ACK to the segment in frame: 3429 The RTT to ACK the segment was: 0.000455000 seconds Data (382 bytes) 0000 bc ef 7e 01 b5 fe 18 00 62 01 02 21 0d 64 32 0a ..~.....b..!.d2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 40 4b 87 4a a4 32 ee 20 o0O(~...@K.J.2. 0040 0f 15 7c 6c 9a 84 83 9a 99 cf 7d ab c3 4e 22 74 ..|l......}..N"t 0050 d4 f7 1d 2e 63 94 f8 ff 9d 4b 12 92 d8 32 b5 82 ....c....K...2.. 0060 7c 14 65 2a 85 84 71 fc 99 cf e2 40 cb 4e de 09 |.e*..q....@.N.. 0070 1c f7 61 a8 6c 94 00 75 8d 4b 98 ad b3 32 e1 a0 ..a.l..u.K...2.. 0080 5f 14 13 48 36 47 8d 1a 8f 6b ed 8f a2 8d 2c f4 _..H6G...k....,. 0090 58 34 15 ae 51 94 52 bc bd 4b 50 71 bb 32 18 c1 X4..Q.R..KPq.2.. 00a0 c2 d7 57 aa 97 84 71 7c 85 6b 02 a7 dc 4e d2 89 ..W...q|.k...N.. 00b0 6f 34 51 28 f9 57 00 f5 8a 4b 26 ee 83 32 55 e3 o4Q(.W...K&..2U. 00c0 7f 14 24 c8 bd 84 8d 9a 1f a8 dd 0f ee 4e 2c 74 ..$..........N,t 00d0 0f f7 25 2e 43 94 fc ff 9d 4b d6 32 8b 32 1d 41 ..%.C....K.2.2.A 00e0 6f 14 47 2a 30 47 71 fc 80 6b b9 e4 ec 4e 46 ca o.G*0Gq..k...NF. 00f0 6f 34 44 a8 49 94 00 75 39 88 36 6e 99 32 e4 a0 o4D.I..u9.6n.2.. 0100 86 d7 33 48 c8 84 8d 1a 85 6b 51 4c f4 4e 26 f4 ..3H.....kQL.N&. 0110 1f 34 ba 6a 31 94 f9 7f fd 4b 32 71 0b f6 98 c1 .4.j1....K2q.... 0120 63 14 b7 ab b5 84 ef bd 85 6b cc 62 fc 4e 50 83 c........k.b.NP. 0130 03 f7 b1 37 33 94 00 95 17 a9 46 0e e6 32 64 40 ...73.....F..2d@ 0140 7f 14 9e ea dd 84 87 f8 85 6b c0 2a 84 4e a9 1e .........k.*.N.. 0150 7f 34 c5 d1 cc 57 fc ff 97 4b 22 f1 f7 96 12 e5 .4...W...K"..... 0160 68 14 b7 2b c5 84 0f 5a 82 6b d3 e2 8c 4e 4c a7 h..+...Z.k...NL. 0170 12 34 a0 b7 21 94 2c 14 91 ef 4a 2a 7e 01 .4..!.,...J*~. No. Time Source Destination Protocol Info 3431 914.199275 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=67579 Ack=21905 Win=16364 Len=110 Frame 3431 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.957779000 Time delta from previous packet: 0.000406000 seconds Time since reference or first frame: 914.199275000 seconds Frame Number: 3431 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0xf98e (63886) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x7c8f [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 67579, Ack: 21905, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 67579 (relative sequence number) Next sequence number: 67689 (relative sequence number) Acknowledgement number: 21905 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16364 Checksum: 0x2ae9 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3430 The RTT to ACK the segment was: 0.000406000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 b0 ba 32 0a ..n.....R..!..2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf e2 32 6e 00 n.k(..q....2n. No. Time Source Destination Protocol Info 3432 914.205271 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=21905 Ack=67689 Win=17080 [TCP CHECKSUM INCORRECT] Len=166 Frame 3432 (220 bytes on wire, 220 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.963775000 Time delta from previous packet: 0.005996000 seconds Time since reference or first frame: 914.205271000 seconds Frame Number: 3432 Packet Length: 220 bytes Capture Length: 220 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 206 Identification: 0x4897 (18583) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2d4f] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 21905, Ack: 67689, Len: 166 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 21905 (relative sequence number) Next sequence number: 22071 (relative sequence number) Acknowledgement number: 67689 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17080 Checksum: 0x8504 [incorrect, should be 0xad7f] SEQ/ACK analysis This is an ACK to the segment in frame: 3431 The RTT to ACK the segment was: 0.005996000 seconds Data (166 bytes) 0000 bc ef a6 00 b5 fe 18 00 8a 00 02 21 f3 ba 32 0a ...........!..2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a 18 bc 72 aa 3b b1 25 76 a.elr.....r.;.%v 0030 6f 30 4f 28 7e 94 0a f5 c7 4a 87 4a a4 32 ee 20 o0O(~....J.J.2. 0040 0c 15 7c 6c 9a 84 83 9a 6e a8 e1 0f c1 4e 3c 74 ..|l....n....N 4605 [PSH, ACK] Seq=67689 Ack=22071 Win=16198 Len=110 Frame 3433 (164 bytes on wire, 164 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.964143000 Time delta from previous packet: 0.000368000 seconds Time since reference or first frame: 914.205639000 seconds Frame Number: 3433 Packet Length: 164 bytes Capture Length: 164 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 150 Identification: 0xfb8e (64398) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x7a8f [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 67689, Ack: 22071, Len: 110 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 67689 (relative sequence number) Next sequence number: 67799 (relative sequence number) Acknowledgement number: 22071 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16198 Checksum: 0xe87a [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3432 The RTT to ACK the segment was: 0.000368000 seconds Data (110 bytes) 0000 bc ef 6e 00 b5 fe 18 00 52 00 02 21 4f bb 32 0a ..n.....R..!O.2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 4b 99 e1 42 ..<*qC..f...K..B 0020 65 04 e8 2e 5d 10 08 f0 81 bc 23 54 3b b1 2b 74 e...].....#T;.+t 0030 47 90 76 2e 7d 94 28 5b 8a 4b 02 f0 8b 96 e3 42 G.v.}.([.K.....B 0040 7b 14 2b 8a 9a 84 89 f0 0f cf fa f1 d4 4e 2c 72 {.+..........N,r 0050 01 90 02 30 6b 94 fc 99 b5 ef 65 0f af 32 6a e7 ...0k.....e..2j. 0060 6e 14 6b 28 85 84 71 ee 99 cf 85 32 6e 00 n.k(..q....2n. No. Time Source Destination Protocol Info 3434 914.206144 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=22071 Ack=67799 Win=16970 [TCP CHECKSUM INCORRECT] Len=230 Frame 3434 (284 bytes on wire, 284 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.964648000 Time delta from previous packet: 0.000505000 seconds Time since reference or first frame: 914.206144000 seconds Frame Number: 3434 Packet Length: 284 bytes Capture Length: 284 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 270 Identification: 0x4898 (18584) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2d0e] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 22071, Ack: 67799, Len: 230 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 22071 (relative sequence number) Next sequence number: 22301 (relative sequence number) Acknowledgement number: 67799 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16970 Checksum: 0x8544 [incorrect, should be 0x2403] SEQ/ACK analysis This is an ACK to the segment in frame: 3433 The RTT to ACK the segment was: 0.000505000 seconds Data (230 bytes) 0000 bc ef e6 00 b5 fe 18 00 ca 00 02 21 bd 3d 32 0a ...........!.=2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a a3 bc 76 aa 3b b1 23 76 a.elr.....v.;.#v 0030 7f 34 71 28 07 30 07 f5 87 4b 62 ee 22 96 e3 20 .4q(.0...Kb.".. 0040 75 14 03 c8 12 20 8a 9a 92 6b fd 0f c4 4e cb d0 u.... ...k...N.. 0050 78 34 09 2e 9e 6b 03 00 68 ef 65 f1 a5 32 08 e5 x4...k..h.e..2.. 0060 68 14 6d 2a a1 84 08 58 82 6b 93 e4 cc 4a 92 ad h.m*...X.k...J.. 0070 68 34 6b a8 69 94 3e 75 8a 4b 1c 6e f9 33 99 04 h4k.i.>u.K.n.3.. 0080 58 14 1f 48 ad 84 8d 1a fa cf ea 8f da 4e c7 37 X..H.........N.7 0090 43 34 10 ae 41 94 fc 7f de 4b 33 71 95 32 7b c1 C4..A....K3q.2{. 00a0 00 14 3a aa 95 84 71 7c 99 cf 29 c0 db 4e de 89 ..:...q|..)..N.. 00b0 84 f7 4d 28 5c 94 10 f5 8d 4b 45 ee e2 32 ca 20 ..M(\....KE..2. 00c0 1c 14 4c c8 d0 84 8d 9a 85 6b c1 ab 65 ea 2b 74 ..L......k..e.+t 00d0 75 34 56 2f 5d 30 e0 5b e0 4b 43 f1 83 32 34 40 u4V/]0.[.KC..24@ 00e0 73 b0 00 00 e6 00 s..... No. Time Source Destination Protocol Info 3435 914.206500 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=67799 Ack=22301 Win=15968 Len=102 Frame 3435 (156 bytes on wire, 156 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.965004000 Time delta from previous packet: 0.000356000 seconds Time since reference or first frame: 914.206500000 seconds Frame Number: 3435 Packet Length: 156 bytes Capture Length: 156 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 142 Identification: 0xfd8e (64910) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x7897 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 67799, Ack: 22301, Len: 102 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 67799 (relative sequence number) Next sequence number: 67901 (relative sequence number) Acknowledgement number: 22301 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 15968 Checksum: 0x5565 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3434 The RTT to ACK the segment was: 0.000356000 seconds Data (102 bytes) 0000 bc ef 66 00 b5 fe 18 00 4a 00 02 21 5b 97 32 0a ..f.....J..![.2. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 73 99 e1 42 ..<*qC..f...s..B 0020 6b 04 5d 8a 72 b4 0b f0 fb 18 0c f0 36 b1 2f 74 k.].r.......6./t 0030 47 90 76 2e 7d 94 8f 5b 8a 4b 11 f0 a3 32 e4 42 G.v.}..[.K...2.B 0040 98 b0 04 2e 91 84 ed 3b 86 6b d5 55 c3 4e 28 72 .......;.k.U.N(r 0050 57 90 02 30 65 94 8e 3d 9c 4b 6e 0f a5 63 18 43 W..0e..=.Kn..c.C 0060 73 b0 6d 28 66 00 s.m(f. No. Time Source Destination Protocol Info 3436 914.207123 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=22301 Ack=67901 Win=16868 [TCP CHECKSUM INCORRECT] Len=74 Frame 3436 (128 bytes on wire, 128 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.965627000 Time delta from previous packet: 0.000623000 seconds Time since reference or first frame: 914.207123000 seconds Frame Number: 3436 Packet Length: 128 bytes Capture Length: 128 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 114 Identification: 0x4899 (18585) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2da9] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 22301, Ack: 67901, Len: 74 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 22301 (relative sequence number) Next sequence number: 22375 (relative sequence number) Acknowledgement number: 67901 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16868 Checksum: 0x84a8 [incorrect, should be 0xb5c0] SEQ/ACK analysis This is an ACK to the segment in frame: 3435 The RTT to ACK the segment was: 0.000623000 seconds Data (74 bytes) 0000 bc ef 4a 00 b5 fe 18 00 30 00 00 21 13 79 32 0a ..J.....0..!.y2. 0010 04 00 3c 2a 71 43 00 0a 66 17 0f ee 2d 99 e7 20 ..<*qC..f...-.. 0020 61 04 65 6c 72 b4 05 9a a0 bc 8a aa 3b b1 25 76 a.elr.......;.%v 0030 6f 34 96 8c 7e 94 0c f5 ed 80 05 ee bf 96 99 20 o4..~.......... 0040 7e 14 0b c8 b1 85 91 3e 4a 00 ~......>J. No. Time Source Destination Protocol Info 3437 914.207330 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=67901 Ack=22375 Win=15894 Len=66 Frame 3437 (120 bytes on wire, 120 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.965834000 Time delta from previous packet: 0.000207000 seconds Time since reference or first frame: 914.207330000 seconds Frame Number: 3437 Packet Length: 120 bytes Capture Length: 120 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 106 Identification: 0xff8e (65422) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x76bb [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 67901, Ack: 22375, Len: 66 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 67901 (relative sequence number) Next sequence number: 67967 (relative sequence number) Acknowledgement number: 22375 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 15894 Checksum: 0xe032 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3436 The RTT to ACK the segment was: 0.000207000 seconds Data (66 bytes) 0000 bc ef 42 00 b5 fe 18 00 28 00 00 21 e9 33 32 0a ..B.....(..!.32. 0010 04 00 3c 2a 71 43 00 00 66 17 0f f0 73 99 e1 42 ..<*qC..f...s..B 0020 6b 04 5d 8a 72 b4 0b f0 ad 18 0c f0 38 b1 07 d0 k.].r.......8... 0030 68 34 75 2e 0b 30 01 ff 81 4b 06 f0 a3 32 f8 e6 h4u..0...K...2.. 0040 42 00 B. No. Time Source Destination Protocol Info 3438 914.213645 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=22375 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3438 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.972149000 Time delta from previous packet: 0.006315000 seconds Time since reference or first frame: 914.213645000 seconds Frame Number: 3438 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x489a (18586) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x283e] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 22375, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 22375 (relative sequence number) Next sequence number: 23835 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0x3f89] SEQ/ACK analysis This is an ACK to the segment in frame: 3437 The RTT to ACK the segment was: 0.006315000 seconds Data (1460 bytes) 0000 bc ef 3a 6c b4 fe 18 00 00 80 11 21 7c 41 32 0a ..:l.......!|A2. 0010 04 00 3c 2a 71 43 00 0a 70 1a 0f ee 58 05 e6 22 ..<*qC..p...X.." 0020 6f 02 75 d1 6d 24 0f 0f c4 de 8b 1e 3d b0 a5 33 o.u.m$......=..3 0030 d7 2b 8e 4e 18 bc de 9b 9d 58 03 2c a1 5b 40 f8 .+.N.....X.,.[@. 0040 13 26 9f 4d 05 04 0b d4 a7 8a 7f 11 dc 6e 9f 7d .&.M.........n.} 0050 db e6 a5 ae fd f1 c6 e2 50 ac 41 a8 67 72 48 7b ........P.A.grH{ 0060 71 60 86 fa 4d 48 44 e7 88 d1 35 c4 d7 03 77 4a q`..MHD...5...wJ 0070 19 43 e4 6e 5a ed b4 29 ec 71 a5 51 3d 34 af e2 .C.nZ..).q.Q=4.. 0080 76 10 13 48 cd 85 61 3d 9d 22 fd 11 e4 69 be 04 v..H..a=."...i.. 0090 b1 04 1d 07 63 54 ec 7f a1 85 72 dd f9 29 9e c7 ....cT....r..).. 00a0 6b d4 ae 2a b4 0e 07 fa af 1a a1 78 44 1d d2 97 k..*.......xD... 00b0 af 31 91 2e 99 ae 00 f9 4d 4a a8 c7 b3 b2 e9 e0 .1......MJ...... 00c0 7c 8c 23 1b 37 77 bc 1a 8b 7b 22 7c 64 86 2c 41 |.#.7w...{"|d.,A 00d0 bd 0d a5 e6 41 a6 17 e3 8d 7b 84 89 10 07 81 e5 ....A....{...... 00e0 dd 94 88 2e 51 28 c1 93 4f 56 da e0 f4 fa de 42 ....Q(..OV.....B 00f0 19 62 59 63 54 d7 24 17 23 9b 5e b3 ac f1 28 d1 .bYcT.$.#.^...(. 0100 92 55 ad 4c cd 86 2b 5b 4f 70 6d 54 7c 09 4c f7 .U.L..+[OpmT|.L. 0110 f1 3d 33 6c cc 42 fb 12 5e ef 3c 91 98 6c b9 21 .=3l.B..^.<..l.! 0120 70 74 de 3f fb 38 77 68 d1 4c 47 47 68 74 07 08 pt.?.8wh.LGGht.. 0130 15 32 d1 2c ca 0c 6f 1b af d2 c2 d4 cf 74 d7 51 .2.,..o......t.Q 0140 af ff c1 f9 36 31 33 e5 de 49 85 63 95 66 a8 18 ....613..I.c.f.. 0150 8c 9a d5 5b 99 fa c7 9d 5e d2 a6 19 82 f6 09 d5 ...[....^....... 0160 66 36 df 8b 47 87 d0 36 76 ef d4 1b 68 a6 3c 37 f6..G..6v...h.<7 0170 aa c8 72 d6 a1 56 63 20 10 05 54 8d 6a be b4 a5 ..r..Vc ..T.j... 0180 69 8d 96 74 b2 76 a6 93 06 2a 2a f7 9c 48 36 3c i..t.v...**..H6< 0190 69 d0 a1 52 68 0c bc 48 58 4d 01 f0 6c 24 80 8c i..Rh..HXM..l$.. 01a0 a9 55 97 6c 0f c2 09 ba 18 2b 26 f7 5d 48 5c 6f .U.l.....+&.]H\o 01b0 f1 14 55 45 29 68 0e 02 74 56 92 ef 0b ed ca 4e ..UE)h..tV.....N 01c0 e7 64 0a d2 c7 24 0e 78 c7 67 8d 8c e7 67 02 0b .d...$.x.g...g.. 01d0 fe fa f1 b7 27 7f 4e de 93 ed cc 09 a5 e6 88 e9 ....'.N......... 01e0 5b 55 50 67 86 87 78 62 46 8c c8 83 16 54 94 30 [UPg..xbF....T.0 01f0 a2 18 b4 32 ae 6d c8 c8 6e af 5b 82 ea de 45 7e ...2.m..n.[...E~ 0200 84 f2 73 52 1c 8d 15 ab 94 16 2f 2b 13 49 d7 f8 ..sR....../+.I.. 0210 1c 5c 46 a9 92 a9 b3 2f 46 6b f9 33 dd ea e4 a5 .\F..../Fk.3.... 0220 54 27 06 09 9b 8e 95 22 46 6a f6 b0 0d f5 4f 07 T'....."Fj....O. 0230 e9 a3 0a c7 5b de 7a 5f 04 75 9c 2f d0 a8 36 c6 ....[.z_.u./..6. 0240 83 77 cf 5c 7f 43 a2 d0 b2 9c e5 e3 a2 f4 91 07 .w.\.C.......... 0250 79 ec f9 d3 e6 ac 99 ed b2 2c 73 ed 3f 8a 02 57 y........,s.?..W 0260 03 cc 0e ed 23 cc 64 ad b2 33 23 76 c0 ab b2 56 ....#.d..3#v...V 0270 2b e3 1b 3a db 93 70 ac cb 35 3f 70 8b 6f f6 47 +..:..p..5?p.o.G 0280 4c dd 00 00 7c 1a 42 74 01 4e f1 c1 2f 8b 53 25 L...|.Bt.N../.S% 0290 0b 0f 57 ac 5a f2 bf 33 34 b4 e3 39 7f ac 85 e0 ..W.Z..34..9.... 02a0 61 a1 74 0c f7 92 cd 84 1a df 61 bc c7 4b 19 95 a.t.......a..K.. 02b0 46 0e 0c 7d 42 56 fa 6f f2 d2 d5 1b 98 62 5e 71 F..}BV.o.....b^q 02c0 f1 e3 7e 11 b3 85 f7 bd c6 d4 9d c6 40 9b bc 00 ..~.........@... 02d0 e2 8f 89 c7 f3 90 9d e4 84 db a2 39 c3 78 fd c7 ...........9.x.. 02e0 ab 3f c3 42 a2 53 0f 41 00 aa 89 9d 48 2b 56 09 .?.B.S.A....H+V. 02f0 29 53 8a 7b c5 55 c8 50 cc 9f f1 f1 b3 11 01 0b )S.{.U.P........ 0300 0d 45 a8 ba e8 12 d0 8c 0f f1 e3 d8 a9 c6 5d 9a .E............]. 0310 13 a7 05 c9 a8 94 20 ee f4 64 f1 61 52 20 7c d9 ...... ..d.aR |. 0320 f2 f5 04 84 17 d8 14 db 5c 51 87 5c 18 b4 2c 09 ........\Q.\..,. 0330 5d 76 59 d4 a6 7e bf b5 b8 19 11 28 6a c9 f2 6a ]vY..~.....(j..j 0340 e5 88 0a 71 7e 91 da 07 36 1b 9b 01 60 e9 d8 82 ...q~...6...`... 0350 aa 26 e7 b1 44 97 31 af 0c 6c 54 0b 2f 18 3c df .&..D.1..lT./.<. 0360 ca 0b c9 2f 2c 24 16 ec 92 97 c1 7b 90 93 1e 18 .../,$.....{.... 0370 f4 11 d9 de ca b1 65 c4 da a4 27 53 d3 72 95 71 ......e...'S.r.q 0380 2d 9c 81 27 9f af 43 30 45 b0 1f 95 1b 88 70 90 -..'..C0E.....p. 0390 84 bc e5 e1 1d 6e 7a 52 f3 a3 60 13 37 33 50 8a .....nzR..`.73P. 03a0 ff 6b 59 91 43 06 cb 29 a3 a5 18 68 f9 bb 35 f5 .kY.C..)...h..5. 03b0 24 a0 59 ac 97 5b 0f ce 72 e8 85 be aa 36 5a 7a $.Y..[..r....6Zz 03c0 33 d7 a6 c7 14 5b 60 1f a0 b3 d2 d6 4d 8e b6 93 3....[`.....M... 03d0 ea c2 c4 e5 fa 47 f5 bc e9 9c 95 d6 b4 10 81 bc .....G.......... 03e0 4b dd 81 d3 be 39 0d a1 74 42 aa 6f d5 eb 74 9e K....9..tB.o..t. 03f0 34 c5 2a 64 76 c9 5b fb eb 0f 68 90 34 35 54 f2 4.*dv.[...h.45T. 0400 08 e7 57 43 df 11 c7 d6 04 93 95 1b c4 7b 6f 0e ..WC.........{o. 0410 39 3f ef 2e 37 b3 88 47 cb 20 c3 0f db e6 81 16 9?..7..G. ...... 0420 a0 da e0 c1 54 89 f3 b8 85 ae b7 ee cc b7 c0 0c ....T........... 0430 fc 48 a4 2f ff 80 fb b8 b8 95 78 7b 90 80 c3 a8 .H./......x{.... 0440 68 ae fe 66 3d b5 c4 ec 70 93 1a b6 cc ff a6 06 h..f=...p....... 0450 bf 63 75 1d 63 c8 65 13 1c ed 57 11 dd a7 96 55 .cu.c.e...W....U 0460 1f 22 8e dc e4 f6 e7 59 b8 f8 90 a3 9e 2c 11 c1 .".....Y.....,.. 0470 a9 3e 39 73 68 c5 9c e0 8a 0a 1a a7 40 64 2a 2a .>9sh.......@d** 0480 e1 04 17 9a 1f 94 06 fe 14 f9 5f d3 f5 c7 4f 96 .........._...O. 0490 38 08 94 d1 92 95 e7 52 5b 31 22 96 bb 5f 62 42 8......R[1".._bB 04a0 98 36 94 0d 52 a5 2a cf f3 32 87 ce 2c d6 df 5b .6..R.*..2..,..[ 04b0 9f f9 31 c9 51 80 8d fe 94 bf 7a c7 83 80 40 69 ..1.Q.....z...@i 04c0 db d3 5e 5e ca 14 bb ef 82 d1 ec 66 34 42 2b ac ..^^.......f4B+. 04d0 6d dc a1 d5 78 21 5d 3e 94 3c 5f 4e 2b a0 1e 09 m...x!]>.<_N+... 04e0 61 29 c4 6b 19 d5 e6 b4 e6 8c 84 0b ca c4 a0 5d a).k...........] 04f0 23 c7 3c 02 10 9b 14 4a cc 55 5b d3 16 d9 a9 e2 #.<....J.U[..... 0500 43 b6 69 c7 10 1e ab ab 88 0f 8d 33 a8 4c 6d 0b C.i........3.Lm. 0510 c2 b5 41 de 7c bb d6 79 76 7e d7 78 6a 62 f6 ce ..A.|..yv~.xjb.. 0520 3f eb 3d 6e d1 0c 4b a1 d7 ea 1d 73 db d5 30 52 ?.=n..K....s..0R 0530 4b df e4 e6 3c 00 ae 1b 44 97 ee 08 de ab 7b be K...<...D.....{. 0540 6d de b6 61 df 2f b7 b7 71 5d 72 2e 0c fa f4 75 m..a./..q]r....u 0550 3a 1d 3e ae b9 a5 53 e2 8d 5d f5 0c 1e 93 65 5a :.>...S..]....eZ 0560 f7 b6 ae 0b 87 fc 0d 68 89 81 e2 cc 48 dc da 8c .......h....H... 0570 9c 4c 60 4a 0a 36 36 7e 71 05 44 40 e0 c6 eb f1 .L`J.66~q.D@.... 0580 92 0a 12 e8 e1 63 1f ac ae 50 7d 66 e2 06 9d bf .....c...P}f.... 0590 c8 8b a8 5e 9e e0 d3 2c b4 9b b1 4a 67 93 61 7a ...^...,...Jg.az 05a0 b5 16 62 12 88 1b 7a d7 1a 22 f9 38 27 2a 89 b9 ..b...z..".8'*.. 05b0 33 8c 32 4a 3.2J No. Time Source Destination Protocol Info 3439 914.213679 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=23835 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3439 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.972183000 Time delta from previous packet: 0.000034000 seconds Time since reference or first frame: 914.213679000 seconds Frame Number: 3439 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x489b (18587) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x283d] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 23835, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 23835 (relative sequence number) Next sequence number: 25295 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0x7ea0] Data (1460 bytes) 0000 fa 07 10 e0 66 76 a6 ba e4 78 53 0f 69 33 d5 9b ....fv...xS.i3.. 0010 25 1a 65 93 25 d5 6a f5 8a ff f2 42 1c 72 86 27 %.e.%.j....B.r.' 0020 10 66 aa e8 84 5b b2 62 7f a1 d6 f6 97 22 4e 46 .f...[.b....."NF 0030 f9 0b 2c d9 05 d7 0e f3 98 c0 47 d0 6f f0 e6 c9 ..,.......G.o... 0040 7d 9e 6d e4 f4 02 a5 68 78 88 68 1f 31 60 d1 28 }.m....hx.h.1`.( 0050 d6 5e b4 38 78 41 f9 f5 08 aa bd 94 ef b4 0f de .^.8xA.......... 0060 af 8b b3 46 4c 4d ea c4 68 d4 0e 46 8a 1a 97 b6 ...FLM..h..F.... 0070 0b a7 f4 7c 1d 9f 77 ad b5 66 a0 66 43 29 e3 33 ...|..w..f.fC).3 0080 72 d0 36 87 e1 d0 20 fe d3 da 65 b1 0d 82 43 04 r.6... ...e...C. 0090 3d 23 1a 75 e8 b7 4e 10 35 d1 6d 5b 55 8c 6e 6e =#.u..N.5.m[U.nn 00a0 3f 4a 6b ec 41 d5 94 e5 56 a6 c9 30 da 33 af 1b ?Jk.A...V..0.3.. 00b0 07 a4 5d 35 fc 81 3a 49 9b 82 1b 72 51 ef ff 97 ..]5..:I...rQ... 00c0 bb 09 e0 b3 f7 41 66 94 a6 13 e0 5b c0 f1 f5 93 .....Af....[.... 00d0 ac 66 1b 39 9b f0 a2 69 45 7c 5f a5 e0 43 33 2c .f.9...iE|_..C3, 00e0 73 03 a5 9a 87 00 0f 31 e3 cf dc d0 fe a1 4a 56 s......1......JV 00f0 93 ff 76 ec 0e 3e 91 65 47 b3 43 af cd ea dc fd ..v..>.eG.C..... 0100 55 bf f8 e2 60 95 b1 99 e6 ea 11 67 93 8f 7d 57 U...`......g..}W 0110 f5 e4 a9 94 11 81 69 71 72 99 81 35 a2 a9 08 90 ......iqr..5.... 0120 46 4f f6 cf 2f 43 28 ae 63 6f 46 07 5b 03 96 3e FO../C(.coF.[..> 0130 f7 d6 d8 25 28 e9 c4 57 d0 97 c5 b3 b2 bf fe ef ...%(..W........ 0140 94 55 ec 19 af 3e a5 a4 30 14 10 55 1c ee 83 1c .U...>..0..U.... 0150 be b7 3a 31 31 ab 7c ec bd 20 61 57 37 cd 11 0e ..:11.|.. aW7... 0160 2d 4a e9 70 c9 33 7b 27 2f 60 d9 a2 2c 76 ee 98 -J.p.3{'/`..,v.. 0170 df cd d2 21 60 4d 85 b1 86 e4 07 b1 e8 f6 29 bb ...!`M........). 0180 a1 7b 34 45 12 25 77 e3 da 85 56 9c 36 f3 69 b0 .{4E.%w...V.6.i. 0190 3f 66 ab cd c1 8f ab 11 c2 d6 6a b5 6f c0 d7 73 ?f........j.o..s 01a0 ee 2f 59 a8 ec db 5a 02 7e fa bf 95 3f 03 28 ea ./Y...Z.~...?.(. 01b0 65 a4 ba 9d 32 67 b6 b3 03 d9 7b 13 69 6e 05 63 e...2g....{.in.c 01c0 45 c2 f9 b0 5a 5b f8 fe 3e 5a 3f 0d d5 37 cf e3 E...Z[..>Z?..7.. 01d0 25 01 81 6b a5 16 70 4c 82 6d 2b e5 fc 24 6c 45 %..k..pL.m+..$lE 01e0 72 67 35 9b 73 09 07 88 23 ae ad 60 fa c5 d7 11 rg5.s...#..`.... 01f0 f2 37 f3 0e 54 ae 99 51 7b 3c 45 e3 9b fa 0c 6c .7..T..Q{6..k..... 0290 b6 7e 1b 5e f2 2d 39 98 85 c6 b0 6e 4d 68 6a c8 .~.^.-9....nMhj. 02a0 b3 ba e8 13 97 65 ff a3 6c fa b0 a4 17 f3 65 63 .....e..l.....ec 02b0 82 d4 c1 70 85 22 0e 1c 8a 76 b4 fd de d0 e3 b2 ...p."...v...... 02c0 f2 91 bf 65 57 eb b8 74 8b 58 1c 8a 68 0b 1b 98 ...eW..t.X..h... 02d0 b2 56 2d 07 ec 36 60 e8 50 c4 4a 7e 40 34 80 1e .V-..6`.P.J~@4.. 02e0 ba 13 ad 87 07 1e be 99 31 61 7b 3e 8b bc 11 79 ........1a{>...y 02f0 84 eb 11 e5 1f e7 8d 5b f5 25 0b 41 7e 9b fc b1 .......[.%.A~... 0300 64 88 6b ed a8 fd 2a 9d 1f 1e 5a 85 24 f7 3c 3c d.k...*...Z.$.<< 0310 b4 2a 9e 3d 2a 20 ae 93 f0 b8 c3 0d 16 d8 f2 47 .*.=* .........G 0320 fd 4a da de c5 46 be 01 86 47 5a 42 99 e8 83 98 .J...F...GZB.... 0330 4a e1 f8 a6 c7 1c 75 75 2a ba db 48 e7 92 0a eb J.....uu*..H.... 0340 10 dc e6 d1 15 a7 29 90 4b a9 e8 77 4d fb 05 d2 ......).K..wM... 0350 db e7 77 85 ce 90 d4 49 7e e1 12 70 91 a5 f8 c1 ..w....I~..p.... 0360 33 06 19 d2 8d 17 5f 65 3c f7 f5 75 8e 21 94 90 3....._e<..u.!.. 0370 9d 7e 73 a3 39 7c 59 16 3f 0c a1 1b 4c 0b 91 02 .~s.9|Y.?...L... 0380 1b cc a0 92 50 2b 26 3a 89 de 2b f8 a9 78 88 01 ....P+&:..+..x.. 0390 12 db f6 61 30 05 76 db c8 34 c8 84 bb 3c 11 4b ...a0.v..4...<.K 03a0 4b 37 9f 33 4d 01 fc 35 bf ee 8d 7d f6 00 f3 62 K7.3M..5...}...b 03b0 63 6b 9c 81 34 ca 39 25 ef a7 82 60 db 60 71 44 ck..4.9%...`.`qD 03c0 ee db 51 4f cc 3d 49 fd 9b ab da d7 c5 54 eb 37 ..QO.=I......T.7 03d0 44 1c c9 00 88 78 cd 10 2f 15 79 08 08 22 49 6a D....x../.y.."Ij 03e0 60 86 e4 f4 93 57 18 50 b6 bc 12 8a cd 5b 31 0a `....W.P.....[1. 03f0 1d f0 75 31 29 cd e8 f8 21 e0 18 be 26 85 6b 02 ..u1)...!...&.k. 0400 0a a5 bc 4f 1d 08 e6 6f ef e1 ab a0 71 95 bf b7 ...O...o....q... 0410 f5 d8 1a 6e b2 9c 75 d1 69 e8 33 22 a8 37 47 21 ...n..u.i.3".7G! 0420 6a 35 be 1a c9 98 de 83 8e 41 ba 65 4a e4 a0 2f j5.......A.eJ../ 0430 e2 33 39 07 66 6b 89 a5 cf 88 5b e6 28 19 4c d2 .39.fk....[.(.L. 0440 93 81 f4 cf 02 6c eb d8 e9 84 d9 fd 1e 17 c7 07 .....l.......... 0450 87 e1 02 fb 6b 31 c8 70 a6 3f 93 b5 8b 83 e4 ba ....k1.p.?...... 0460 7e 1d 35 99 44 4b 02 4b c8 e9 8e 28 5b 4a 52 4a ~.5.DK.K...([JRJ 0470 e9 85 73 a3 ef 15 a2 4f 31 5f 58 96 7b fa e2 77 ..s....O1_X.{..w 0480 78 2b 3a e8 97 db e1 98 54 c9 9c 21 ea b2 da 14 x+:.....T..!.... 0490 3b 93 e1 fc 01 58 16 3d 1d 16 53 bd 2c e8 3c bf ;....X.=..S.,.<. 04a0 f9 3e 0f c1 dd 5e 14 dc 5f e1 85 7c cd e8 e6 31 .>...^.._..|...1 04b0 be 42 8f d1 f4 9b 65 e0 6e 3c 16 38 62 0a 53 28 .B....e.n<.8b.S( 04c0 97 05 ee 25 ad 04 b6 a8 5f cc 29 fa 11 4d ac 51 ...%...._.)..M.Q 04d0 b9 4d 01 7c db b4 a7 c1 d3 9d 1f 72 9d 4b 29 25 .M.|.......r.K)% 04e0 17 ce 6c 8b 8f 64 40 a4 f9 8b 10 b7 b1 b9 7b 6e ..l..d@.......{n 04f0 78 bf 4c e9 b2 8d 6b 24 bb a5 c3 e8 8c 8b 9c d1 x.L...k$........ 0500 b3 11 f1 96 9f 74 87 fa 92 f2 a3 35 b0 6f 2e 65 .....t.....5.o.e 0510 a7 fa 3b db 06 bf d8 94 cc 2b 04 bf 5a 37 c6 e5 ..;......+..Z7.. 0520 29 53 e0 1b ec c1 cc 27 aa 81 3d 28 86 f0 c0 02 )S.....'..=(.... 0530 bd 2e ed 49 d1 98 fe ad 21 93 8e b9 5c a8 d9 57 ...I....!...\..W 0540 73 bb 24 1a a7 68 0b 78 75 42 20 71 5b e6 f9 1f s.$..h.xuB q[... 0550 0a c1 68 90 19 d3 23 85 3a f2 20 40 4b 75 94 93 ..h...#.:. @Ku.. 0560 08 55 be fe 97 50 c8 d0 4b e3 8b a0 cf 3b 1f a4 .U...P..K....;.. 0570 39 9c 66 75 ea ff 2c 58 1c 53 9b c7 7e e6 87 a9 9.fu..,X.S..~... 0580 39 23 8e 85 9c 40 39 36 e1 08 54 c9 42 f6 25 6a 9#...@96..T.B.%j 0590 9e f5 82 0b 6b 2e 1b f6 df 5e 61 aa 57 c7 58 61 ....k....^a.W.Xa 05a0 a5 07 df d8 be 6d e0 9c 77 c0 5d 8a 6b 90 0a c2 .....m..w.].k... 05b0 bf 90 45 30 ..E0 No. Time Source Destination Protocol Info 3440 914.213697 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=25295 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3440 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.972201000 Time delta from previous packet: 0.000018000 seconds Time since reference or first frame: 914.213697000 seconds Frame Number: 3440 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x489c (18588) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x283c] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 25295, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 25295 (relative sequence number) Next sequence number: 26755 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0x976c] Data (1460 bytes) 0000 4f 79 1e 92 e4 dc 54 3d 3b 06 dd ea 6d d5 f6 f0 Oy....T=;...m... 0010 b7 7d 42 82 cf b5 17 9f 7f 1c 2d 07 9c b3 21 45 .}B.......-...!E 0020 16 5c 7f 28 36 b2 5c 34 5d a0 78 be ff c9 68 f7 .\.(6.\4].x...h. 0030 3d 29 21 01 f3 50 13 f5 62 c9 56 35 e1 c3 f0 65 =)!..P..b.V5...e 0040 24 cf af f0 53 95 fa a1 28 a9 3e b6 df 8e d3 2e $...S...(.>..... 0050 4e 99 1d e0 dc ae 10 21 dd 82 49 b4 e7 b9 c7 f5 N......!..I..... 0060 41 19 51 5c f4 85 f2 2e 71 d1 82 4f 31 94 ce 56 A.Q\....q..O1..V 0070 03 e7 cc 5e 0a b8 a2 75 3f fc 83 a1 f0 de 03 b1 ...^...u?....... 0080 9e c1 af 57 8a 51 20 39 e9 20 5a 83 1e cc 88 d0 ...W.Q 9. Z..... 0090 88 c5 0b e1 d4 a6 1c bd 2e 3b ee 94 ff 93 eb c8 .........;...... 00a0 61 dd 73 a5 bf a2 59 ca 0d d1 dc 30 72 56 f0 cd a.s...Y....0rV.. 00b0 26 41 72 b3 35 60 d3 cc f9 c9 93 87 9a bf d1 9a &Ar.5`.......... 00c0 86 2d c7 7b 42 bf 50 03 df f2 8c ee 07 de 76 eb .-.{B.P.......v. 00d0 69 1a 63 c5 c9 84 4f 34 63 d8 3e 39 45 df 96 51 i.c...O4c.>9E..Q 00e0 99 5f 6f 0b 40 b4 b1 9c 63 8a d9 b6 47 4a 72 9a ._o.@...c...GJr. 00f0 e4 81 92 51 93 48 9b ee 18 f1 e7 d5 0c e6 df 69 ...Q.H.........i 0100 8a f8 8e 14 5c e0 8e 3a ca 14 2e eb 5c 54 fc e3 ....\..:....\T.. 0110 39 56 8e e9 c0 f2 be 64 3f 0e cc 99 19 d0 38 4d 9V.....d?.....8M 0120 4b 7e 1a ba 75 c1 e8 27 d0 67 18 06 90 4f 60 50 K~..u..'.g...O`P 0130 b3 59 ca 6c 53 61 15 32 c4 bf 00 f9 89 a1 3c 6f .Y.lSa.2.......eV..R....!. 01c0 05 1f ea 6b 6a de e3 1e 2d 38 85 c7 0f 77 b1 2e ...kj...-8...w.. 01d0 51 92 6c 9e ee 4f cf 97 d9 71 72 6d 65 ca 2d d4 Q.l..O...qrme.-. 01e0 aa 9a ac 55 75 3d 4e fa a0 05 7b 83 ea 21 b6 03 ...Uu=N...{..!.. 01f0 4f b6 c7 d0 2f 88 a6 ca c0 c9 34 ff f3 70 95 55 O.../.....4..p.U 0200 09 12 10 2c 38 03 c3 bc b2 6e a1 05 b4 e9 4b 11 ...,8....n....K. 0210 59 8f b1 22 51 64 12 f9 bd 02 cc 5a b6 27 3e 02 Y.."Qd.....Z.'>. 0220 e4 86 83 74 2d 92 ca ff 39 fd 94 ec d3 45 07 cb ...t-...9....E.. 0230 70 f0 d2 6e 72 29 75 0c 5d aa 58 33 0d 15 6a cb p..nr)u.].X3..j. 0240 14 45 79 d9 01 2e b1 45 14 66 73 74 a2 67 72 cd .Ey....E.fst.gr. 0250 38 a6 79 c5 59 19 fa 1d 22 47 d3 4c de ac 18 2a 8.y.Y..."G.L...* 0260 ed 20 6d 79 cc 3b d0 e4 38 09 44 e4 3d d8 67 f0 . my.;..8.D.=.g. 0270 7b 88 d0 f1 b3 b1 27 f2 bc f1 f2 e5 68 21 1a 91 {.....'.....h!.. 0280 0e bd 88 8a 66 c1 37 48 5e 23 7b 7e 7d 5c 89 6e ....f.7H^#{~}\.n 0290 e5 94 0c b0 88 70 7e 26 90 51 1d d0 ea 44 42 c9 .....p~&.Q...DB. 02a0 00 b8 bc 28 12 65 a0 49 7f 3a 03 49 35 e9 be c9 ...(.e.I.:.I5... 02b0 c9 94 49 21 7d 4e 75 42 5d 09 3f c7 09 5a eb 81 ..I!}NuB].?..Z.. 02c0 1c a0 db 67 ee f0 de 42 71 6c de 13 0f 64 58 d1 ...g...Bql...dX. 02d0 29 83 ca 8f 65 83 09 03 33 a9 f7 bc 09 fe 23 be )...e...3.....#. 02e0 55 cd 79 c5 6f b0 a8 86 f6 e3 a7 49 8c 01 71 08 U.y.o......I..q. 02f0 10 4b c1 68 86 0d 45 35 fd 16 e1 a3 55 3f 73 7d .K.h..E5....U?s} 0300 a0 0e 11 d4 bc dd f9 84 90 66 1b bc 16 f1 f6 33 .........f.....3 0310 b2 14 79 00 3c a9 fc d7 51 ac 6e 7c e7 26 e9 ff ..y.<...Q.n|.&.. 0320 8e ed 3e ef f5 24 6c f4 5c da c6 3c f8 aa 56 48 ..>..$l.\..<..VH 0330 9d f3 bd 46 ca 36 fb 38 08 88 ea 7f 16 2f 37 fc ...F.6.8...../7. 0340 4b f4 5b b8 44 85 94 75 bf bf 50 67 d4 84 54 7e K.[.D..u..Pg..T~ 0350 09 63 5d 0d ff a7 5a 12 17 ec c6 87 e1 71 44 47 .c]...Z......qDG 0360 7c e9 2c 6e 64 19 d4 f1 a1 3b 38 d0 99 05 9c b9 |.,nd....;8..... 0370 72 3c 0b 88 4d fd 9b 50 96 d9 f8 7c 8e 8a 44 01 r<..M..P...|..D. 0380 ed ac 53 24 aa 0f a1 bd a3 39 82 f2 42 3b 9f 46 ..S$.....9..B;.F 0390 7f 87 fa a5 9e b4 fc a3 ae 5f c0 94 c1 59 10 00 ........._...Y.. 03a0 3d 56 12 69 27 67 75 09 29 e8 c0 38 13 02 25 7a =V.i'gu.)..8..%z 03b0 34 1c d7 d9 ef c2 b0 72 22 29 c2 10 38 23 61 6f 4......r")..8#ao 03c0 1e 4c 0b 30 e6 27 a1 97 11 5b c1 ea dc 54 59 df .L.0.'...[...TY. 03d0 eb 97 22 24 65 80 fa 1e fd 59 72 71 88 30 05 44 .."$e....Yrq.0.D 03e0 38 87 90 17 03 2c ca f8 c5 7f 53 6e b7 b0 42 eb 8....,....Sn..B. 03f0 89 19 2f 35 d4 08 49 19 00 84 eb e1 b9 dc af 76 ../5..I........v 0400 db 18 23 cb 5c 15 3c 41 7f c2 7a f0 54 2b 23 d1 ..#.\..q......,. 0540 4f 6c 56 d7 22 44 18 63 20 72 f5 72 bf 06 ed 5f OlV."D.c r.r..._ 0550 71 e2 d0 94 96 c1 e6 a1 c1 a5 be 61 97 1e 02 00 q..........a.... 0560 df 03 ab ee 77 b4 b4 dd da b0 2f 97 f8 4c cd 7e ....w...../..L.~ 0570 c7 c1 5f 9d ab fb 16 03 dc 30 f9 f1 95 63 2a 6c .._......0...c*l 0580 da 3c 45 82 13 cd 4a bd bf 6a e7 82 6e 14 34 ef . 1677 [ACK] Seq=26755 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3441 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.972217000 Time delta from previous packet: 0.000016000 seconds Time since reference or first frame: 914.213713000 seconds Frame Number: 3441 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x489d (18589) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x283b] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 26755, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 26755 (relative sequence number) Next sequence number: 28215 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0x17e4] Data (1460 bytes) 0000 2c 09 ff be 76 13 79 61 e3 ab 4c bd b4 c7 6a fc ,...v.ya..L...j. 0010 57 f6 ef d5 6b e4 31 5f a5 b7 bd cc 5c 3d fa c6 W...k.1_....\=.. 0020 33 b4 4c ab 37 fe a8 53 88 00 65 b1 1b 5d ce 4d 3.L.7..S..e..].M 0030 1d 86 94 a3 0e 84 cf a3 76 62 c1 2d 44 dd 09 79 ........vb.-D..y 0040 81 6b 37 20 c3 89 93 09 4f 68 85 0f dc 1d 65 1d .k7 ....Oh....e. 0050 16 67 68 ce 1f d9 b3 eb 27 13 b0 6f fe 8a a0 6e .gh.....'..o...n 0060 60 de 73 25 15 26 e4 d1 af a6 3a ec ca 02 84 84 `.s%.&....:..... 0070 e0 12 a9 91 07 d4 54 05 86 7d 88 17 21 8f 03 07 ......T..}..!... 0080 c9 f5 a8 e0 05 15 8a f7 35 66 ca 33 10 01 c3 3a ........5f.3...: 0090 94 be ae 19 14 a2 b2 62 1c 59 04 4c fc c2 04 e3 .......b.Y.L.... 00a0 87 14 ef 1f 9e 1e 2b d8 24 c6 63 6d e5 22 5a d0 ......+.$.cm."Z. 00b0 8a 9d 4c 7d ac d6 e4 8c 7c b4 38 2f 39 53 67 32 ..L}....|.8/9Sg2 00c0 11 22 65 a0 0a 15 5c c7 96 e3 05 84 bc 73 02 71 ."e...\......s.q 00d0 a0 65 82 b9 f8 3c 1e c5 49 51 ef 50 b3 e7 c2 a6 .e...<..IQ.P.... 00e0 25 36 d6 55 d8 e6 8f 72 43 cf c1 5e 0f bb ca 83 %6.U...rC..^.... 00f0 b5 7f e8 75 96 b9 af f6 ff af 5e 2b 98 73 b7 61 ...u......^+.s.a 0100 1b e3 f6 8a 64 a8 5c f6 e1 51 18 cb f9 de dc 24 ....d.\..Q.....$ 0110 31 e6 25 38 9e 93 5f dc 8d 8f a1 02 3a c6 03 6c 1.%8.._.....:..l 0120 98 26 4e 7f 56 c1 33 22 95 2d a2 bb 8d 66 57 2e .&N.V.3".-...fW. 0130 29 0d cc 43 71 e5 97 64 19 58 45 15 ba 57 8e 65 )..Cq..d.XE..W.e 0140 af 94 7d 46 44 c9 16 3c 75 ef ac 52 f5 45 88 66 ..}FD...u....s..J. 0360 a4 9f 40 4e d0 68 10 ff eb ed 72 00 47 4c f2 a9 ..@N.h....r.GL.. 0370 16 fb 30 1d 5e 61 c5 e7 d8 43 e3 13 3c aa fe b4 ..0.^a...C..<... 0380 18 1b e2 5c 2a 5a 92 f6 74 44 d8 0b a7 ff 8a f7 ...\*Z..tD...... 0390 9d 4e 35 24 7d 2a ab df ec e4 07 42 6f b3 aa 0a .N5$}*.....Bo... 03a0 c5 62 61 e5 e1 fc 72 c7 58 30 0e 8d 39 e2 d1 50 .ba...r.X0..9..P 03b0 1b 34 ae 00 80 02 6e 38 fe 4d 5f 55 5f 6c 6e bc .4....n8.M_U_ln. 03c0 49 85 b8 54 73 28 bf 1d 30 91 67 d3 92 6d ff 4c I..Ts(..0.g..m.L 03d0 e7 22 79 9b 32 93 df 9a 6b a1 db b4 13 e9 bd 5d ."y.2...k......] 03e0 d4 c0 c8 e0 d9 a3 b5 97 66 c3 56 0d 65 0b a2 b7 ........f.V.e... 03f0 0e 74 19 ca 0a 25 ed b4 91 f9 9f 41 e2 b1 44 35 .t...%.....A..D5 0400 99 02 3b 93 14 33 8d bb 06 9a 75 79 ce b8 ce 7d ..;..3....uy...} 0410 7e 7d 80 58 fd 0e 0e 7d 61 8c fd f0 c5 41 95 8d ~}.X...}a....A.. 0420 ed c6 ec 3f e7 16 90 ab 8d bb b0 0a e0 87 fe 24 ...?...........$ 0430 11 0b 9c 20 1c 2f 07 dc 41 22 7f 56 fd a4 ce 68 ... ./..A".V...h 0440 c0 39 fa 8b 04 f2 4b b4 49 4a cc ee 40 a7 c9 cd .9....K.IJ..@... 0450 04 b3 88 02 c3 b3 86 84 81 29 89 d9 b9 f3 44 d7 .........)....D. 0460 f6 f6 b8 4a 73 a4 e5 e8 a6 e0 75 98 83 88 37 ad ...Js.....u...7. 0470 fc 0f c6 bf 4c 81 a8 78 5f 64 ad 77 e9 74 65 a2 ....L..x_d.w.te. 0480 e8 56 3c c8 f9 3b a3 ad 9f 64 e1 ec c4 de d7 c8 .V<..;...d...... 0490 fc 28 ad 88 e6 32 97 69 bc 76 5b 0a cf 44 43 7b .(...2.i.v[..DC{ 04a0 f2 e9 d6 65 7a ea f9 df b7 71 63 5a e4 1b 56 93 ...ez....qcZ..V. 04b0 5b 34 2e 6a 80 73 29 b7 47 a0 38 79 4a fc 7b f2 [4.j.s).G.8yJ.{. 04c0 fd 71 5a 43 6a 66 23 c0 19 b3 dd e4 4d 55 d8 d7 .qZCjf#.....MU.. 04d0 af c6 6c 9f 00 31 f2 ab 93 8d b7 9f 0c c5 26 d8 ..l..1........&. 04e0 9b 0b 71 9f 0f 22 b8 29 23 f5 8a 59 18 ca e2 cc ..q..".)#..Y.... 04f0 c5 03 46 c8 33 7a 2e 5b 21 2a fb 12 03 c6 95 0c ..F.3z.[!*...... 0500 8c cd 59 9a e7 da 3a 04 fb c3 71 a3 ab f1 ce 59 ..Y...:...q....Y 0510 7b 8b 76 8d 5a f3 4f cd e0 31 5c d4 3d 2a f9 30 {.v.Z.O..1\.=*.0 0520 c3 76 65 b0 2f 53 2b 5a d8 8c 6a 51 0c b9 bb 6f .ve./S+Z..jQ...o 0530 b4 6c 2e 52 30 e3 0d d3 2d 59 b9 6a 03 7d 72 f0 .l.R0...-Y.j.}r. 0540 29 c5 8c 74 79 4e 9c 53 9e db e4 70 83 4d 88 49 )..tyN.S...p.M.I 0550 8e e1 d5 c4 2f 11 1a 92 39 0c e1 6f d9 c4 ca 9d ..../...9..o.... 0560 07 bf 2b 47 1e dd d5 96 85 e3 d2 4f 80 7e 68 6c ..+G.......O.~hl 0570 5c 7f d0 00 68 aa 23 75 72 af d4 9e 4e 97 94 c0 \...h.#ur...N... 0580 11 8c 39 d7 1e e9 95 74 0e 54 d2 f7 c6 f4 43 4c ..9....t.T....CL 0590 7e 03 99 55 2b aa 01 e4 c5 b7 0c ef 72 10 59 ec ~..U+.......r.Y. 05a0 fc ab 10 ad 57 ae d5 4a e0 ba d9 f2 85 ef 3d 5e ....W..J......=^ 05b0 a4 c9 08 94 .... No. Time Source Destination Protocol Info 3442 914.213728 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=28215 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3442 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.972232000 Time delta from previous packet: 0.000015000 seconds Time since reference or first frame: 914.213728000 seconds Frame Number: 3442 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x489e (18590) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x283a] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 28215, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 28215 (relative sequence number) Next sequence number: 29675 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0x7890] Data (1460 bytes) 0000 50 91 08 91 d2 0a f4 99 ef a4 96 da 84 54 7f 41 P............T.A 0010 3e c0 b9 98 9d 67 f5 ff 27 73 c1 63 28 56 a0 2d >....g..'s.c(V.- 0020 87 63 9a e5 f1 51 1f 4b 0d cf e9 94 10 14 81 b9 .c...Q.K........ 0030 be f7 bb ea d0 9a 5b 19 6f da c9 da 1e 51 d2 c5 ......[.o....Q.. 0040 6e c2 97 a3 a1 79 e3 91 17 dd 15 a5 c7 4f 32 6f n....y.......O2o 0050 3a 60 22 70 b9 e5 73 ac f3 bf 86 c8 4f 09 c8 51 :`"p..s.....O..Q 0060 a5 8d 14 fc 1a 64 19 7a e0 e1 0a b9 c7 5d cc 51 .....d.z.....].Q 0070 d6 a0 6a ad f7 b1 24 4a c1 2e 6b 3b 22 8f cc 20 ..j...$J..k;".. 0080 53 29 b0 7e 03 cd 75 a9 dd 8b a0 cd 41 c9 84 e2 S).~..u.....A... 0090 8f 53 c8 c3 58 3d 8d 21 f5 29 20 84 08 b4 77 2a .S..X=.!.) ...w* 00a0 6e 8a 2f d7 88 50 41 b9 e0 73 f7 45 ba 96 7d 9c n./..PA..s.E..}. 00b0 a0 5c af d6 92 2e b4 cd 78 29 a9 b3 81 aa 79 36 .\......x)....y6 00c0 d9 a4 3e 7c 3c bb 9d 2c 29 ba 0e e2 51 b1 f3 53 ..>|<..,)...Q..S 00d0 29 3d fa 6f 65 05 97 34 01 5e ad 82 09 c3 b0 cf )=.oe..4.^...... 00e0 41 83 98 bc fe 54 57 de 15 10 df e6 90 1f 97 11 A....TW......... 00f0 bb 5b 91 1d f9 d5 16 9e 6e ce 12 8f 45 14 a3 b7 .[......n...E... 0100 cb fe 2c 04 f6 09 24 cb a6 58 21 82 a8 ec 80 26 ..,...$..X!....& 0110 92 a4 68 1d 6b 35 e0 18 41 9d b2 43 f6 41 bf 54 ..h.k5..A..C.A.T 0120 75 22 5a 4a 92 a2 4c d0 27 36 1a 99 58 33 c4 e8 u"ZJ..L.'6..X3.. 0130 f8 05 db 59 b4 c8 c3 1a c0 ea 15 b1 42 8d 8c 00 ...Y........B... 0140 ad 9c ad 14 6f 36 f8 da ed e0 17 a2 17 4f c9 8b ....o6.......O.. 0150 4f 71 94 7f b0 76 9b a1 0a 90 53 3f 32 4a aa f6 Oq...v....S?2J.. 0160 0e 7e 37 42 57 93 d9 d5 8d 5d 96 fc eb 7a 2d a6 .~7BW....]...z-. 0170 a3 ff 8e 9f 2e f3 46 a3 6d 82 ea d3 81 13 63 63 ......F.m.....cc 0180 9b b7 3b 48 5c 8d 00 ec 62 10 e4 b1 75 d2 11 02 ..;H\...b...u... 0190 de c8 a2 57 2d d1 d8 25 f9 e1 1c 1d a4 7b 81 31 ...W-..%.....{.1 01a0 be 0b e5 1a a9 69 15 ce 0d 9f 7c 2f 2b fc f7 c1 .....i....|/+... 01b0 19 84 06 d7 be 23 55 10 60 6d f5 87 de 6b 40 af .....#U.`m...k@. 01c0 45 47 ef 24 e4 88 5c 6a 98 bf 82 b5 19 ec f3 e8 EG.$..\j........ 01d0 00 0a 1d 3d ac 04 49 dc 42 67 3b 06 e6 ca f9 52 ...=..I.Bg;....R 01e0 9e 3a 6b 07 9d 22 8a 19 f1 2d 2e 4c 00 56 9b 75 .:k.."...-.L.V.u 01f0 37 96 97 e0 50 d8 77 2c 47 cf 1c 70 2d 2b 0a b5 7...P.w,G..p-+.. 0200 7c 76 71 b5 6d c3 af 15 4b 86 2a 42 2e d6 bb 96 |vq.m...K.*B.... 0210 64 19 2c 35 a4 1a 7c d3 ab aa 32 66 92 aa be 35 d.,5..|...2f...5 0220 c1 5f 3c 27 b6 dd 00 1d 4f 81 d5 6f 4a 08 a7 e9 ._<'....O..oJ... 0230 be 8d ae 69 56 5c a7 03 d6 67 10 0c 68 c0 c4 4a ...iV\...g..h..J 0240 aa b4 16 b1 fb e3 03 5c 64 ff 24 bc d6 24 77 74 .......\d.$..$wt 0250 42 d4 de 49 b6 3f b1 cf dd 41 7d 25 4d f8 2f 2b B..I.?...A}%M./+ 0260 62 b1 13 a6 e1 c8 de b0 d7 fe ea 91 cb f9 dd 75 b..............u 0270 38 f4 7c fe 4a d2 af e0 61 11 1f 32 d1 6f 56 d1 8.|.J...a..2.oV. 0280 4a 7f 0e 0d 9f cd e7 32 a7 8d 3e cc dd e0 f5 bc J......2..>..... 0290 8b 2d 0a cf ca c6 c1 b6 2f d6 f2 6e dd 7c 75 cf .-....../..n.|u. 02a0 a9 0f 40 be c8 38 40 72 45 17 e3 51 72 71 f8 a8 ..@..8@rE..Qrq.. 02b0 4e d0 65 0d 6e fc 33 8c 86 2c 9e 43 84 3b 76 71 N.e.n.3..,.C.;vq 02c0 50 01 e4 b6 79 30 29 3c 7b ca 31 b2 dc ab 91 0b P...y0)<{.1..... 02d0 90 5f 17 23 2b 77 6c cc 70 2d 91 b8 37 6f b1 d7 ._.#+wl.p-..7o.. 02e0 77 b5 75 8b 01 7c 50 70 9c b2 ba 5a f3 ed 22 80 w.u..|Pp...Z..". 02f0 a8 ba 1b dd ec 0b 53 9a 07 e7 26 93 6c 48 8a 3e ......S...&.lH.> 0300 30 96 cb 02 17 ae 37 7f b1 c2 f2 a7 83 8f ea c0 0.....7......... 0310 4f 1d e2 a0 c0 f3 2f e0 00 06 09 7e a4 a7 6d a6 O...../....~..m. 0320 85 02 28 97 15 f6 f9 87 d0 4a 70 d8 ae 98 f8 f9 ..(......Jp..... 0330 01 a5 dd 57 f7 7b ed 81 c0 7e 20 6b 96 80 91 75 ...W.{...~ k...u 0340 7d d9 81 45 7b e1 ad 3f d1 13 f2 0f cc bb 65 32 }..E{..?......e2 0350 76 85 e0 94 de 0a b2 65 d6 45 9d d7 c1 4d 9e d3 v......e.E...M.. 0360 7a 20 47 d3 17 0e 7d 7f 0f ee 84 04 a3 ef c8 b9 z G...}......... 0370 28 ac 36 f0 b2 f4 d2 e5 59 ff 05 d4 45 e1 76 81 (.6.....Y...E.v. 0380 fe b5 b2 5d b0 2a 3f 74 98 6e cb 62 2f 16 3c cc ...].*?t.n.b/.<. 0390 f7 e1 ce 22 34 d6 61 31 5d e4 b8 05 20 cb 32 fc ..."4.a1]... .2. 03a0 d9 bf ef 85 5c 5a 76 26 08 df bf 5b 11 c7 d7 1a ....\Zv&...[.... 03b0 79 b1 42 6a 55 89 b5 89 ac ec d9 76 3c 6d 4d fb y.BjU......v....M(.$ 0400 0e 9d 0e 8b 45 52 93 79 3c 90 2d 8c 00 f6 0e 29 ....ER.y<.-....) 0410 93 38 c4 73 30 b7 d2 0e 9c f9 e6 92 57 d5 7d a2 .8.s0.......W.}. 0420 cf fa 4b 0d 96 81 6d 2f ee 44 4f e4 98 1a d0 72 ..K...m/.DO....r 0430 3e 03 32 9d 57 1e 9e 3c da c4 e4 0c 69 b9 54 de >.2.W..<....i.T. 0440 06 2d 21 6a f8 42 87 d3 f6 e4 02 e3 ee f6 e0 8c .-!j.B.......... 0450 ff e9 63 88 b8 b6 22 99 59 53 d7 37 af 06 86 98 ..c...".YS.7.... 0460 d6 55 85 ef 31 b0 5f 57 3e 1c 78 8e 0e da f9 a0 .U..1._W>.x..... 0470 af 8a 65 74 67 fd 53 a7 fc fc 51 e9 52 4c 11 98 ..etg.S...Q.RL.. 0480 fa 31 07 65 37 3c f3 f4 55 c2 4d 69 8d a4 1d 88 .1.e7<..U.Mi.... 0490 f8 f4 44 4c 47 67 e8 60 01 c4 d1 19 82 e4 b6 48 ..DLGg.`.......H 04a0 e6 8d 71 ec bf 6b 99 b1 6f 61 8e e1 68 08 f9 0c ..q..k..oa..h... 04b0 5b 2f 79 12 6f 8a e1 35 b2 c8 80 6f 13 fc 0b bf [/y.o..5...o.... 04c0 21 f3 d3 9e 0a ee 6b 42 90 e5 fe a4 ef 11 23 11 !.....kB......#. 04d0 6c 77 22 9d 0e 73 a5 21 f1 a5 a8 5c 01 fa 4f 7b lw"..s.!...\..O{ 04e0 a9 32 58 f4 ff 6a 9a a4 de 29 f4 23 7a bd 69 2c .2X..j...).#z.i, 04f0 63 37 a6 54 ff 8a 97 21 c4 c0 f2 09 b4 7b 40 34 c7.T...!.....{@4 0500 33 fb 13 b2 27 56 af 04 db f9 3b 19 7f 90 c6 92 3...'V....;..... 0510 ef 1e 62 87 25 df 6d 6c 44 fb c1 28 3c 90 34 7f ..b.%.mlD..(<.4. 0520 e7 5e 81 bd d0 32 ef 6b 23 b7 63 f4 5b 10 cb 35 .^...2.k#.c.[..5 0530 3f 86 d5 33 6c 45 db ec 15 4b 67 6c c0 96 4e 37 ?..3lE...Kgl..N7 0540 3a 3a 7b b5 5c e6 07 9b 1f 39 a5 80 19 41 c1 06 ::{.\....9...A.. 0550 fd 0a 81 d2 c1 41 d9 59 a0 cd 1b 88 b7 82 81 19 .....A.Y........ 0560 57 bd 14 92 86 dc 00 1d 72 ab 5d 45 7d 0c bc 34 W.......r.]E}..4 0570 6f 4d d8 eb 1d 00 5b 76 a1 4c 10 4d d6 49 d1 82 oM....[v.L.M.I.. 0580 2e dd e3 58 d7 8f eb 17 c0 2b 0a 9b eb ef c7 d1 ...X.....+...... 0590 77 f1 a2 5b d3 cc d9 51 42 ae ee 5a d9 a1 aa af w..[...QB..Z.... 05a0 7b 26 ae e7 71 3a dd 5c d9 e8 d2 3a 05 86 81 06 {&..q:.\...:.... 05b0 12 a7 99 9e .... No. Time Source Destination Protocol Info 3443 914.213746 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=29675 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3443 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.972250000 Time delta from previous packet: 0.000018000 seconds Time since reference or first frame: 914.213746000 seconds Frame Number: 3443 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x489f (18591) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2839] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 29675, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 29675 (relative sequence number) Next sequence number: 31135 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0x68f4] Data (1460 bytes) 0000 82 92 e1 6b 5f 84 63 54 04 c8 00 4b 9e c4 0c 7e ...k_.cT...K...~ 0010 4f f9 72 c6 5c 19 d6 fc d7 e2 f2 78 38 89 4c 78 O.r.\......x8.Lx 0020 b1 dd 7b 37 0d df 61 7b 8c 2c 61 38 a5 cc a7 9f ..{7..a{.,a8.... 0030 24 ed 19 dc 82 66 4b 55 60 a9 d6 c4 cf 1e 6a 50 $....fKU`.....jP 0040 b6 1c 54 89 fe 50 cd fb 83 e5 1b 2f cc 1b 16 aa ..T..P...../.... 0050 a2 41 46 78 c7 c4 b1 07 0c e7 f9 71 0f c3 3c 84 .AFx.......q..<. 0060 66 65 aa 0e 0b 14 43 03 72 65 e3 fd 8e 1c 73 36 fe....C.re....s6 0070 91 eb db ad 7d 84 1a 55 fb b1 b6 d3 3d 34 77 7f ....}..U....=4w. 0080 c4 dd 46 71 c0 f1 3d c3 51 97 d4 8b f5 66 61 35 ..Fq..=.Q....fa5 0090 2c 17 65 9e ed 04 eb 7e a6 3e 41 8a e0 80 c3 27 ,.e....~.>A....' 00a0 ef 01 d9 d4 d8 e5 cc 85 70 bf 33 fa 60 f9 7a 2f ........p.3.`.z/ 00b0 d3 da bb cd ae 76 4c d8 17 25 b5 2c 0b 81 66 2b .....vL..%.,..f+ 00c0 35 20 41 f9 bf 49 79 d2 e4 a5 fb 86 a4 83 ef 5f 5 A..Iy........_ 00d0 ea 2c 0f e0 28 7d 36 cb e8 4a 02 a5 4e fb 32 32 .,..(}6..J..N.22 00e0 e1 c7 39 0e f0 ce bc 73 d4 ea 79 19 eb a4 92 c5 ..9....s..y..... 00f0 3f 17 d5 8d ca a3 71 32 d2 49 5d f9 cc 6c 5a e0 ?.....q2.I]..lZ. 0100 8f da 6b e7 d6 46 00 db 56 20 4c a5 d4 c8 85 6a ..k..F..V L....j 0110 3c b5 33 38 3a 9c 53 5a 8e 2b cb 5f 21 13 29 ae <.38:.SZ.+._!.). 0120 b6 14 ec 6d 21 4e dd b1 76 f4 63 0b 28 e4 38 6c ...m!N..v.c.(.8l 0130 fb 98 96 b7 11 c8 b5 3a 3d 47 27 93 87 3d d5 a4 .......:=G'..=.. 0140 7f 36 84 f0 f5 0b 37 79 9a 98 96 b3 fc 8a ed 20 .6....7y....... 0150 12 1a 67 7c de 3e a7 25 4f 5e aa 36 2e af e8 5c ..g|.>.%O^.6...\ 0160 a4 f6 ab c4 82 44 19 af 22 24 d0 12 1c de 05 13 .....D.."$...... 0170 38 86 f5 69 6b f4 e6 55 44 48 d7 4b 14 02 9a 51 8..ik..UDH.K...Q 0180 5f 7f d7 fc 1e 4e 34 ad b9 9d 14 19 12 d6 43 63 _....N4.......Cc 0190 b0 a0 79 99 22 89 57 4b e3 2b 60 31 84 8a 45 99 ..y.".WK.+`1..E. 01a0 da b8 7c 0f 40 bd 4c 54 39 7a b2 e0 40 3d 8d 3a ..|.@.LT9z..@=.: 01b0 ff d3 d8 46 30 25 bb 9b 48 05 26 3a 1f e5 74 95 ...F0%..H.&:..t. 01c0 07 1e 05 3b 6f e6 43 6c b0 42 32 ac 24 6b 2e 70 ...;o.Cl.B2.$k.p 01d0 69 a1 e6 fb 93 34 fa 86 f8 a3 ab 0a 2c 65 82 bf i....4......,e.. 01e0 b2 0a 8d c4 0a 6c a7 e0 88 98 dd 1e b1 29 ab 95 .....l.......).. 01f0 86 19 a3 24 ab b9 fd 11 a1 b1 c6 b4 eb 88 5c d8 ...$..........\. 0200 e3 ee c8 55 4b f8 0e 35 0a cc 21 3b 7d 0a 48 62 ...UK..5..!;}.Hb 0210 51 38 20 6a 88 e1 af cf d8 55 59 f8 42 89 38 62 Q8 j.....UY.B.8b 0220 3f 0b e8 fc d1 3d ba 24 90 2a ea 0e c9 6b 26 1d ?....=.$.*...k&. 0230 a9 67 fe 27 98 93 ba 27 c2 f2 4e 16 ac cd 59 bf .g.'...'..N...Y. 0240 74 7a 98 b4 8b e6 e9 5f 6b 3f 1e 5e 57 05 af 2f tz....._k?.^W../ 0250 47 69 8d 3f 65 ce fe 2a 55 5b bd fc 8a 32 55 06 Gi.?e..*U[...2U. 0260 c5 fd 56 e8 6a 51 e2 c0 56 cb 6f 0e ea 03 69 76 ..V.jQ..V.o...iv 0270 c0 15 33 6c 35 7e 7e 65 e8 84 7b 84 76 57 e0 8b ..3l5~~e..{.vW.. 0280 57 53 bc fa ae 0e 6d c4 1a 71 f8 26 98 a2 09 a6 WS....m..q.&.... 0290 0c 84 0c a6 18 cb 8f 16 ac 43 75 a8 bc 58 2a 8e .........Cu..X*. 02a0 57 5e f6 c3 c4 9e db 5a 0f 44 b5 54 87 78 de 9b W^.....Z.D.T.x.. 02b0 b5 9a f1 a9 d5 a3 40 cd ee 64 61 dc 20 8f d8 fc ......@..da. ... 02c0 86 9f f0 2b 00 c1 60 c3 b5 b3 29 22 3e e2 02 c0 ...+..`...)">... 02d0 21 7d ca ac b4 67 b1 77 e8 d7 ef 1e 59 41 cc 91 !}...g.w....YA.. 02e0 55 09 11 5c d4 0b 73 f2 47 f9 75 60 39 ba 7e a9 U..\..s.G.u`9.~. 02f0 71 19 95 02 80 1d 87 93 cf fd c1 74 84 2e ed 8c q..........t.... 0300 53 3c ac 2e 86 0a bf 69 95 d1 90 d1 70 cc 72 e8 S<.....i....p.r. 0310 b7 e2 17 4e 64 ad fd c8 a6 0c e3 fc 61 09 e5 8d ...Nd.......a... 0320 1f 06 b2 35 95 2f 6b 14 c4 58 a7 4b 1f 53 72 ad ...5./k..X.K.Sr. 0330 f4 8f 11 e2 38 78 82 83 ca db ed 04 f7 b8 db fc ....8x.......... 0340 2a b3 9c 45 43 ff 79 16 65 69 dd 43 7d 0c 49 fa *..EC.y.ei.C}.I. 0350 08 77 f4 bd c5 07 5e ba da 2d 86 45 07 af 0b c5 .w....^..-.E.... 0360 25 99 be c3 8b 50 b0 b0 27 57 e1 ea 4c b1 f5 f2 %....P..'W..L... 0370 6f 90 51 18 84 62 ec f7 92 b4 f4 04 c6 1b 27 c3 o.Q..b........'. 0380 65 02 f8 27 00 ff b8 36 ec 02 f7 8f 54 fd ea af e..'...6....T... 0390 7c c1 cd c1 f5 d7 38 77 39 2d 19 c4 81 17 2b 5d |.....8w9-....+] 03a0 d7 4e 6c 8c 7f a3 10 4c 6d 39 f3 3e c2 aa f4 4b .Nl....Lm9.>...K 03b0 63 80 83 20 d7 93 4d 87 cd 74 2f aa 78 8c 32 46 c.. ..M..t/.x.2F 03c0 d0 26 96 02 08 3b bb 01 85 f4 2f d7 81 02 8f d6 .&...;..../..... 03d0 ef f8 11 ab 5b 58 fc 00 30 28 34 43 b6 ac bf 74 ....[X..0(4C...t 03e0 b1 20 01 b4 c1 6e a3 d5 79 48 ad 53 7f 37 c1 2f . ...n..yH.S.7./ 03f0 e2 ab d8 46 0a 7d 18 aa 03 5c 3e e4 80 3e 47 02 ...F.}...\>..>G. 0400 b4 9e b7 0f 92 eb 45 56 7d 7e e8 19 24 df 43 70 ......EV}~..$.Cp 0410 92 75 8e e9 52 9a f3 91 15 9c 6f 5c 3f ec 60 d9 .u..R.....o\?.`. 0420 8f 99 28 8b f1 d5 63 5f e4 ce 9c fb 14 01 0b db ..(...c_........ 0430 6f 11 50 02 7e 84 08 6f b7 49 aa 7e dd 89 bf 8b o.P.~..o.I.~.... 0440 ed a0 57 f2 e2 59 b2 bb a7 13 66 3e 69 7e 35 14 ..W..Y....f>i~5. 0450 a5 bd 1f 9b c7 de d1 c8 eb 5f 34 01 31 a6 0d 65 ........._4.1..e 0460 7f 38 09 e9 53 72 e6 7b 54 7a 2c d0 b2 98 2c 9c .8..Sr.{Tz,...,. 0470 75 36 88 f4 32 b0 e0 74 03 6f fe af 3b 20 bc 92 u6..2..t.o..; .. 0480 2b b5 d1 a7 ee 0b f7 5b 79 c0 53 0f 89 c7 47 e9 +......[y.S...G. 0490 6c 0c 84 65 b4 9b 8a b4 07 04 83 79 7e 34 27 2f l..e.......y~4'/ 04a0 ea 8a d1 a9 23 e1 b7 15 18 7e c1 64 0c 07 e6 45 ....#....~.d...E 04b0 fe c5 10 c6 ac 3b d9 93 97 17 f2 bc 58 15 b9 35 .....;......X..5 04c0 0d 31 58 c9 11 f9 64 7c e1 f7 e1 bc 3d a2 8f be .1X...d|....=... 04d0 e0 e8 51 44 dc 8b d2 e9 c2 8b af ee 14 cd e5 a4 ..QD............ 04e0 fb 39 8c 8c 91 60 fa d5 1b 55 68 5e db 49 1e 51 .9...`...Uh^.I.Q 04f0 f8 18 4d d1 64 62 ad 08 88 dd ef 6a 9d 35 1e 79 ..M.db.....j.5.y 0500 7e 56 b2 23 cc aa ed 6b 08 c6 2e 8c 9d 15 71 a0 ~V.#...k......q. 0510 45 f0 ea f8 2b 65 52 d4 53 36 8c 9e 70 22 a9 7b E...+eR.S6..p".{ 0520 14 84 69 c0 3b 76 1d 48 f7 b1 01 b6 b1 53 2f 06 ..i.;v.H.....S/. 0530 85 29 05 14 7c a5 10 95 72 d9 41 a8 c4 b5 cd 5e .)..|...r.A....^ 0540 f0 24 96 9c 92 e9 03 c5 bf 6b 49 50 d4 c1 45 5d .$.......kIP..E] 0550 ea 8b 85 0f bb 6a 41 ff 31 76 fd 6f ce f2 53 b9 .....jA.1v.o..S. 0560 72 2b 1d fa 6e 0f a0 1b 0b b5 63 2e 4d fa 60 18 r+..n.....c.M.`. 0570 97 7b 13 fc ab 2e b8 a2 e7 07 c2 31 4a 7e 33 61 .{.........1J~3a 0580 dc 9c ad 4a 3c b6 27 c3 ef 65 35 db c2 05 ed 80 ...J<.'..e5..... 0590 a4 8e 3d 65 54 03 20 48 ae 61 f0 8c 8b 42 d0 c2 ..=eT. H.a...B.. 05a0 76 82 5d 60 eb a3 a3 e5 dd 7a 66 85 15 18 9f 3a v.]`.....zf....: 05b0 9f 5e 9b c3 .^.. No. Time Source Destination Protocol Info 3444 914.213758 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=31135 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3444 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.972262000 Time delta from previous packet: 0.000012000 seconds Time since reference or first frame: 914.213758000 seconds Frame Number: 3444 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x48a0 (18592) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2838] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 31135, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 31135 (relative sequence number) Next sequence number: 32595 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0x0227] Data (1460 bytes) 0000 13 91 4c cb 38 06 e5 b2 07 f7 ae 8b 2a 96 3c e5 ..L.8.......*.<. 0010 80 be a1 1b d1 de 91 9f ff 1f 2d e7 db 4a 1c f5 ..........-..J.. 0020 38 9d 4c a9 ea 75 72 e7 44 bb 9c f4 f5 1c f9 80 8.L..ur.D....... 0030 0b fa 51 3a 00 ef 26 d4 bd 65 f5 83 27 7b 61 64 ..Q:..&..e..'{ad 0040 78 0d d1 f0 2c 7c 60 af 8e fa c0 b4 c5 86 a2 16 x...,|`......... 0050 cd 2f 64 53 df 36 81 b9 24 f6 39 98 88 6a ca 3c ./dS.6..$.9..j.< 0060 3b 94 69 f7 12 56 d6 74 41 fd 56 a8 29 3c 75 71 ;.i..V.tA.V.).3.+. 00a0 1d c7 cf c6 c2 40 e5 de 55 dc a6 e5 36 e6 04 45 .....@..U...6..E 00b0 09 3d 16 c0 94 85 10 81 e9 81 08 74 44 b4 ae ec .=.........tD... 00c0 bb 22 23 11 e2 2f 58 2d 9e 8d 3f 8c e8 02 ad f6 ."#../X-..?..... 00d0 83 e1 60 22 e1 9d 28 5f 6a cb 35 d8 a1 2c ae 19 ..`"..(_j.5..,.. 00e0 ab 56 55 63 2e 39 c1 bb d4 7e 1c a6 ac 45 44 a0 .VUc.9...~...ED. 00f0 b0 d7 77 e5 dc ed 2d 24 51 38 4b af 7c 19 aa 0b ..w...-$Q8K.|... 0100 a5 88 32 ad 23 08 c0 bf 1a 61 b0 2f 1f b4 15 b1 ..2.#....a./.... 0110 de 4f 40 fa 81 ba b6 ff 0e 09 6d f1 01 84 74 73 .O@.......m...ts 0120 ce 54 65 b8 ac c8 82 85 e6 34 32 5c 61 bb fb ae .Te......42\a... 0130 d1 7f 62 44 5e 35 c4 3c 66 ce 7e 5b da 97 66 34 ..bD^5.......N.Okhu 04a0 ed e5 47 83 86 80 86 2e be ad 3a 2b 3e 02 31 67 ..G.......:+>.1g 04b0 dd 2a 09 d1 27 c3 98 e7 86 09 05 cd 7a 3c ad 15 .*..'.......z<.. 04c0 ff 97 a2 43 7d a9 c3 43 28 ed e8 51 40 6f b6 26 ...C}..C(..Q@o.& 04d0 29 79 f0 76 d6 57 73 18 c9 80 df 32 36 28 fb 2b )y.v.Ws....26(.+ 04e0 5d df 35 fe f0 6b b6 d5 71 ca 7a 4e d7 6d 56 44 ].5..k..q.zN.mVD 04f0 62 37 0c 95 86 a8 a7 e2 01 42 70 4f ca cf df 30 b7.......BpO...0 0500 06 f0 a7 d4 41 a0 27 c2 d0 7a 1f 4c 60 02 dd c0 ....A.'..z.L`... 0510 00 f8 64 e2 9a 9d b8 54 a0 46 74 7a cd fb 79 24 ..d....T.Ftz..y$ 0520 a6 2c e9 33 29 c2 4e 6e df b1 f3 1c cb 9e 9b 90 .,.3).Nn........ 0530 f6 d2 61 0b 73 f4 a5 2e 1a c3 ba 28 cc e3 8e 5a ..a.s......(...Z 0540 a9 e8 90 3f 1b 62 4f 63 cc cf 1d 2b cc f1 da 57 ...?.bOc...+...W 0550 85 3c 8e 48 97 04 f7 02 40 de 5c e6 40 37 27 1b .<.H....@.\.@7'. 0560 db 80 8b 51 79 f5 6d c0 85 bc 6c 86 85 1e f9 78 ...Qy.m...l....x 0570 6f 48 05 5a aa 77 c6 a4 37 10 44 8a ba b8 ca 1a oH.Z.w..7.D..... 0580 9b 95 30 c7 c7 72 d7 83 34 9e e5 4b 75 08 68 be ..0..r..4..Ku.h. 0590 11 be 9f 64 b9 16 71 0c c8 a5 40 ec 39 84 16 95 ...d..q...@.9... 05a0 a5 c1 81 ff 0d f1 e6 13 92 1a 14 08 44 ef f3 8c ............D... 05b0 69 7f ec df i... No. Time Source Destination Protocol Info 3445 914.213770 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=32595 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3445 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.972274000 Time delta from previous packet: 0.000012000 seconds Time since reference or first frame: 914.213770000 seconds Frame Number: 3445 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x48a1 (18593) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2837] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 32595, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 32595 (relative sequence number) Next sequence number: 34055 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0x7281] Data (1460 bytes) 0000 8e bf 32 78 4c 9c 47 12 f9 2b 9e 0e 53 36 0d 91 ..2xL.G..+..S6.. 0010 ca 1c eb 12 34 ab 66 90 46 33 64 f8 1b 5f 7f f6 ....4.f.F3d.._.. 0020 0e f8 86 cb e4 12 b5 6c 47 64 d9 56 e8 3d 82 a0 .......lGd.V.=.. 0030 7b 7e 37 94 54 75 3f 1c d5 e7 9a 9e 81 a4 76 40 {~7.Tu?.......v@ 0040 97 0d 5f e0 b1 21 4b 8a 24 91 c2 f7 cc 17 76 6a .._..!K.$.....vj 0050 a9 32 60 79 5e 54 7e 1c e6 22 e2 10 e1 86 b9 85 .2`y^T~.."...... 0060 65 83 b0 ec fc 4c 36 1b 3f 3d a6 98 09 5a 56 45 e....L6.?=...ZVE 0070 33 a7 9d ae 93 6f 6b 4a 2c fe 69 b6 8f 68 4c 4e 3....okJ,.i..hLN 0080 12 5b 7c 93 6d 0d 5f 95 01 c7 bf b6 79 79 4b 34 .[|.m._.....yyK4 0090 95 58 52 3c 7c f1 ee ab 4a 9e d7 21 9f bd 6e 60 .XR<|...J..!..n` 00a0 b8 19 04 36 20 49 86 8c 00 8f 0f 52 78 98 6a 3c ...6 I.....Rx.j< 00b0 f5 7a d0 38 b2 6e b2 bc 1c b4 ad 4d 10 14 a5 19 .z.8.n.....M.... 00c0 96 be 0a 4c 8f 90 bf e4 7a 61 30 b9 8a f3 6b 91 ...L....za0...k. 00d0 8e 7a fb ad 71 3c d8 c8 cc d6 7a 8c cc 48 47 50 .z..q<....z..HGP 00e0 a7 ed f7 97 1f 90 5d 5e 2b c7 88 f6 76 15 42 46 ......]^+...v.BF 00f0 ba 69 b5 8d 37 76 5a a8 99 0b 3d 7c a4 a7 9d ba .i..7vZ...=|.... 0100 9d ef e1 02 3a 5a 46 91 a8 4a 4a 0d d3 cb 5c 64 ....:ZF..JJ...\d 0110 03 49 5a 5f 8e 41 ed 73 a8 8a 71 9b bb 75 a2 c8 .IZ_.A.s..q..u.. 0120 71 1a 9a 3d 0b 8c 53 1d 1c 67 68 7a 1c 6a b8 d4 q..=..S..ghz.j.. 0130 09 78 88 fa 7e 23 1e 7d 6d a2 d2 c2 c5 f6 e3 9d .x..~#.}m....... 0140 9e e4 49 6f 0c 69 d1 78 3e 8c 19 c3 3d fa 8a c3 ..Io.i.x>...=... 0150 57 39 4e 1b fe ce 6f fd 67 4d 7b 16 d3 70 08 4b W9N...o.gM{..p.K 0160 f9 b8 56 78 de e1 80 c5 39 d7 8e ef 93 af 24 b4 ..Vx....9.....$. 0170 e6 3a a9 8c 52 65 20 f5 f8 a6 a9 17 35 5b bb 3d .:..Re .....5[.= 0180 50 14 ff de 3f 36 10 b5 87 34 0c b5 ce ab 56 d7 P...?6...4....V. 0190 81 db a8 f7 4e db fb 47 77 0f dc 32 2c b6 75 4f ....N..Gw..2,.uO 01a0 b9 49 bb 8a 2e 41 fe 03 10 91 90 9f 3a 9d ca e7 .I...A......:... 01b0 7e 84 c4 6c ec b4 a6 0a ac b4 3b 46 d4 3e e9 22 ~..l......;F.>." 01c0 d9 99 18 50 00 13 c1 b8 99 95 4b 5a 8b cd 0c 54 ...P......KZ...T 01d0 a0 88 22 d3 ec 82 1a 86 1a 67 c8 1d 2d 14 cd 11 .."......g..-... 01e0 5d d0 23 25 fc c9 8f 81 75 50 56 ba 38 fe d5 43 ].#%....uPV.8..C 01f0 84 60 f0 f0 c2 1b 6f 63 56 6c fe cc 3f c0 04 c9 .`....ocVl..?... 0200 47 4b 66 e3 71 df 80 9d 06 31 26 c7 f0 21 47 9b GKf.q....1&..!G. 0210 66 7c c1 1a 6e f2 6a 02 53 28 21 7d 7f 7a 03 fc f|..n.j.S(!}.z.. 0220 5c 67 9b a4 c2 52 7e de a4 5c 97 c3 03 d6 e5 90 \g...R~..\...... 0230 73 b0 36 a2 75 d8 80 34 b6 8d 4e a2 18 65 5d 26 s.6.u..4..N..e]& 0240 e2 71 26 b4 bc 90 bf c2 7a a8 bb 25 20 fb 93 19 .q&.....z..% ... 0250 5d dd a0 b0 e2 ef 65 5d 1b b9 cb 6f 1f 66 7f fd ].....e]...o.f.. 0260 d5 9c 8a 41 8b 0d 28 95 72 ae ed 8e ee 69 d6 9c ...A..(.r....i.. 0270 7e 7c b0 4a 9c 10 1a 91 56 67 f8 6c 2f 68 8e 7e ~|.J....Vg.l/h.~ 0280 38 33 6a d5 37 16 91 44 4d ac ea a3 25 28 71 ee 83j.7..DM...%(q. 0290 e6 6f 22 32 ea 07 1c cc e1 aa 9c fa 00 e7 b9 af .o"2............ 02a0 3e 9d 0b fb 30 20 a4 b2 44 27 7a ed 77 c4 d4 c0 >...0 ..D'z.w... 02b0 f2 97 5c c7 19 78 88 53 4f 65 c5 c1 38 a3 ce 7f ..\..x.SOe..8... 02c0 e0 7e 8c 29 54 8e a1 01 c5 ac c2 f9 2b aa d6 84 .~.)T.......+... 02d0 af 8c a1 67 9f 47 c1 71 54 8b 88 16 43 36 29 ce ...g.G.qT...C6). 02e0 25 7b e9 91 da 4d 5e f4 d9 dd 36 3c 52 78 e2 98 %{...M^...6[4o[ 0390 2f 7d 4e 33 f4 8e c2 28 2c d4 e2 ad 3a c6 3f 82 /}N3...(,...:.?. 03a0 33 1a c7 d1 bb 96 3a 42 cd 51 27 b0 b0 69 e5 a4 3.....:B.Q'..i.. 03b0 ed b2 20 a7 00 f9 09 03 a7 eb 4d 79 d9 65 2a e4 .. .......My.e*. 03c0 d1 45 92 ed 28 b4 eb a4 20 35 2b 80 06 a3 4b a3 .E..(... 5+...K. 03d0 72 f9 a8 2b 46 b5 76 ff d4 6b 2e b3 d0 5b d1 3b r..+F.v..k...[.; 03e0 97 ae 79 0d b3 0e c4 17 48 f5 6a 94 8d 14 fd 8d ..y.....H.j..... 03f0 ee 42 51 78 cd a8 8e 03 4b e8 08 54 1b b3 66 46 .BQx....K..T..fF 0400 49 17 48 28 43 20 f3 1a f2 63 e4 1f d1 52 9f 23 I.H(C ...c...R.# 0410 56 fa 82 d6 5a 0f b9 58 08 cd 80 e5 3b 61 62 82 V...Z..X....;ab. 0420 3d 18 d9 ca b3 b7 a1 75 dc 3d 24 2d 44 a4 0e 2a =......u.=$-D..* 0430 64 6c ac 4b 0b b2 ea fd 90 3f 5d ab 0e 0a 9e ca dl.K.....?]..... 0440 5a 13 72 e8 a8 a5 e8 5b d1 39 4f 13 af e8 51 35 Z.r....[.9O...Q5 0450 2a 39 b1 d8 07 d4 69 38 d1 00 b1 bd 3f 90 83 99 *9....i8....?... 0460 ab 52 3a 83 1a 18 32 cf 8f 8d bb 06 93 2a 8b e5 .R:...2......*.. 0470 85 2e a8 1b 24 86 a2 e1 c1 1d 60 6d 04 e6 c4 16 ....$.....`m.... 0480 c7 00 93 47 79 55 9e 74 a9 5f d3 88 d4 83 e8 b3 ...GyU.t._...... 0490 dd 05 ff 3a a9 c5 0c 9a 70 e1 c4 c1 99 8b 9e 99 ...:....p....... 04a0 78 f2 06 c5 c7 56 88 84 e0 cf 9d 48 ba ec bb d1 x....V.....H.... 04b0 48 2c fb 8b 16 f5 c9 f2 30 a4 9f f4 59 e3 e2 40 H,......0...Y..@ 04c0 1a 08 91 c5 e5 cd a6 26 63 ca 30 62 e0 40 c1 63 .......&c.0b.@.c 04d0 47 9a 5b 05 88 67 e0 62 b7 ba f9 e6 b5 27 b8 70 G.[..g.b.....'.p 04e0 e8 9b 8a ff e2 da bf d0 72 78 ee 2b 16 04 ee 73 ........rx.+...s 04f0 df 45 b2 cf 8b 92 93 1f 30 63 61 f5 16 62 db a8 .E......0ca..b.. 0500 ef ee 44 45 85 06 af 15 05 2b 5a 17 c5 94 d1 fe ..DE.....+Z..... 0510 48 ee 05 ab 7a 38 d0 7f 69 8e 35 aa e1 69 0e 9e H...z8..i.5..i.. 0520 f5 6d 65 3e dd 62 1a 22 6a b8 52 10 08 61 3d ba .me>.b."j.R..a=. 0530 b6 a7 c0 fa e7 37 e0 b5 8c 07 e8 c7 37 7c ca 6d .....7......7|.m 0540 ff a8 a7 9f 2c be c3 9b 12 56 85 56 a9 54 a5 d5 ....,....V.V.T.. 0550 a0 49 72 aa 45 5d ee 68 69 33 62 b3 b8 b6 be f0 .Ir.E].hi3b..... 0560 e5 a9 24 fd 65 80 52 75 09 f7 a8 a3 ff e0 e0 3a ..$.e.Ru.......: 0570 2f e1 46 fa 43 c2 01 0a ed be 52 47 f1 2d 6b 87 /.F.C.....RG.-k. 0580 be 7c 6a 1f 6e 60 7b 1a 79 b3 22 4f 49 7d bf ec .|j.n`{.y."OI}.. 0590 9a 20 7e 97 ec 57 5f 79 bf 21 91 1b a0 7d ef 91 . ~..W_y.!...}.. 05a0 d8 8e 67 77 9c 7c 06 07 59 85 cb a3 38 d8 b5 78 ..gw.|..Y...8..x 05b0 de 8b 73 fc ..s. No. Time Source Destination Protocol Info 3446 914.213782 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=34055 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3446 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.972286000 Time delta from previous packet: 0.000012000 seconds Time since reference or first frame: 914.213782000 seconds Frame Number: 3446 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x48a2 (18594) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2836] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 34055, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 34055 (relative sequence number) Next sequence number: 35515 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0x226c] Data (1460 bytes) 0000 d8 fa 19 fe 82 23 26 14 55 bc 3c 39 f9 a2 07 2e .....#&.U.<9.... 0010 75 4a 75 e7 e8 df 07 40 d1 ca 08 06 7f d1 e1 f6 uJu....@........ 0020 97 42 ac 4e ca 8b 47 96 35 6a c7 85 88 d7 ab 64 .B.N..G.5j.....d 0030 f0 b0 07 89 a8 82 68 83 9b d7 94 3a 61 cd e3 bd ......h....:a... 0040 2f f2 22 47 90 20 f7 3e d4 15 3b c4 84 db dd bf /."G. .>..;..... 0050 79 5a aa 1d 07 88 ab 67 c5 3d 20 90 16 62 c5 88 yZ.....g.= ..b.. 0060 52 23 82 93 28 d5 38 df 8e e2 fb be b5 7b a7 d7 R#..(.8......{.. 0070 ef 75 a3 e3 d9 f7 a2 97 38 8b 86 d1 2a be e0 f7 .u......8...*... 0080 60 22 3f 84 91 42 e8 34 0e d6 ee de 9b cb a4 11 `"?..B.4........ 0090 32 ca 1c 62 e9 6e 94 dc ae 0f 4c 8b 83 e2 45 28 2..b.n....L...E( 00a0 83 52 94 f1 0b c4 bf 1a 46 84 48 33 1c b7 78 2f .R......F.H3..x/ 00b0 4b 43 98 f5 c6 41 75 d0 cd 86 4b 8e 93 a7 d2 a3 KC...Au...K..... 00c0 ea 07 b8 e9 9f b6 52 9c dc 35 02 69 0e 18 30 b2 ......R..5.i..0. 00d0 fe fc 71 38 d7 57 bc d3 6d a8 41 80 72 be f0 bb ..q8.W..m.A.r... 00e0 61 11 a1 62 5c 0b 66 dd 52 46 60 f4 d1 f5 8a 8f a..b\.f.RF`..... 00f0 5a 84 47 09 d9 1b 68 bb b5 8b fb c9 49 1f 30 9c Z.G...h.....I.0. 0100 6d e3 b0 e7 9a 73 20 1b 8a 6a 48 ae dc 90 bc a7 m....s ..jH..... 0110 39 c2 27 a9 b1 db f9 f9 a3 2f 75 ea db d6 b6 9c 9.'....../u..... 0120 54 d3 eb 75 48 88 f8 e0 87 fe a0 a9 ee 73 29 c0 T..uH........s). 0130 8d 62 b9 97 8b d5 5a 0b 8d 01 81 36 5e d8 d3 80 .b....Z....6^... 0140 5e 8b bc f4 2d e7 b9 10 ba ab 68 a1 e1 6c f1 9f ^...-.....h..l.. 0150 e3 93 35 ae d2 d7 6f cd 40 9c 41 bc 7f ec 91 59 ..5...o.@.A....Y 0160 1a fa c0 d2 64 d6 32 09 78 09 34 a3 38 52 bc 83 ....d.2.x.4.8R.. 0170 c9 e9 d1 4a 73 74 aa 8e 93 63 7b 35 cc c7 3d 83 ...Jst...c{5..=. 0180 b2 96 79 cf 35 1e 28 98 e5 92 a1 ff ae 47 00 f0 ..y.5.(......G.. 0190 47 1a a9 79 d6 c7 20 c5 85 83 a7 98 23 cc e2 d9 G..y.. .....#... 01a0 73 52 3e 37 6d 77 74 ca c7 4d 58 f1 4d 1e 8c 48 sR>7mwt..MX.M..H 01b0 dc ab ed 4b e8 a5 a6 e5 de 2e b4 19 ca 0f a7 5d ...K...........] 01c0 e0 86 fd e1 c9 ae 45 02 bb d9 8e 17 2c ff 76 72 ......E.....,.vr 01d0 45 c4 7c c1 b9 f6 51 ec 65 76 cf 52 b7 e0 b5 2b E.|...Q.ev.R...+ 01e0 77 2d f8 af 78 34 f8 0c d6 06 ac 95 d0 f7 ec 38 w-..x4.........8 01f0 5a 76 42 5e 2f d7 df 1a fd 1b 64 1f 41 ea cf 82 ZvB^/.....d.A... 0200 07 53 3d c5 69 89 34 0c 0b 19 62 89 18 6d 54 80 .S=.i.4...b..mT. 0210 7b d7 d2 cd d2 fb 79 e4 03 16 b2 6d 09 05 9b 8b {.....y....m.... 0220 e2 a6 a6 a3 69 03 c9 51 19 9f c7 62 54 e6 f4 4a ....i..Q...bT..J 0230 fa c3 f8 9d 83 1d b1 1a 6e 00 a4 63 f0 2d ff 29 ........n..c.-.) 0240 04 92 10 f0 a8 93 a5 a0 d5 ac 31 eb 25 b9 37 bf ..........1.%.7. 0250 6e ef 97 21 62 37 97 84 37 1b f4 0a 66 4b a3 44 n..!b7..7...fK.D 0260 93 1b aa dc b3 17 72 0d ad cd d5 f0 55 ac 5b 22 ......r.....U.[" 0270 4d c1 03 d4 7b ac 80 7f 43 95 0e fe f7 a2 d8 5e M...{...C......^ 0280 0c dc 97 0b a9 3f 1a 55 5e 4d 1d 5c 0a 5a db f3 .....?.U^M.\.Z.. 0290 31 a4 da 58 5d 16 cb aa a7 70 8d d7 51 08 f2 09 1..X]....p..Q... 02a0 d3 0f dd 68 d9 f2 93 49 c9 3b ae 0c 0b 7d 85 84 ...h...I.;...}.. 02b0 05 61 53 2e 4c ba c8 da df 05 32 26 30 d1 92 7c .aS.L.....2&0..| 02c0 7c 64 c6 a4 25 0d 32 2c 17 1b 3a f9 f2 df ca 2a |d..%.2,..:....* 02d0 4a c7 b0 03 82 ef ae b1 14 3b a7 fe a6 4a a0 54 J........;...J.T 02e0 0e 16 ca 8a e5 13 92 4b b8 a9 30 3b 36 8a 74 b1 .......K..0;6.t. 02f0 42 d3 b9 57 64 b3 ae 0e f0 81 e8 8a d0 27 9e 04 B..Wd........'.. 0300 a6 1f e0 a1 b0 68 e5 93 40 6b 63 c6 bd 32 d3 61 .....h..@kc..2.a 0310 7c 74 80 22 e2 08 72 6b 5d eb 70 ac a7 ec b0 c2 |t."..rk].p..... 0320 fb 63 06 b9 47 45 98 24 7b ff e0 6e 6e ba 47 75 .c..GE.${..nn.Gu 0330 6f fe 3f 48 c7 31 a3 31 60 7b 96 af 27 5e 31 49 o.?H.1.1`{..'^1I 0340 b1 7a 62 0a e6 a5 ef 2a 24 ec 74 cf 1b bb 3a 2f .zb....*$.t...:/ 0350 db a7 e7 33 1c 29 cc 4f 0a e1 24 94 2a 26 de 98 ...3.).O..$.*&.. 0360 67 d9 4c 53 5f d4 b7 79 0e 1e c5 e9 d2 f3 7c e5 g.LS_..y......|. 0370 4d 6c a0 da 98 14 4b ab af 6e c2 a6 b0 5b 33 cc Ml....K..n...[3. 0380 3d 49 67 67 a2 3a 74 c9 2f 2b 0e 27 1e 7a bb d4 =Igg.:t./+.'.z.. 0390 3b d1 28 75 67 e4 77 74 2a ce 5b 25 2e 84 c6 3c ;.(ug.wt*.[%...< 03a0 58 e9 61 1a 18 fa 2e 6d 87 11 54 c2 98 20 4e c0 X.a....m..T.. N. 03b0 ee 48 c2 94 5b 41 e5 33 dc ab 74 72 23 51 4c 8f .H..[A.3..tr#QL. 03c0 ee ee 22 fc df 97 40 0e 99 66 d6 d2 bd 70 77 13 .."...@..f...pw. 03d0 b9 67 ea c1 a3 21 e7 18 d5 c8 79 ca 31 ac 8e 36 .g...!....y.1..6 03e0 fb 81 6a 0c b8 05 e9 14 14 13 f0 02 8a cc 23 f4 ..j...........#. 03f0 37 60 9b 36 11 33 e2 e9 2a 59 08 13 11 15 fe cc 7`.6.3..*Y...... 0400 3d 64 a2 d4 b0 78 23 04 88 c1 c8 21 7a 19 a8 01 =d...x#....!z... 0410 1c 6b 3c 47 92 26 46 0f b7 42 6c 42 b3 14 89 94 .kt;...... 0530 fc b3 61 78 bc fa ad da 12 60 fe 91 51 e3 66 78 ..ax.....`..Q.fx 0540 74 f1 54 70 c7 91 45 f8 9a 11 85 3f a1 36 4c 60 t.Tp..E....?.6L` 0550 91 b2 62 11 8e d7 ec e9 21 81 50 42 1c 4c 08 d3 ..b.....!.PB.L.. 0560 42 e0 4f b4 6b 6e 6c 82 7d 13 4e eb 68 1c 66 f9 B.O.knl.}.N.h.f. 0570 a7 00 91 4d ff cc 5b 17 89 51 0b eb 43 41 0f 5d ...M..[..Q..CA.] 0580 89 33 d9 a8 75 d6 f1 a7 76 f7 cb 83 e4 95 d4 75 .3..u...v......u 0590 6c cb d3 96 9e 63 29 52 bf d0 d3 ed a7 8a e2 83 l....c)R........ 05a0 ae 7c 87 1c 98 d9 f3 80 81 98 1e 0e 07 de 0a 79 .|.............y 05b0 3e a2 e9 f6 >... No. Time Source Destination Protocol Info 3447 914.213794 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=35515 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3447 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.972298000 Time delta from previous packet: 0.000012000 seconds Time since reference or first frame: 914.213794000 seconds Frame Number: 3447 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x48a3 (18595) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2835] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 35515, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 35515 (relative sequence number) Next sequence number: 36975 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0xec52] Data (1460 bytes) 0000 9f 9f 11 36 25 3d 3d 92 7b 8c 4b c1 e5 99 23 4d ...6%==.{.K...#M 0010 45 2a 0e 66 ab 69 52 d0 96 94 ff 93 9b b7 ab 06 E*.f.iR......... 0020 eb 75 81 07 84 ba 60 59 90 6a 4b 4f df f5 54 ef .u....`Y.jKO..T. 0030 7f 36 37 9d 5a f8 bf 81 db 6e 44 f4 a4 57 03 bb .67.Z....nD..W.. 0040 76 0c 10 63 3e dd c5 19 54 bb c6 a8 cf cc 5d 43 v..c>...T.....]C 0050 83 9d cc 89 4d b7 b5 64 4c 53 d9 12 48 09 5a d8 ....M..dLS..H.Z. 0060 c9 48 a9 fc 8c 2a 95 bf a8 9b f0 9e 0f 46 19 80 .H...*.......F.. 0070 9f 45 9c d3 12 79 42 4a 04 f1 5c 5c a1 aa 95 dc .E...yBJ..\\.... 0080 13 d0 ff f0 92 bb 34 92 dd 27 3c 1f e5 ff 45 3f ......4..'<...E? 0090 ad a4 fa ce aa 09 ef ab 8c 6e 81 a2 1f 03 29 59 .........n....)Y 00a0 95 5d fe 06 d1 2a b1 b3 d9 ea fd be 25 7c e0 8e .]...*......%|.. 00b0 2c 5d 1f fa 7b d4 75 09 81 67 5f 12 1f 42 d9 90 ,]..{.u..g_..B.. 00c0 6f 47 a8 2a c1 96 e9 06 52 45 84 da 6a a2 a3 e7 oG.*....RE..j... 00d0 96 12 81 09 77 df 9f 12 28 18 c8 09 a6 56 9e c4 ....w...(....V.. 00e0 b8 b9 39 99 11 ae 02 cc 3d 5c 4e 28 20 a1 9c c4 ..9.....=\N( ... 00f0 c8 a1 d6 8a 65 c0 aa fc 95 8d 72 08 29 7a 96 20 ....e.....r.)z. 0100 b3 3a 82 14 e4 ad 57 0e 2d 9a 5b eb 2d c7 b1 24 .:....W.-.[.-..$ 0110 b4 95 2b 1d 87 bd 70 1c e1 a4 17 35 31 cf e0 b2 ..+...p....51... 0120 2a 89 37 fa 87 38 36 46 93 c5 6d 4c f6 b7 fc 6b *.7..86F..mL...k 0130 a4 c0 8e 51 c0 5b ca d7 c1 30 ae 06 03 56 60 e5 ...Q.[...0...V`. 0140 6d 1c b8 73 bc 8b fd 5b 59 44 9f 41 cd 6c 97 92 m..s...[YD.A.l.. 0150 9f 90 e5 60 cc d9 11 28 e7 10 24 b8 ff 86 7c 76 ...`...(..$...|v 0160 42 40 c1 08 99 88 1a 7f 71 5d fa 10 2b 0e c8 19 B@......q]..+... 0170 15 ed b6 69 93 76 87 aa 40 01 d4 98 06 44 59 c0 ...i.v..@....DY. 0180 ea e7 b6 e4 c6 99 36 d1 97 0d 44 fc 7d da 82 3e ......6...D.}..> 0190 f1 cd 4d 50 c1 0c 6e b7 92 9b 66 5e 03 b6 c0 8e ..MP..n...f^.... 01a0 08 fb 85 6a 4f a3 70 bf 02 90 4e 9a fc 30 c0 bf ...jO.p...N..0.. 01b0 e5 2a a8 70 df 39 75 a5 a4 14 41 46 99 07 81 ee .*.p.9u...AF.... 01c0 93 8e 05 49 11 c6 85 ea 2d 8d ab 7b 22 d0 81 11 ...I....-..{"... 01d0 6b ad e9 8a 97 1e c1 cb ae 93 6c 35 37 32 7b 60 k.........l572{` 01e0 20 48 d9 8a 3c 23 99 b0 9a 8b c2 d2 eb 58 99 59 H..<#.......X.Y 01f0 51 e2 15 0d 89 6b a2 bb 55 77 4e 52 51 27 73 12 Q....k..UwNRQ's. 0200 f0 93 9c b6 71 0d f6 ff 7f ec 62 f2 81 5c b4 65 ....q.....b..\.e 0210 1a 27 36 3d 9f ce 3e f2 6d b4 74 7c 5e 0d 06 69 .'6=..>.m.t|^..i 0220 4b c9 69 6b ee cf 6a 8f a2 65 e3 ba b1 27 31 da K.ik..j..e...'1. 0230 05 12 ba 05 aa 51 cd e9 fd 2d d7 60 5c 54 0a 56 .....Q...-.`\T.V 0240 6a 98 9d f9 4a cf a5 d6 23 9e 86 0c 50 c4 52 94 j...J...#...P.R. 0250 43 f6 a7 3f 8e c7 6f d2 50 a1 39 e0 56 6d b2 06 C..?..o.P.9.Vm.. 0260 05 bd 95 39 e5 1a 9f d2 dc 22 e9 19 85 3f 3d e0 ...9....."...?=. 0270 9e 7b 8b 9a 4e f6 46 b2 3d 30 62 24 8f 1a 63 dc .{..N.F.=0b$..c. 0280 6b aa 7b 9a 25 ee ef 5a 6d af c0 8d 8a 18 c2 a9 k.{.%..Zm....... 0290 63 41 a3 62 b0 d7 35 83 d4 15 75 93 13 2b c9 f3 cA.b..5...u..+.. 02a0 50 d1 ea 3c d4 10 34 c5 45 a5 1d 83 12 dd 39 05 P..<..4.E.....9. 02b0 d7 f4 f8 c5 89 87 86 a2 81 19 8c b2 a9 f9 cc 4a ...............J 02c0 ff 77 27 12 55 6b 54 4b cd ce 77 6d bc 5e cb 5c .w'.UkTK..wm.^.\ 02d0 e1 42 51 92 be 41 a6 35 03 97 27 54 7d 56 70 69 .BQ..A.5..'T}Vpi 02e0 fa d7 db 7d 7c f4 b0 77 b5 1b 0a e5 40 bc bc 8f ...}|..w....@... 02f0 82 c0 a2 3d e9 34 10 5a 39 2e 9a cb ca 2c fb 91 ...=.4.Z9....,.. 0300 1d 21 df 3e ff 26 55 93 24 a3 40 52 99 30 ae d6 .!.>.&U.$.@R.0.. 0310 f6 51 fe 43 21 ff 60 b9 b7 92 39 57 26 d7 1d e2 .Q.C!.`...9W&... 0320 3f b6 43 b8 d5 73 7b 84 d3 95 5d b2 97 40 49 d6 ?.C..s{...]..@I. 0330 85 31 e9 f1 0c 97 bc 5c 6c 3a 02 65 84 de c8 74 .1.....\l:.e...t 0340 50 86 c2 77 20 af 35 e5 4a 12 ab cc 6e e5 58 9e P..w .5.J...n.X. 0350 9e 4c 52 9f 23 52 b6 25 a6 9c 2a 60 3a 21 c4 48 .LR.#R.%..*`:!.H 0360 f3 88 b7 02 4f ae 53 7f e0 af 25 68 72 d7 64 2d ....O.S...%hr.d- 0370 a5 ff 6e ba 15 67 4b cc 22 75 fa 4b 6b 5d 2a da ..n..gK."u.Kk]*. 0380 15 49 65 b8 bf 2c ec 0a 75 a0 89 8f fc cc c5 f7 .Ie..,..u....... 0390 25 4a d6 af f5 de dd 6f 6f c0 0c e4 72 4b 11 4a %J.....oo...rK.J 03a0 0c 01 93 fd 52 8e 8e ee 4d f0 ce fc b5 3b 09 d0 ....R...M....;.. 03b0 87 85 15 58 04 da 0c ab ba b5 4e 52 46 66 7b 0a ...X......NRFf{. 03c0 0c 27 8a 43 09 61 ad 21 54 09 46 0f 21 47 9f 65 .'.C.a.!T.F.!G.e 03d0 35 02 b4 2f 25 36 d6 70 05 63 34 8c 6d 85 01 6e 5../%6.p.c4.m..n 03e0 c7 43 8d 99 e5 50 1c 63 d8 44 e9 07 27 30 94 da .C...P.c.D..'0.. 03f0 3c 23 cf a9 dc f8 e1 4e 48 8d ff f5 de b3 ef ba <#.....NH....... 0400 e7 9c 0d 62 95 09 41 b4 71 e8 34 7d 23 26 97 1c ...b..A.q.4}#&.. 0410 1f f2 fd 42 81 8f 57 1f 33 bf bb 3b 80 bb 59 c1 ...B..W.3..;..Y. 0420 5f a8 c8 32 67 3e 6b bd 70 10 87 dd 61 27 6d a1 _..2g>k.p...a'm. 0430 be 19 4d b8 92 46 df ea 01 a9 3a 97 5e 55 21 b1 ..M..F....:.^U!. 0440 55 19 cb 4d 3f 8f 58 56 aa 10 80 ca 46 ad 7b 85 U..M?.XV....F.{. 0450 55 cc 4a a5 86 5d f6 44 1d 31 6c e1 6d 06 91 08 U.J..].D.1l.m... 0460 79 21 f1 ca b9 a3 be 70 5b 82 e7 31 af a5 11 af y!.....p[..1.... 0470 cd dd ec e8 89 c9 3a 8e 5c 92 50 d9 11 9e 88 8c ......:.\.P..... 0480 b9 b3 93 5f 2c dd 2c d1 c5 f2 3c 91 45 7b c0 b4 ..._,.,...<.E{.. 0490 74 6f 22 52 12 bc a3 11 07 57 9f 9e fa ce 63 bf to"R.....W....c. 04a0 42 a2 f5 6d a1 b8 4e 52 ae bf 99 ce 60 9c 73 49 B..m..NR....`.sI 04b0 06 af f5 68 73 b2 41 99 bb 9b e5 7b f3 47 ff 1e ...hs.A....{.G.. 04c0 5c 7f e3 4b ef 5e 37 43 18 ec 8c 31 df 02 60 87 \..K.^7C...1..`. 04d0 cc f4 ff 3f 16 d4 5f 9f 46 0a e0 ea 7d e3 c7 00 ...?.._.F...}... 04e0 9e 63 5f 37 a6 ca b0 df c5 75 05 8f 26 4d 38 44 .c_7.....u..&M8D 04f0 ed 56 30 4d 22 d4 3b cb bd 6d 46 bb 74 9a 2c a9 .V0M".;..mF.t.,. 0500 f0 33 0c 44 17 a3 20 2f d3 7d f5 b6 65 02 d5 86 .3.D.. /.}..e... 0510 cd 50 9e 2a 1c 11 93 b9 55 c5 14 00 73 0e f9 c4 .P.*....U...s... 0520 3e 92 d8 74 62 47 4a 16 dc bb 9c 3b 45 c9 dc 44 >..tbGJ....;E..D 0530 fb 24 9c 6a ac 53 c1 c7 d1 f2 1b 8f 92 72 68 4c .$.j.S.......rhL 0540 89 c4 18 5c 8d eb 20 cf 68 e8 26 56 70 f0 84 2d ...\.. .h.&Vp..- 0550 64 19 68 a4 7f 35 30 0b 9d 91 95 b4 a1 ef b9 dd d.h..50......... 0560 88 df 6e 99 f0 11 eb 26 3e d2 69 9a fb e7 11 55 ..n....&>.i....U 0570 8c c5 30 ac 26 ee 97 d5 6a d1 3d cf a0 a3 2c ff ..0.&...j.=...,. 0580 d4 e0 b4 9e 93 78 3e 00 62 1d 1e 78 47 ed 41 f9 .....x>.b..xG.A. 0590 80 41 2d 5e 16 39 93 b9 a2 b6 eb bd b6 19 22 41 .A-^.9........"A 05a0 98 33 d7 b6 a2 87 dc c6 38 6e cd 0d fd ce 5b 76 .3......8n....[v 05b0 f8 94 e2 d0 .... No. Time Source Destination Protocol Info 3448 914.215006 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=67967 Ack=25295 Win=17824 Len=0 SLE=35515 SRE=36975 SLE=32595 SRE=34055 SLE=29675 SRE=31135 SLE=26755 SRE=28215 Frame 3448 (90 bytes on wire, 90 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.973510000 Time delta from previous packet: 0.001212000 seconds Time since reference or first frame: 914.215006000 seconds Frame Number: 3448 Packet Length: 90 bytes Capture Length: 90 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 76 Identification: 0x058f (1423) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x70d9 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 67967, Ack: 25295, Len: 0 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 67967 (relative sequence number) Acknowledgement number: 25295 (relative ack number) Header length: 56 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17824 Checksum: 0x2d7b [correct] Options: (36 bytes) NOP NOP SACK: 35515-36975 32595-34055 29675-31135 26755-28215 left edge = 35515 (relative) right edge = 36975 (relative) left edge = 32595 (relative) right edge = 34055 (relative) left edge = 29675 (relative) right edge = 31135 (relative) left edge = 26755 (relative) right edge = 28215 (relative) SEQ/ACK analysis This is an ACK to the segment in frame: 3439 The RTT to ACK the segment was: 0.001327000 seconds No. Time Source Destination Protocol Info 3449 914.215062 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=36975 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3449 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.973566000 Time delta from previous packet: 0.000056000 seconds Time since reference or first frame: 914.215062000 seconds Frame Number: 3449 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x48a4 (18596) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2834] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 36975, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 36975 (relative sequence number) Next sequence number: 38435 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0x5eaf] Data (1460 bytes) 0000 1f 91 2e c6 54 d4 0e 25 40 aa 9c 7a 86 83 e3 38 ....T..%@..z...8 0010 fc 96 92 17 be a8 73 7b a5 14 8a 92 f8 34 f7 30 ......s{.....4.0 0020 a3 7b 16 74 c7 b4 76 f6 f0 d3 a5 ab 2a b7 18 02 .{.t..v.....*... 0030 8f 86 7f ee 94 82 78 f7 5d 95 55 58 8c ad ad 22 ......x.].UX..." 0040 db e8 2e 6b 3c a0 b8 4e 37 97 9c ab 24 64 db 46 ...k<..N7...$d.F 0050 a5 85 fb cf 0c 1e 7a 71 ff 48 35 1a 63 e2 6d 7c ......zq.H5.c.m| 0060 0c 93 b1 2c 27 f1 52 ae 05 a9 38 d5 1b 9f 76 9c ...,'.R...8...v. 0070 22 93 1f e1 a7 e7 3a c7 6c 27 5c 66 98 d7 a3 ee ".....:.l'\f.... 0080 ad eb 59 d2 ee be aa 26 43 b2 e6 6e 25 34 de 39 ..Y....&C..n%4.9 0090 08 c5 d9 d1 b2 40 e9 a2 d8 ea cf ad 9a 03 33 23 .....@........3# 00a0 fa af b4 61 5e 24 c9 3a 86 06 0e aa 9c df 7a 83 ...a^$.:......z. 00b0 ff 8a dc 9f f8 0d e3 1a 80 d0 a7 13 6f ff 68 75 ............o.hu 00c0 65 70 8a 47 e2 57 4e 1c f7 4f 7b 4f 52 f0 40 b9 ep.G.WN..O{OR.@. 00d0 17 be 34 c5 31 5d 90 dd 3d 59 9f 96 53 a8 c9 cc ..4.1]..=Y..S... 00e0 85 e1 ea 0f 85 f0 07 19 9b 90 1b fe b8 ca 15 34 ...............4 00f0 93 6e 33 2f 23 56 bc 34 8d b1 54 80 d2 bb b2 31 .n3/#V.4..T....1 0100 86 d0 ce 95 33 8d 42 97 8c 8f d3 12 73 d3 71 27 ....3.B.....s.q' 0110 79 2a 51 82 be 1b 37 0c 15 f6 ba bb e4 3b 07 f8 y*Q...7......;.. 0120 a5 fa 5e 68 71 23 b8 2e 74 f8 77 d0 b9 1b 1f 19 ..^hq#..t.w..... 0130 45 9d 95 7f a5 e7 61 ef 9a 76 69 82 29 00 b2 76 E.....a..vi.)..v 0140 44 fc 31 84 6e b0 32 10 43 05 44 d4 2b e0 56 d0 D.1.n.2.C.D.+.V. 0150 b2 79 b6 c8 11 a7 2f 9a 1b ce d6 6b d5 e8 15 23 .y..../....k...# 0160 0d 89 09 1b d8 6f 0d 8c 45 37 48 71 bd 41 f0 e9 .....o..E7Hq.A.. 0170 c4 0c bd ec 06 c9 23 2d 9c b3 dd ed 20 fe 2d 63 ......#-.... .-c 0180 81 df fb d9 de 03 d1 aa 4d b4 e3 ed c9 d9 69 d3 ........M.....i. 0190 ff 01 78 c6 18 87 ce 21 e2 5d 75 9d d0 48 7b 51 ..x....!.]u..H{Q 01a0 c1 38 0e 1a 0c 13 73 1f 35 03 30 f0 b0 01 6b e6 .8....s.5.0...k. 01b0 1d ef 31 bf 13 2f 78 d9 aa 63 f9 42 6f b1 91 22 ..1../x..c.Bo.." 01c0 14 eb 5a 07 91 3e 62 e3 2a 40 78 c2 74 f5 e2 8c ..Z..>b.*@x.t... 01d0 d8 b5 0d f6 c0 68 1f 61 ae 26 d7 ee 21 47 22 e1 .....h.a.&..!G". 01e0 cc 5c db ce 99 fa 0e b5 7f 51 7d 2b f4 53 9b f8 .\.......Q}+.S.. 01f0 07 59 d7 e5 59 51 6f d7 53 25 bc 2e 99 d5 1e 8c .Y..YQo.S%...... 0200 d3 4b 44 94 b8 d8 43 47 29 5b 0a b1 3d e8 55 a3 .KD...CG)[..=.U. 0210 ef 8e c6 9e b3 99 05 2b eb 53 d7 dd 17 c6 7c b4 .......+.S....|. 0220 39 cc 56 5d 5e 17 9f b4 4b 81 34 6b b6 1b 03 22 9.V]^...K.4k..." 0230 2c ab f1 95 73 4c 45 e5 da 21 c8 57 85 e9 d6 0c ,...sLE..!.W.... 0240 03 3c c3 01 f3 40 1c c4 a6 4c f4 34 7c cc 01 27 .<...@...L.4|..' 0250 de d6 bf 68 4b c1 a4 b4 f4 b9 de 7c b9 52 f5 7b ...hK......|.R.{ 0260 94 06 7e 6f 27 a1 e0 b9 ea 93 4e 69 0a 82 05 80 ..~o'.....Ni.... 0270 c6 a2 aa ce 09 89 f9 4f a5 21 98 80 d7 c0 f0 00 .......O.!...... 0280 00 15 c3 a0 be 50 fd 3d 73 3d a8 32 61 c8 16 46 .....P.=s=.2a..F 0290 e0 15 d3 e4 57 89 f2 46 6e 58 54 6d 1a c4 3a 1e ....W..FnXTm..:. 02a0 ea c0 21 8d ab e2 9a bc 5e 06 4b ca cb 9b 67 d9 ..!.....^.K...g. 02b0 af 75 85 4e b1 30 89 f7 96 f1 7d d9 be 4a e4 ed .u.N.0....}..J.. 02c0 f3 b3 17 26 31 b7 f9 04 72 25 4a c7 78 9a 73 60 ...&1...r%J.x.s` 02d0 64 32 7a 55 3b 28 7d b1 ac a0 b9 9e e9 33 4c 39 d2zU;(}......3L9 02e0 23 8e b3 1e 92 fd cd c9 a1 e5 a6 85 e1 4f 2c 5c #............O,\ 02f0 ef a5 27 a1 fb da e2 57 b7 eb 85 a8 f4 a8 4a 82 ..'....W......J. 0300 4f c9 f2 23 2c 1b 15 3f d8 2e 0f ff 74 c0 5c a2 O..#,..?....t.\. 0310 d4 e9 2d dc 4d 3d 43 1e 0c 08 d0 59 b1 85 ce bb ..-.M=C....Y.... 0320 0c 68 84 7d 4e c7 69 66 25 08 7b 1c c8 cd 12 37 .h.}N.if%.{....7 0330 01 31 44 bd 4a c2 bd 89 dd 9e 32 e7 74 dc 09 0b .1D.J.....2.t... 0340 7b 81 d1 74 f5 75 f4 61 cb c5 96 16 41 0f 1b cd {..t.u.a....A... 0350 92 08 47 8e dc ad 19 89 f8 67 ae 29 45 20 a5 66 ..G......g.)E .f 0360 cb 10 20 4e e4 35 05 4d 47 a4 a0 de 60 78 11 f8 .. N.5.MG...`x.. 0370 14 2c 72 3a c5 a5 2a 4c 8d 48 d8 7e 28 39 18 19 .,r:..*L.H.~(9.. 0380 89 ed d2 60 af f2 58 6f 5c 88 9b 96 3c bc 03 7f ...`..Xo\...<... 0390 f0 32 bc 19 d1 99 bb e8 99 4a c8 5a 6f 4c 22 06 .2.......J.ZoL". 03a0 23 cf 1a ef 7a d1 29 ba 5b 63 3e ba 1c 78 01 e8 #...z.).[c>..x.. 03b0 e2 bb de 0c 2b ab 63 b8 c3 2a 75 f3 df a2 9e 78 ....+.c..*u....x 03c0 a8 98 f0 13 8c c9 b4 b0 ef 78 5e 82 6c 65 6d 42 .........x^.lemB 03d0 4b 38 21 f4 af 08 51 28 e6 8a e2 da c4 20 92 88 K8!...Q(..... .. 03e0 6f 62 27 65 ac 52 c6 19 ba 25 76 96 ed e3 b0 e3 ob'e.R...%v..... 03f0 6f bf 7d ed 6b 95 c3 b0 a5 65 5c ed 33 e0 41 60 o.}.k....e\.3.A` 0400 1b 85 54 e8 06 6f 7c e6 e5 c3 dd 41 43 25 cd 4f ..T..o|....AC%.O 0410 b3 64 e7 5e 1d 0c f5 c9 a9 2c 3c 18 e9 18 68 2d .d.^.....,<...h- 0420 0e 58 f8 c0 f7 8c 1a cf 2f 7f f1 e2 9d 25 fe 9a .X....../....%.. 0430 09 d0 f0 fa e9 49 ca d3 63 99 6a d0 09 32 fa 57 .....I..c.j..2.W 0440 88 22 b4 be b3 8d e8 e4 1b 19 d2 b4 b3 e6 84 c5 .".............. 0450 a1 3c be 37 38 a0 d4 35 29 ec ef bf 33 12 87 8a .<.78..5)...3... 0460 88 90 f1 e5 fc a5 0b 50 7f 61 aa 7e 0f ce 55 fa .......P.a.~..U. 0470 0c 26 f5 81 56 c5 c0 c1 bd da 6a 01 a9 b5 11 a0 .&..V.....j..... 0480 1c e2 e0 e6 14 46 77 9a 5e 19 fa dc 27 fe 73 ef .....Fw.^...'.s. 0490 88 5f 7c dd 3d f4 da 46 7c 9e 33 51 76 26 47 7f ._|.=..F|.3Qv&G. 04a0 cc 8c d6 03 06 0f 7c d2 0d 0a 17 9c 21 50 74 46 ......|.....!PtF 04b0 dc 18 97 f5 73 83 43 65 4b b2 a4 7f e5 2e 9c 28 ....s.CeK......( 04c0 6b 0a 6e e8 78 45 a7 fb 0e 66 3a a7 7e dc 5d 41 k.n.xE...f:.~.]A 04d0 68 a6 db 1a 6d 46 7b 68 91 7b 38 48 ae df e7 18 h...mF{h.{8H.... 04e0 52 66 12 eb ef d4 13 a4 07 76 a1 6b a7 35 e9 3d Rf.......v.k.5.= 04f0 58 cc da f5 6b 33 dd e6 88 74 eb 59 4f 0f 70 6d X...k3...t.YO.pm 0500 cd d7 11 c3 15 31 55 8e 6e 46 3a a2 b2 30 bc 90 .....1U.nF:..0.. 0510 9b a9 2a 03 69 e5 88 51 94 f8 9a 0b e0 2f 4a ee ..*.i..Q...../J. 0520 b7 e0 8b 51 8b 51 80 8a a1 cc f1 e8 87 cd 1e f3 ...Q.Q.......... 0530 87 47 ad 82 c7 c9 d6 81 e7 e4 73 2f d3 f1 86 09 .G........s/.... 0540 f5 81 17 e9 4d aa b8 2d 67 16 98 d5 f6 85 31 be ....M..-g.....1. 0550 1e 4b cd 14 7e 62 af 7f 97 4d 7c 3a a2 89 a0 89 .K..~b...M|:.... 0560 78 ed a4 ed cb 57 f8 55 29 01 c4 5b 37 8f 4d eb x....W.U)..[7.M. 0570 20 58 d5 65 93 9a 16 cf 67 5a f5 85 22 d2 6d 0d X.e....gZ..".m. 0580 f5 5a 24 c1 aa 13 f3 d9 72 09 df 59 ff 0c 0d 37 .Z$.....r..Y...7 0590 32 70 cf b1 c4 0f c1 24 0b fd ad c0 07 19 25 f3 2p.....$......%. 05a0 f0 c9 64 69 ef 3f 83 e9 27 cb c2 da 9e ff f6 e1 ..di.?..'....... 05b0 f9 e9 ca 77 ...w No. Time Source Destination Protocol Info 3450 914.215075 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=38435 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3450 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.973579000 Time delta from previous packet: 0.000013000 seconds Time since reference or first frame: 914.215075000 seconds Frame Number: 3450 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x48a5 (18597) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2833] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 38435, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 38435 (relative sequence number) Next sequence number: 39895 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0xd31c] Data (1460 bytes) 0000 ca 92 49 11 fc 5b a5 cb 91 fc f6 a8 4c 85 c7 19 ..I..[......L... 0010 85 94 c5 98 ee 25 68 d8 48 f6 ba 20 cb ef ee 25 .....%h.H.. ...% 0020 fc 1b 94 77 a3 a3 f4 db 25 51 c1 22 f7 1d 6c c5 ...w....%Q."..l. 0030 b5 a6 c9 ff 8b cd 43 12 c5 05 4e 7e 61 f6 19 43 ......C...N~a..C 0040 4c 83 b4 cb bf 76 71 a8 a1 2a 29 07 70 da 54 3d L....vq..*).p.T= 0050 42 5d c8 ce 91 0a 87 28 c9 dc 57 21 32 5e 88 0f B].....(..W!2^.. 0060 d6 fe 47 b6 c2 33 78 a9 8f 4a f4 09 8c aa 58 73 ..G..3x..J....Xs 0070 fa 47 90 41 5b 59 73 d1 17 d4 2d ce d7 63 11 f0 .G.A[Ys...-..c.. 0080 ae c8 52 6c ee a1 e9 6b 49 0c 1c b9 d3 6c 58 c0 ..Rl...kI....lX. 0090 b5 6e f7 8d 24 eb 06 a7 67 1a 1c e4 79 d9 71 4d .n..$...g...y.qM 00a0 76 8f fd d4 2e 17 fb d1 84 78 8d d5 28 bb 6c 6f v........x..(.lo 00b0 a1 70 0e 92 a1 be ea 69 b3 3a ca ec f1 0d 80 6a .p.....i.:.....j 00c0 cf 5c 02 33 94 03 57 e4 52 25 37 80 b0 fb 19 87 .\.3..W.R%7..... 00d0 84 13 8d db 4c 17 32 50 84 d9 b4 98 b6 6a e0 3a ....L.2P.....j.: 00e0 b0 da 50 77 3f e8 53 bb 47 70 35 99 5e c9 6e 8a ..Pw?.S.Gp5.^.n. 00f0 b1 03 1c 22 55 11 a1 49 10 d8 dc e4 e7 ac e7 33 ..."U..I.......3 0100 99 19 97 25 7e 8b c0 3c be ae c5 d4 8d 62 72 0e ...%~..<.....br. 0110 a1 27 f3 49 18 cf d1 7e 28 86 a7 db 63 33 1b 23 .'.I...~(...c3.# 0120 cd 6d 10 e7 61 dc b4 91 97 f6 49 cc 6e c9 53 ac .m..a.....I.n.S. 0130 46 0e f9 e0 97 09 f7 fb 43 3b 8d a2 da ad 3e 76 F.......C;....>v 0140 66 d7 2e a1 24 56 1b 8e 03 94 8c 06 b0 e1 9d 68 f...$V.........h 0150 ec e3 05 ea d9 ad a6 bc b2 3d bf 02 c6 ca 02 75 .........=.....u 0160 f9 3d ae 33 ad 00 cc 42 bc e5 33 e4 cc 6c 6a 34 .=.3...B..3..lj4 0170 3e b9 39 58 ef 85 b2 58 36 d7 a5 94 6c 50 74 9d >.9X...X6...lPt. 0180 24 4e 03 6f 13 82 54 d6 73 e3 cd 48 8e cd f0 03 $N.o..T.s..H.... 0190 19 4c 88 bf 75 a1 b2 13 cb 88 3f e2 b4 94 7d ac .L..u.....?...}. 01a0 3c 1b 91 ba 4c 63 20 2c 88 c7 f9 e8 7b 72 5b 68 <...Lc ,....{r[h 01b0 0d f7 87 ba 8a 46 70 b9 dc f5 1f 71 f6 ce ab 2d .....Fp....q...- 01c0 f2 8f 97 d3 9e 6c 8b 4b 9b 3b 55 82 68 3e 09 56 .....l.K.;U.h>.V 01d0 42 35 77 e6 86 97 8c 43 49 5e 83 f3 8c b2 37 ee B5w....CI^....7. 01e0 70 67 13 1a 2d 4d af f6 22 07 2f 10 16 92 48 61 pg..-M.."./...Ha 01f0 3d fa a0 97 9f 8c 52 d3 03 0a 9b 86 01 f7 9b 5e =.....R........^ 0200 3d d0 d8 74 7c cd c1 66 e3 52 ed 9c 72 b9 b6 01 =..t|..f.R..r... 0210 e8 f5 b7 a5 17 01 d3 a8 6d 11 2f 13 15 ca 18 2d ........m./....- 0220 94 73 e9 7e 7b d2 e3 9f b3 ff 03 50 62 ee ff a3 .s.~{......Pb... 0230 8a c8 60 e5 86 f6 54 ec 03 71 d7 a4 6f bf 72 a1 ..`...T..q..o.r. 0240 04 21 30 49 87 c6 d7 72 25 45 98 7e 19 89 02 d7 .!0I...r%E.~.... 0250 e5 5a 47 49 97 01 99 78 3f 18 00 ec e6 4d b7 af .ZGI...x?....M.. 0260 00 87 bd f3 58 15 78 51 95 f9 d8 fe 6e f3 59 7c ....X.xQ....n.Y| 0270 4f 6f 06 0f 93 90 d8 4f fe f3 8f d2 71 e4 75 2b Oo.....O....q.u+ 0280 37 09 1a 6a 7e 14 63 8c 7a bb 1c a8 bd 2b 93 75 7..j~.c.z....+.u 0290 a4 65 32 86 e8 97 4f d6 c7 d2 40 c3 72 4f 9b 5b .e2...O...@.rO.[ 02a0 15 85 1d f9 3b 9b cb e8 49 66 c7 87 9b 50 41 ae ....;...If...PA. 02b0 14 ef 03 b3 6f e7 95 05 1a 56 a7 29 c7 c0 17 09 ....o....V.).... 02c0 8b 19 08 32 0b 0e f3 1c 62 67 62 2e ca 5a b1 d0 ...2....bgb..Z.. 02d0 02 82 b6 00 d7 9a cd f5 f4 52 ca 75 fd 24 ca 32 .........R.u.$.2 02e0 be 8e 97 b5 af ae 52 c3 63 a3 12 9a 1f 8e 71 14 ......R.c.....q. 02f0 ef c9 98 e6 b8 15 d1 3b 71 5f 6a ca cc 9c 4f 3c .......;q_j...O< 0300 3d fd 36 66 b0 99 38 03 80 82 99 07 8d d2 71 6e =.6f..8.......qn 0310 b8 91 6d ab 56 84 66 48 1f ab d4 ef 67 8f 47 16 ..m.V.fH....g.G. 0320 9b 35 f9 c0 b8 b7 4c c5 8e 8f e7 5c ec ff bc e6 .5....L....\.... 0330 1a f9 29 43 b3 38 af cb c4 36 98 5c 8a a4 7a b9 ..)C.8...6.\..z. 0340 60 eb 12 ba e9 63 d5 b7 ff 86 ad 3a dc 38 a0 f9 `....c.....:.8.. 0350 a7 ae fb d1 db 85 fa cb ea 2a bc 3f 25 95 41 e8 .........*.?%.A. 0360 e9 5c 38 21 92 4b 43 0d 95 16 1c 5b 5f 44 ad df .\8!.KC....[_D.. 0370 27 d9 79 6b b3 39 39 42 6a 9e f8 60 fc 0d be 8c '.yk.99Bj..`.... 0380 51 d1 a6 04 a9 f3 38 bc 8b 6a f0 7b ce df 9a 51 Q.....8..j.{...Q 0390 90 c0 fd 44 7f 4d 7e cb 66 b2 76 3d bb 84 87 db ...D.M~.f.v=.... 03a0 6b 56 b7 a0 42 a3 36 46 b3 3f d4 70 1d 19 f5 65 kV..B.6F.?.p...e 03b0 1a ea fc f1 2b 70 27 46 34 33 6b 57 24 08 3e 49 ....+p'F43kW$.>I 03c0 a7 b7 56 e6 37 19 19 d5 64 56 73 4d 57 9f 40 ee ..V.7...dVsMW.@. 03d0 14 c4 2a 00 2b 31 ea e1 4d 02 36 02 dd 50 9e 00 ..*.+1..M.6..P.. 03e0 16 dc 63 75 08 c9 21 75 1b 57 cd 49 c5 1a 6a e8 ..cu..!u.W.I..j. 03f0 12 47 17 d7 39 58 e4 77 e1 2c 59 cf a5 e5 4f e3 .G..9X.w.,Y...O. 0400 03 96 23 3f 19 02 6d da 48 a7 99 b6 62 03 38 3c ..#?..m.H...b.8< 0410 21 56 2e 79 9f 25 37 66 1d 7c 4b 68 a0 33 6d 85 !V.y.%7f.|Kh.3m. 0420 8c a4 00 19 74 3b db 8f 29 74 09 03 83 2f b1 6e ....t;..)t.../.n 0430 ad d3 72 b0 61 bb c6 df 6e 57 1a 1d 3d e3 54 74 ..r.a...nW..=.Tt 0440 aa 4f 69 e9 6e 39 3f b8 1d 7f 80 e8 a3 31 15 25 .Oi.n9?......1.% 0450 bf a6 34 74 31 9c c3 d3 38 86 f7 bf ac 78 0f 16 ..4t1...8....x.. 0460 2c 4a 90 4d 55 34 f9 d8 bc e3 5a aa a3 01 d2 fa ,J.MU4....Z..... 0470 bf ae 3a 24 ed 7d 02 b2 0d 27 56 5c d2 b1 82 4a ..:$.}...'V\...J 0480 bb b6 a4 90 06 7c 71 51 8a 12 62 05 02 98 08 27 .....|qQ..b....' 0490 d9 6b 5f ba 66 80 94 b4 49 c7 ec 68 43 22 a4 43 .k_.f...I..hC".C 04a0 36 f5 e6 89 e6 e1 63 2b 7e 58 32 3b 93 d6 a7 56 6.....c+~X2;...V 04b0 5d 49 0c c1 7b bd 40 7f 15 c3 59 00 08 01 13 ab ]I..{.@...Y..... 04c0 6a a7 7b f4 74 b5 12 9a 4e aa 9f 9f dc 15 dc f3 j.{.t...N....... 04d0 85 6c e7 a5 36 bb 35 6a aa b5 ed 95 4d 2c cb 50 .l..6.5j....M,.P 04e0 96 73 e7 c4 8d 8d 61 c9 c9 cb db a0 c0 d2 df d8 .s....a......... 04f0 68 33 6b 2a 4f 72 38 ca 92 74 bd ce da f2 ff 0d h3k*Or8..t...... 0500 f3 c2 f1 99 28 43 e6 63 35 d2 b9 28 95 1c f3 3e ....(C.c5..(...> 0510 c3 1c 9a 88 d0 89 b0 fc ad 20 8b dd 48 96 8a 35 ......... ..H..5 0520 a9 69 bc f6 cf a3 3b 78 38 cf 31 e4 78 49 05 ad .i....;x8.1.xI.. 0530 ac 6f 20 88 ff 16 61 fc be 3d bc 80 cb 9c eb ad .o ...a..=...... 0540 3c 75 27 7d f9 02 6c 95 38 9c 2d 86 f5 35 63 d8 c.%..w.yD. 0590 2e 4e 0f bf 4b 56 a6 63 e8 b8 cc f0 71 d7 f1 e9 .N..KV.c....q... 05a0 8a 28 cb 06 6e 4b 2a b5 c7 69 77 6f b0 1f 7f 00 .(..nK*..iwo.... 05b0 d4 62 18 13 .b.. No. Time Source Destination Protocol Info 3451 914.215086 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=39895 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3451 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.973590000 Time delta from previous packet: 0.000011000 seconds Time since reference or first frame: 914.215086000 seconds Frame Number: 3451 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x48a6 (18598) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2832] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 39895, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 39895 (relative sequence number) Next sequence number: 41355 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0x537f] Data (1460 bytes) 0000 8c b9 8b e8 47 ce 01 ab 82 97 3b 50 34 57 7a b9 ....G.....;P4Wz. 0010 b7 eb ba e3 35 e9 72 2b 31 07 34 fb 11 c1 ce f7 ....5.r+1.4..... 0020 a5 8d 91 ec 08 d7 bc 30 60 19 e1 e7 9b 13 c3 53 .......0`......S 0030 a1 df d9 70 11 31 2e 10 04 20 c2 9f fc a2 fa c5 ...p.1... ...... 0040 30 89 d4 57 6d 6f 2a 60 2e cf 91 b6 ab 30 97 23 0..Wmo*`.....0.# 0050 bc 11 c8 50 45 7b fc 3a a6 6c 6a 5d 3c 89 92 14 ...PE{.:.lj]<... 0060 39 31 fc 23 f0 a9 aa 9f 21 bc f9 f2 40 06 73 33 91.#....!...@.s3 0070 17 f9 44 0f 1e fa fc 4a 75 70 f5 aa fb ec bb 45 ..D....Jup.....E 0080 f9 f9 67 e0 c6 7e 45 8f 46 8f 14 5d 45 79 63 bb ..g..~E.F..]Eyc. 0090 9d 18 33 54 1d 93 11 b8 32 27 b6 07 90 b0 6d 37 ..3T....2'....m7 00a0 03 1a 77 f6 b4 99 7d 53 6f c1 8e 17 97 c7 31 96 ..w...}So.....1. 00b0 88 49 59 04 7c 63 c2 18 6c 8a f2 73 f0 f1 e9 83 .IY.|c..l..s.... 00c0 6b 79 a1 aa 8c 59 43 19 8f b1 e9 e0 a3 b2 b7 b5 ky...YC......... 00d0 7b 9a ca 31 ec 05 a5 3a b1 6a 41 01 a1 0e 3e 78 {..1...:.jA...>x 00e0 ef 96 a8 e0 e0 29 23 a6 be 51 85 d2 c2 e5 e6 17 .....)#..Q...... 00f0 05 d6 5c 53 a3 69 fc e3 61 d6 c7 ae a2 3e 1f c6 ..\S.i..a....>.. 0100 21 69 b3 f2 87 d0 4a 2a b9 be d8 81 5c 48 84 97 !i....J*....\H.. 0110 ed 66 1f a2 e9 67 26 d9 f5 47 40 7c af 01 94 48 .f...g&..G@|...H 0120 c3 19 2e 3d b9 23 b2 97 26 f1 a4 b7 2a 63 c7 e9 ...=.#..&...*c.. 0130 70 34 37 2a 36 14 6e 29 27 e4 b4 b4 2c 01 d9 5f p47*6.n)'...,.._ 0140 f4 a5 fc fd d2 d8 fb ca e8 7a fe 2e 15 df ae 06 .........z...... 0150 05 af 90 3f 88 e9 a1 52 63 fe da 05 5b 1d 88 3b ...?...Rc...[..; 0160 12 ed 71 55 3f 49 e8 6f 18 3d 6d 3a 32 23 18 22 ..qU?I.o.=m:2#." 0170 f0 e1 1c a9 5c 98 dc b2 e7 70 7c 07 5e 9e 93 99 ....\....p|.^... 0180 a5 bc 91 74 20 a1 67 45 c1 11 94 b0 93 fe a2 f1 ...t .gE........ 0190 e7 fb 6c 1a 22 23 b5 12 b7 2a 89 32 f8 45 bf 38 ..l."#...*.2.E.8 01a0 77 73 0f 01 8d c2 39 ab f4 3a 64 88 c6 25 42 01 ws....9..:d..%B. 01b0 f7 46 a2 bd d8 e9 e4 01 d3 7d f6 4a bf 73 2c 40 .F.......}.J.s,@ 01c0 a2 2c bb aa 69 e9 43 16 11 7e a5 52 22 8a 91 d9 .,..i.C..~.R"... 01d0 64 1a a8 68 d5 81 e2 bc ac 13 74 51 6b 28 65 e3 d..h......tQk(e. 01e0 cc 76 b5 c7 ff 1f 2a 9b ab 2f c3 39 e7 41 f5 4d .v....*../.9.A.M 01f0 cd 2d 93 5b 85 0a e8 a4 40 b9 fa 85 d0 28 3f 21 .-.[....@....(?! 0200 49 39 64 e8 d3 cd e3 bb bb 65 03 09 e1 6b fd b3 I9d......e...k.. 0210 3f 18 2e 11 29 c0 b0 99 a1 e1 35 5e fd 00 ad 1e ?...).....5^.... 0220 90 98 51 78 a3 c7 a4 f4 64 37 f8 88 e6 3c b4 66 ..Qx....d7...<.f 0230 88 fd c0 3e d3 8a 43 9c f3 2c 97 ea 9a 12 96 55 ...>..C..,.....U 0240 9b 89 e1 70 81 98 0a ba 9d 8d 00 0d 25 24 a1 60 ...p........%$.` 0250 6f 73 f4 6c 36 d4 ac 90 f7 f5 e2 13 32 12 0c 4b os.l6.......2..K 0260 57 5c 91 5e a0 b4 7f 55 92 7e 62 36 15 5f 36 81 W\.^...U.~b6._6. 0270 b3 1e 0e 6a 3a 06 52 47 f9 55 da 98 6a 7e 41 19 ...j:.RG.U..j~A. 0280 5f 5b 3b 6d f1 b0 ec c6 1a 2c 8e e6 ed 01 f8 0c _[;m.....,...... 0290 1f 3a fe de 7b fc 68 a6 0f 61 2e fa ff 93 65 2e .:..{.h..a....e. 02a0 db 0e 15 2e e7 d0 eb 52 cc 3b e0 a2 04 38 81 37 .......R.;...8.7 02b0 ad 5f 8a 4f 2c 55 be c5 e1 bc da 80 9f 5e b2 55 ._.O,U.......^.U 02c0 23 6c 4b b1 2f 15 03 4f 5d 3a 55 75 a2 7f 46 46 #lK./..O]:Uu..FF 02d0 eb 5d e3 89 07 c4 c7 64 11 81 c8 8f a9 ea 47 9e .].....d......G. 02e0 8f 6e eb 42 cd 94 fb 1d 24 3f 4c 95 2c 97 ff 0b .n.B....$?L.,... 02f0 ec 9d 29 16 03 18 80 a3 9f 50 ae a1 71 54 81 2f ..)......P..qT./ 0300 79 fb 6d f2 a3 f9 bd 84 87 41 88 44 b6 c3 b4 4d y.m......A.D...M 0310 38 56 e9 e9 af 00 e9 8b f7 b4 ca 63 bb 01 99 2a 8V.........c...* 0320 90 8a 8a eb 57 79 c1 dc 2b 14 57 24 fc 48 e5 47 ....Wy..+.W$.H.G 0330 79 fa e5 ff 2c 23 4b 53 27 9c b2 7f c8 d9 e0 a8 y...,#KS'....... 0340 23 ba 51 ad 6d 73 f8 b0 10 23 a5 84 0a 65 99 5a #.Q.ms...#...e.Z 0350 0e a1 f2 b2 b9 ed 2a a6 24 2b c3 00 38 c6 fe ab ......*.$+..8... 0360 f8 f2 2b 95 7c 6a e0 32 92 58 f6 59 d7 6b 73 45 ..+.|j.2.X.Y.ksE 0370 21 98 8c 89 47 21 b3 02 bd cd b7 d9 2c 41 0f 93 !...G!......,A.. 0380 73 46 0a c4 01 b1 7f 57 cb 93 e5 61 ba 58 5c 86 sF.....W...a.X\. 0390 a2 b6 56 7d 1e c3 a8 39 89 49 f6 87 4f 25 a4 68 ..V}...9.I..O%.h 03a0 5d 13 9b 3c 32 37 32 fb 1c 04 f7 82 b7 56 cd 91 ]..<272......V.. 03b0 c5 c3 2b 49 f2 bc 9c 7e 58 2a 82 8f 1c 8c 3b 7b ..+I...~X*....;{ 03c0 98 58 6b ad f2 02 f0 cf 0c 7c bc 45 51 bb 24 1a .Xk......|.EQ.$. 03d0 ad 77 ad d0 f2 53 32 14 91 6f e1 cd 58 09 92 fe .w...S2..o..X... 03e0 d2 1e 32 4a 7c 1f df fe ec f9 19 60 e4 52 46 d8 ..2J|......`.RF. 03f0 8d a9 14 c4 68 f3 22 14 d9 7d 50 8f 99 c5 b3 1b ....h."..}P..... 0400 d1 f4 5e 20 e5 06 c4 4c f1 85 ea fb 23 3b 15 29 ..^ ...L....#;.) 0410 09 34 e4 64 85 f6 2e 64 c0 de 3e c4 4a 28 8e 29 .4.d...d..>.J(.) 0420 35 7e 90 de 53 c0 8c 48 98 d7 32 3c b3 7f 4d b2 5~..S..H..2<..M. 0430 16 6d 89 4e 92 52 c9 c9 88 9c c0 6b 18 7a 1e cc .m.N.R.....k.z.. 0440 a8 98 35 6e 3c 6e ab 68 ac 38 8a b7 4a 7d f7 00 ..5n 1677 [ACK] Seq=41355 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3452 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:22.973600000 Time delta from previous packet: 0.000010000 seconds Time since reference or first frame: 914.215096000 seconds Frame Number: 3452 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x48a7 (18599) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2831] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 41355, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 41355 (relative sequence number) Next sequence number: 42815 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0x6ceb] Data (1460 bytes) 0000 f8 b7 49 04 71 a2 da 14 3a 4c f8 0e 77 6d c0 f4 ..I.q...:L..wm.. 0010 4e 57 2c a9 83 1a 72 af 62 f1 9c 26 7e f0 30 56 NW,...r.b..&~.0V 0020 ab 37 d5 84 c3 4a 5d 75 d5 72 0f ad bf 0d 19 e5 .7...J]u.r...... 0030 bb 89 1c 21 69 55 ca e3 f7 35 21 a4 33 91 0f 2a ...!iU...5!.3..* 0040 a7 a5 17 e1 4d cd 9b a8 fc f5 6d d8 d0 e8 25 49 ....M.....m...%I 0050 88 17 a9 c7 91 65 53 6d 80 b2 5d 69 14 3a ae 99 .....eSm..]i.:.. 0060 63 b6 82 05 15 dc 99 3e b8 03 1b 7e 3c 12 d9 21 c......>...~<..! 0070 37 4d f7 12 43 9b be 36 d0 38 2f 92 25 a4 8f 85 7M..C..6.8/.%... 0080 0d 1b 59 d4 05 6c 98 53 90 fb 35 ea a0 55 98 e4 ..Y..l.S..5..U.. 0090 d1 f6 96 19 52 c9 46 5d 8e 2e 5e 2e ba 7a a2 99 ....R.F]..^..z.. 00a0 c3 51 36 71 9c f1 f4 d5 c9 91 db 35 ff 69 91 97 .Q6q.......5.i.. 00b0 6a d3 8f 1a bf 67 71 52 e8 a0 9c a3 00 1a a9 81 j....gqR........ 00c0 e8 52 e3 cc 7d ca f9 ba 23 43 d9 ce 7e ad aa 84 .R..}...#C..~... 00d0 d8 51 b6 02 fe 51 24 ed 48 f9 bb eb fa 92 58 66 .Q...Q$.H.....Xf 00e0 ad 1c 75 b9 8c ab 39 ff aa a0 f7 c5 b8 3d 66 f5 ..u...9......=f. 00f0 53 e8 4f 21 7b c5 02 bd a7 ae 05 90 35 e6 5c 9b S.O!{.......5.\. 0100 04 d4 a3 5b 13 ed 87 3f fb 69 02 2f a3 dc 60 88 ...[...?.i./..`. 0110 25 f2 77 d3 8d 92 06 69 96 df ab a9 4c ad 4f 87 %.w....i....L.O. 0120 55 b6 9a 35 fb c0 80 4b b2 35 bc 41 f7 4a 0b 0d U..5...K.5.A.J.. 0130 28 1e a0 bf 2a b3 3e 34 49 90 8f 2e 6f 32 d7 08 (...*.>4I...o2.. 0140 31 24 b0 84 bb 10 6e 1a ea f2 cf 7a c5 3b 5a cb 1$....n....z.;Z. 0150 53 0e c0 3d 2f 7e 74 b2 39 47 86 66 ce bf 45 0f S..=/~t.9G.f..E. 0160 a1 28 a3 63 05 9f 63 ec c2 f1 e5 33 e7 af 4a c0 .(.c..c....3..J. 0170 a7 5f 3e 05 35 64 af 62 7c 59 64 cc ba ad 5c 25 ._>.5d.b|Yd...\% 0180 41 e0 94 c1 97 cd 75 e3 2b 49 65 62 2d 20 2b bf A.....u.+Ieb- +. 0190 53 18 42 73 0f 08 0f 7a fb 78 86 ed a7 f9 55 c7 S.Bs...z.x....U. 01a0 cc 1a 27 49 07 d9 77 d3 3f ca aa 35 92 c7 fc 8d ..'I..w.?..5.... 01b0 86 03 fc 44 2d 6c 66 0e 6d df 3a 85 7e 11 c6 51 ...D-lf.m.:.~..Q 01c0 c9 70 ce db 26 3e 69 e8 84 3d f3 c2 34 bb 16 36 .p..&>i..=..4..6 01d0 bd c4 28 6b 0d 24 0e 44 4b 03 f5 cc 08 93 e6 9a ..(k.$.DK....... 01e0 fa ef d1 22 4e 2f 74 6e 32 41 c6 73 f1 1b e9 da ..."N/tn2A.s.... 01f0 b8 dc ef 92 55 83 ee 99 5e b7 a2 b0 5e 46 06 a2 ....U...^...^F.. 0200 2a e4 24 18 15 55 b6 e0 2d 45 8d c3 0a fa 70 23 *.$..U..-E....p# 0210 4f 9e 99 02 7e ae 27 68 d1 33 4a ef 52 be 23 6c O...~.'h.3J.R.#l 0220 29 d7 20 ff c8 93 96 09 44 f3 de 9e fe e4 b6 c4 ). .....D....... 0230 1b 93 95 ea d8 db 7b 95 9d 65 4e c6 b5 1e c6 bc ......{..eN..... 0240 c3 45 bb d3 f5 dd d3 1c 77 35 b0 55 a5 99 72 92 .E......w5.U..r. 0250 d7 ae 36 bd 4a 50 64 d6 1b b8 40 c8 9c ca 1c b8 ..6.JPd...@..... 0260 f2 e9 08 ba db 6b 8a bb c7 b4 2b 77 25 c0 c6 bd .....k....+w%... 0270 fe 50 74 50 67 f6 5b cb 61 5c 55 ed 47 00 b1 7a .PtPg.[.a\U.G..z 0280 ae b4 7b d9 6c 94 9d 1c e1 36 ca c2 6f ed f7 ae ..{.l....6..o... 0290 0a 63 af 0b c0 c0 31 8e 00 39 59 de 20 10 25 87 .c....1..9Y. .%. 02a0 d4 bf f3 47 f1 c6 fa 61 e7 50 a1 04 d5 20 f7 af ...G...a.P... .. 02b0 f4 0e 5e 82 e7 86 91 6e e5 ac a4 51 d3 ea 68 5c ..^....n...Q..h\ 02c0 a8 6a b4 02 a1 17 8f 89 50 b9 a9 5b bd 4f ef ba .j......P..[.O.. 02d0 74 29 f1 27 2f 75 c7 00 0f 42 6c a1 bc 48 20 cd t).'/u...Bl..H . 02e0 ab 4d 19 52 d6 57 04 41 5d bf 67 b6 01 fc 4f 82 .M.R.W.A].g...O. 02f0 89 aa a9 81 e6 72 51 96 0d f3 18 f8 20 15 74 9b .....rQ..... .t. 0300 da 20 38 c3 f1 e1 2d 2f 2d 28 8b 59 0a 84 7c 43 . 8...-/-(.Y..|C 0310 80 8a bb 31 8f 90 86 b8 d6 6b 33 cd 49 11 f0 cd ...1.....k3.I... 0320 4e 4e 43 d3 14 d4 d2 de b3 07 f3 1f 0f dd 82 c9 NNC............. 0330 ac 40 17 21 e7 c5 70 40 a4 8b b6 44 05 fc 04 89 .@.!..p@...D.... 0340 c3 8c 89 66 39 1e d3 c1 0c 10 04 ef 77 4d a1 c6 ...f9.......wM.. 0350 7a 7a 2e c0 a1 c9 21 5c e2 2c 25 54 35 37 a2 df zz....!\.,%T57.. 0360 8b f2 71 28 06 d6 af 4f ff 26 b7 21 32 8b 6b 4f ..q(...O.&.!2.kO 0370 53 6a d2 26 15 ba c9 65 94 db 37 db 3d 03 b2 4b Sj.&...e..7.=..K 0380 84 f7 1d 1e 69 31 c0 ce 57 45 42 59 61 52 4b 04 ....i1..WEBYaRK. 0390 b4 1a b9 e2 8d 80 30 f9 fd d6 f2 c3 ae c1 f5 63 ......0........c 03a0 b1 14 4e 8d ae a8 0b b8 26 7e 37 46 34 d5 ec 6e ..N.....&~7F4..n 03b0 6f 1e 38 7c 4e 7f 36 0d d3 3f d9 82 20 ae 73 62 o.8|N.6..?.. .sb 03c0 b3 33 9c bf 92 d2 bd c6 82 11 ae 63 4f 52 ff 49 .3.........cOR.I 03d0 86 54 ab 7a e5 39 1c 60 ef bd ec cf 5e b0 24 e8 .T.z.9.`....^.$. 03e0 54 1f fb e6 38 e4 79 e4 3c ef 86 90 9c 7a df 1c T...8.y.<....z.. 03f0 64 18 ea 16 d2 a3 34 25 5b d7 6b 58 93 26 08 40 d.....4%[.kX.&.@ 0400 f7 61 77 dc 05 b6 bb db bb 49 c8 da 57 3f dc 7f .aw......I..W?.. 0410 ea 3d 2e 96 0e 08 ae 99 41 14 13 38 bd 6f 57 87 .=......A..8.oW. 0420 36 cc 69 ea 21 a2 e1 6a 52 0f e5 d2 31 33 c3 05 6.i.!..jR...13.. 0430 67 9d 31 e3 8e de 92 ff 49 52 ce 4a 6c 9b f0 e2 g.1.....IR.Jl... 0440 86 65 0a 07 69 4a 4c d9 4e 15 9f ff 60 17 c7 c1 .e..iJL.N...`... 0450 16 66 77 79 72 b5 28 b1 0c 41 93 32 39 6d 7b 7b .fwyr.(..A.29m{{ 0460 72 09 30 b0 96 d4 94 a5 61 6a ad 40 15 a1 15 97 r.0.....aj.@.... 0470 96 fa bc 0c 47 ee a8 7c 09 ec 06 77 a5 16 34 0e ....G..|...w..4. 0480 5e c8 c1 23 23 c9 24 14 b8 e5 b5 1c a1 95 48 5c ^..##.$.......H\ 0490 9c fb f0 16 b5 17 0d 28 03 bc cf 29 cd c4 bf 9f .......(...).... 04a0 ec 43 0d 6e ec 24 7d f5 17 60 64 ac 43 7c 42 54 .C.n.$}..`d.C|BT 04b0 0b f7 66 1e 5a b8 67 a4 56 8b fb dd 28 a4 a7 96 ..f.Z.g.V...(... 04c0 c9 a1 e8 a9 5c 45 25 89 f5 0c e6 63 4d a2 ea 64 ....\E%....cM..d 04d0 ab 32 8e e6 8e 53 14 ad e7 a4 ec c6 08 7c d9 8a .2...S.......|.. 04e0 cd fb e2 77 83 0b f6 b3 28 54 c7 4d ca a5 8a f5 ...w....(T.M.... 04f0 1f 50 6d 92 1e b2 85 17 70 20 bd 54 af 00 20 9e .Pm.....p .T.. . 0500 8d 3b 2b c4 04 6f ff b1 aa 4d f8 b7 27 0d 55 16 .;+..o...M..'.U. 0510 1c 73 05 ac 3a 10 a7 30 1d 1a 2f 61 73 c8 0c a7 .s..:..0../as... 0520 25 03 6e 13 a2 f6 24 09 fe dc 60 77 4f 1b 46 5c %.n...$...`wO.F\ 0530 b0 5e 27 bd 3e 6a b9 c7 28 1c be fd fa 63 84 4c .^'.>j..(....c.L 0540 73 34 2b 5f 02 ec ff 05 f6 ad d7 a2 57 93 e1 b5 s4+_........W... 0550 a6 a3 b1 73 f6 e5 af 48 4a c4 e9 99 5b 03 92 6a ...s...HJ...[..j 0560 78 d7 ad de 34 6a 8c ea dd 5d 7b cf d1 40 42 94 x...4j...]{..@B. 0570 f3 bc b0 a3 6a 4d 7c ff d2 4c 17 eb cb 1e df 20 ....jM|..L..... 0580 af 77 0b 7e f4 0b d2 a6 8b 00 73 45 26 f8 0c a2 .w.~......sE&... 0590 71 4f a7 94 67 c6 5d 72 98 2c 5c 24 1b 62 8d 0e qO..g.]r.,\$.b.. 05a0 f9 1b e4 4a 81 a8 f9 52 c4 23 6c ba 1b b0 6c 6a ...J...R.#l...lj 05b0 02 bc f0 ed .... No. Time Source Destination Protocol Info 3460 914.715405 zen1 soth1 TCP [TCP Retransmission] 4605 > 1677 [ACK] Seq=25295 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3460 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:23.473909000 Time delta from previous packet: 0.500309000 seconds Time since reference or first frame: 914.715405000 seconds Frame Number: 3460 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x48b3 (18611) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2825] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 25295, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 25295 (relative sequence number) Next sequence number: 26755 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0x976c] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 0.500309000 seconds RTO based on delta from frame: 3452 Data (1460 bytes) 0000 4f 79 1e 92 e4 dc 54 3d 3b 06 dd ea 6d d5 f6 f0 Oy....T=;...m... 0010 b7 7d 42 82 cf b5 17 9f 7f 1c 2d 07 9c b3 21 45 .}B.......-...!E 0020 16 5c 7f 28 36 b2 5c 34 5d a0 78 be ff c9 68 f7 .\.(6.\4].x...h. 0030 3d 29 21 01 f3 50 13 f5 62 c9 56 35 e1 c3 f0 65 =)!..P..b.V5...e 0040 24 cf af f0 53 95 fa a1 28 a9 3e b6 df 8e d3 2e $...S...(.>..... 0050 4e 99 1d e0 dc ae 10 21 dd 82 49 b4 e7 b9 c7 f5 N......!..I..... 0060 41 19 51 5c f4 85 f2 2e 71 d1 82 4f 31 94 ce 56 A.Q\....q..O1..V 0070 03 e7 cc 5e 0a b8 a2 75 3f fc 83 a1 f0 de 03 b1 ...^...u?....... 0080 9e c1 af 57 8a 51 20 39 e9 20 5a 83 1e cc 88 d0 ...W.Q 9. Z..... 0090 88 c5 0b e1 d4 a6 1c bd 2e 3b ee 94 ff 93 eb c8 .........;...... 00a0 61 dd 73 a5 bf a2 59 ca 0d d1 dc 30 72 56 f0 cd a.s...Y....0rV.. 00b0 26 41 72 b3 35 60 d3 cc f9 c9 93 87 9a bf d1 9a &Ar.5`.......... 00c0 86 2d c7 7b 42 bf 50 03 df f2 8c ee 07 de 76 eb .-.{B.P.......v. 00d0 69 1a 63 c5 c9 84 4f 34 63 d8 3e 39 45 df 96 51 i.c...O4c.>9E..Q 00e0 99 5f 6f 0b 40 b4 b1 9c 63 8a d9 b6 47 4a 72 9a ._o.@...c...GJr. 00f0 e4 81 92 51 93 48 9b ee 18 f1 e7 d5 0c e6 df 69 ...Q.H.........i 0100 8a f8 8e 14 5c e0 8e 3a ca 14 2e eb 5c 54 fc e3 ....\..:....\T.. 0110 39 56 8e e9 c0 f2 be 64 3f 0e cc 99 19 d0 38 4d 9V.....d?.....8M 0120 4b 7e 1a ba 75 c1 e8 27 d0 67 18 06 90 4f 60 50 K~..u..'.g...O`P 0130 b3 59 ca 6c 53 61 15 32 c4 bf 00 f9 89 a1 3c 6f .Y.lSa.2.......eV..R....!. 01c0 05 1f ea 6b 6a de e3 1e 2d 38 85 c7 0f 77 b1 2e ...kj...-8...w.. 01d0 51 92 6c 9e ee 4f cf 97 d9 71 72 6d 65 ca 2d d4 Q.l..O...qrme.-. 01e0 aa 9a ac 55 75 3d 4e fa a0 05 7b 83 ea 21 b6 03 ...Uu=N...{..!.. 01f0 4f b6 c7 d0 2f 88 a6 ca c0 c9 34 ff f3 70 95 55 O.../.....4..p.U 0200 09 12 10 2c 38 03 c3 bc b2 6e a1 05 b4 e9 4b 11 ...,8....n....K. 0210 59 8f b1 22 51 64 12 f9 bd 02 cc 5a b6 27 3e 02 Y.."Qd.....Z.'>. 0220 e4 86 83 74 2d 92 ca ff 39 fd 94 ec d3 45 07 cb ...t-...9....E.. 0230 70 f0 d2 6e 72 29 75 0c 5d aa 58 33 0d 15 6a cb p..nr)u.].X3..j. 0240 14 45 79 d9 01 2e b1 45 14 66 73 74 a2 67 72 cd .Ey....E.fst.gr. 0250 38 a6 79 c5 59 19 fa 1d 22 47 d3 4c de ac 18 2a 8.y.Y..."G.L...* 0260 ed 20 6d 79 cc 3b d0 e4 38 09 44 e4 3d d8 67 f0 . my.;..8.D.=.g. 0270 7b 88 d0 f1 b3 b1 27 f2 bc f1 f2 e5 68 21 1a 91 {.....'.....h!.. 0280 0e bd 88 8a 66 c1 37 48 5e 23 7b 7e 7d 5c 89 6e ....f.7H^#{~}\.n 0290 e5 94 0c b0 88 70 7e 26 90 51 1d d0 ea 44 42 c9 .....p~&.Q...DB. 02a0 00 b8 bc 28 12 65 a0 49 7f 3a 03 49 35 e9 be c9 ...(.e.I.:.I5... 02b0 c9 94 49 21 7d 4e 75 42 5d 09 3f c7 09 5a eb 81 ..I!}NuB].?..Z.. 02c0 1c a0 db 67 ee f0 de 42 71 6c de 13 0f 64 58 d1 ...g...Bql...dX. 02d0 29 83 ca 8f 65 83 09 03 33 a9 f7 bc 09 fe 23 be )...e...3.....#. 02e0 55 cd 79 c5 6f b0 a8 86 f6 e3 a7 49 8c 01 71 08 U.y.o......I..q. 02f0 10 4b c1 68 86 0d 45 35 fd 16 e1 a3 55 3f 73 7d .K.h..E5....U?s} 0300 a0 0e 11 d4 bc dd f9 84 90 66 1b bc 16 f1 f6 33 .........f.....3 0310 b2 14 79 00 3c a9 fc d7 51 ac 6e 7c e7 26 e9 ff ..y.<...Q.n|.&.. 0320 8e ed 3e ef f5 24 6c f4 5c da c6 3c f8 aa 56 48 ..>..$l.\..<..VH 0330 9d f3 bd 46 ca 36 fb 38 08 88 ea 7f 16 2f 37 fc ...F.6.8...../7. 0340 4b f4 5b b8 44 85 94 75 bf bf 50 67 d4 84 54 7e K.[.D..u..Pg..T~ 0350 09 63 5d 0d ff a7 5a 12 17 ec c6 87 e1 71 44 47 .c]...Z......qDG 0360 7c e9 2c 6e 64 19 d4 f1 a1 3b 38 d0 99 05 9c b9 |.,nd....;8..... 0370 72 3c 0b 88 4d fd 9b 50 96 d9 f8 7c 8e 8a 44 01 r<..M..P...|..D. 0380 ed ac 53 24 aa 0f a1 bd a3 39 82 f2 42 3b 9f 46 ..S$.....9..B;.F 0390 7f 87 fa a5 9e b4 fc a3 ae 5f c0 94 c1 59 10 00 ........._...Y.. 03a0 3d 56 12 69 27 67 75 09 29 e8 c0 38 13 02 25 7a =V.i'gu.)..8..%z 03b0 34 1c d7 d9 ef c2 b0 72 22 29 c2 10 38 23 61 6f 4......r")..8#ao 03c0 1e 4c 0b 30 e6 27 a1 97 11 5b c1 ea dc 54 59 df .L.0.'...[...TY. 03d0 eb 97 22 24 65 80 fa 1e fd 59 72 71 88 30 05 44 .."$e....Yrq.0.D 03e0 38 87 90 17 03 2c ca f8 c5 7f 53 6e b7 b0 42 eb 8....,....Sn..B. 03f0 89 19 2f 35 d4 08 49 19 00 84 eb e1 b9 dc af 76 ../5..I........v 0400 db 18 23 cb 5c 15 3c 41 7f c2 7a f0 54 2b 23 d1 ..#.\..q......,. 0540 4f 6c 56 d7 22 44 18 63 20 72 f5 72 bf 06 ed 5f OlV."D.c r.r..._ 0550 71 e2 d0 94 96 c1 e6 a1 c1 a5 be 61 97 1e 02 00 q..........a.... 0560 df 03 ab ee 77 b4 b4 dd da b0 2f 97 f8 4c cd 7e ....w...../..L.~ 0570 c7 c1 5f 9d ab fb 16 03 dc 30 f9 f1 95 63 2a 6c .._......0...c*l 0580 da 3c 45 82 13 cd 4a bd bf 6a e7 82 6e 14 34 ef . 4605 [ACK] Seq=67967 Ack=28215 Win=17824 Len=0 SLE=39895 SRE=41355 SLE=35515 SRE=38435 SLE=32595 SRE=34055 SLE=29675 SRE=31135 Frame 3461 (90 bytes on wire, 90 bytes captured) Arrival Time: Nov 11, 2005 16:45:23.474246000 Time delta from previous packet: 0.000337000 seconds Time since reference or first frame: 914.715742000 seconds Frame Number: 3461 Packet Length: 90 bytes Capture Length: 90 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 76 Identification: 0x0d8f (3471) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x68d9 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 67967, Ack: 28215, Len: 0 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 67967 (relative sequence number) Acknowledgement number: 28215 (relative ack number) Header length: 56 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17824 Checksum: 0xb5b6 [correct] Options: (36 bytes) NOP NOP SACK: 39895-41355 35515-38435 32595-34055 29675-31135 left edge = 39895 (relative) right edge = 41355 (relative) left edge = 35515 (relative) right edge = 38435 (relative) left edge = 32595 (relative) right edge = 34055 (relative) left edge = 29675 (relative) right edge = 31135 (relative) SEQ/ACK analysis This is an ACK to the segment in frame: 3441 The RTT to ACK the segment was: 0.502029000 seconds No. Time Source Destination Protocol Info 3462 914.715792 zen1 soth1 TCP [TCP Retransmission] 4605 > 1677 [ACK] Seq=28215 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3462 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:23.474296000 Time delta from previous packet: 0.000050000 seconds Time since reference or first frame: 914.715792000 seconds Frame Number: 3462 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x48b4 (18612) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2824] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 28215, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 28215 (relative sequence number) Next sequence number: 29675 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0x7890] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 0.500696000 seconds RTO based on delta from frame: 3452 Data (1460 bytes) 0000 50 91 08 91 d2 0a f4 99 ef a4 96 da 84 54 7f 41 P............T.A 0010 3e c0 b9 98 9d 67 f5 ff 27 73 c1 63 28 56 a0 2d >....g..'s.c(V.- 0020 87 63 9a e5 f1 51 1f 4b 0d cf e9 94 10 14 81 b9 .c...Q.K........ 0030 be f7 bb ea d0 9a 5b 19 6f da c9 da 1e 51 d2 c5 ......[.o....Q.. 0040 6e c2 97 a3 a1 79 e3 91 17 dd 15 a5 c7 4f 32 6f n....y.......O2o 0050 3a 60 22 70 b9 e5 73 ac f3 bf 86 c8 4f 09 c8 51 :`"p..s.....O..Q 0060 a5 8d 14 fc 1a 64 19 7a e0 e1 0a b9 c7 5d cc 51 .....d.z.....].Q 0070 d6 a0 6a ad f7 b1 24 4a c1 2e 6b 3b 22 8f cc 20 ..j...$J..k;".. 0080 53 29 b0 7e 03 cd 75 a9 dd 8b a0 cd 41 c9 84 e2 S).~..u.....A... 0090 8f 53 c8 c3 58 3d 8d 21 f5 29 20 84 08 b4 77 2a .S..X=.!.) ...w* 00a0 6e 8a 2f d7 88 50 41 b9 e0 73 f7 45 ba 96 7d 9c n./..PA..s.E..}. 00b0 a0 5c af d6 92 2e b4 cd 78 29 a9 b3 81 aa 79 36 .\......x)....y6 00c0 d9 a4 3e 7c 3c bb 9d 2c 29 ba 0e e2 51 b1 f3 53 ..>|<..,)...Q..S 00d0 29 3d fa 6f 65 05 97 34 01 5e ad 82 09 c3 b0 cf )=.oe..4.^...... 00e0 41 83 98 bc fe 54 57 de 15 10 df e6 90 1f 97 11 A....TW......... 00f0 bb 5b 91 1d f9 d5 16 9e 6e ce 12 8f 45 14 a3 b7 .[......n...E... 0100 cb fe 2c 04 f6 09 24 cb a6 58 21 82 a8 ec 80 26 ..,...$..X!....& 0110 92 a4 68 1d 6b 35 e0 18 41 9d b2 43 f6 41 bf 54 ..h.k5..A..C.A.T 0120 75 22 5a 4a 92 a2 4c d0 27 36 1a 99 58 33 c4 e8 u"ZJ..L.'6..X3.. 0130 f8 05 db 59 b4 c8 c3 1a c0 ea 15 b1 42 8d 8c 00 ...Y........B... 0140 ad 9c ad 14 6f 36 f8 da ed e0 17 a2 17 4f c9 8b ....o6.......O.. 0150 4f 71 94 7f b0 76 9b a1 0a 90 53 3f 32 4a aa f6 Oq...v....S?2J.. 0160 0e 7e 37 42 57 93 d9 d5 8d 5d 96 fc eb 7a 2d a6 .~7BW....]...z-. 0170 a3 ff 8e 9f 2e f3 46 a3 6d 82 ea d3 81 13 63 63 ......F.m.....cc 0180 9b b7 3b 48 5c 8d 00 ec 62 10 e4 b1 75 d2 11 02 ..;H\...b...u... 0190 de c8 a2 57 2d d1 d8 25 f9 e1 1c 1d a4 7b 81 31 ...W-..%.....{.1 01a0 be 0b e5 1a a9 69 15 ce 0d 9f 7c 2f 2b fc f7 c1 .....i....|/+... 01b0 19 84 06 d7 be 23 55 10 60 6d f5 87 de 6b 40 af .....#U.`m...k@. 01c0 45 47 ef 24 e4 88 5c 6a 98 bf 82 b5 19 ec f3 e8 EG.$..\j........ 01d0 00 0a 1d 3d ac 04 49 dc 42 67 3b 06 e6 ca f9 52 ...=..I.Bg;....R 01e0 9e 3a 6b 07 9d 22 8a 19 f1 2d 2e 4c 00 56 9b 75 .:k.."...-.L.V.u 01f0 37 96 97 e0 50 d8 77 2c 47 cf 1c 70 2d 2b 0a b5 7...P.w,G..p-+.. 0200 7c 76 71 b5 6d c3 af 15 4b 86 2a 42 2e d6 bb 96 |vq.m...K.*B.... 0210 64 19 2c 35 a4 1a 7c d3 ab aa 32 66 92 aa be 35 d.,5..|...2f...5 0220 c1 5f 3c 27 b6 dd 00 1d 4f 81 d5 6f 4a 08 a7 e9 ._<'....O..oJ... 0230 be 8d ae 69 56 5c a7 03 d6 67 10 0c 68 c0 c4 4a ...iV\...g..h..J 0240 aa b4 16 b1 fb e3 03 5c 64 ff 24 bc d6 24 77 74 .......\d.$..$wt 0250 42 d4 de 49 b6 3f b1 cf dd 41 7d 25 4d f8 2f 2b B..I.?...A}%M./+ 0260 62 b1 13 a6 e1 c8 de b0 d7 fe ea 91 cb f9 dd 75 b..............u 0270 38 f4 7c fe 4a d2 af e0 61 11 1f 32 d1 6f 56 d1 8.|.J...a..2.oV. 0280 4a 7f 0e 0d 9f cd e7 32 a7 8d 3e cc dd e0 f5 bc J......2..>..... 0290 8b 2d 0a cf ca c6 c1 b6 2f d6 f2 6e dd 7c 75 cf .-....../..n.|u. 02a0 a9 0f 40 be c8 38 40 72 45 17 e3 51 72 71 f8 a8 ..@..8@rE..Qrq.. 02b0 4e d0 65 0d 6e fc 33 8c 86 2c 9e 43 84 3b 76 71 N.e.n.3..,.C.;vq 02c0 50 01 e4 b6 79 30 29 3c 7b ca 31 b2 dc ab 91 0b P...y0)<{.1..... 02d0 90 5f 17 23 2b 77 6c cc 70 2d 91 b8 37 6f b1 d7 ._.#+wl.p-..7o.. 02e0 77 b5 75 8b 01 7c 50 70 9c b2 ba 5a f3 ed 22 80 w.u..|Pp...Z..". 02f0 a8 ba 1b dd ec 0b 53 9a 07 e7 26 93 6c 48 8a 3e ......S...&.lH.> 0300 30 96 cb 02 17 ae 37 7f b1 c2 f2 a7 83 8f ea c0 0.....7......... 0310 4f 1d e2 a0 c0 f3 2f e0 00 06 09 7e a4 a7 6d a6 O...../....~..m. 0320 85 02 28 97 15 f6 f9 87 d0 4a 70 d8 ae 98 f8 f9 ..(......Jp..... 0330 01 a5 dd 57 f7 7b ed 81 c0 7e 20 6b 96 80 91 75 ...W.{...~ k...u 0340 7d d9 81 45 7b e1 ad 3f d1 13 f2 0f cc bb 65 32 }..E{..?......e2 0350 76 85 e0 94 de 0a b2 65 d6 45 9d d7 c1 4d 9e d3 v......e.E...M.. 0360 7a 20 47 d3 17 0e 7d 7f 0f ee 84 04 a3 ef c8 b9 z G...}......... 0370 28 ac 36 f0 b2 f4 d2 e5 59 ff 05 d4 45 e1 76 81 (.6.....Y...E.v. 0380 fe b5 b2 5d b0 2a 3f 74 98 6e cb 62 2f 16 3c cc ...].*?t.n.b/.<. 0390 f7 e1 ce 22 34 d6 61 31 5d e4 b8 05 20 cb 32 fc ..."4.a1]... .2. 03a0 d9 bf ef 85 5c 5a 76 26 08 df bf 5b 11 c7 d7 1a ....\Zv&...[.... 03b0 79 b1 42 6a 55 89 b5 89 ac ec d9 76 3c 6d 4d fb y.BjU......v....M(.$ 0400 0e 9d 0e 8b 45 52 93 79 3c 90 2d 8c 00 f6 0e 29 ....ER.y<.-....) 0410 93 38 c4 73 30 b7 d2 0e 9c f9 e6 92 57 d5 7d a2 .8.s0.......W.}. 0420 cf fa 4b 0d 96 81 6d 2f ee 44 4f e4 98 1a d0 72 ..K...m/.DO....r 0430 3e 03 32 9d 57 1e 9e 3c da c4 e4 0c 69 b9 54 de >.2.W..<....i.T. 0440 06 2d 21 6a f8 42 87 d3 f6 e4 02 e3 ee f6 e0 8c .-!j.B.......... 0450 ff e9 63 88 b8 b6 22 99 59 53 d7 37 af 06 86 98 ..c...".YS.7.... 0460 d6 55 85 ef 31 b0 5f 57 3e 1c 78 8e 0e da f9 a0 .U..1._W>.x..... 0470 af 8a 65 74 67 fd 53 a7 fc fc 51 e9 52 4c 11 98 ..etg.S...Q.RL.. 0480 fa 31 07 65 37 3c f3 f4 55 c2 4d 69 8d a4 1d 88 .1.e7<..U.Mi.... 0490 f8 f4 44 4c 47 67 e8 60 01 c4 d1 19 82 e4 b6 48 ..DLGg.`.......H 04a0 e6 8d 71 ec bf 6b 99 b1 6f 61 8e e1 68 08 f9 0c ..q..k..oa..h... 04b0 5b 2f 79 12 6f 8a e1 35 b2 c8 80 6f 13 fc 0b bf [/y.o..5...o.... 04c0 21 f3 d3 9e 0a ee 6b 42 90 e5 fe a4 ef 11 23 11 !.....kB......#. 04d0 6c 77 22 9d 0e 73 a5 21 f1 a5 a8 5c 01 fa 4f 7b lw"..s.!...\..O{ 04e0 a9 32 58 f4 ff 6a 9a a4 de 29 f4 23 7a bd 69 2c .2X..j...).#z.i, 04f0 63 37 a6 54 ff 8a 97 21 c4 c0 f2 09 b4 7b 40 34 c7.T...!.....{@4 0500 33 fb 13 b2 27 56 af 04 db f9 3b 19 7f 90 c6 92 3...'V....;..... 0510 ef 1e 62 87 25 df 6d 6c 44 fb c1 28 3c 90 34 7f ..b.%.mlD..(<.4. 0520 e7 5e 81 bd d0 32 ef 6b 23 b7 63 f4 5b 10 cb 35 .^...2.k#.c.[..5 0530 3f 86 d5 33 6c 45 db ec 15 4b 67 6c c0 96 4e 37 ?..3lE...Kgl..N7 0540 3a 3a 7b b5 5c e6 07 9b 1f 39 a5 80 19 41 c1 06 ::{.\....9...A.. 0550 fd 0a 81 d2 c1 41 d9 59 a0 cd 1b 88 b7 82 81 19 .....A.Y........ 0560 57 bd 14 92 86 dc 00 1d 72 ab 5d 45 7d 0c bc 34 W.......r.]E}..4 0570 6f 4d d8 eb 1d 00 5b 76 a1 4c 10 4d d6 49 d1 82 oM....[v.L.M.I.. 0580 2e dd e3 58 d7 8f eb 17 c0 2b 0a 9b eb ef c7 d1 ...X.....+...... 0590 77 f1 a2 5b d3 cc d9 51 42 ae ee 5a d9 a1 aa af w..[...QB..Z.... 05a0 7b 26 ae e7 71 3a dd 5c d9 e8 d2 3a 05 86 81 06 {&..q:.\...:.... 05b0 12 a7 99 9e .... No. Time Source Destination Protocol Info 3463 914.715806 zen1 soth1 TCP [TCP Retransmission] 4605 > 1677 [ACK] Seq=29675 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3463 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:23.474310000 Time delta from previous packet: 0.000014000 seconds Time since reference or first frame: 914.715806000 seconds Frame Number: 3463 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x48b5 (18613) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2823] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 29675, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 29675 (relative sequence number) Next sequence number: 31135 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0x68f4] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 0.500710000 seconds RTO based on delta from frame: 3452 Data (1460 bytes) 0000 82 92 e1 6b 5f 84 63 54 04 c8 00 4b 9e c4 0c 7e ...k_.cT...K...~ 0010 4f f9 72 c6 5c 19 d6 fc d7 e2 f2 78 38 89 4c 78 O.r.\......x8.Lx 0020 b1 dd 7b 37 0d df 61 7b 8c 2c 61 38 a5 cc a7 9f ..{7..a{.,a8.... 0030 24 ed 19 dc 82 66 4b 55 60 a9 d6 c4 cf 1e 6a 50 $....fKU`.....jP 0040 b6 1c 54 89 fe 50 cd fb 83 e5 1b 2f cc 1b 16 aa ..T..P...../.... 0050 a2 41 46 78 c7 c4 b1 07 0c e7 f9 71 0f c3 3c 84 .AFx.......q..<. 0060 66 65 aa 0e 0b 14 43 03 72 65 e3 fd 8e 1c 73 36 fe....C.re....s6 0070 91 eb db ad 7d 84 1a 55 fb b1 b6 d3 3d 34 77 7f ....}..U....=4w. 0080 c4 dd 46 71 c0 f1 3d c3 51 97 d4 8b f5 66 61 35 ..Fq..=.Q....fa5 0090 2c 17 65 9e ed 04 eb 7e a6 3e 41 8a e0 80 c3 27 ,.e....~.>A....' 00a0 ef 01 d9 d4 d8 e5 cc 85 70 bf 33 fa 60 f9 7a 2f ........p.3.`.z/ 00b0 d3 da bb cd ae 76 4c d8 17 25 b5 2c 0b 81 66 2b .....vL..%.,..f+ 00c0 35 20 41 f9 bf 49 79 d2 e4 a5 fb 86 a4 83 ef 5f 5 A..Iy........_ 00d0 ea 2c 0f e0 28 7d 36 cb e8 4a 02 a5 4e fb 32 32 .,..(}6..J..N.22 00e0 e1 c7 39 0e f0 ce bc 73 d4 ea 79 19 eb a4 92 c5 ..9....s..y..... 00f0 3f 17 d5 8d ca a3 71 32 d2 49 5d f9 cc 6c 5a e0 ?.....q2.I]..lZ. 0100 8f da 6b e7 d6 46 00 db 56 20 4c a5 d4 c8 85 6a ..k..F..V L....j 0110 3c b5 33 38 3a 9c 53 5a 8e 2b cb 5f 21 13 29 ae <.38:.SZ.+._!.). 0120 b6 14 ec 6d 21 4e dd b1 76 f4 63 0b 28 e4 38 6c ...m!N..v.c.(.8l 0130 fb 98 96 b7 11 c8 b5 3a 3d 47 27 93 87 3d d5 a4 .......:=G'..=.. 0140 7f 36 84 f0 f5 0b 37 79 9a 98 96 b3 fc 8a ed 20 .6....7y....... 0150 12 1a 67 7c de 3e a7 25 4f 5e aa 36 2e af e8 5c ..g|.>.%O^.6...\ 0160 a4 f6 ab c4 82 44 19 af 22 24 d0 12 1c de 05 13 .....D.."$...... 0170 38 86 f5 69 6b f4 e6 55 44 48 d7 4b 14 02 9a 51 8..ik..UDH.K...Q 0180 5f 7f d7 fc 1e 4e 34 ad b9 9d 14 19 12 d6 43 63 _....N4.......Cc 0190 b0 a0 79 99 22 89 57 4b e3 2b 60 31 84 8a 45 99 ..y.".WK.+`1..E. 01a0 da b8 7c 0f 40 bd 4c 54 39 7a b2 e0 40 3d 8d 3a ..|.@.LT9z..@=.: 01b0 ff d3 d8 46 30 25 bb 9b 48 05 26 3a 1f e5 74 95 ...F0%..H.&:..t. 01c0 07 1e 05 3b 6f e6 43 6c b0 42 32 ac 24 6b 2e 70 ...;o.Cl.B2.$k.p 01d0 69 a1 e6 fb 93 34 fa 86 f8 a3 ab 0a 2c 65 82 bf i....4......,e.. 01e0 b2 0a 8d c4 0a 6c a7 e0 88 98 dd 1e b1 29 ab 95 .....l.......).. 01f0 86 19 a3 24 ab b9 fd 11 a1 b1 c6 b4 eb 88 5c d8 ...$..........\. 0200 e3 ee c8 55 4b f8 0e 35 0a cc 21 3b 7d 0a 48 62 ...UK..5..!;}.Hb 0210 51 38 20 6a 88 e1 af cf d8 55 59 f8 42 89 38 62 Q8 j.....UY.B.8b 0220 3f 0b e8 fc d1 3d ba 24 90 2a ea 0e c9 6b 26 1d ?....=.$.*...k&. 0230 a9 67 fe 27 98 93 ba 27 c2 f2 4e 16 ac cd 59 bf .g.'...'..N...Y. 0240 74 7a 98 b4 8b e6 e9 5f 6b 3f 1e 5e 57 05 af 2f tz....._k?.^W../ 0250 47 69 8d 3f 65 ce fe 2a 55 5b bd fc 8a 32 55 06 Gi.?e..*U[...2U. 0260 c5 fd 56 e8 6a 51 e2 c0 56 cb 6f 0e ea 03 69 76 ..V.jQ..V.o...iv 0270 c0 15 33 6c 35 7e 7e 65 e8 84 7b 84 76 57 e0 8b ..3l5~~e..{.vW.. 0280 57 53 bc fa ae 0e 6d c4 1a 71 f8 26 98 a2 09 a6 WS....m..q.&.... 0290 0c 84 0c a6 18 cb 8f 16 ac 43 75 a8 bc 58 2a 8e .........Cu..X*. 02a0 57 5e f6 c3 c4 9e db 5a 0f 44 b5 54 87 78 de 9b W^.....Z.D.T.x.. 02b0 b5 9a f1 a9 d5 a3 40 cd ee 64 61 dc 20 8f d8 fc ......@..da. ... 02c0 86 9f f0 2b 00 c1 60 c3 b5 b3 29 22 3e e2 02 c0 ...+..`...)">... 02d0 21 7d ca ac b4 67 b1 77 e8 d7 ef 1e 59 41 cc 91 !}...g.w....YA.. 02e0 55 09 11 5c d4 0b 73 f2 47 f9 75 60 39 ba 7e a9 U..\..s.G.u`9.~. 02f0 71 19 95 02 80 1d 87 93 cf fd c1 74 84 2e ed 8c q..........t.... 0300 53 3c ac 2e 86 0a bf 69 95 d1 90 d1 70 cc 72 e8 S<.....i....p.r. 0310 b7 e2 17 4e 64 ad fd c8 a6 0c e3 fc 61 09 e5 8d ...Nd.......a... 0320 1f 06 b2 35 95 2f 6b 14 c4 58 a7 4b 1f 53 72 ad ...5./k..X.K.Sr. 0330 f4 8f 11 e2 38 78 82 83 ca db ed 04 f7 b8 db fc ....8x.......... 0340 2a b3 9c 45 43 ff 79 16 65 69 dd 43 7d 0c 49 fa *..EC.y.ei.C}.I. 0350 08 77 f4 bd c5 07 5e ba da 2d 86 45 07 af 0b c5 .w....^..-.E.... 0360 25 99 be c3 8b 50 b0 b0 27 57 e1 ea 4c b1 f5 f2 %....P..'W..L... 0370 6f 90 51 18 84 62 ec f7 92 b4 f4 04 c6 1b 27 c3 o.Q..b........'. 0380 65 02 f8 27 00 ff b8 36 ec 02 f7 8f 54 fd ea af e..'...6....T... 0390 7c c1 cd c1 f5 d7 38 77 39 2d 19 c4 81 17 2b 5d |.....8w9-....+] 03a0 d7 4e 6c 8c 7f a3 10 4c 6d 39 f3 3e c2 aa f4 4b .Nl....Lm9.>...K 03b0 63 80 83 20 d7 93 4d 87 cd 74 2f aa 78 8c 32 46 c.. ..M..t/.x.2F 03c0 d0 26 96 02 08 3b bb 01 85 f4 2f d7 81 02 8f d6 .&...;..../..... 03d0 ef f8 11 ab 5b 58 fc 00 30 28 34 43 b6 ac bf 74 ....[X..0(4C...t 03e0 b1 20 01 b4 c1 6e a3 d5 79 48 ad 53 7f 37 c1 2f . ...n..yH.S.7./ 03f0 e2 ab d8 46 0a 7d 18 aa 03 5c 3e e4 80 3e 47 02 ...F.}...\>..>G. 0400 b4 9e b7 0f 92 eb 45 56 7d 7e e8 19 24 df 43 70 ......EV}~..$.Cp 0410 92 75 8e e9 52 9a f3 91 15 9c 6f 5c 3f ec 60 d9 .u..R.....o\?.`. 0420 8f 99 28 8b f1 d5 63 5f e4 ce 9c fb 14 01 0b db ..(...c_........ 0430 6f 11 50 02 7e 84 08 6f b7 49 aa 7e dd 89 bf 8b o.P.~..o.I.~.... 0440 ed a0 57 f2 e2 59 b2 bb a7 13 66 3e 69 7e 35 14 ..W..Y....f>i~5. 0450 a5 bd 1f 9b c7 de d1 c8 eb 5f 34 01 31 a6 0d 65 ........._4.1..e 0460 7f 38 09 e9 53 72 e6 7b 54 7a 2c d0 b2 98 2c 9c .8..Sr.{Tz,...,. 0470 75 36 88 f4 32 b0 e0 74 03 6f fe af 3b 20 bc 92 u6..2..t.o..; .. 0480 2b b5 d1 a7 ee 0b f7 5b 79 c0 53 0f 89 c7 47 e9 +......[y.S...G. 0490 6c 0c 84 65 b4 9b 8a b4 07 04 83 79 7e 34 27 2f l..e.......y~4'/ 04a0 ea 8a d1 a9 23 e1 b7 15 18 7e c1 64 0c 07 e6 45 ....#....~.d...E 04b0 fe c5 10 c6 ac 3b d9 93 97 17 f2 bc 58 15 b9 35 .....;......X..5 04c0 0d 31 58 c9 11 f9 64 7c e1 f7 e1 bc 3d a2 8f be .1X...d|....=... 04d0 e0 e8 51 44 dc 8b d2 e9 c2 8b af ee 14 cd e5 a4 ..QD............ 04e0 fb 39 8c 8c 91 60 fa d5 1b 55 68 5e db 49 1e 51 .9...`...Uh^.I.Q 04f0 f8 18 4d d1 64 62 ad 08 88 dd ef 6a 9d 35 1e 79 ..M.db.....j.5.y 0500 7e 56 b2 23 cc aa ed 6b 08 c6 2e 8c 9d 15 71 a0 ~V.#...k......q. 0510 45 f0 ea f8 2b 65 52 d4 53 36 8c 9e 70 22 a9 7b E...+eR.S6..p".{ 0520 14 84 69 c0 3b 76 1d 48 f7 b1 01 b6 b1 53 2f 06 ..i.;v.H.....S/. 0530 85 29 05 14 7c a5 10 95 72 d9 41 a8 c4 b5 cd 5e .)..|...r.A....^ 0540 f0 24 96 9c 92 e9 03 c5 bf 6b 49 50 d4 c1 45 5d .$.......kIP..E] 0550 ea 8b 85 0f bb 6a 41 ff 31 76 fd 6f ce f2 53 b9 .....jA.1v.o..S. 0560 72 2b 1d fa 6e 0f a0 1b 0b b5 63 2e 4d fa 60 18 r+..n.....c.M.`. 0570 97 7b 13 fc ab 2e b8 a2 e7 07 c2 31 4a 7e 33 61 .{.........1J~3a 0580 dc 9c ad 4a 3c b6 27 c3 ef 65 35 db c2 05 ed 80 ...J<.'..e5..... 0590 a4 8e 3d 65 54 03 20 48 ae 61 f0 8c 8b 42 d0 c2 ..=eT. H.a...B.. 05a0 76 82 5d 60 eb a3 a3 e5 dd 7a 66 85 15 18 9f 3a v.]`.....zf....: 05b0 9f 5e 9b c3 .^.. No. Time Source Destination Protocol Info 3470 915.716828 zen1 soth1 TCP [TCP Retransmission] 4605 > 1677 [ACK] Seq=28215 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3470 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:24.475332000 Time delta from previous packet: 1.001022000 seconds Time since reference or first frame: 915.716828000 seconds Frame Number: 3470 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x48c7 (18631) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2811] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 28215, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 28215 (relative sequence number) Next sequence number: 29675 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0x7890] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 1.501732000 seconds RTO based on delta from frame: 3452 Data (1460 bytes) 0000 50 91 08 91 d2 0a f4 99 ef a4 96 da 84 54 7f 41 P............T.A 0010 3e c0 b9 98 9d 67 f5 ff 27 73 c1 63 28 56 a0 2d >....g..'s.c(V.- 0020 87 63 9a e5 f1 51 1f 4b 0d cf e9 94 10 14 81 b9 .c...Q.K........ 0030 be f7 bb ea d0 9a 5b 19 6f da c9 da 1e 51 d2 c5 ......[.o....Q.. 0040 6e c2 97 a3 a1 79 e3 91 17 dd 15 a5 c7 4f 32 6f n....y.......O2o 0050 3a 60 22 70 b9 e5 73 ac f3 bf 86 c8 4f 09 c8 51 :`"p..s.....O..Q 0060 a5 8d 14 fc 1a 64 19 7a e0 e1 0a b9 c7 5d cc 51 .....d.z.....].Q 0070 d6 a0 6a ad f7 b1 24 4a c1 2e 6b 3b 22 8f cc 20 ..j...$J..k;".. 0080 53 29 b0 7e 03 cd 75 a9 dd 8b a0 cd 41 c9 84 e2 S).~..u.....A... 0090 8f 53 c8 c3 58 3d 8d 21 f5 29 20 84 08 b4 77 2a .S..X=.!.) ...w* 00a0 6e 8a 2f d7 88 50 41 b9 e0 73 f7 45 ba 96 7d 9c n./..PA..s.E..}. 00b0 a0 5c af d6 92 2e b4 cd 78 29 a9 b3 81 aa 79 36 .\......x)....y6 00c0 d9 a4 3e 7c 3c bb 9d 2c 29 ba 0e e2 51 b1 f3 53 ..>|<..,)...Q..S 00d0 29 3d fa 6f 65 05 97 34 01 5e ad 82 09 c3 b0 cf )=.oe..4.^...... 00e0 41 83 98 bc fe 54 57 de 15 10 df e6 90 1f 97 11 A....TW......... 00f0 bb 5b 91 1d f9 d5 16 9e 6e ce 12 8f 45 14 a3 b7 .[......n...E... 0100 cb fe 2c 04 f6 09 24 cb a6 58 21 82 a8 ec 80 26 ..,...$..X!....& 0110 92 a4 68 1d 6b 35 e0 18 41 9d b2 43 f6 41 bf 54 ..h.k5..A..C.A.T 0120 75 22 5a 4a 92 a2 4c d0 27 36 1a 99 58 33 c4 e8 u"ZJ..L.'6..X3.. 0130 f8 05 db 59 b4 c8 c3 1a c0 ea 15 b1 42 8d 8c 00 ...Y........B... 0140 ad 9c ad 14 6f 36 f8 da ed e0 17 a2 17 4f c9 8b ....o6.......O.. 0150 4f 71 94 7f b0 76 9b a1 0a 90 53 3f 32 4a aa f6 Oq...v....S?2J.. 0160 0e 7e 37 42 57 93 d9 d5 8d 5d 96 fc eb 7a 2d a6 .~7BW....]...z-. 0170 a3 ff 8e 9f 2e f3 46 a3 6d 82 ea d3 81 13 63 63 ......F.m.....cc 0180 9b b7 3b 48 5c 8d 00 ec 62 10 e4 b1 75 d2 11 02 ..;H\...b...u... 0190 de c8 a2 57 2d d1 d8 25 f9 e1 1c 1d a4 7b 81 31 ...W-..%.....{.1 01a0 be 0b e5 1a a9 69 15 ce 0d 9f 7c 2f 2b fc f7 c1 .....i....|/+... 01b0 19 84 06 d7 be 23 55 10 60 6d f5 87 de 6b 40 af .....#U.`m...k@. 01c0 45 47 ef 24 e4 88 5c 6a 98 bf 82 b5 19 ec f3 e8 EG.$..\j........ 01d0 00 0a 1d 3d ac 04 49 dc 42 67 3b 06 e6 ca f9 52 ...=..I.Bg;....R 01e0 9e 3a 6b 07 9d 22 8a 19 f1 2d 2e 4c 00 56 9b 75 .:k.."...-.L.V.u 01f0 37 96 97 e0 50 d8 77 2c 47 cf 1c 70 2d 2b 0a b5 7...P.w,G..p-+.. 0200 7c 76 71 b5 6d c3 af 15 4b 86 2a 42 2e d6 bb 96 |vq.m...K.*B.... 0210 64 19 2c 35 a4 1a 7c d3 ab aa 32 66 92 aa be 35 d.,5..|...2f...5 0220 c1 5f 3c 27 b6 dd 00 1d 4f 81 d5 6f 4a 08 a7 e9 ._<'....O..oJ... 0230 be 8d ae 69 56 5c a7 03 d6 67 10 0c 68 c0 c4 4a ...iV\...g..h..J 0240 aa b4 16 b1 fb e3 03 5c 64 ff 24 bc d6 24 77 74 .......\d.$..$wt 0250 42 d4 de 49 b6 3f b1 cf dd 41 7d 25 4d f8 2f 2b B..I.?...A}%M./+ 0260 62 b1 13 a6 e1 c8 de b0 d7 fe ea 91 cb f9 dd 75 b..............u 0270 38 f4 7c fe 4a d2 af e0 61 11 1f 32 d1 6f 56 d1 8.|.J...a..2.oV. 0280 4a 7f 0e 0d 9f cd e7 32 a7 8d 3e cc dd e0 f5 bc J......2..>..... 0290 8b 2d 0a cf ca c6 c1 b6 2f d6 f2 6e dd 7c 75 cf .-....../..n.|u. 02a0 a9 0f 40 be c8 38 40 72 45 17 e3 51 72 71 f8 a8 ..@..8@rE..Qrq.. 02b0 4e d0 65 0d 6e fc 33 8c 86 2c 9e 43 84 3b 76 71 N.e.n.3..,.C.;vq 02c0 50 01 e4 b6 79 30 29 3c 7b ca 31 b2 dc ab 91 0b P...y0)<{.1..... 02d0 90 5f 17 23 2b 77 6c cc 70 2d 91 b8 37 6f b1 d7 ._.#+wl.p-..7o.. 02e0 77 b5 75 8b 01 7c 50 70 9c b2 ba 5a f3 ed 22 80 w.u..|Pp...Z..". 02f0 a8 ba 1b dd ec 0b 53 9a 07 e7 26 93 6c 48 8a 3e ......S...&.lH.> 0300 30 96 cb 02 17 ae 37 7f b1 c2 f2 a7 83 8f ea c0 0.....7......... 0310 4f 1d e2 a0 c0 f3 2f e0 00 06 09 7e a4 a7 6d a6 O...../....~..m. 0320 85 02 28 97 15 f6 f9 87 d0 4a 70 d8 ae 98 f8 f9 ..(......Jp..... 0330 01 a5 dd 57 f7 7b ed 81 c0 7e 20 6b 96 80 91 75 ...W.{...~ k...u 0340 7d d9 81 45 7b e1 ad 3f d1 13 f2 0f cc bb 65 32 }..E{..?......e2 0350 76 85 e0 94 de 0a b2 65 d6 45 9d d7 c1 4d 9e d3 v......e.E...M.. 0360 7a 20 47 d3 17 0e 7d 7f 0f ee 84 04 a3 ef c8 b9 z G...}......... 0370 28 ac 36 f0 b2 f4 d2 e5 59 ff 05 d4 45 e1 76 81 (.6.....Y...E.v. 0380 fe b5 b2 5d b0 2a 3f 74 98 6e cb 62 2f 16 3c cc ...].*?t.n.b/.<. 0390 f7 e1 ce 22 34 d6 61 31 5d e4 b8 05 20 cb 32 fc ..."4.a1]... .2. 03a0 d9 bf ef 85 5c 5a 76 26 08 df bf 5b 11 c7 d7 1a ....\Zv&...[.... 03b0 79 b1 42 6a 55 89 b5 89 ac ec d9 76 3c 6d 4d fb y.BjU......v....M(.$ 0400 0e 9d 0e 8b 45 52 93 79 3c 90 2d 8c 00 f6 0e 29 ....ER.y<.-....) 0410 93 38 c4 73 30 b7 d2 0e 9c f9 e6 92 57 d5 7d a2 .8.s0.......W.}. 0420 cf fa 4b 0d 96 81 6d 2f ee 44 4f e4 98 1a d0 72 ..K...m/.DO....r 0430 3e 03 32 9d 57 1e 9e 3c da c4 e4 0c 69 b9 54 de >.2.W..<....i.T. 0440 06 2d 21 6a f8 42 87 d3 f6 e4 02 e3 ee f6 e0 8c .-!j.B.......... 0450 ff e9 63 88 b8 b6 22 99 59 53 d7 37 af 06 86 98 ..c...".YS.7.... 0460 d6 55 85 ef 31 b0 5f 57 3e 1c 78 8e 0e da f9 a0 .U..1._W>.x..... 0470 af 8a 65 74 67 fd 53 a7 fc fc 51 e9 52 4c 11 98 ..etg.S...Q.RL.. 0480 fa 31 07 65 37 3c f3 f4 55 c2 4d 69 8d a4 1d 88 .1.e7<..U.Mi.... 0490 f8 f4 44 4c 47 67 e8 60 01 c4 d1 19 82 e4 b6 48 ..DLGg.`.......H 04a0 e6 8d 71 ec bf 6b 99 b1 6f 61 8e e1 68 08 f9 0c ..q..k..oa..h... 04b0 5b 2f 79 12 6f 8a e1 35 b2 c8 80 6f 13 fc 0b bf [/y.o..5...o.... 04c0 21 f3 d3 9e 0a ee 6b 42 90 e5 fe a4 ef 11 23 11 !.....kB......#. 04d0 6c 77 22 9d 0e 73 a5 21 f1 a5 a8 5c 01 fa 4f 7b lw"..s.!...\..O{ 04e0 a9 32 58 f4 ff 6a 9a a4 de 29 f4 23 7a bd 69 2c .2X..j...).#z.i, 04f0 63 37 a6 54 ff 8a 97 21 c4 c0 f2 09 b4 7b 40 34 c7.T...!.....{@4 0500 33 fb 13 b2 27 56 af 04 db f9 3b 19 7f 90 c6 92 3...'V....;..... 0510 ef 1e 62 87 25 df 6d 6c 44 fb c1 28 3c 90 34 7f ..b.%.mlD..(<.4. 0520 e7 5e 81 bd d0 32 ef 6b 23 b7 63 f4 5b 10 cb 35 .^...2.k#.c.[..5 0530 3f 86 d5 33 6c 45 db ec 15 4b 67 6c c0 96 4e 37 ?..3lE...Kgl..N7 0540 3a 3a 7b b5 5c e6 07 9b 1f 39 a5 80 19 41 c1 06 ::{.\....9...A.. 0550 fd 0a 81 d2 c1 41 d9 59 a0 cd 1b 88 b7 82 81 19 .....A.Y........ 0560 57 bd 14 92 86 dc 00 1d 72 ab 5d 45 7d 0c bc 34 W.......r.]E}..4 0570 6f 4d d8 eb 1d 00 5b 76 a1 4c 10 4d d6 49 d1 82 oM....[v.L.M.I.. 0580 2e dd e3 58 d7 8f eb 17 c0 2b 0a 9b eb ef c7 d1 ...X.....+...... 0590 77 f1 a2 5b d3 cc d9 51 42 ae ee 5a d9 a1 aa af w..[...QB..Z.... 05a0 7b 26 ae e7 71 3a dd 5c d9 e8 d2 3a 05 86 81 06 {&..q:.\...:.... 05b0 12 a7 99 9e .... No. Time Source Destination Protocol Info 3471 915.717127 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=67967 Ack=31135 Win=17824 Len=0 SLE=39895 SRE=41355 SLE=35515 SRE=38435 SLE=32595 SRE=34055 Frame 3471 (82 bytes on wire, 82 bytes captured) Arrival Time: Nov 11, 2005 16:45:24.475631000 Time delta from previous packet: 0.000299000 seconds Time since reference or first frame: 915.717127000 seconds Frame Number: 3471 Packet Length: 82 bytes Capture Length: 82 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 68 Identification: 0x138f (5007) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x62e1 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 67967, Ack: 31135, Len: 0 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 67967 (relative sequence number) Acknowledgement number: 31135 (relative ack number) Header length: 48 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17824 Checksum: 0x4929 [correct] Options: (28 bytes) NOP NOP SACK: 39895-41355 35515-38435 32595-34055 left edge = 39895 (relative) right edge = 41355 (relative) left edge = 35515 (relative) right edge = 38435 (relative) left edge = 32595 (relative) right edge = 34055 (relative) SEQ/ACK analysis This is an ACK to the segment in frame: 3443 The RTT to ACK the segment was: 1.503381000 seconds No. Time Source Destination Protocol Info 3472 915.717171 zen1 soth1 TCP [TCP Retransmission] 4605 > 1677 [ACK] Seq=31135 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3472 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:24.475675000 Time delta from previous packet: 0.000044000 seconds Time since reference or first frame: 915.717171000 seconds Frame Number: 3472 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x48c8 (18632) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2810] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 31135, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 31135 (relative sequence number) Next sequence number: 32595 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0x0227] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 1.502075000 seconds RTO based on delta from frame: 3452 Data (1460 bytes) 0000 13 91 4c cb 38 06 e5 b2 07 f7 ae 8b 2a 96 3c e5 ..L.8.......*.<. 0010 80 be a1 1b d1 de 91 9f ff 1f 2d e7 db 4a 1c f5 ..........-..J.. 0020 38 9d 4c a9 ea 75 72 e7 44 bb 9c f4 f5 1c f9 80 8.L..ur.D....... 0030 0b fa 51 3a 00 ef 26 d4 bd 65 f5 83 27 7b 61 64 ..Q:..&..e..'{ad 0040 78 0d d1 f0 2c 7c 60 af 8e fa c0 b4 c5 86 a2 16 x...,|`......... 0050 cd 2f 64 53 df 36 81 b9 24 f6 39 98 88 6a ca 3c ./dS.6..$.9..j.< 0060 3b 94 69 f7 12 56 d6 74 41 fd 56 a8 29 3c 75 71 ;.i..V.tA.V.).3.+. 00a0 1d c7 cf c6 c2 40 e5 de 55 dc a6 e5 36 e6 04 45 .....@..U...6..E 00b0 09 3d 16 c0 94 85 10 81 e9 81 08 74 44 b4 ae ec .=.........tD... 00c0 bb 22 23 11 e2 2f 58 2d 9e 8d 3f 8c e8 02 ad f6 ."#../X-..?..... 00d0 83 e1 60 22 e1 9d 28 5f 6a cb 35 d8 a1 2c ae 19 ..`"..(_j.5..,.. 00e0 ab 56 55 63 2e 39 c1 bb d4 7e 1c a6 ac 45 44 a0 .VUc.9...~...ED. 00f0 b0 d7 77 e5 dc ed 2d 24 51 38 4b af 7c 19 aa 0b ..w...-$Q8K.|... 0100 a5 88 32 ad 23 08 c0 bf 1a 61 b0 2f 1f b4 15 b1 ..2.#....a./.... 0110 de 4f 40 fa 81 ba b6 ff 0e 09 6d f1 01 84 74 73 .O@.......m...ts 0120 ce 54 65 b8 ac c8 82 85 e6 34 32 5c 61 bb fb ae .Te......42\a... 0130 d1 7f 62 44 5e 35 c4 3c 66 ce 7e 5b da 97 66 34 ..bD^5.......N.Okhu 04a0 ed e5 47 83 86 80 86 2e be ad 3a 2b 3e 02 31 67 ..G.......:+>.1g 04b0 dd 2a 09 d1 27 c3 98 e7 86 09 05 cd 7a 3c ad 15 .*..'.......z<.. 04c0 ff 97 a2 43 7d a9 c3 43 28 ed e8 51 40 6f b6 26 ...C}..C(..Q@o.& 04d0 29 79 f0 76 d6 57 73 18 c9 80 df 32 36 28 fb 2b )y.v.Ws....26(.+ 04e0 5d df 35 fe f0 6b b6 d5 71 ca 7a 4e d7 6d 56 44 ].5..k..q.zN.mVD 04f0 62 37 0c 95 86 a8 a7 e2 01 42 70 4f ca cf df 30 b7.......BpO...0 0500 06 f0 a7 d4 41 a0 27 c2 d0 7a 1f 4c 60 02 dd c0 ....A.'..z.L`... 0510 00 f8 64 e2 9a 9d b8 54 a0 46 74 7a cd fb 79 24 ..d....T.Ftz..y$ 0520 a6 2c e9 33 29 c2 4e 6e df b1 f3 1c cb 9e 9b 90 .,.3).Nn........ 0530 f6 d2 61 0b 73 f4 a5 2e 1a c3 ba 28 cc e3 8e 5a ..a.s......(...Z 0540 a9 e8 90 3f 1b 62 4f 63 cc cf 1d 2b cc f1 da 57 ...?.bOc...+...W 0550 85 3c 8e 48 97 04 f7 02 40 de 5c e6 40 37 27 1b .<.H....@.\.@7'. 0560 db 80 8b 51 79 f5 6d c0 85 bc 6c 86 85 1e f9 78 ...Qy.m...l....x 0570 6f 48 05 5a aa 77 c6 a4 37 10 44 8a ba b8 ca 1a oH.Z.w..7.D..... 0580 9b 95 30 c7 c7 72 d7 83 34 9e e5 4b 75 08 68 be ..0..r..4..Ku.h. 0590 11 be 9f 64 b9 16 71 0c c8 a5 40 ec 39 84 16 95 ...d..q...@.9... 05a0 a5 c1 81 ff 0d f1 e6 13 92 1a 14 08 44 ef f3 8c ............D... 05b0 69 7f ec df i... No. Time Source Destination Protocol Info 3473 915.717184 zen1 soth1 TCP [TCP Retransmission] 4605 > 1677 [ACK] Seq=32595 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3473 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:24.475688000 Time delta from previous packet: 0.000013000 seconds Time since reference or first frame: 915.717184000 seconds Frame Number: 3473 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x48c9 (18633) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x280f] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 32595, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 32595 (relative sequence number) Next sequence number: 34055 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0x7281] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 1.502088000 seconds RTO based on delta from frame: 3452 Data (1460 bytes) 0000 8e bf 32 78 4c 9c 47 12 f9 2b 9e 0e 53 36 0d 91 ..2xL.G..+..S6.. 0010 ca 1c eb 12 34 ab 66 90 46 33 64 f8 1b 5f 7f f6 ....4.f.F3d.._.. 0020 0e f8 86 cb e4 12 b5 6c 47 64 d9 56 e8 3d 82 a0 .......lGd.V.=.. 0030 7b 7e 37 94 54 75 3f 1c d5 e7 9a 9e 81 a4 76 40 {~7.Tu?.......v@ 0040 97 0d 5f e0 b1 21 4b 8a 24 91 c2 f7 cc 17 76 6a .._..!K.$.....vj 0050 a9 32 60 79 5e 54 7e 1c e6 22 e2 10 e1 86 b9 85 .2`y^T~.."...... 0060 65 83 b0 ec fc 4c 36 1b 3f 3d a6 98 09 5a 56 45 e....L6.?=...ZVE 0070 33 a7 9d ae 93 6f 6b 4a 2c fe 69 b6 8f 68 4c 4e 3....okJ,.i..hLN 0080 12 5b 7c 93 6d 0d 5f 95 01 c7 bf b6 79 79 4b 34 .[|.m._.....yyK4 0090 95 58 52 3c 7c f1 ee ab 4a 9e d7 21 9f bd 6e 60 .XR<|...J..!..n` 00a0 b8 19 04 36 20 49 86 8c 00 8f 0f 52 78 98 6a 3c ...6 I.....Rx.j< 00b0 f5 7a d0 38 b2 6e b2 bc 1c b4 ad 4d 10 14 a5 19 .z.8.n.....M.... 00c0 96 be 0a 4c 8f 90 bf e4 7a 61 30 b9 8a f3 6b 91 ...L....za0...k. 00d0 8e 7a fb ad 71 3c d8 c8 cc d6 7a 8c cc 48 47 50 .z..q<....z..HGP 00e0 a7 ed f7 97 1f 90 5d 5e 2b c7 88 f6 76 15 42 46 ......]^+...v.BF 00f0 ba 69 b5 8d 37 76 5a a8 99 0b 3d 7c a4 a7 9d ba .i..7vZ...=|.... 0100 9d ef e1 02 3a 5a 46 91 a8 4a 4a 0d d3 cb 5c 64 ....:ZF..JJ...\d 0110 03 49 5a 5f 8e 41 ed 73 a8 8a 71 9b bb 75 a2 c8 .IZ_.A.s..q..u.. 0120 71 1a 9a 3d 0b 8c 53 1d 1c 67 68 7a 1c 6a b8 d4 q..=..S..ghz.j.. 0130 09 78 88 fa 7e 23 1e 7d 6d a2 d2 c2 c5 f6 e3 9d .x..~#.}m....... 0140 9e e4 49 6f 0c 69 d1 78 3e 8c 19 c3 3d fa 8a c3 ..Io.i.x>...=... 0150 57 39 4e 1b fe ce 6f fd 67 4d 7b 16 d3 70 08 4b W9N...o.gM{..p.K 0160 f9 b8 56 78 de e1 80 c5 39 d7 8e ef 93 af 24 b4 ..Vx....9.....$. 0170 e6 3a a9 8c 52 65 20 f5 f8 a6 a9 17 35 5b bb 3d .:..Re .....5[.= 0180 50 14 ff de 3f 36 10 b5 87 34 0c b5 ce ab 56 d7 P...?6...4....V. 0190 81 db a8 f7 4e db fb 47 77 0f dc 32 2c b6 75 4f ....N..Gw..2,.uO 01a0 b9 49 bb 8a 2e 41 fe 03 10 91 90 9f 3a 9d ca e7 .I...A......:... 01b0 7e 84 c4 6c ec b4 a6 0a ac b4 3b 46 d4 3e e9 22 ~..l......;F.>." 01c0 d9 99 18 50 00 13 c1 b8 99 95 4b 5a 8b cd 0c 54 ...P......KZ...T 01d0 a0 88 22 d3 ec 82 1a 86 1a 67 c8 1d 2d 14 cd 11 .."......g..-... 01e0 5d d0 23 25 fc c9 8f 81 75 50 56 ba 38 fe d5 43 ].#%....uPV.8..C 01f0 84 60 f0 f0 c2 1b 6f 63 56 6c fe cc 3f c0 04 c9 .`....ocVl..?... 0200 47 4b 66 e3 71 df 80 9d 06 31 26 c7 f0 21 47 9b GKf.q....1&..!G. 0210 66 7c c1 1a 6e f2 6a 02 53 28 21 7d 7f 7a 03 fc f|..n.j.S(!}.z.. 0220 5c 67 9b a4 c2 52 7e de a4 5c 97 c3 03 d6 e5 90 \g...R~..\...... 0230 73 b0 36 a2 75 d8 80 34 b6 8d 4e a2 18 65 5d 26 s.6.u..4..N..e]& 0240 e2 71 26 b4 bc 90 bf c2 7a a8 bb 25 20 fb 93 19 .q&.....z..% ... 0250 5d dd a0 b0 e2 ef 65 5d 1b b9 cb 6f 1f 66 7f fd ].....e]...o.f.. 0260 d5 9c 8a 41 8b 0d 28 95 72 ae ed 8e ee 69 d6 9c ...A..(.r....i.. 0270 7e 7c b0 4a 9c 10 1a 91 56 67 f8 6c 2f 68 8e 7e ~|.J....Vg.l/h.~ 0280 38 33 6a d5 37 16 91 44 4d ac ea a3 25 28 71 ee 83j.7..DM...%(q. 0290 e6 6f 22 32 ea 07 1c cc e1 aa 9c fa 00 e7 b9 af .o"2............ 02a0 3e 9d 0b fb 30 20 a4 b2 44 27 7a ed 77 c4 d4 c0 >...0 ..D'z.w... 02b0 f2 97 5c c7 19 78 88 53 4f 65 c5 c1 38 a3 ce 7f ..\..x.SOe..8... 02c0 e0 7e 8c 29 54 8e a1 01 c5 ac c2 f9 2b aa d6 84 .~.)T.......+... 02d0 af 8c a1 67 9f 47 c1 71 54 8b 88 16 43 36 29 ce ...g.G.qT...C6). 02e0 25 7b e9 91 da 4d 5e f4 d9 dd 36 3c 52 78 e2 98 %{...M^...6[4o[ 0390 2f 7d 4e 33 f4 8e c2 28 2c d4 e2 ad 3a c6 3f 82 /}N3...(,...:.?. 03a0 33 1a c7 d1 bb 96 3a 42 cd 51 27 b0 b0 69 e5 a4 3.....:B.Q'..i.. 03b0 ed b2 20 a7 00 f9 09 03 a7 eb 4d 79 d9 65 2a e4 .. .......My.e*. 03c0 d1 45 92 ed 28 b4 eb a4 20 35 2b 80 06 a3 4b a3 .E..(... 5+...K. 03d0 72 f9 a8 2b 46 b5 76 ff d4 6b 2e b3 d0 5b d1 3b r..+F.v..k...[.; 03e0 97 ae 79 0d b3 0e c4 17 48 f5 6a 94 8d 14 fd 8d ..y.....H.j..... 03f0 ee 42 51 78 cd a8 8e 03 4b e8 08 54 1b b3 66 46 .BQx....K..T..fF 0400 49 17 48 28 43 20 f3 1a f2 63 e4 1f d1 52 9f 23 I.H(C ...c...R.# 0410 56 fa 82 d6 5a 0f b9 58 08 cd 80 e5 3b 61 62 82 V...Z..X....;ab. 0420 3d 18 d9 ca b3 b7 a1 75 dc 3d 24 2d 44 a4 0e 2a =......u.=$-D..* 0430 64 6c ac 4b 0b b2 ea fd 90 3f 5d ab 0e 0a 9e ca dl.K.....?]..... 0440 5a 13 72 e8 a8 a5 e8 5b d1 39 4f 13 af e8 51 35 Z.r....[.9O...Q5 0450 2a 39 b1 d8 07 d4 69 38 d1 00 b1 bd 3f 90 83 99 *9....i8....?... 0460 ab 52 3a 83 1a 18 32 cf 8f 8d bb 06 93 2a 8b e5 .R:...2......*.. 0470 85 2e a8 1b 24 86 a2 e1 c1 1d 60 6d 04 e6 c4 16 ....$.....`m.... 0480 c7 00 93 47 79 55 9e 74 a9 5f d3 88 d4 83 e8 b3 ...GyU.t._...... 0490 dd 05 ff 3a a9 c5 0c 9a 70 e1 c4 c1 99 8b 9e 99 ...:....p....... 04a0 78 f2 06 c5 c7 56 88 84 e0 cf 9d 48 ba ec bb d1 x....V.....H.... 04b0 48 2c fb 8b 16 f5 c9 f2 30 a4 9f f4 59 e3 e2 40 H,......0...Y..@ 04c0 1a 08 91 c5 e5 cd a6 26 63 ca 30 62 e0 40 c1 63 .......&c.0b.@.c 04d0 47 9a 5b 05 88 67 e0 62 b7 ba f9 e6 b5 27 b8 70 G.[..g.b.....'.p 04e0 e8 9b 8a ff e2 da bf d0 72 78 ee 2b 16 04 ee 73 ........rx.+...s 04f0 df 45 b2 cf 8b 92 93 1f 30 63 61 f5 16 62 db a8 .E......0ca..b.. 0500 ef ee 44 45 85 06 af 15 05 2b 5a 17 c5 94 d1 fe ..DE.....+Z..... 0510 48 ee 05 ab 7a 38 d0 7f 69 8e 35 aa e1 69 0e 9e H...z8..i.5..i.. 0520 f5 6d 65 3e dd 62 1a 22 6a b8 52 10 08 61 3d ba .me>.b."j.R..a=. 0530 b6 a7 c0 fa e7 37 e0 b5 8c 07 e8 c7 37 7c ca 6d .....7......7|.m 0540 ff a8 a7 9f 2c be c3 9b 12 56 85 56 a9 54 a5 d5 ....,....V.V.T.. 0550 a0 49 72 aa 45 5d ee 68 69 33 62 b3 b8 b6 be f0 .Ir.E].hi3b..... 0560 e5 a9 24 fd 65 80 52 75 09 f7 a8 a3 ff e0 e0 3a ..$.e.Ru.......: 0570 2f e1 46 fa 43 c2 01 0a ed be 52 47 f1 2d 6b 87 /.F.C.....RG.-k. 0580 be 7c 6a 1f 6e 60 7b 1a 79 b3 22 4f 49 7d bf ec .|j.n`{.y."OI}.. 0590 9a 20 7e 97 ec 57 5f 79 bf 21 91 1b a0 7d ef 91 . ~..W_y.!...}.. 05a0 d8 8e 67 77 9c 7c 06 07 59 85 cb a3 38 d8 b5 78 ..gw.|..Y...8..x 05b0 de 8b 73 fc ..s. No. Time Source Destination Protocol Info 3477 917.719700 zen1 soth1 TCP [TCP Retransmission] 4605 > 1677 [ACK] Seq=31135 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3477 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:26.478204000 Time delta from previous packet: 2.002516000 seconds Time since reference or first frame: 917.719700000 seconds Frame Number: 3477 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x48e5 (18661) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x27f3] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 31135, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 31135 (relative sequence number) Next sequence number: 32595 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0x0227] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 3.504604000 seconds RTO based on delta from frame: 3452 Data (1460 bytes) 0000 13 91 4c cb 38 06 e5 b2 07 f7 ae 8b 2a 96 3c e5 ..L.8.......*.<. 0010 80 be a1 1b d1 de 91 9f ff 1f 2d e7 db 4a 1c f5 ..........-..J.. 0020 38 9d 4c a9 ea 75 72 e7 44 bb 9c f4 f5 1c f9 80 8.L..ur.D....... 0030 0b fa 51 3a 00 ef 26 d4 bd 65 f5 83 27 7b 61 64 ..Q:..&..e..'{ad 0040 78 0d d1 f0 2c 7c 60 af 8e fa c0 b4 c5 86 a2 16 x...,|`......... 0050 cd 2f 64 53 df 36 81 b9 24 f6 39 98 88 6a ca 3c ./dS.6..$.9..j.< 0060 3b 94 69 f7 12 56 d6 74 41 fd 56 a8 29 3c 75 71 ;.i..V.tA.V.).3.+. 00a0 1d c7 cf c6 c2 40 e5 de 55 dc a6 e5 36 e6 04 45 .....@..U...6..E 00b0 09 3d 16 c0 94 85 10 81 e9 81 08 74 44 b4 ae ec .=.........tD... 00c0 bb 22 23 11 e2 2f 58 2d 9e 8d 3f 8c e8 02 ad f6 ."#../X-..?..... 00d0 83 e1 60 22 e1 9d 28 5f 6a cb 35 d8 a1 2c ae 19 ..`"..(_j.5..,.. 00e0 ab 56 55 63 2e 39 c1 bb d4 7e 1c a6 ac 45 44 a0 .VUc.9...~...ED. 00f0 b0 d7 77 e5 dc ed 2d 24 51 38 4b af 7c 19 aa 0b ..w...-$Q8K.|... 0100 a5 88 32 ad 23 08 c0 bf 1a 61 b0 2f 1f b4 15 b1 ..2.#....a./.... 0110 de 4f 40 fa 81 ba b6 ff 0e 09 6d f1 01 84 74 73 .O@.......m...ts 0120 ce 54 65 b8 ac c8 82 85 e6 34 32 5c 61 bb fb ae .Te......42\a... 0130 d1 7f 62 44 5e 35 c4 3c 66 ce 7e 5b da 97 66 34 ..bD^5.......N.Okhu 04a0 ed e5 47 83 86 80 86 2e be ad 3a 2b 3e 02 31 67 ..G.......:+>.1g 04b0 dd 2a 09 d1 27 c3 98 e7 86 09 05 cd 7a 3c ad 15 .*..'.......z<.. 04c0 ff 97 a2 43 7d a9 c3 43 28 ed e8 51 40 6f b6 26 ...C}..C(..Q@o.& 04d0 29 79 f0 76 d6 57 73 18 c9 80 df 32 36 28 fb 2b )y.v.Ws....26(.+ 04e0 5d df 35 fe f0 6b b6 d5 71 ca 7a 4e d7 6d 56 44 ].5..k..q.zN.mVD 04f0 62 37 0c 95 86 a8 a7 e2 01 42 70 4f ca cf df 30 b7.......BpO...0 0500 06 f0 a7 d4 41 a0 27 c2 d0 7a 1f 4c 60 02 dd c0 ....A.'..z.L`... 0510 00 f8 64 e2 9a 9d b8 54 a0 46 74 7a cd fb 79 24 ..d....T.Ftz..y$ 0520 a6 2c e9 33 29 c2 4e 6e df b1 f3 1c cb 9e 9b 90 .,.3).Nn........ 0530 f6 d2 61 0b 73 f4 a5 2e 1a c3 ba 28 cc e3 8e 5a ..a.s......(...Z 0540 a9 e8 90 3f 1b 62 4f 63 cc cf 1d 2b cc f1 da 57 ...?.bOc...+...W 0550 85 3c 8e 48 97 04 f7 02 40 de 5c e6 40 37 27 1b .<.H....@.\.@7'. 0560 db 80 8b 51 79 f5 6d c0 85 bc 6c 86 85 1e f9 78 ...Qy.m...l....x 0570 6f 48 05 5a aa 77 c6 a4 37 10 44 8a ba b8 ca 1a oH.Z.w..7.D..... 0580 9b 95 30 c7 c7 72 d7 83 34 9e e5 4b 75 08 68 be ..0..r..4..Ku.h. 0590 11 be 9f 64 b9 16 71 0c c8 a5 40 ec 39 84 16 95 ...d..q...@.9... 05a0 a5 c1 81 ff 0d f1 e6 13 92 1a 14 08 44 ef f3 8c ............D... 05b0 69 7f ec df i... No. Time Source Destination Protocol Info 3478 917.720000 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=67967 Ack=34055 Win=17824 Len=0 SLE=39895 SRE=41355 SLE=35515 SRE=38435 Frame 3478 (74 bytes on wire, 74 bytes captured) Arrival Time: Nov 11, 2005 16:45:26.478504000 Time delta from previous packet: 0.000300000 seconds Time since reference or first frame: 917.720000000 seconds Frame Number: 3478 Packet Length: 74 bytes Capture Length: 74 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 60 Identification: 0x178f (6031) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x5ee9 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 67967, Ack: 34055, Len: 0 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 67967 (relative sequence number) Acknowledgement number: 34055 (relative ack number) Header length: 40 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17824 Checksum: 0xf36b [correct] Options: (20 bytes) NOP NOP SACK: 39895-41355 35515-38435 left edge = 39895 (relative) right edge = 41355 (relative) left edge = 35515 (relative) right edge = 38435 (relative) SEQ/ACK analysis This is an ACK to the segment in frame: 3445 The RTT to ACK the segment was: 3.506230000 seconds No. Time Source Destination Protocol Info 3479 917.720046 zen1 soth1 TCP [TCP Retransmission] 4605 > 1677 [ACK] Seq=34055 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3479 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:26.478550000 Time delta from previous packet: 0.000046000 seconds Time since reference or first frame: 917.720046000 seconds Frame Number: 3479 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x48e6 (18662) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x27f2] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 34055, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 34055 (relative sequence number) Next sequence number: 35515 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0x226c] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 3.504950000 seconds RTO based on delta from frame: 3452 Data (1460 bytes) 0000 d8 fa 19 fe 82 23 26 14 55 bc 3c 39 f9 a2 07 2e .....#&.U.<9.... 0010 75 4a 75 e7 e8 df 07 40 d1 ca 08 06 7f d1 e1 f6 uJu....@........ 0020 97 42 ac 4e ca 8b 47 96 35 6a c7 85 88 d7 ab 64 .B.N..G.5j.....d 0030 f0 b0 07 89 a8 82 68 83 9b d7 94 3a 61 cd e3 bd ......h....:a... 0040 2f f2 22 47 90 20 f7 3e d4 15 3b c4 84 db dd bf /."G. .>..;..... 0050 79 5a aa 1d 07 88 ab 67 c5 3d 20 90 16 62 c5 88 yZ.....g.= ..b.. 0060 52 23 82 93 28 d5 38 df 8e e2 fb be b5 7b a7 d7 R#..(.8......{.. 0070 ef 75 a3 e3 d9 f7 a2 97 38 8b 86 d1 2a be e0 f7 .u......8...*... 0080 60 22 3f 84 91 42 e8 34 0e d6 ee de 9b cb a4 11 `"?..B.4........ 0090 32 ca 1c 62 e9 6e 94 dc ae 0f 4c 8b 83 e2 45 28 2..b.n....L...E( 00a0 83 52 94 f1 0b c4 bf 1a 46 84 48 33 1c b7 78 2f .R......F.H3..x/ 00b0 4b 43 98 f5 c6 41 75 d0 cd 86 4b 8e 93 a7 d2 a3 KC...Au...K..... 00c0 ea 07 b8 e9 9f b6 52 9c dc 35 02 69 0e 18 30 b2 ......R..5.i..0. 00d0 fe fc 71 38 d7 57 bc d3 6d a8 41 80 72 be f0 bb ..q8.W..m.A.r... 00e0 61 11 a1 62 5c 0b 66 dd 52 46 60 f4 d1 f5 8a 8f a..b\.f.RF`..... 00f0 5a 84 47 09 d9 1b 68 bb b5 8b fb c9 49 1f 30 9c Z.G...h.....I.0. 0100 6d e3 b0 e7 9a 73 20 1b 8a 6a 48 ae dc 90 bc a7 m....s ..jH..... 0110 39 c2 27 a9 b1 db f9 f9 a3 2f 75 ea db d6 b6 9c 9.'....../u..... 0120 54 d3 eb 75 48 88 f8 e0 87 fe a0 a9 ee 73 29 c0 T..uH........s). 0130 8d 62 b9 97 8b d5 5a 0b 8d 01 81 36 5e d8 d3 80 .b....Z....6^... 0140 5e 8b bc f4 2d e7 b9 10 ba ab 68 a1 e1 6c f1 9f ^...-.....h..l.. 0150 e3 93 35 ae d2 d7 6f cd 40 9c 41 bc 7f ec 91 59 ..5...o.@.A....Y 0160 1a fa c0 d2 64 d6 32 09 78 09 34 a3 38 52 bc 83 ....d.2.x.4.8R.. 0170 c9 e9 d1 4a 73 74 aa 8e 93 63 7b 35 cc c7 3d 83 ...Jst...c{5..=. 0180 b2 96 79 cf 35 1e 28 98 e5 92 a1 ff ae 47 00 f0 ..y.5.(......G.. 0190 47 1a a9 79 d6 c7 20 c5 85 83 a7 98 23 cc e2 d9 G..y.. .....#... 01a0 73 52 3e 37 6d 77 74 ca c7 4d 58 f1 4d 1e 8c 48 sR>7mwt..MX.M..H 01b0 dc ab ed 4b e8 a5 a6 e5 de 2e b4 19 ca 0f a7 5d ...K...........] 01c0 e0 86 fd e1 c9 ae 45 02 bb d9 8e 17 2c ff 76 72 ......E.....,.vr 01d0 45 c4 7c c1 b9 f6 51 ec 65 76 cf 52 b7 e0 b5 2b E.|...Q.ev.R...+ 01e0 77 2d f8 af 78 34 f8 0c d6 06 ac 95 d0 f7 ec 38 w-..x4.........8 01f0 5a 76 42 5e 2f d7 df 1a fd 1b 64 1f 41 ea cf 82 ZvB^/.....d.A... 0200 07 53 3d c5 69 89 34 0c 0b 19 62 89 18 6d 54 80 .S=.i.4...b..mT. 0210 7b d7 d2 cd d2 fb 79 e4 03 16 b2 6d 09 05 9b 8b {.....y....m.... 0220 e2 a6 a6 a3 69 03 c9 51 19 9f c7 62 54 e6 f4 4a ....i..Q...bT..J 0230 fa c3 f8 9d 83 1d b1 1a 6e 00 a4 63 f0 2d ff 29 ........n..c.-.) 0240 04 92 10 f0 a8 93 a5 a0 d5 ac 31 eb 25 b9 37 bf ..........1.%.7. 0250 6e ef 97 21 62 37 97 84 37 1b f4 0a 66 4b a3 44 n..!b7..7...fK.D 0260 93 1b aa dc b3 17 72 0d ad cd d5 f0 55 ac 5b 22 ......r.....U.[" 0270 4d c1 03 d4 7b ac 80 7f 43 95 0e fe f7 a2 d8 5e M...{...C......^ 0280 0c dc 97 0b a9 3f 1a 55 5e 4d 1d 5c 0a 5a db f3 .....?.U^M.\.Z.. 0290 31 a4 da 58 5d 16 cb aa a7 70 8d d7 51 08 f2 09 1..X]....p..Q... 02a0 d3 0f dd 68 d9 f2 93 49 c9 3b ae 0c 0b 7d 85 84 ...h...I.;...}.. 02b0 05 61 53 2e 4c ba c8 da df 05 32 26 30 d1 92 7c .aS.L.....2&0..| 02c0 7c 64 c6 a4 25 0d 32 2c 17 1b 3a f9 f2 df ca 2a |d..%.2,..:....* 02d0 4a c7 b0 03 82 ef ae b1 14 3b a7 fe a6 4a a0 54 J........;...J.T 02e0 0e 16 ca 8a e5 13 92 4b b8 a9 30 3b 36 8a 74 b1 .......K..0;6.t. 02f0 42 d3 b9 57 64 b3 ae 0e f0 81 e8 8a d0 27 9e 04 B..Wd........'.. 0300 a6 1f e0 a1 b0 68 e5 93 40 6b 63 c6 bd 32 d3 61 .....h..@kc..2.a 0310 7c 74 80 22 e2 08 72 6b 5d eb 70 ac a7 ec b0 c2 |t."..rk].p..... 0320 fb 63 06 b9 47 45 98 24 7b ff e0 6e 6e ba 47 75 .c..GE.${..nn.Gu 0330 6f fe 3f 48 c7 31 a3 31 60 7b 96 af 27 5e 31 49 o.?H.1.1`{..'^1I 0340 b1 7a 62 0a e6 a5 ef 2a 24 ec 74 cf 1b bb 3a 2f .zb....*$.t...:/ 0350 db a7 e7 33 1c 29 cc 4f 0a e1 24 94 2a 26 de 98 ...3.).O..$.*&.. 0360 67 d9 4c 53 5f d4 b7 79 0e 1e c5 e9 d2 f3 7c e5 g.LS_..y......|. 0370 4d 6c a0 da 98 14 4b ab af 6e c2 a6 b0 5b 33 cc Ml....K..n...[3. 0380 3d 49 67 67 a2 3a 74 c9 2f 2b 0e 27 1e 7a bb d4 =Igg.:t./+.'.z.. 0390 3b d1 28 75 67 e4 77 74 2a ce 5b 25 2e 84 c6 3c ;.(ug.wt*.[%...< 03a0 58 e9 61 1a 18 fa 2e 6d 87 11 54 c2 98 20 4e c0 X.a....m..T.. N. 03b0 ee 48 c2 94 5b 41 e5 33 dc ab 74 72 23 51 4c 8f .H..[A.3..tr#QL. 03c0 ee ee 22 fc df 97 40 0e 99 66 d6 d2 bd 70 77 13 .."...@..f...pw. 03d0 b9 67 ea c1 a3 21 e7 18 d5 c8 79 ca 31 ac 8e 36 .g...!....y.1..6 03e0 fb 81 6a 0c b8 05 e9 14 14 13 f0 02 8a cc 23 f4 ..j...........#. 03f0 37 60 9b 36 11 33 e2 e9 2a 59 08 13 11 15 fe cc 7`.6.3..*Y...... 0400 3d 64 a2 d4 b0 78 23 04 88 c1 c8 21 7a 19 a8 01 =d...x#....!z... 0410 1c 6b 3c 47 92 26 46 0f b7 42 6c 42 b3 14 89 94 .kt;...... 0530 fc b3 61 78 bc fa ad da 12 60 fe 91 51 e3 66 78 ..ax.....`..Q.fx 0540 74 f1 54 70 c7 91 45 f8 9a 11 85 3f a1 36 4c 60 t.Tp..E....?.6L` 0550 91 b2 62 11 8e d7 ec e9 21 81 50 42 1c 4c 08 d3 ..b.....!.PB.L.. 0560 42 e0 4f b4 6b 6e 6c 82 7d 13 4e eb 68 1c 66 f9 B.O.knl.}.N.h.f. 0570 a7 00 91 4d ff cc 5b 17 89 51 0b eb 43 41 0f 5d ...M..[..Q..CA.] 0580 89 33 d9 a8 75 d6 f1 a7 76 f7 cb 83 e4 95 d4 75 .3..u...v......u 0590 6c cb d3 96 9e 63 29 52 bf d0 d3 ed a7 8a e2 83 l....c)R........ 05a0 ae 7c 87 1c 98 d9 f3 80 81 98 1e 0e 07 de 0a 79 .|.............y 05b0 3e a2 e9 f6 >... No. Time Source Destination Protocol Info 3480 917.720057 zen1 soth1 TCP [TCP Retransmission] 4605 > 1677 [ACK] Seq=35515 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3480 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:26.478561000 Time delta from previous packet: 0.000011000 seconds Time since reference or first frame: 917.720057000 seconds Frame Number: 3480 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x48e7 (18663) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x27f1] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 35515, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 35515 (relative sequence number) Next sequence number: 36975 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0xec52] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 3.504961000 seconds RTO based on delta from frame: 3452 Data (1460 bytes) 0000 9f 9f 11 36 25 3d 3d 92 7b 8c 4b c1 e5 99 23 4d ...6%==.{.K...#M 0010 45 2a 0e 66 ab 69 52 d0 96 94 ff 93 9b b7 ab 06 E*.f.iR......... 0020 eb 75 81 07 84 ba 60 59 90 6a 4b 4f df f5 54 ef .u....`Y.jKO..T. 0030 7f 36 37 9d 5a f8 bf 81 db 6e 44 f4 a4 57 03 bb .67.Z....nD..W.. 0040 76 0c 10 63 3e dd c5 19 54 bb c6 a8 cf cc 5d 43 v..c>...T.....]C 0050 83 9d cc 89 4d b7 b5 64 4c 53 d9 12 48 09 5a d8 ....M..dLS..H.Z. 0060 c9 48 a9 fc 8c 2a 95 bf a8 9b f0 9e 0f 46 19 80 .H...*.......F.. 0070 9f 45 9c d3 12 79 42 4a 04 f1 5c 5c a1 aa 95 dc .E...yBJ..\\.... 0080 13 d0 ff f0 92 bb 34 92 dd 27 3c 1f e5 ff 45 3f ......4..'<...E? 0090 ad a4 fa ce aa 09 ef ab 8c 6e 81 a2 1f 03 29 59 .........n....)Y 00a0 95 5d fe 06 d1 2a b1 b3 d9 ea fd be 25 7c e0 8e .]...*......%|.. 00b0 2c 5d 1f fa 7b d4 75 09 81 67 5f 12 1f 42 d9 90 ,]..{.u..g_..B.. 00c0 6f 47 a8 2a c1 96 e9 06 52 45 84 da 6a a2 a3 e7 oG.*....RE..j... 00d0 96 12 81 09 77 df 9f 12 28 18 c8 09 a6 56 9e c4 ....w...(....V.. 00e0 b8 b9 39 99 11 ae 02 cc 3d 5c 4e 28 20 a1 9c c4 ..9.....=\N( ... 00f0 c8 a1 d6 8a 65 c0 aa fc 95 8d 72 08 29 7a 96 20 ....e.....r.)z. 0100 b3 3a 82 14 e4 ad 57 0e 2d 9a 5b eb 2d c7 b1 24 .:....W.-.[.-..$ 0110 b4 95 2b 1d 87 bd 70 1c e1 a4 17 35 31 cf e0 b2 ..+...p....51... 0120 2a 89 37 fa 87 38 36 46 93 c5 6d 4c f6 b7 fc 6b *.7..86F..mL...k 0130 a4 c0 8e 51 c0 5b ca d7 c1 30 ae 06 03 56 60 e5 ...Q.[...0...V`. 0140 6d 1c b8 73 bc 8b fd 5b 59 44 9f 41 cd 6c 97 92 m..s...[YD.A.l.. 0150 9f 90 e5 60 cc d9 11 28 e7 10 24 b8 ff 86 7c 76 ...`...(..$...|v 0160 42 40 c1 08 99 88 1a 7f 71 5d fa 10 2b 0e c8 19 B@......q]..+... 0170 15 ed b6 69 93 76 87 aa 40 01 d4 98 06 44 59 c0 ...i.v..@....DY. 0180 ea e7 b6 e4 c6 99 36 d1 97 0d 44 fc 7d da 82 3e ......6...D.}..> 0190 f1 cd 4d 50 c1 0c 6e b7 92 9b 66 5e 03 b6 c0 8e ..MP..n...f^.... 01a0 08 fb 85 6a 4f a3 70 bf 02 90 4e 9a fc 30 c0 bf ...jO.p...N..0.. 01b0 e5 2a a8 70 df 39 75 a5 a4 14 41 46 99 07 81 ee .*.p.9u...AF.... 01c0 93 8e 05 49 11 c6 85 ea 2d 8d ab 7b 22 d0 81 11 ...I....-..{"... 01d0 6b ad e9 8a 97 1e c1 cb ae 93 6c 35 37 32 7b 60 k.........l572{` 01e0 20 48 d9 8a 3c 23 99 b0 9a 8b c2 d2 eb 58 99 59 H..<#.......X.Y 01f0 51 e2 15 0d 89 6b a2 bb 55 77 4e 52 51 27 73 12 Q....k..UwNRQ's. 0200 f0 93 9c b6 71 0d f6 ff 7f ec 62 f2 81 5c b4 65 ....q.....b..\.e 0210 1a 27 36 3d 9f ce 3e f2 6d b4 74 7c 5e 0d 06 69 .'6=..>.m.t|^..i 0220 4b c9 69 6b ee cf 6a 8f a2 65 e3 ba b1 27 31 da K.ik..j..e...'1. 0230 05 12 ba 05 aa 51 cd e9 fd 2d d7 60 5c 54 0a 56 .....Q...-.`\T.V 0240 6a 98 9d f9 4a cf a5 d6 23 9e 86 0c 50 c4 52 94 j...J...#...P.R. 0250 43 f6 a7 3f 8e c7 6f d2 50 a1 39 e0 56 6d b2 06 C..?..o.P.9.Vm.. 0260 05 bd 95 39 e5 1a 9f d2 dc 22 e9 19 85 3f 3d e0 ...9....."...?=. 0270 9e 7b 8b 9a 4e f6 46 b2 3d 30 62 24 8f 1a 63 dc .{..N.F.=0b$..c. 0280 6b aa 7b 9a 25 ee ef 5a 6d af c0 8d 8a 18 c2 a9 k.{.%..Zm....... 0290 63 41 a3 62 b0 d7 35 83 d4 15 75 93 13 2b c9 f3 cA.b..5...u..+.. 02a0 50 d1 ea 3c d4 10 34 c5 45 a5 1d 83 12 dd 39 05 P..<..4.E.....9. 02b0 d7 f4 f8 c5 89 87 86 a2 81 19 8c b2 a9 f9 cc 4a ...............J 02c0 ff 77 27 12 55 6b 54 4b cd ce 77 6d bc 5e cb 5c .w'.UkTK..wm.^.\ 02d0 e1 42 51 92 be 41 a6 35 03 97 27 54 7d 56 70 69 .BQ..A.5..'T}Vpi 02e0 fa d7 db 7d 7c f4 b0 77 b5 1b 0a e5 40 bc bc 8f ...}|..w....@... 02f0 82 c0 a2 3d e9 34 10 5a 39 2e 9a cb ca 2c fb 91 ...=.4.Z9....,.. 0300 1d 21 df 3e ff 26 55 93 24 a3 40 52 99 30 ae d6 .!.>.&U.$.@R.0.. 0310 f6 51 fe 43 21 ff 60 b9 b7 92 39 57 26 d7 1d e2 .Q.C!.`...9W&... 0320 3f b6 43 b8 d5 73 7b 84 d3 95 5d b2 97 40 49 d6 ?.C..s{...]..@I. 0330 85 31 e9 f1 0c 97 bc 5c 6c 3a 02 65 84 de c8 74 .1.....\l:.e...t 0340 50 86 c2 77 20 af 35 e5 4a 12 ab cc 6e e5 58 9e P..w .5.J...n.X. 0350 9e 4c 52 9f 23 52 b6 25 a6 9c 2a 60 3a 21 c4 48 .LR.#R.%..*`:!.H 0360 f3 88 b7 02 4f ae 53 7f e0 af 25 68 72 d7 64 2d ....O.S...%hr.d- 0370 a5 ff 6e ba 15 67 4b cc 22 75 fa 4b 6b 5d 2a da ..n..gK."u.Kk]*. 0380 15 49 65 b8 bf 2c ec 0a 75 a0 89 8f fc cc c5 f7 .Ie..,..u....... 0390 25 4a d6 af f5 de dd 6f 6f c0 0c e4 72 4b 11 4a %J.....oo...rK.J 03a0 0c 01 93 fd 52 8e 8e ee 4d f0 ce fc b5 3b 09 d0 ....R...M....;.. 03b0 87 85 15 58 04 da 0c ab ba b5 4e 52 46 66 7b 0a ...X......NRFf{. 03c0 0c 27 8a 43 09 61 ad 21 54 09 46 0f 21 47 9f 65 .'.C.a.!T.F.!G.e 03d0 35 02 b4 2f 25 36 d6 70 05 63 34 8c 6d 85 01 6e 5../%6.p.c4.m..n 03e0 c7 43 8d 99 e5 50 1c 63 d8 44 e9 07 27 30 94 da .C...P.c.D..'0.. 03f0 3c 23 cf a9 dc f8 e1 4e 48 8d ff f5 de b3 ef ba <#.....NH....... 0400 e7 9c 0d 62 95 09 41 b4 71 e8 34 7d 23 26 97 1c ...b..A.q.4}#&.. 0410 1f f2 fd 42 81 8f 57 1f 33 bf bb 3b 80 bb 59 c1 ...B..W.3..;..Y. 0420 5f a8 c8 32 67 3e 6b bd 70 10 87 dd 61 27 6d a1 _..2g>k.p...a'm. 0430 be 19 4d b8 92 46 df ea 01 a9 3a 97 5e 55 21 b1 ..M..F....:.^U!. 0440 55 19 cb 4d 3f 8f 58 56 aa 10 80 ca 46 ad 7b 85 U..M?.XV....F.{. 0450 55 cc 4a a5 86 5d f6 44 1d 31 6c e1 6d 06 91 08 U.J..].D.1l.m... 0460 79 21 f1 ca b9 a3 be 70 5b 82 e7 31 af a5 11 af y!.....p[..1.... 0470 cd dd ec e8 89 c9 3a 8e 5c 92 50 d9 11 9e 88 8c ......:.\.P..... 0480 b9 b3 93 5f 2c dd 2c d1 c5 f2 3c 91 45 7b c0 b4 ..._,.,...<.E{.. 0490 74 6f 22 52 12 bc a3 11 07 57 9f 9e fa ce 63 bf to"R.....W....c. 04a0 42 a2 f5 6d a1 b8 4e 52 ae bf 99 ce 60 9c 73 49 B..m..NR....`.sI 04b0 06 af f5 68 73 b2 41 99 bb 9b e5 7b f3 47 ff 1e ...hs.A....{.G.. 04c0 5c 7f e3 4b ef 5e 37 43 18 ec 8c 31 df 02 60 87 \..K.^7C...1..`. 04d0 cc f4 ff 3f 16 d4 5f 9f 46 0a e0 ea 7d e3 c7 00 ...?.._.F...}... 04e0 9e 63 5f 37 a6 ca b0 df c5 75 05 8f 26 4d 38 44 .c_7.....u..&M8D 04f0 ed 56 30 4d 22 d4 3b cb bd 6d 46 bb 74 9a 2c a9 .V0M".;..mF.t.,. 0500 f0 33 0c 44 17 a3 20 2f d3 7d f5 b6 65 02 d5 86 .3.D.. /.}..e... 0510 cd 50 9e 2a 1c 11 93 b9 55 c5 14 00 73 0e f9 c4 .P.*....U...s... 0520 3e 92 d8 74 62 47 4a 16 dc bb 9c 3b 45 c9 dc 44 >..tbGJ....;E..D 0530 fb 24 9c 6a ac 53 c1 c7 d1 f2 1b 8f 92 72 68 4c .$.j.S.......rhL 0540 89 c4 18 5c 8d eb 20 cf 68 e8 26 56 70 f0 84 2d ...\.. .h.&Vp..- 0550 64 19 68 a4 7f 35 30 0b 9d 91 95 b4 a1 ef b9 dd d.h..50......... 0560 88 df 6e 99 f0 11 eb 26 3e d2 69 9a fb e7 11 55 ..n....&>.i....U 0570 8c c5 30 ac 26 ee 97 d5 6a d1 3d cf a0 a3 2c ff ..0.&...j.=...,. 0580 d4 e0 b4 9e 93 78 3e 00 62 1d 1e 78 47 ed 41 f9 .....x>.b..xG.A. 0590 80 41 2d 5e 16 39 93 b9 a2 b6 eb bd b6 19 22 41 .A-^.9........"A 05a0 98 33 d7 b6 a2 87 dc c6 38 6e cd 0d fd ce 5b 76 .3......8n....[v 05b0 f8 94 e2 d0 .... No. Time Source Destination Protocol Info 3496 921.725464 zen1 soth1 TCP [TCP Retransmission] 4605 > 1677 [ACK] Seq=34055 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3496 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:30.483968000 Time delta from previous packet: 4.005407000 seconds Time since reference or first frame: 921.725464000 seconds Frame Number: 3496 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x4926 (18726) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x27b2] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 34055, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 34055 (relative sequence number) Next sequence number: 35515 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0x226c] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 7.510368000 seconds RTO based on delta from frame: 3452 Data (1460 bytes) 0000 d8 fa 19 fe 82 23 26 14 55 bc 3c 39 f9 a2 07 2e .....#&.U.<9.... 0010 75 4a 75 e7 e8 df 07 40 d1 ca 08 06 7f d1 e1 f6 uJu....@........ 0020 97 42 ac 4e ca 8b 47 96 35 6a c7 85 88 d7 ab 64 .B.N..G.5j.....d 0030 f0 b0 07 89 a8 82 68 83 9b d7 94 3a 61 cd e3 bd ......h....:a... 0040 2f f2 22 47 90 20 f7 3e d4 15 3b c4 84 db dd bf /."G. .>..;..... 0050 79 5a aa 1d 07 88 ab 67 c5 3d 20 90 16 62 c5 88 yZ.....g.= ..b.. 0060 52 23 82 93 28 d5 38 df 8e e2 fb be b5 7b a7 d7 R#..(.8......{.. 0070 ef 75 a3 e3 d9 f7 a2 97 38 8b 86 d1 2a be e0 f7 .u......8...*... 0080 60 22 3f 84 91 42 e8 34 0e d6 ee de 9b cb a4 11 `"?..B.4........ 0090 32 ca 1c 62 e9 6e 94 dc ae 0f 4c 8b 83 e2 45 28 2..b.n....L...E( 00a0 83 52 94 f1 0b c4 bf 1a 46 84 48 33 1c b7 78 2f .R......F.H3..x/ 00b0 4b 43 98 f5 c6 41 75 d0 cd 86 4b 8e 93 a7 d2 a3 KC...Au...K..... 00c0 ea 07 b8 e9 9f b6 52 9c dc 35 02 69 0e 18 30 b2 ......R..5.i..0. 00d0 fe fc 71 38 d7 57 bc d3 6d a8 41 80 72 be f0 bb ..q8.W..m.A.r... 00e0 61 11 a1 62 5c 0b 66 dd 52 46 60 f4 d1 f5 8a 8f a..b\.f.RF`..... 00f0 5a 84 47 09 d9 1b 68 bb b5 8b fb c9 49 1f 30 9c Z.G...h.....I.0. 0100 6d e3 b0 e7 9a 73 20 1b 8a 6a 48 ae dc 90 bc a7 m....s ..jH..... 0110 39 c2 27 a9 b1 db f9 f9 a3 2f 75 ea db d6 b6 9c 9.'....../u..... 0120 54 d3 eb 75 48 88 f8 e0 87 fe a0 a9 ee 73 29 c0 T..uH........s). 0130 8d 62 b9 97 8b d5 5a 0b 8d 01 81 36 5e d8 d3 80 .b....Z....6^... 0140 5e 8b bc f4 2d e7 b9 10 ba ab 68 a1 e1 6c f1 9f ^...-.....h..l.. 0150 e3 93 35 ae d2 d7 6f cd 40 9c 41 bc 7f ec 91 59 ..5...o.@.A....Y 0160 1a fa c0 d2 64 d6 32 09 78 09 34 a3 38 52 bc 83 ....d.2.x.4.8R.. 0170 c9 e9 d1 4a 73 74 aa 8e 93 63 7b 35 cc c7 3d 83 ...Jst...c{5..=. 0180 b2 96 79 cf 35 1e 28 98 e5 92 a1 ff ae 47 00 f0 ..y.5.(......G.. 0190 47 1a a9 79 d6 c7 20 c5 85 83 a7 98 23 cc e2 d9 G..y.. .....#... 01a0 73 52 3e 37 6d 77 74 ca c7 4d 58 f1 4d 1e 8c 48 sR>7mwt..MX.M..H 01b0 dc ab ed 4b e8 a5 a6 e5 de 2e b4 19 ca 0f a7 5d ...K...........] 01c0 e0 86 fd e1 c9 ae 45 02 bb d9 8e 17 2c ff 76 72 ......E.....,.vr 01d0 45 c4 7c c1 b9 f6 51 ec 65 76 cf 52 b7 e0 b5 2b E.|...Q.ev.R...+ 01e0 77 2d f8 af 78 34 f8 0c d6 06 ac 95 d0 f7 ec 38 w-..x4.........8 01f0 5a 76 42 5e 2f d7 df 1a fd 1b 64 1f 41 ea cf 82 ZvB^/.....d.A... 0200 07 53 3d c5 69 89 34 0c 0b 19 62 89 18 6d 54 80 .S=.i.4...b..mT. 0210 7b d7 d2 cd d2 fb 79 e4 03 16 b2 6d 09 05 9b 8b {.....y....m.... 0220 e2 a6 a6 a3 69 03 c9 51 19 9f c7 62 54 e6 f4 4a ....i..Q...bT..J 0230 fa c3 f8 9d 83 1d b1 1a 6e 00 a4 63 f0 2d ff 29 ........n..c.-.) 0240 04 92 10 f0 a8 93 a5 a0 d5 ac 31 eb 25 b9 37 bf ..........1.%.7. 0250 6e ef 97 21 62 37 97 84 37 1b f4 0a 66 4b a3 44 n..!b7..7...fK.D 0260 93 1b aa dc b3 17 72 0d ad cd d5 f0 55 ac 5b 22 ......r.....U.[" 0270 4d c1 03 d4 7b ac 80 7f 43 95 0e fe f7 a2 d8 5e M...{...C......^ 0280 0c dc 97 0b a9 3f 1a 55 5e 4d 1d 5c 0a 5a db f3 .....?.U^M.\.Z.. 0290 31 a4 da 58 5d 16 cb aa a7 70 8d d7 51 08 f2 09 1..X]....p..Q... 02a0 d3 0f dd 68 d9 f2 93 49 c9 3b ae 0c 0b 7d 85 84 ...h...I.;...}.. 02b0 05 61 53 2e 4c ba c8 da df 05 32 26 30 d1 92 7c .aS.L.....2&0..| 02c0 7c 64 c6 a4 25 0d 32 2c 17 1b 3a f9 f2 df ca 2a |d..%.2,..:....* 02d0 4a c7 b0 03 82 ef ae b1 14 3b a7 fe a6 4a a0 54 J........;...J.T 02e0 0e 16 ca 8a e5 13 92 4b b8 a9 30 3b 36 8a 74 b1 .......K..0;6.t. 02f0 42 d3 b9 57 64 b3 ae 0e f0 81 e8 8a d0 27 9e 04 B..Wd........'.. 0300 a6 1f e0 a1 b0 68 e5 93 40 6b 63 c6 bd 32 d3 61 .....h..@kc..2.a 0310 7c 74 80 22 e2 08 72 6b 5d eb 70 ac a7 ec b0 c2 |t."..rk].p..... 0320 fb 63 06 b9 47 45 98 24 7b ff e0 6e 6e ba 47 75 .c..GE.${..nn.Gu 0330 6f fe 3f 48 c7 31 a3 31 60 7b 96 af 27 5e 31 49 o.?H.1.1`{..'^1I 0340 b1 7a 62 0a e6 a5 ef 2a 24 ec 74 cf 1b bb 3a 2f .zb....*$.t...:/ 0350 db a7 e7 33 1c 29 cc 4f 0a e1 24 94 2a 26 de 98 ...3.).O..$.*&.. 0360 67 d9 4c 53 5f d4 b7 79 0e 1e c5 e9 d2 f3 7c e5 g.LS_..y......|. 0370 4d 6c a0 da 98 14 4b ab af 6e c2 a6 b0 5b 33 cc Ml....K..n...[3. 0380 3d 49 67 67 a2 3a 74 c9 2f 2b 0e 27 1e 7a bb d4 =Igg.:t./+.'.z.. 0390 3b d1 28 75 67 e4 77 74 2a ce 5b 25 2e 84 c6 3c ;.(ug.wt*.[%...< 03a0 58 e9 61 1a 18 fa 2e 6d 87 11 54 c2 98 20 4e c0 X.a....m..T.. N. 03b0 ee 48 c2 94 5b 41 e5 33 dc ab 74 72 23 51 4c 8f .H..[A.3..tr#QL. 03c0 ee ee 22 fc df 97 40 0e 99 66 d6 d2 bd 70 77 13 .."...@..f...pw. 03d0 b9 67 ea c1 a3 21 e7 18 d5 c8 79 ca 31 ac 8e 36 .g...!....y.1..6 03e0 fb 81 6a 0c b8 05 e9 14 14 13 f0 02 8a cc 23 f4 ..j...........#. 03f0 37 60 9b 36 11 33 e2 e9 2a 59 08 13 11 15 fe cc 7`.6.3..*Y...... 0400 3d 64 a2 d4 b0 78 23 04 88 c1 c8 21 7a 19 a8 01 =d...x#....!z... 0410 1c 6b 3c 47 92 26 46 0f b7 42 6c 42 b3 14 89 94 .kt;...... 0530 fc b3 61 78 bc fa ad da 12 60 fe 91 51 e3 66 78 ..ax.....`..Q.fx 0540 74 f1 54 70 c7 91 45 f8 9a 11 85 3f a1 36 4c 60 t.Tp..E....?.6L` 0550 91 b2 62 11 8e d7 ec e9 21 81 50 42 1c 4c 08 d3 ..b.....!.PB.L.. 0560 42 e0 4f b4 6b 6e 6c 82 7d 13 4e eb 68 1c 66 f9 B.O.knl.}.N.h.f. 0570 a7 00 91 4d ff cc 5b 17 89 51 0b eb 43 41 0f 5d ...M..[..Q..CA.] 0580 89 33 d9 a8 75 d6 f1 a7 76 f7 cb 83 e4 95 d4 75 .3..u...v......u 0590 6c cb d3 96 9e 63 29 52 bf d0 d3 ed a7 8a e2 83 l....c)R........ 05a0 ae 7c 87 1c 98 d9 f3 80 81 98 1e 0e 07 de 0a 79 .|.............y 05b0 3e a2 e9 f6 >... No. Time Source Destination Protocol Info 3497 921.725768 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=67967 Ack=38435 Win=17824 Len=0 SLE=39895 SRE=41355 Frame 3497 (66 bytes on wire, 66 bytes captured) Arrival Time: Nov 11, 2005 16:45:30.484272000 Time delta from previous packet: 0.000304000 seconds Time since reference or first frame: 921.725768000 seconds Frame Number: 3497 Packet Length: 66 bytes Capture Length: 66 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x1d8f (7567) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x58f1 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 67967, Ack: 38435, Len: 0 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 67967 (relative sequence number) Acknowledgement number: 38435 (relative ack number) Header length: 32 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17824 Checksum: 0xb47e [correct] Options: (12 bytes) NOP NOP SACK: 39895-41355 left edge = 39895 (relative) right edge = 41355 (relative) SEQ/ACK analysis This is an ACK to the segment in frame: 3449 The RTT to ACK the segment was: 7.510706000 seconds No. Time Source Destination Protocol Info 3498 921.725812 zen1 soth1 TCP [TCP Retransmission] 4605 > 1677 [ACK] Seq=38435 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3498 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:30.484316000 Time delta from previous packet: 0.000044000 seconds Time since reference or first frame: 921.725812000 seconds Frame Number: 3498 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x4927 (18727) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x27b1] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 38435, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 38435 (relative sequence number) Next sequence number: 39895 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0xd31c] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 7.510716000 seconds RTO based on delta from frame: 3452 Data (1460 bytes) 0000 ca 92 49 11 fc 5b a5 cb 91 fc f6 a8 4c 85 c7 19 ..I..[......L... 0010 85 94 c5 98 ee 25 68 d8 48 f6 ba 20 cb ef ee 25 .....%h.H.. ...% 0020 fc 1b 94 77 a3 a3 f4 db 25 51 c1 22 f7 1d 6c c5 ...w....%Q."..l. 0030 b5 a6 c9 ff 8b cd 43 12 c5 05 4e 7e 61 f6 19 43 ......C...N~a..C 0040 4c 83 b4 cb bf 76 71 a8 a1 2a 29 07 70 da 54 3d L....vq..*).p.T= 0050 42 5d c8 ce 91 0a 87 28 c9 dc 57 21 32 5e 88 0f B].....(..W!2^.. 0060 d6 fe 47 b6 c2 33 78 a9 8f 4a f4 09 8c aa 58 73 ..G..3x..J....Xs 0070 fa 47 90 41 5b 59 73 d1 17 d4 2d ce d7 63 11 f0 .G.A[Ys...-..c.. 0080 ae c8 52 6c ee a1 e9 6b 49 0c 1c b9 d3 6c 58 c0 ..Rl...kI....lX. 0090 b5 6e f7 8d 24 eb 06 a7 67 1a 1c e4 79 d9 71 4d .n..$...g...y.qM 00a0 76 8f fd d4 2e 17 fb d1 84 78 8d d5 28 bb 6c 6f v........x..(.lo 00b0 a1 70 0e 92 a1 be ea 69 b3 3a ca ec f1 0d 80 6a .p.....i.:.....j 00c0 cf 5c 02 33 94 03 57 e4 52 25 37 80 b0 fb 19 87 .\.3..W.R%7..... 00d0 84 13 8d db 4c 17 32 50 84 d9 b4 98 b6 6a e0 3a ....L.2P.....j.: 00e0 b0 da 50 77 3f e8 53 bb 47 70 35 99 5e c9 6e 8a ..Pw?.S.Gp5.^.n. 00f0 b1 03 1c 22 55 11 a1 49 10 d8 dc e4 e7 ac e7 33 ..."U..I.......3 0100 99 19 97 25 7e 8b c0 3c be ae c5 d4 8d 62 72 0e ...%~..<.....br. 0110 a1 27 f3 49 18 cf d1 7e 28 86 a7 db 63 33 1b 23 .'.I...~(...c3.# 0120 cd 6d 10 e7 61 dc b4 91 97 f6 49 cc 6e c9 53 ac .m..a.....I.n.S. 0130 46 0e f9 e0 97 09 f7 fb 43 3b 8d a2 da ad 3e 76 F.......C;....>v 0140 66 d7 2e a1 24 56 1b 8e 03 94 8c 06 b0 e1 9d 68 f...$V.........h 0150 ec e3 05 ea d9 ad a6 bc b2 3d bf 02 c6 ca 02 75 .........=.....u 0160 f9 3d ae 33 ad 00 cc 42 bc e5 33 e4 cc 6c 6a 34 .=.3...B..3..lj4 0170 3e b9 39 58 ef 85 b2 58 36 d7 a5 94 6c 50 74 9d >.9X...X6...lPt. 0180 24 4e 03 6f 13 82 54 d6 73 e3 cd 48 8e cd f0 03 $N.o..T.s..H.... 0190 19 4c 88 bf 75 a1 b2 13 cb 88 3f e2 b4 94 7d ac .L..u.....?...}. 01a0 3c 1b 91 ba 4c 63 20 2c 88 c7 f9 e8 7b 72 5b 68 <...Lc ,....{r[h 01b0 0d f7 87 ba 8a 46 70 b9 dc f5 1f 71 f6 ce ab 2d .....Fp....q...- 01c0 f2 8f 97 d3 9e 6c 8b 4b 9b 3b 55 82 68 3e 09 56 .....l.K.;U.h>.V 01d0 42 35 77 e6 86 97 8c 43 49 5e 83 f3 8c b2 37 ee B5w....CI^....7. 01e0 70 67 13 1a 2d 4d af f6 22 07 2f 10 16 92 48 61 pg..-M.."./...Ha 01f0 3d fa a0 97 9f 8c 52 d3 03 0a 9b 86 01 f7 9b 5e =.....R........^ 0200 3d d0 d8 74 7c cd c1 66 e3 52 ed 9c 72 b9 b6 01 =..t|..f.R..r... 0210 e8 f5 b7 a5 17 01 d3 a8 6d 11 2f 13 15 ca 18 2d ........m./....- 0220 94 73 e9 7e 7b d2 e3 9f b3 ff 03 50 62 ee ff a3 .s.~{......Pb... 0230 8a c8 60 e5 86 f6 54 ec 03 71 d7 a4 6f bf 72 a1 ..`...T..q..o.r. 0240 04 21 30 49 87 c6 d7 72 25 45 98 7e 19 89 02 d7 .!0I...r%E.~.... 0250 e5 5a 47 49 97 01 99 78 3f 18 00 ec e6 4d b7 af .ZGI...x?....M.. 0260 00 87 bd f3 58 15 78 51 95 f9 d8 fe 6e f3 59 7c ....X.xQ....n.Y| 0270 4f 6f 06 0f 93 90 d8 4f fe f3 8f d2 71 e4 75 2b Oo.....O....q.u+ 0280 37 09 1a 6a 7e 14 63 8c 7a bb 1c a8 bd 2b 93 75 7..j~.c.z....+.u 0290 a4 65 32 86 e8 97 4f d6 c7 d2 40 c3 72 4f 9b 5b .e2...O...@.rO.[ 02a0 15 85 1d f9 3b 9b cb e8 49 66 c7 87 9b 50 41 ae ....;...If...PA. 02b0 14 ef 03 b3 6f e7 95 05 1a 56 a7 29 c7 c0 17 09 ....o....V.).... 02c0 8b 19 08 32 0b 0e f3 1c 62 67 62 2e ca 5a b1 d0 ...2....bgb..Z.. 02d0 02 82 b6 00 d7 9a cd f5 f4 52 ca 75 fd 24 ca 32 .........R.u.$.2 02e0 be 8e 97 b5 af ae 52 c3 63 a3 12 9a 1f 8e 71 14 ......R.c.....q. 02f0 ef c9 98 e6 b8 15 d1 3b 71 5f 6a ca cc 9c 4f 3c .......;q_j...O< 0300 3d fd 36 66 b0 99 38 03 80 82 99 07 8d d2 71 6e =.6f..8.......qn 0310 b8 91 6d ab 56 84 66 48 1f ab d4 ef 67 8f 47 16 ..m.V.fH....g.G. 0320 9b 35 f9 c0 b8 b7 4c c5 8e 8f e7 5c ec ff bc e6 .5....L....\.... 0330 1a f9 29 43 b3 38 af cb c4 36 98 5c 8a a4 7a b9 ..)C.8...6.\..z. 0340 60 eb 12 ba e9 63 d5 b7 ff 86 ad 3a dc 38 a0 f9 `....c.....:.8.. 0350 a7 ae fb d1 db 85 fa cb ea 2a bc 3f 25 95 41 e8 .........*.?%.A. 0360 e9 5c 38 21 92 4b 43 0d 95 16 1c 5b 5f 44 ad df .\8!.KC....[_D.. 0370 27 d9 79 6b b3 39 39 42 6a 9e f8 60 fc 0d be 8c '.yk.99Bj..`.... 0380 51 d1 a6 04 a9 f3 38 bc 8b 6a f0 7b ce df 9a 51 Q.....8..j.{...Q 0390 90 c0 fd 44 7f 4d 7e cb 66 b2 76 3d bb 84 87 db ...D.M~.f.v=.... 03a0 6b 56 b7 a0 42 a3 36 46 b3 3f d4 70 1d 19 f5 65 kV..B.6F.?.p...e 03b0 1a ea fc f1 2b 70 27 46 34 33 6b 57 24 08 3e 49 ....+p'F43kW$.>I 03c0 a7 b7 56 e6 37 19 19 d5 64 56 73 4d 57 9f 40 ee ..V.7...dVsMW.@. 03d0 14 c4 2a 00 2b 31 ea e1 4d 02 36 02 dd 50 9e 00 ..*.+1..M.6..P.. 03e0 16 dc 63 75 08 c9 21 75 1b 57 cd 49 c5 1a 6a e8 ..cu..!u.W.I..j. 03f0 12 47 17 d7 39 58 e4 77 e1 2c 59 cf a5 e5 4f e3 .G..9X.w.,Y...O. 0400 03 96 23 3f 19 02 6d da 48 a7 99 b6 62 03 38 3c ..#?..m.H...b.8< 0410 21 56 2e 79 9f 25 37 66 1d 7c 4b 68 a0 33 6d 85 !V.y.%7f.|Kh.3m. 0420 8c a4 00 19 74 3b db 8f 29 74 09 03 83 2f b1 6e ....t;..)t.../.n 0430 ad d3 72 b0 61 bb c6 df 6e 57 1a 1d 3d e3 54 74 ..r.a...nW..=.Tt 0440 aa 4f 69 e9 6e 39 3f b8 1d 7f 80 e8 a3 31 15 25 .Oi.n9?......1.% 0450 bf a6 34 74 31 9c c3 d3 38 86 f7 bf ac 78 0f 16 ..4t1...8....x.. 0460 2c 4a 90 4d 55 34 f9 d8 bc e3 5a aa a3 01 d2 fa ,J.MU4....Z..... 0470 bf ae 3a 24 ed 7d 02 b2 0d 27 56 5c d2 b1 82 4a ..:$.}...'V\...J 0480 bb b6 a4 90 06 7c 71 51 8a 12 62 05 02 98 08 27 .....|qQ..b....' 0490 d9 6b 5f ba 66 80 94 b4 49 c7 ec 68 43 22 a4 43 .k_.f...I..hC".C 04a0 36 f5 e6 89 e6 e1 63 2b 7e 58 32 3b 93 d6 a7 56 6.....c+~X2;...V 04b0 5d 49 0c c1 7b bd 40 7f 15 c3 59 00 08 01 13 ab ]I..{.@...Y..... 04c0 6a a7 7b f4 74 b5 12 9a 4e aa 9f 9f dc 15 dc f3 j.{.t...N....... 04d0 85 6c e7 a5 36 bb 35 6a aa b5 ed 95 4d 2c cb 50 .l..6.5j....M,.P 04e0 96 73 e7 c4 8d 8d 61 c9 c9 cb db a0 c0 d2 df d8 .s....a......... 04f0 68 33 6b 2a 4f 72 38 ca 92 74 bd ce da f2 ff 0d h3k*Or8..t...... 0500 f3 c2 f1 99 28 43 e6 63 35 d2 b9 28 95 1c f3 3e ....(C.c5..(...> 0510 c3 1c 9a 88 d0 89 b0 fc ad 20 8b dd 48 96 8a 35 ......... ..H..5 0520 a9 69 bc f6 cf a3 3b 78 38 cf 31 e4 78 49 05 ad .i....;x8.1.xI.. 0530 ac 6f 20 88 ff 16 61 fc be 3d bc 80 cb 9c eb ad .o ...a..=...... 0540 3c 75 27 7d f9 02 6c 95 38 9c 2d 86 f5 35 63 d8 c.%..w.yD. 0590 2e 4e 0f bf 4b 56 a6 63 e8 b8 cc f0 71 d7 f1 e9 .N..KV.c....q... 05a0 8a 28 cb 06 6e 4b 2a b5 c7 69 77 6f b0 1f 7f 00 .(..nK*..iwo.... 05b0 d4 62 18 13 .b.. No. Time Source Destination Protocol Info 3499 921.725823 zen1 soth1 TCP [TCP Retransmission] 4605 > 1677 [ACK] Seq=39895 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3499 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:30.484327000 Time delta from previous packet: 0.000011000 seconds Time since reference or first frame: 921.725823000 seconds Frame Number: 3499 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x4928 (18728) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x27b0] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 39895, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 39895 (relative sequence number) Next sequence number: 41355 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0x537f] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 7.510727000 seconds RTO based on delta from frame: 3452 Data (1460 bytes) 0000 8c b9 8b e8 47 ce 01 ab 82 97 3b 50 34 57 7a b9 ....G.....;P4Wz. 0010 b7 eb ba e3 35 e9 72 2b 31 07 34 fb 11 c1 ce f7 ....5.r+1.4..... 0020 a5 8d 91 ec 08 d7 bc 30 60 19 e1 e7 9b 13 c3 53 .......0`......S 0030 a1 df d9 70 11 31 2e 10 04 20 c2 9f fc a2 fa c5 ...p.1... ...... 0040 30 89 d4 57 6d 6f 2a 60 2e cf 91 b6 ab 30 97 23 0..Wmo*`.....0.# 0050 bc 11 c8 50 45 7b fc 3a a6 6c 6a 5d 3c 89 92 14 ...PE{.:.lj]<... 0060 39 31 fc 23 f0 a9 aa 9f 21 bc f9 f2 40 06 73 33 91.#....!...@.s3 0070 17 f9 44 0f 1e fa fc 4a 75 70 f5 aa fb ec bb 45 ..D....Jup.....E 0080 f9 f9 67 e0 c6 7e 45 8f 46 8f 14 5d 45 79 63 bb ..g..~E.F..]Eyc. 0090 9d 18 33 54 1d 93 11 b8 32 27 b6 07 90 b0 6d 37 ..3T....2'....m7 00a0 03 1a 77 f6 b4 99 7d 53 6f c1 8e 17 97 c7 31 96 ..w...}So.....1. 00b0 88 49 59 04 7c 63 c2 18 6c 8a f2 73 f0 f1 e9 83 .IY.|c..l..s.... 00c0 6b 79 a1 aa 8c 59 43 19 8f b1 e9 e0 a3 b2 b7 b5 ky...YC......... 00d0 7b 9a ca 31 ec 05 a5 3a b1 6a 41 01 a1 0e 3e 78 {..1...:.jA...>x 00e0 ef 96 a8 e0 e0 29 23 a6 be 51 85 d2 c2 e5 e6 17 .....)#..Q...... 00f0 05 d6 5c 53 a3 69 fc e3 61 d6 c7 ae a2 3e 1f c6 ..\S.i..a....>.. 0100 21 69 b3 f2 87 d0 4a 2a b9 be d8 81 5c 48 84 97 !i....J*....\H.. 0110 ed 66 1f a2 e9 67 26 d9 f5 47 40 7c af 01 94 48 .f...g&..G@|...H 0120 c3 19 2e 3d b9 23 b2 97 26 f1 a4 b7 2a 63 c7 e9 ...=.#..&...*c.. 0130 70 34 37 2a 36 14 6e 29 27 e4 b4 b4 2c 01 d9 5f p47*6.n)'...,.._ 0140 f4 a5 fc fd d2 d8 fb ca e8 7a fe 2e 15 df ae 06 .........z...... 0150 05 af 90 3f 88 e9 a1 52 63 fe da 05 5b 1d 88 3b ...?...Rc...[..; 0160 12 ed 71 55 3f 49 e8 6f 18 3d 6d 3a 32 23 18 22 ..qU?I.o.=m:2#." 0170 f0 e1 1c a9 5c 98 dc b2 e7 70 7c 07 5e 9e 93 99 ....\....p|.^... 0180 a5 bc 91 74 20 a1 67 45 c1 11 94 b0 93 fe a2 f1 ...t .gE........ 0190 e7 fb 6c 1a 22 23 b5 12 b7 2a 89 32 f8 45 bf 38 ..l."#...*.2.E.8 01a0 77 73 0f 01 8d c2 39 ab f4 3a 64 88 c6 25 42 01 ws....9..:d..%B. 01b0 f7 46 a2 bd d8 e9 e4 01 d3 7d f6 4a bf 73 2c 40 .F.......}.J.s,@ 01c0 a2 2c bb aa 69 e9 43 16 11 7e a5 52 22 8a 91 d9 .,..i.C..~.R"... 01d0 64 1a a8 68 d5 81 e2 bc ac 13 74 51 6b 28 65 e3 d..h......tQk(e. 01e0 cc 76 b5 c7 ff 1f 2a 9b ab 2f c3 39 e7 41 f5 4d .v....*../.9.A.M 01f0 cd 2d 93 5b 85 0a e8 a4 40 b9 fa 85 d0 28 3f 21 .-.[....@....(?! 0200 49 39 64 e8 d3 cd e3 bb bb 65 03 09 e1 6b fd b3 I9d......e...k.. 0210 3f 18 2e 11 29 c0 b0 99 a1 e1 35 5e fd 00 ad 1e ?...).....5^.... 0220 90 98 51 78 a3 c7 a4 f4 64 37 f8 88 e6 3c b4 66 ..Qx....d7...<.f 0230 88 fd c0 3e d3 8a 43 9c f3 2c 97 ea 9a 12 96 55 ...>..C..,.....U 0240 9b 89 e1 70 81 98 0a ba 9d 8d 00 0d 25 24 a1 60 ...p........%$.` 0250 6f 73 f4 6c 36 d4 ac 90 f7 f5 e2 13 32 12 0c 4b os.l6.......2..K 0260 57 5c 91 5e a0 b4 7f 55 92 7e 62 36 15 5f 36 81 W\.^...U.~b6._6. 0270 b3 1e 0e 6a 3a 06 52 47 f9 55 da 98 6a 7e 41 19 ...j:.RG.U..j~A. 0280 5f 5b 3b 6d f1 b0 ec c6 1a 2c 8e e6 ed 01 f8 0c _[;m.....,...... 0290 1f 3a fe de 7b fc 68 a6 0f 61 2e fa ff 93 65 2e .:..{.h..a....e. 02a0 db 0e 15 2e e7 d0 eb 52 cc 3b e0 a2 04 38 81 37 .......R.;...8.7 02b0 ad 5f 8a 4f 2c 55 be c5 e1 bc da 80 9f 5e b2 55 ._.O,U.......^.U 02c0 23 6c 4b b1 2f 15 03 4f 5d 3a 55 75 a2 7f 46 46 #lK./..O]:Uu..FF 02d0 eb 5d e3 89 07 c4 c7 64 11 81 c8 8f a9 ea 47 9e .].....d......G. 02e0 8f 6e eb 42 cd 94 fb 1d 24 3f 4c 95 2c 97 ff 0b .n.B....$?L.,... 02f0 ec 9d 29 16 03 18 80 a3 9f 50 ae a1 71 54 81 2f ..)......P..qT./ 0300 79 fb 6d f2 a3 f9 bd 84 87 41 88 44 b6 c3 b4 4d y.m......A.D...M 0310 38 56 e9 e9 af 00 e9 8b f7 b4 ca 63 bb 01 99 2a 8V.........c...* 0320 90 8a 8a eb 57 79 c1 dc 2b 14 57 24 fc 48 e5 47 ....Wy..+.W$.H.G 0330 79 fa e5 ff 2c 23 4b 53 27 9c b2 7f c8 d9 e0 a8 y...,#KS'....... 0340 23 ba 51 ad 6d 73 f8 b0 10 23 a5 84 0a 65 99 5a #.Q.ms...#...e.Z 0350 0e a1 f2 b2 b9 ed 2a a6 24 2b c3 00 38 c6 fe ab ......*.$+..8... 0360 f8 f2 2b 95 7c 6a e0 32 92 58 f6 59 d7 6b 73 45 ..+.|j.2.X.Y.ksE 0370 21 98 8c 89 47 21 b3 02 bd cd b7 d9 2c 41 0f 93 !...G!......,A.. 0380 73 46 0a c4 01 b1 7f 57 cb 93 e5 61 ba 58 5c 86 sF.....W...a.X\. 0390 a2 b6 56 7d 1e c3 a8 39 89 49 f6 87 4f 25 a4 68 ..V}...9.I..O%.h 03a0 5d 13 9b 3c 32 37 32 fb 1c 04 f7 82 b7 56 cd 91 ]..<272......V.. 03b0 c5 c3 2b 49 f2 bc 9c 7e 58 2a 82 8f 1c 8c 3b 7b ..+I...~X*....;{ 03c0 98 58 6b ad f2 02 f0 cf 0c 7c bc 45 51 bb 24 1a .Xk......|.EQ.$. 03d0 ad 77 ad d0 f2 53 32 14 91 6f e1 cd 58 09 92 fe .w...S2..o..X... 03e0 d2 1e 32 4a 7c 1f df fe ec f9 19 60 e4 52 46 d8 ..2J|......`.RF. 03f0 8d a9 14 c4 68 f3 22 14 d9 7d 50 8f 99 c5 b3 1b ....h."..}P..... 0400 d1 f4 5e 20 e5 06 c4 4c f1 85 ea fb 23 3b 15 29 ..^ ...L....#;.) 0410 09 34 e4 64 85 f6 2e 64 c0 de 3e c4 4a 28 8e 29 .4.d...d..>.J(.) 0420 35 7e 90 de 53 c0 8c 48 98 d7 32 3c b3 7f 4d b2 5~..S..H..2<..M. 0430 16 6d 89 4e 92 52 c9 c9 88 9c c0 6b 18 7a 1e cc .m.N.R.....k.z.. 0440 a8 98 35 6e 3c 6e ab 68 ac 38 8a b7 4a 7d f7 00 ..5n 1677 [ACK] Seq=38435 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3509 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:38.495484000 Time delta from previous packet: 8.011157000 seconds Time since reference or first frame: 929.736980000 seconds Frame Number: 3509 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x4999 (18841) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x273f] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 38435, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 38435 (relative sequence number) Next sequence number: 39895 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0xd31c] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 15.521884000 seconds RTO based on delta from frame: 3452 Data (1460 bytes) 0000 ca 92 49 11 fc 5b a5 cb 91 fc f6 a8 4c 85 c7 19 ..I..[......L... 0010 85 94 c5 98 ee 25 68 d8 48 f6 ba 20 cb ef ee 25 .....%h.H.. ...% 0020 fc 1b 94 77 a3 a3 f4 db 25 51 c1 22 f7 1d 6c c5 ...w....%Q."..l. 0030 b5 a6 c9 ff 8b cd 43 12 c5 05 4e 7e 61 f6 19 43 ......C...N~a..C 0040 4c 83 b4 cb bf 76 71 a8 a1 2a 29 07 70 da 54 3d L....vq..*).p.T= 0050 42 5d c8 ce 91 0a 87 28 c9 dc 57 21 32 5e 88 0f B].....(..W!2^.. 0060 d6 fe 47 b6 c2 33 78 a9 8f 4a f4 09 8c aa 58 73 ..G..3x..J....Xs 0070 fa 47 90 41 5b 59 73 d1 17 d4 2d ce d7 63 11 f0 .G.A[Ys...-..c.. 0080 ae c8 52 6c ee a1 e9 6b 49 0c 1c b9 d3 6c 58 c0 ..Rl...kI....lX. 0090 b5 6e f7 8d 24 eb 06 a7 67 1a 1c e4 79 d9 71 4d .n..$...g...y.qM 00a0 76 8f fd d4 2e 17 fb d1 84 78 8d d5 28 bb 6c 6f v........x..(.lo 00b0 a1 70 0e 92 a1 be ea 69 b3 3a ca ec f1 0d 80 6a .p.....i.:.....j 00c0 cf 5c 02 33 94 03 57 e4 52 25 37 80 b0 fb 19 87 .\.3..W.R%7..... 00d0 84 13 8d db 4c 17 32 50 84 d9 b4 98 b6 6a e0 3a ....L.2P.....j.: 00e0 b0 da 50 77 3f e8 53 bb 47 70 35 99 5e c9 6e 8a ..Pw?.S.Gp5.^.n. 00f0 b1 03 1c 22 55 11 a1 49 10 d8 dc e4 e7 ac e7 33 ..."U..I.......3 0100 99 19 97 25 7e 8b c0 3c be ae c5 d4 8d 62 72 0e ...%~..<.....br. 0110 a1 27 f3 49 18 cf d1 7e 28 86 a7 db 63 33 1b 23 .'.I...~(...c3.# 0120 cd 6d 10 e7 61 dc b4 91 97 f6 49 cc 6e c9 53 ac .m..a.....I.n.S. 0130 46 0e f9 e0 97 09 f7 fb 43 3b 8d a2 da ad 3e 76 F.......C;....>v 0140 66 d7 2e a1 24 56 1b 8e 03 94 8c 06 b0 e1 9d 68 f...$V.........h 0150 ec e3 05 ea d9 ad a6 bc b2 3d bf 02 c6 ca 02 75 .........=.....u 0160 f9 3d ae 33 ad 00 cc 42 bc e5 33 e4 cc 6c 6a 34 .=.3...B..3..lj4 0170 3e b9 39 58 ef 85 b2 58 36 d7 a5 94 6c 50 74 9d >.9X...X6...lPt. 0180 24 4e 03 6f 13 82 54 d6 73 e3 cd 48 8e cd f0 03 $N.o..T.s..H.... 0190 19 4c 88 bf 75 a1 b2 13 cb 88 3f e2 b4 94 7d ac .L..u.....?...}. 01a0 3c 1b 91 ba 4c 63 20 2c 88 c7 f9 e8 7b 72 5b 68 <...Lc ,....{r[h 01b0 0d f7 87 ba 8a 46 70 b9 dc f5 1f 71 f6 ce ab 2d .....Fp....q...- 01c0 f2 8f 97 d3 9e 6c 8b 4b 9b 3b 55 82 68 3e 09 56 .....l.K.;U.h>.V 01d0 42 35 77 e6 86 97 8c 43 49 5e 83 f3 8c b2 37 ee B5w....CI^....7. 01e0 70 67 13 1a 2d 4d af f6 22 07 2f 10 16 92 48 61 pg..-M.."./...Ha 01f0 3d fa a0 97 9f 8c 52 d3 03 0a 9b 86 01 f7 9b 5e =.....R........^ 0200 3d d0 d8 74 7c cd c1 66 e3 52 ed 9c 72 b9 b6 01 =..t|..f.R..r... 0210 e8 f5 b7 a5 17 01 d3 a8 6d 11 2f 13 15 ca 18 2d ........m./....- 0220 94 73 e9 7e 7b d2 e3 9f b3 ff 03 50 62 ee ff a3 .s.~{......Pb... 0230 8a c8 60 e5 86 f6 54 ec 03 71 d7 a4 6f bf 72 a1 ..`...T..q..o.r. 0240 04 21 30 49 87 c6 d7 72 25 45 98 7e 19 89 02 d7 .!0I...r%E.~.... 0250 e5 5a 47 49 97 01 99 78 3f 18 00 ec e6 4d b7 af .ZGI...x?....M.. 0260 00 87 bd f3 58 15 78 51 95 f9 d8 fe 6e f3 59 7c ....X.xQ....n.Y| 0270 4f 6f 06 0f 93 90 d8 4f fe f3 8f d2 71 e4 75 2b Oo.....O....q.u+ 0280 37 09 1a 6a 7e 14 63 8c 7a bb 1c a8 bd 2b 93 75 7..j~.c.z....+.u 0290 a4 65 32 86 e8 97 4f d6 c7 d2 40 c3 72 4f 9b 5b .e2...O...@.rO.[ 02a0 15 85 1d f9 3b 9b cb e8 49 66 c7 87 9b 50 41 ae ....;...If...PA. 02b0 14 ef 03 b3 6f e7 95 05 1a 56 a7 29 c7 c0 17 09 ....o....V.).... 02c0 8b 19 08 32 0b 0e f3 1c 62 67 62 2e ca 5a b1 d0 ...2....bgb..Z.. 02d0 02 82 b6 00 d7 9a cd f5 f4 52 ca 75 fd 24 ca 32 .........R.u.$.2 02e0 be 8e 97 b5 af ae 52 c3 63 a3 12 9a 1f 8e 71 14 ......R.c.....q. 02f0 ef c9 98 e6 b8 15 d1 3b 71 5f 6a ca cc 9c 4f 3c .......;q_j...O< 0300 3d fd 36 66 b0 99 38 03 80 82 99 07 8d d2 71 6e =.6f..8.......qn 0310 b8 91 6d ab 56 84 66 48 1f ab d4 ef 67 8f 47 16 ..m.V.fH....g.G. 0320 9b 35 f9 c0 b8 b7 4c c5 8e 8f e7 5c ec ff bc e6 .5....L....\.... 0330 1a f9 29 43 b3 38 af cb c4 36 98 5c 8a a4 7a b9 ..)C.8...6.\..z. 0340 60 eb 12 ba e9 63 d5 b7 ff 86 ad 3a dc 38 a0 f9 `....c.....:.8.. 0350 a7 ae fb d1 db 85 fa cb ea 2a bc 3f 25 95 41 e8 .........*.?%.A. 0360 e9 5c 38 21 92 4b 43 0d 95 16 1c 5b 5f 44 ad df .\8!.KC....[_D.. 0370 27 d9 79 6b b3 39 39 42 6a 9e f8 60 fc 0d be 8c '.yk.99Bj..`.... 0380 51 d1 a6 04 a9 f3 38 bc 8b 6a f0 7b ce df 9a 51 Q.....8..j.{...Q 0390 90 c0 fd 44 7f 4d 7e cb 66 b2 76 3d bb 84 87 db ...D.M~.f.v=.... 03a0 6b 56 b7 a0 42 a3 36 46 b3 3f d4 70 1d 19 f5 65 kV..B.6F.?.p...e 03b0 1a ea fc f1 2b 70 27 46 34 33 6b 57 24 08 3e 49 ....+p'F43kW$.>I 03c0 a7 b7 56 e6 37 19 19 d5 64 56 73 4d 57 9f 40 ee ..V.7...dVsMW.@. 03d0 14 c4 2a 00 2b 31 ea e1 4d 02 36 02 dd 50 9e 00 ..*.+1..M.6..P.. 03e0 16 dc 63 75 08 c9 21 75 1b 57 cd 49 c5 1a 6a e8 ..cu..!u.W.I..j. 03f0 12 47 17 d7 39 58 e4 77 e1 2c 59 cf a5 e5 4f e3 .G..9X.w.,Y...O. 0400 03 96 23 3f 19 02 6d da 48 a7 99 b6 62 03 38 3c ..#?..m.H...b.8< 0410 21 56 2e 79 9f 25 37 66 1d 7c 4b 68 a0 33 6d 85 !V.y.%7f.|Kh.3m. 0420 8c a4 00 19 74 3b db 8f 29 74 09 03 83 2f b1 6e ....t;..)t.../.n 0430 ad d3 72 b0 61 bb c6 df 6e 57 1a 1d 3d e3 54 74 ..r.a...nW..=.Tt 0440 aa 4f 69 e9 6e 39 3f b8 1d 7f 80 e8 a3 31 15 25 .Oi.n9?......1.% 0450 bf a6 34 74 31 9c c3 d3 38 86 f7 bf ac 78 0f 16 ..4t1...8....x.. 0460 2c 4a 90 4d 55 34 f9 d8 bc e3 5a aa a3 01 d2 fa ,J.MU4....Z..... 0470 bf ae 3a 24 ed 7d 02 b2 0d 27 56 5c d2 b1 82 4a ..:$.}...'V\...J 0480 bb b6 a4 90 06 7c 71 51 8a 12 62 05 02 98 08 27 .....|qQ..b....' 0490 d9 6b 5f ba 66 80 94 b4 49 c7 ec 68 43 22 a4 43 .k_.f...I..hC".C 04a0 36 f5 e6 89 e6 e1 63 2b 7e 58 32 3b 93 d6 a7 56 6.....c+~X2;...V 04b0 5d 49 0c c1 7b bd 40 7f 15 c3 59 00 08 01 13 ab ]I..{.@...Y..... 04c0 6a a7 7b f4 74 b5 12 9a 4e aa 9f 9f dc 15 dc f3 j.{.t...N....... 04d0 85 6c e7 a5 36 bb 35 6a aa b5 ed 95 4d 2c cb 50 .l..6.5j....M,.P 04e0 96 73 e7 c4 8d 8d 61 c9 c9 cb db a0 c0 d2 df d8 .s....a......... 04f0 68 33 6b 2a 4f 72 38 ca 92 74 bd ce da f2 ff 0d h3k*Or8..t...... 0500 f3 c2 f1 99 28 43 e6 63 35 d2 b9 28 95 1c f3 3e ....(C.c5..(...> 0510 c3 1c 9a 88 d0 89 b0 fc ad 20 8b dd 48 96 8a 35 ......... ..H..5 0520 a9 69 bc f6 cf a3 3b 78 38 cf 31 e4 78 49 05 ad .i....;x8.1.xI.. 0530 ac 6f 20 88 ff 16 61 fc be 3d bc 80 cb 9c eb ad .o ...a..=...... 0540 3c 75 27 7d f9 02 6c 95 38 9c 2d 86 f5 35 63 d8 c.%..w.yD. 0590 2e 4e 0f bf 4b 56 a6 63 e8 b8 cc f0 71 d7 f1 e9 .N..KV.c....q... 05a0 8a 28 cb 06 6e 4b 2a b5 c7 69 77 6f b0 1f 7f 00 .(..nK*..iwo.... 05b0 d4 62 18 13 .b.. No. Time Source Destination Protocol Info 3510 929.737289 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=67967 Ack=41355 Win=17824 Len=0 Frame 3510 (60 bytes on wire, 60 bytes captured) Arrival Time: Nov 11, 2005 16:45:38.495793000 Time delta from previous packet: 0.000309000 seconds Time since reference or first frame: 929.737289000 seconds Frame Number: 3510 Packet Length: 60 bytes Capture Length: 60 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Trailer: 000000000000 Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x528f (21135) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x23fd [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 67967, Ack: 41355, Len: 0 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 67967 (relative sequence number) Acknowledgement number: 41355 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17824 Checksum: 0xadd0 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3451 The RTT to ACK the segment was: 15.522203000 seconds No. Time Source Destination Protocol Info 3511 929.737313 zen1 soth1 TCP [TCP Retransmission] 4605 > 1677 [ACK] Seq=41355 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3511 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:38.495817000 Time delta from previous packet: 0.000024000 seconds Time since reference or first frame: 929.737313000 seconds Frame Number: 3511 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x499a (18842) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x273e] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 41355, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 41355 (relative sequence number) Next sequence number: 42815 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0x6ceb] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 15.522217000 seconds RTO based on delta from frame: 3452 Data (1460 bytes) 0000 f8 b7 49 04 71 a2 da 14 3a 4c f8 0e 77 6d c0 f4 ..I.q...:L..wm.. 0010 4e 57 2c a9 83 1a 72 af 62 f1 9c 26 7e f0 30 56 NW,...r.b..&~.0V 0020 ab 37 d5 84 c3 4a 5d 75 d5 72 0f ad bf 0d 19 e5 .7...J]u.r...... 0030 bb 89 1c 21 69 55 ca e3 f7 35 21 a4 33 91 0f 2a ...!iU...5!.3..* 0040 a7 a5 17 e1 4d cd 9b a8 fc f5 6d d8 d0 e8 25 49 ....M.....m...%I 0050 88 17 a9 c7 91 65 53 6d 80 b2 5d 69 14 3a ae 99 .....eSm..]i.:.. 0060 63 b6 82 05 15 dc 99 3e b8 03 1b 7e 3c 12 d9 21 c......>...~<..! 0070 37 4d f7 12 43 9b be 36 d0 38 2f 92 25 a4 8f 85 7M..C..6.8/.%... 0080 0d 1b 59 d4 05 6c 98 53 90 fb 35 ea a0 55 98 e4 ..Y..l.S..5..U.. 0090 d1 f6 96 19 52 c9 46 5d 8e 2e 5e 2e ba 7a a2 99 ....R.F]..^..z.. 00a0 c3 51 36 71 9c f1 f4 d5 c9 91 db 35 ff 69 91 97 .Q6q.......5.i.. 00b0 6a d3 8f 1a bf 67 71 52 e8 a0 9c a3 00 1a a9 81 j....gqR........ 00c0 e8 52 e3 cc 7d ca f9 ba 23 43 d9 ce 7e ad aa 84 .R..}...#C..~... 00d0 d8 51 b6 02 fe 51 24 ed 48 f9 bb eb fa 92 58 66 .Q...Q$.H.....Xf 00e0 ad 1c 75 b9 8c ab 39 ff aa a0 f7 c5 b8 3d 66 f5 ..u...9......=f. 00f0 53 e8 4f 21 7b c5 02 bd a7 ae 05 90 35 e6 5c 9b S.O!{.......5.\. 0100 04 d4 a3 5b 13 ed 87 3f fb 69 02 2f a3 dc 60 88 ...[...?.i./..`. 0110 25 f2 77 d3 8d 92 06 69 96 df ab a9 4c ad 4f 87 %.w....i....L.O. 0120 55 b6 9a 35 fb c0 80 4b b2 35 bc 41 f7 4a 0b 0d U..5...K.5.A.J.. 0130 28 1e a0 bf 2a b3 3e 34 49 90 8f 2e 6f 32 d7 08 (...*.>4I...o2.. 0140 31 24 b0 84 bb 10 6e 1a ea f2 cf 7a c5 3b 5a cb 1$....n....z.;Z. 0150 53 0e c0 3d 2f 7e 74 b2 39 47 86 66 ce bf 45 0f S..=/~t.9G.f..E. 0160 a1 28 a3 63 05 9f 63 ec c2 f1 e5 33 e7 af 4a c0 .(.c..c....3..J. 0170 a7 5f 3e 05 35 64 af 62 7c 59 64 cc ba ad 5c 25 ._>.5d.b|Yd...\% 0180 41 e0 94 c1 97 cd 75 e3 2b 49 65 62 2d 20 2b bf A.....u.+Ieb- +. 0190 53 18 42 73 0f 08 0f 7a fb 78 86 ed a7 f9 55 c7 S.Bs...z.x....U. 01a0 cc 1a 27 49 07 d9 77 d3 3f ca aa 35 92 c7 fc 8d ..'I..w.?..5.... 01b0 86 03 fc 44 2d 6c 66 0e 6d df 3a 85 7e 11 c6 51 ...D-lf.m.:.~..Q 01c0 c9 70 ce db 26 3e 69 e8 84 3d f3 c2 34 bb 16 36 .p..&>i..=..4..6 01d0 bd c4 28 6b 0d 24 0e 44 4b 03 f5 cc 08 93 e6 9a ..(k.$.DK....... 01e0 fa ef d1 22 4e 2f 74 6e 32 41 c6 73 f1 1b e9 da ..."N/tn2A.s.... 01f0 b8 dc ef 92 55 83 ee 99 5e b7 a2 b0 5e 46 06 a2 ....U...^...^F.. 0200 2a e4 24 18 15 55 b6 e0 2d 45 8d c3 0a fa 70 23 *.$..U..-E....p# 0210 4f 9e 99 02 7e ae 27 68 d1 33 4a ef 52 be 23 6c O...~.'h.3J.R.#l 0220 29 d7 20 ff c8 93 96 09 44 f3 de 9e fe e4 b6 c4 ). .....D....... 0230 1b 93 95 ea d8 db 7b 95 9d 65 4e c6 b5 1e c6 bc ......{..eN..... 0240 c3 45 bb d3 f5 dd d3 1c 77 35 b0 55 a5 99 72 92 .E......w5.U..r. 0250 d7 ae 36 bd 4a 50 64 d6 1b b8 40 c8 9c ca 1c b8 ..6.JPd...@..... 0260 f2 e9 08 ba db 6b 8a bb c7 b4 2b 77 25 c0 c6 bd .....k....+w%... 0270 fe 50 74 50 67 f6 5b cb 61 5c 55 ed 47 00 b1 7a .PtPg.[.a\U.G..z 0280 ae b4 7b d9 6c 94 9d 1c e1 36 ca c2 6f ed f7 ae ..{.l....6..o... 0290 0a 63 af 0b c0 c0 31 8e 00 39 59 de 20 10 25 87 .c....1..9Y. .%. 02a0 d4 bf f3 47 f1 c6 fa 61 e7 50 a1 04 d5 20 f7 af ...G...a.P... .. 02b0 f4 0e 5e 82 e7 86 91 6e e5 ac a4 51 d3 ea 68 5c ..^....n...Q..h\ 02c0 a8 6a b4 02 a1 17 8f 89 50 b9 a9 5b bd 4f ef ba .j......P..[.O.. 02d0 74 29 f1 27 2f 75 c7 00 0f 42 6c a1 bc 48 20 cd t).'/u...Bl..H . 02e0 ab 4d 19 52 d6 57 04 41 5d bf 67 b6 01 fc 4f 82 .M.R.W.A].g...O. 02f0 89 aa a9 81 e6 72 51 96 0d f3 18 f8 20 15 74 9b .....rQ..... .t. 0300 da 20 38 c3 f1 e1 2d 2f 2d 28 8b 59 0a 84 7c 43 . 8...-/-(.Y..|C 0310 80 8a bb 31 8f 90 86 b8 d6 6b 33 cd 49 11 f0 cd ...1.....k3.I... 0320 4e 4e 43 d3 14 d4 d2 de b3 07 f3 1f 0f dd 82 c9 NNC............. 0330 ac 40 17 21 e7 c5 70 40 a4 8b b6 44 05 fc 04 89 .@.!..p@...D.... 0340 c3 8c 89 66 39 1e d3 c1 0c 10 04 ef 77 4d a1 c6 ...f9.......wM.. 0350 7a 7a 2e c0 a1 c9 21 5c e2 2c 25 54 35 37 a2 df zz....!\.,%T57.. 0360 8b f2 71 28 06 d6 af 4f ff 26 b7 21 32 8b 6b 4f ..q(...O.&.!2.kO 0370 53 6a d2 26 15 ba c9 65 94 db 37 db 3d 03 b2 4b Sj.&...e..7.=..K 0380 84 f7 1d 1e 69 31 c0 ce 57 45 42 59 61 52 4b 04 ....i1..WEBYaRK. 0390 b4 1a b9 e2 8d 80 30 f9 fd d6 f2 c3 ae c1 f5 63 ......0........c 03a0 b1 14 4e 8d ae a8 0b b8 26 7e 37 46 34 d5 ec 6e ..N.....&~7F4..n 03b0 6f 1e 38 7c 4e 7f 36 0d d3 3f d9 82 20 ae 73 62 o.8|N.6..?.. .sb 03c0 b3 33 9c bf 92 d2 bd c6 82 11 ae 63 4f 52 ff 49 .3.........cOR.I 03d0 86 54 ab 7a e5 39 1c 60 ef bd ec cf 5e b0 24 e8 .T.z.9.`....^.$. 03e0 54 1f fb e6 38 e4 79 e4 3c ef 86 90 9c 7a df 1c T...8.y.<....z.. 03f0 64 18 ea 16 d2 a3 34 25 5b d7 6b 58 93 26 08 40 d.....4%[.kX.&.@ 0400 f7 61 77 dc 05 b6 bb db bb 49 c8 da 57 3f dc 7f .aw......I..W?.. 0410 ea 3d 2e 96 0e 08 ae 99 41 14 13 38 bd 6f 57 87 .=......A..8.oW. 0420 36 cc 69 ea 21 a2 e1 6a 52 0f e5 d2 31 33 c3 05 6.i.!..jR...13.. 0430 67 9d 31 e3 8e de 92 ff 49 52 ce 4a 6c 9b f0 e2 g.1.....IR.Jl... 0440 86 65 0a 07 69 4a 4c d9 4e 15 9f ff 60 17 c7 c1 .e..iJL.N...`... 0450 16 66 77 79 72 b5 28 b1 0c 41 93 32 39 6d 7b 7b .fwyr.(..A.29m{{ 0460 72 09 30 b0 96 d4 94 a5 61 6a ad 40 15 a1 15 97 r.0.....aj.@.... 0470 96 fa bc 0c 47 ee a8 7c 09 ec 06 77 a5 16 34 0e ....G..|...w..4. 0480 5e c8 c1 23 23 c9 24 14 b8 e5 b5 1c a1 95 48 5c ^..##.$.......H\ 0490 9c fb f0 16 b5 17 0d 28 03 bc cf 29 cd c4 bf 9f .......(...).... 04a0 ec 43 0d 6e ec 24 7d f5 17 60 64 ac 43 7c 42 54 .C.n.$}..`d.C|BT 04b0 0b f7 66 1e 5a b8 67 a4 56 8b fb dd 28 a4 a7 96 ..f.Z.g.V...(... 04c0 c9 a1 e8 a9 5c 45 25 89 f5 0c e6 63 4d a2 ea 64 ....\E%....cM..d 04d0 ab 32 8e e6 8e 53 14 ad e7 a4 ec c6 08 7c d9 8a .2...S.......|.. 04e0 cd fb e2 77 83 0b f6 b3 28 54 c7 4d ca a5 8a f5 ...w....(T.M.... 04f0 1f 50 6d 92 1e b2 85 17 70 20 bd 54 af 00 20 9e .Pm.....p .T.. . 0500 8d 3b 2b c4 04 6f ff b1 aa 4d f8 b7 27 0d 55 16 .;+..o...M..'.U. 0510 1c 73 05 ac 3a 10 a7 30 1d 1a 2f 61 73 c8 0c a7 .s..:..0../as... 0520 25 03 6e 13 a2 f6 24 09 fe dc 60 77 4f 1b 46 5c %.n...$...`wO.F\ 0530 b0 5e 27 bd 3e 6a b9 c7 28 1c be fd fa 63 84 4c .^'.>j..(....c.L 0540 73 34 2b 5f 02 ec ff 05 f6 ad d7 a2 57 93 e1 b5 s4+_........W... 0550 a6 a3 b1 73 f6 e5 af 48 4a c4 e9 99 5b 03 92 6a ...s...HJ...[..j 0560 78 d7 ad de 34 6a 8c ea dd 5d 7b cf d1 40 42 94 x...4j...]{..@B. 0570 f3 bc b0 a3 6a 4d 7c ff d2 4c 17 eb cb 1e df 20 ....jM|..L..... 0580 af 77 0b 7e f4 0b d2 a6 8b 00 73 45 26 f8 0c a2 .w.~......sE&... 0590 71 4f a7 94 67 c6 5d 72 98 2c 5c 24 1b 62 8d 0e qO..g.]r.,\$.b.. 05a0 f9 1b e4 4a 81 a8 f9 52 c4 23 6c ba 1b b0 6c 6a ...J...R.#l...lj 05b0 02 bc f0 ed .... No. Time Source Destination Protocol Info 3512 929.737327 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=42815 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3512 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:38.495831000 Time delta from previous packet: 0.000014000 seconds Time since reference or first frame: 929.737327000 seconds Frame Number: 3512 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x499b (18843) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x273d] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 42815, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 42815 (relative sequence number) Next sequence number: 44275 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0x9a67] Data (1460 bytes) 0000 22 a6 4b 52 24 30 4f 43 80 f9 f4 a8 85 7e 18 b0 ".KR$0OC.....~.. 0010 04 e7 a0 e3 20 b6 e5 29 5b 2a 7f 87 b9 c1 c5 73 .... ..)[*.....s 0020 6e f9 6a d6 69 25 82 de 2c f6 a2 74 2e 58 5f 4f n.j.i%..,..t.X_O 0030 a3 0d 80 5c 8f 14 d7 6e 63 57 c3 4b ae 70 50 99 ...\...ncW.K.pP. 0040 ea f7 b6 38 73 5d 53 5c be b7 60 35 79 5a 18 17 ...8s]S\..`5yZ.. 0050 7c 48 ec ee f8 f3 11 03 95 a0 b4 3b 00 ee 3e 5f |H.........;..>_ 0060 86 f4 e4 58 60 e6 08 c4 d9 24 d0 95 db 13 42 cc ...X`....$....B. 0070 bf 69 59 07 82 25 e6 37 30 d2 87 45 21 0c a4 69 .iY..%.70..E!..i 0080 9c 71 60 e5 de 66 25 05 ac 80 e3 5c 7f cd 9d e2 .q`..f%....\.... 0090 f2 c3 fa be 03 97 b9 04 c4 fc 92 ef d7 d7 99 64 ...............d 00a0 46 a9 a5 2d 1a 32 78 75 79 28 9b e5 dd bf f8 78 F..-.2xuy(.....x 00b0 3d 2d d2 3e 30 c2 a7 8a 54 cf 03 73 91 80 54 0d =-.>0...T..s..T. 00c0 87 11 ce 0c f9 54 79 73 b7 43 79 e6 0d 01 93 4e .....Tys.Cy....N 00d0 40 45 ce 98 cf e3 7b db 0d eb 38 35 53 49 52 5c @E....{...85SIR\ 00e0 75 c7 1a ea 03 2b 09 2a 5b 33 e3 5e a2 33 56 e1 u....+.*[3.^.3V. 00f0 b2 8d 01 78 f8 06 95 f4 d3 a6 7e 7b cf f8 71 88 ...x......~{..q. 0100 66 aa 45 fb fe 68 1d 38 ca 4d ff a3 98 aa 77 c7 f.E..h.8.M....w. 0110 e4 c7 44 5e 8d df c1 5c da b2 52 e2 32 98 78 94 ..D^...\..R.2.x. 0120 fc 84 71 50 36 e6 37 75 39 6c 97 d7 c5 79 ce 07 ..qP6.7u9l...y.. 0130 c1 4f 50 36 d8 70 d7 aa 1e 1e e7 00 6c 14 a7 d0 .OP6.p......l... 0140 5d 50 1e ba ff 72 79 5e 76 aa 7b d7 27 c5 43 0a ]P...ry^v.{.'.C. 0150 9c ff 6a f4 da fa 7e 40 1e a5 b5 33 23 44 38 97 ..j...~@...3#D8. 0160 e1 73 d3 99 93 4e 3a f4 3f 2e 0b 79 38 d4 66 8f .s...N:.?..y8.f. 0170 4c ed b7 1c d7 6d 89 dc f3 b7 4b 9f 2b 34 a0 6d L....m....K.+4.m 0180 9c 0b c9 bb d6 5c 8b 7c 69 68 d5 74 02 70 e5 5f .....\.|ih.t.p._ 0190 75 eb 07 ac 92 fb 59 f5 dd d0 a0 5e 7c e3 58 e6 u.....Y....^|.X. 01a0 3d e9 91 95 e6 4e da 2b 5e 89 60 b1 39 9e 3b b8 =....N.+^.`.9.;. 01b0 8c 3b 33 fb c7 1e a3 fd 7e f9 75 dd b1 44 fb 28 .;3.....~.u..D.( 01c0 39 a2 37 34 a3 17 fc 0a fb bd 12 b1 0e 0a f3 ab 9.74............ 01d0 4c e0 a9 71 52 94 45 40 e4 71 d8 cc 5c 45 7d 66 L..qR.E@.q..\E}f 01e0 17 c5 69 7a 06 e7 74 97 b3 b8 c3 36 af c9 c3 3c ..iz..t....6...< 01f0 51 06 a7 01 34 ec 95 d4 27 93 21 71 62 ab cf 0d Q...4...'.!qb... 0200 8d ba 7f e7 82 0b d1 b7 b5 35 ff 8a e5 ec d3 fd .........5...... 0210 a3 66 d4 15 2b 6f f4 4d c2 50 4b e7 ea 64 1e c9 .f..+o.M.PK..d.. 0220 1b 66 fd ce f4 63 33 e2 73 61 db c7 a8 c3 6c 5d .f...c3.sa....l] 0230 ec 21 dc 13 9f bc 1a 78 cd 0d 02 cb e4 f5 aa 2e .!.....x........ 0240 49 10 84 51 e1 30 11 f4 25 27 90 46 e2 93 5b 69 I..Q.0..%'.F..[i 0250 d1 96 0a d4 38 0f cb e7 ef b1 fc 49 7f a4 b0 c7 ....8......I.... 0260 f9 d5 0d 1d 87 ca 74 25 5d 27 9a 72 bc f4 6d 4b ......t%]'.r..mK 0270 a9 c2 61 c8 6b 0c cf d7 c2 5f 70 03 6c 27 4d ab ..a.k...._p.l'M. 0280 1b da b5 30 36 8f 33 c4 68 15 43 98 17 58 dd 18 ...06.3.h.C..X.. 0290 a2 e6 8e 4b 6b 28 de 3b f3 da df 0f ea 19 d4 9e ...Kk(.;........ 02a0 0c 88 58 60 58 8e 6a 5c ff cd d4 d1 67 5e 5c 69 ..X`X.j\....g^\i 02b0 59 f1 8c d3 e4 85 3f 5a 7c 0f a7 ec 42 9d d8 37 Y.....?Z|...B..7 02c0 ff df 7f 46 d7 3d eb f4 b7 cd 22 ac 04 d0 18 7b ...F.=...."....{ 02d0 15 39 f4 4f 35 fe 3f d7 22 be df 1d e2 b3 b4 05 .9.O5.?."....... 02e0 e6 1c 4e 45 48 96 f4 77 4d f1 61 0d ef 63 89 4e ..NEH..wM.a..c.N 02f0 e0 f0 99 6b 28 6c 71 b0 63 81 63 61 29 e9 e4 f3 ...k(lq.c.ca)... 0300 83 11 08 01 71 94 d5 24 f9 48 5a e2 c9 18 75 ff ....q..$.HZ...u. 0310 62 5e 31 65 42 d1 c2 e1 4f df 0f fe 0c 63 30 e8 b^1eB...O....c0. 0320 53 9f 39 c3 f7 bc 4d 48 0c 55 8b d7 13 05 5d ec S.9...MH.U....]. 0330 a7 33 b8 20 2a 8a 53 b1 3f e1 ba 38 be ea e3 bd .3. *.S.?..8.... 0340 da 3e ac a6 4e b2 7b 31 34 8e fd 30 d3 f7 b7 d9 .>..N.{14..0.... 0350 0d 83 6a 99 5f 01 ca 2c 3f 5a db 98 86 d4 f1 81 ..j._..,?Z...... 0360 ff a6 bc 8b 69 68 5a 8a c2 49 07 59 b8 73 5d c1 ....ihZ..I.Y.s]. 0370 5e bd 45 ee 56 b8 a9 44 61 1c 49 00 ab 36 b4 86 ^.E.V..Da.I..6.. 0380 d4 92 38 b7 0b 3c 2b bb 9b 8d 74 60 21 a6 cf a0 ..8..<+...t`!... 0390 ed 7e 87 92 29 4d 6c 76 a3 e6 78 7e a5 15 e0 6a .~..)Mlv..x~...j 03a0 97 a2 63 52 c2 db 78 d4 6a 16 7f 41 75 83 2c 8a ..cR..x.j..Au.,. 03b0 97 ea 6a 4a a0 05 80 15 6d 10 90 b0 28 c3 e4 68 ..jJ....m...(..h 03c0 9f 5c 5a 4f 32 63 8f fd f1 a6 fd b4 7e 64 47 22 .\ZO2c......~dG" 03d0 c5 0e a0 b4 32 5e ac 00 8d 06 48 5c 7c 94 98 c7 ....2^....H\|... 03e0 4c 68 dc e4 1c 04 4e de 61 b3 27 be bf 05 88 44 Lh....N.a.'....D 03f0 40 bf 1e bd ad 79 11 d5 ed 62 21 4f c1 50 d7 52 @....y...b!O.P.R 0400 e7 dc 5d 35 21 3b 5f 7a c6 19 71 bf 6b d5 9e 48 ..]5!;_z..q.k..H 0410 ad 19 b2 0e 05 cc 69 0f 66 cd b0 b2 42 84 50 0d ......i.f...B.P. 0420 ff d2 be 71 bd bb 79 72 3e e2 e4 d1 9c 52 12 ad ...q..yr>....R.. 0430 db ca b8 47 46 3a 1d 5c 3d fe c8 d7 98 6c 3e 92 ...GF:.\=....l>. 0440 63 93 b1 c5 2b 78 93 8a b9 db 87 38 cc 15 a6 66 c...+x.....8...f 0450 43 18 ef c4 f9 70 16 6d 9a f0 12 c2 f9 e8 98 34 C....p.m.......4 0460 3e a9 55 62 9e a4 ed 73 45 51 9f e6 52 8a be 74 >.Ub...sEQ..R..t 0470 db 04 9d 89 61 bf 83 ce 9d 82 34 84 f5 5d 4d 1e ....a.....4..]M. 0480 36 0d 6d a4 99 b9 5a 37 71 50 c6 17 c5 66 d9 f4 6.m...Z7qP...f.. 0490 38 63 d6 7f 73 66 91 03 8c 93 be 6a 30 b3 7e 4b 8c..sf.....j0.~K 04a0 84 68 98 f9 26 0e b9 3b 12 07 0a 2d d5 d5 74 13 .h..&..;...-..t. 04b0 03 86 3b 0d f2 76 73 a5 1c e4 dc f2 f9 63 9a 7f ..;..vs......c.. 04c0 29 c4 0e f7 60 09 82 a8 2e 97 eb ae 73 c8 2c 9e )...`.......s.,. 04d0 d6 a9 a7 28 e3 b8 33 ed cf 8b 5f 4d ad 9b 81 45 ...(..3..._M...E 04e0 33 85 be d1 1b 80 4a 84 9f 08 32 9d b0 33 1b 2f 3.....J...2..3./ 04f0 7f 8e f8 37 b0 7e c4 84 b7 41 24 b6 e8 78 d0 3f ...7.~...A$..x.? 0500 19 2c 9d d6 6b 9b c3 c1 2c e2 7d a9 9c 68 37 9e .,..k...,.}..h7. 0510 66 25 bf 09 a8 28 27 f6 65 93 3b 3d dc 22 f6 53 f%...('.e.;=.".S 0520 2d e4 4f f9 57 28 fa 1d 69 c9 13 7d 47 bf ef 80 -.O.W(..i..}G... 0530 fa 00 c0 3f 6b 60 e4 f3 3b f0 62 fd f6 76 1b 2e ...?k`..;.b..v.. 0540 02 38 96 68 64 58 c1 f7 bd 4d 53 0c a7 eb 38 63 .8.hdX...MS...8c 0550 a9 ab bc 67 28 de 00 cb e2 8a 91 7e 74 35 8b 60 ...g(......~t5.` 0560 18 fe b5 17 a7 80 32 82 f3 01 6b 72 a9 47 ac 53 ......2...kr.G.S 0570 df 9c 93 b2 d7 50 16 e8 49 e1 d9 56 83 f4 99 7a .....P..I..V...z 0580 3d 11 04 fd c3 0d f5 d0 38 9e 1d 01 6c 89 0f 4a =.......8...l..J 0590 83 9d 26 fe 74 ab 40 72 30 0d bf 56 61 bb 1b 10 ..&.t.@r0..Va... 05a0 91 1b 9b b3 40 6a c0 7f 6f 5a ae 5a f2 1a e2 ed ....@j..oZ.Z.... 05b0 af 00 f1 22 ..." No. Time Source Destination Protocol Info 3550 945.760044 zen1 soth1 TCP [TCP Retransmission] 4605 > 1677 [ACK] Seq=41355 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3550 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:54.518548000 Time delta from previous packet: 16.022717000 seconds Time since reference or first frame: 945.760044000 seconds Frame Number: 3550 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x4a84 (19076) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2654] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 41355, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 41355 (relative sequence number) Next sequence number: 42815 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0x6ceb] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 16.022717000 seconds RTO based on delta from frame: 3512 Data (1460 bytes) 0000 f8 b7 49 04 71 a2 da 14 3a 4c f8 0e 77 6d c0 f4 ..I.q...:L..wm.. 0010 4e 57 2c a9 83 1a 72 af 62 f1 9c 26 7e f0 30 56 NW,...r.b..&~.0V 0020 ab 37 d5 84 c3 4a 5d 75 d5 72 0f ad bf 0d 19 e5 .7...J]u.r...... 0030 bb 89 1c 21 69 55 ca e3 f7 35 21 a4 33 91 0f 2a ...!iU...5!.3..* 0040 a7 a5 17 e1 4d cd 9b a8 fc f5 6d d8 d0 e8 25 49 ....M.....m...%I 0050 88 17 a9 c7 91 65 53 6d 80 b2 5d 69 14 3a ae 99 .....eSm..]i.:.. 0060 63 b6 82 05 15 dc 99 3e b8 03 1b 7e 3c 12 d9 21 c......>...~<..! 0070 37 4d f7 12 43 9b be 36 d0 38 2f 92 25 a4 8f 85 7M..C..6.8/.%... 0080 0d 1b 59 d4 05 6c 98 53 90 fb 35 ea a0 55 98 e4 ..Y..l.S..5..U.. 0090 d1 f6 96 19 52 c9 46 5d 8e 2e 5e 2e ba 7a a2 99 ....R.F]..^..z.. 00a0 c3 51 36 71 9c f1 f4 d5 c9 91 db 35 ff 69 91 97 .Q6q.......5.i.. 00b0 6a d3 8f 1a bf 67 71 52 e8 a0 9c a3 00 1a a9 81 j....gqR........ 00c0 e8 52 e3 cc 7d ca f9 ba 23 43 d9 ce 7e ad aa 84 .R..}...#C..~... 00d0 d8 51 b6 02 fe 51 24 ed 48 f9 bb eb fa 92 58 66 .Q...Q$.H.....Xf 00e0 ad 1c 75 b9 8c ab 39 ff aa a0 f7 c5 b8 3d 66 f5 ..u...9......=f. 00f0 53 e8 4f 21 7b c5 02 bd a7 ae 05 90 35 e6 5c 9b S.O!{.......5.\. 0100 04 d4 a3 5b 13 ed 87 3f fb 69 02 2f a3 dc 60 88 ...[...?.i./..`. 0110 25 f2 77 d3 8d 92 06 69 96 df ab a9 4c ad 4f 87 %.w....i....L.O. 0120 55 b6 9a 35 fb c0 80 4b b2 35 bc 41 f7 4a 0b 0d U..5...K.5.A.J.. 0130 28 1e a0 bf 2a b3 3e 34 49 90 8f 2e 6f 32 d7 08 (...*.>4I...o2.. 0140 31 24 b0 84 bb 10 6e 1a ea f2 cf 7a c5 3b 5a cb 1$....n....z.;Z. 0150 53 0e c0 3d 2f 7e 74 b2 39 47 86 66 ce bf 45 0f S..=/~t.9G.f..E. 0160 a1 28 a3 63 05 9f 63 ec c2 f1 e5 33 e7 af 4a c0 .(.c..c....3..J. 0170 a7 5f 3e 05 35 64 af 62 7c 59 64 cc ba ad 5c 25 ._>.5d.b|Yd...\% 0180 41 e0 94 c1 97 cd 75 e3 2b 49 65 62 2d 20 2b bf A.....u.+Ieb- +. 0190 53 18 42 73 0f 08 0f 7a fb 78 86 ed a7 f9 55 c7 S.Bs...z.x....U. 01a0 cc 1a 27 49 07 d9 77 d3 3f ca aa 35 92 c7 fc 8d ..'I..w.?..5.... 01b0 86 03 fc 44 2d 6c 66 0e 6d df 3a 85 7e 11 c6 51 ...D-lf.m.:.~..Q 01c0 c9 70 ce db 26 3e 69 e8 84 3d f3 c2 34 bb 16 36 .p..&>i..=..4..6 01d0 bd c4 28 6b 0d 24 0e 44 4b 03 f5 cc 08 93 e6 9a ..(k.$.DK....... 01e0 fa ef d1 22 4e 2f 74 6e 32 41 c6 73 f1 1b e9 da ..."N/tn2A.s.... 01f0 b8 dc ef 92 55 83 ee 99 5e b7 a2 b0 5e 46 06 a2 ....U...^...^F.. 0200 2a e4 24 18 15 55 b6 e0 2d 45 8d c3 0a fa 70 23 *.$..U..-E....p# 0210 4f 9e 99 02 7e ae 27 68 d1 33 4a ef 52 be 23 6c O...~.'h.3J.R.#l 0220 29 d7 20 ff c8 93 96 09 44 f3 de 9e fe e4 b6 c4 ). .....D....... 0230 1b 93 95 ea d8 db 7b 95 9d 65 4e c6 b5 1e c6 bc ......{..eN..... 0240 c3 45 bb d3 f5 dd d3 1c 77 35 b0 55 a5 99 72 92 .E......w5.U..r. 0250 d7 ae 36 bd 4a 50 64 d6 1b b8 40 c8 9c ca 1c b8 ..6.JPd...@..... 0260 f2 e9 08 ba db 6b 8a bb c7 b4 2b 77 25 c0 c6 bd .....k....+w%... 0270 fe 50 74 50 67 f6 5b cb 61 5c 55 ed 47 00 b1 7a .PtPg.[.a\U.G..z 0280 ae b4 7b d9 6c 94 9d 1c e1 36 ca c2 6f ed f7 ae ..{.l....6..o... 0290 0a 63 af 0b c0 c0 31 8e 00 39 59 de 20 10 25 87 .c....1..9Y. .%. 02a0 d4 bf f3 47 f1 c6 fa 61 e7 50 a1 04 d5 20 f7 af ...G...a.P... .. 02b0 f4 0e 5e 82 e7 86 91 6e e5 ac a4 51 d3 ea 68 5c ..^....n...Q..h\ 02c0 a8 6a b4 02 a1 17 8f 89 50 b9 a9 5b bd 4f ef ba .j......P..[.O.. 02d0 74 29 f1 27 2f 75 c7 00 0f 42 6c a1 bc 48 20 cd t).'/u...Bl..H . 02e0 ab 4d 19 52 d6 57 04 41 5d bf 67 b6 01 fc 4f 82 .M.R.W.A].g...O. 02f0 89 aa a9 81 e6 72 51 96 0d f3 18 f8 20 15 74 9b .....rQ..... .t. 0300 da 20 38 c3 f1 e1 2d 2f 2d 28 8b 59 0a 84 7c 43 . 8...-/-(.Y..|C 0310 80 8a bb 31 8f 90 86 b8 d6 6b 33 cd 49 11 f0 cd ...1.....k3.I... 0320 4e 4e 43 d3 14 d4 d2 de b3 07 f3 1f 0f dd 82 c9 NNC............. 0330 ac 40 17 21 e7 c5 70 40 a4 8b b6 44 05 fc 04 89 .@.!..p@...D.... 0340 c3 8c 89 66 39 1e d3 c1 0c 10 04 ef 77 4d a1 c6 ...f9.......wM.. 0350 7a 7a 2e c0 a1 c9 21 5c e2 2c 25 54 35 37 a2 df zz....!\.,%T57.. 0360 8b f2 71 28 06 d6 af 4f ff 26 b7 21 32 8b 6b 4f ..q(...O.&.!2.kO 0370 53 6a d2 26 15 ba c9 65 94 db 37 db 3d 03 b2 4b Sj.&...e..7.=..K 0380 84 f7 1d 1e 69 31 c0 ce 57 45 42 59 61 52 4b 04 ....i1..WEBYaRK. 0390 b4 1a b9 e2 8d 80 30 f9 fd d6 f2 c3 ae c1 f5 63 ......0........c 03a0 b1 14 4e 8d ae a8 0b b8 26 7e 37 46 34 d5 ec 6e ..N.....&~7F4..n 03b0 6f 1e 38 7c 4e 7f 36 0d d3 3f d9 82 20 ae 73 62 o.8|N.6..?.. .sb 03c0 b3 33 9c bf 92 d2 bd c6 82 11 ae 63 4f 52 ff 49 .3.........cOR.I 03d0 86 54 ab 7a e5 39 1c 60 ef bd ec cf 5e b0 24 e8 .T.z.9.`....^.$. 03e0 54 1f fb e6 38 e4 79 e4 3c ef 86 90 9c 7a df 1c T...8.y.<....z.. 03f0 64 18 ea 16 d2 a3 34 25 5b d7 6b 58 93 26 08 40 d.....4%[.kX.&.@ 0400 f7 61 77 dc 05 b6 bb db bb 49 c8 da 57 3f dc 7f .aw......I..W?.. 0410 ea 3d 2e 96 0e 08 ae 99 41 14 13 38 bd 6f 57 87 .=......A..8.oW. 0420 36 cc 69 ea 21 a2 e1 6a 52 0f e5 d2 31 33 c3 05 6.i.!..jR...13.. 0430 67 9d 31 e3 8e de 92 ff 49 52 ce 4a 6c 9b f0 e2 g.1.....IR.Jl... 0440 86 65 0a 07 69 4a 4c d9 4e 15 9f ff 60 17 c7 c1 .e..iJL.N...`... 0450 16 66 77 79 72 b5 28 b1 0c 41 93 32 39 6d 7b 7b .fwyr.(..A.29m{{ 0460 72 09 30 b0 96 d4 94 a5 61 6a ad 40 15 a1 15 97 r.0.....aj.@.... 0470 96 fa bc 0c 47 ee a8 7c 09 ec 06 77 a5 16 34 0e ....G..|...w..4. 0480 5e c8 c1 23 23 c9 24 14 b8 e5 b5 1c a1 95 48 5c ^..##.$.......H\ 0490 9c fb f0 16 b5 17 0d 28 03 bc cf 29 cd c4 bf 9f .......(...).... 04a0 ec 43 0d 6e ec 24 7d f5 17 60 64 ac 43 7c 42 54 .C.n.$}..`d.C|BT 04b0 0b f7 66 1e 5a b8 67 a4 56 8b fb dd 28 a4 a7 96 ..f.Z.g.V...(... 04c0 c9 a1 e8 a9 5c 45 25 89 f5 0c e6 63 4d a2 ea 64 ....\E%....cM..d 04d0 ab 32 8e e6 8e 53 14 ad e7 a4 ec c6 08 7c d9 8a .2...S.......|.. 04e0 cd fb e2 77 83 0b f6 b3 28 54 c7 4d ca a5 8a f5 ...w....(T.M.... 04f0 1f 50 6d 92 1e b2 85 17 70 20 bd 54 af 00 20 9e .Pm.....p .T.. . 0500 8d 3b 2b c4 04 6f ff b1 aa 4d f8 b7 27 0d 55 16 .;+..o...M..'.U. 0510 1c 73 05 ac 3a 10 a7 30 1d 1a 2f 61 73 c8 0c a7 .s..:..0../as... 0520 25 03 6e 13 a2 f6 24 09 fe dc 60 77 4f 1b 46 5c %.n...$...`wO.F\ 0530 b0 5e 27 bd 3e 6a b9 c7 28 1c be fd fa 63 84 4c .^'.>j..(....c.L 0540 73 34 2b 5f 02 ec ff 05 f6 ad d7 a2 57 93 e1 b5 s4+_........W... 0550 a6 a3 b1 73 f6 e5 af 48 4a c4 e9 99 5b 03 92 6a ...s...HJ...[..j 0560 78 d7 ad de 34 6a 8c ea dd 5d 7b cf d1 40 42 94 x...4j...]{..@B. 0570 f3 bc b0 a3 6a 4d 7c ff d2 4c 17 eb cb 1e df 20 ....jM|..L..... 0580 af 77 0b 7e f4 0b d2 a6 8b 00 73 45 26 f8 0c a2 .w.~......sE&... 0590 71 4f a7 94 67 c6 5d 72 98 2c 5c 24 1b 62 8d 0e qO..g.]r.,\$.b.. 05a0 f9 1b e4 4a 81 a8 f9 52 c4 23 6c ba 1b b0 6c 6a ...J...R.#l...lj 05b0 02 bc f0 ed .... No. Time Source Destination Protocol Info 3551 945.760344 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=67967 Ack=42815 Win=19284 Len=0 Frame 3551 (60 bytes on wire, 60 bytes captured) Arrival Time: Nov 11, 2005 16:45:54.518848000 Time delta from previous packet: 0.000300000 seconds Time since reference or first frame: 945.760344000 seconds Frame Number: 3551 Packet Length: 60 bytes Capture Length: 60 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Trailer: 000000000000 Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x4190 (16784) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x34fc [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 67967, Ack: 42815, Len: 0 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 67967 (relative sequence number) Acknowledgement number: 42815 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 19284 Checksum: 0xa268 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3452 The RTT to ACK the segment was: 31.545248000 seconds No. Time Source Destination Protocol Info 3552 945.760384 zen1 soth1 TCP [TCP Retransmission] 4605 > 1677 [ACK] Seq=42815 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3552 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:54.518888000 Time delta from previous packet: 0.000040000 seconds Time since reference or first frame: 945.760384000 seconds Frame Number: 3552 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x4a85 (19077) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2653] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 42815, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 42815 (relative sequence number) Next sequence number: 44275 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0x9a67] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 16.023057000 seconds RTO based on delta from frame: 3512 Data (1460 bytes) 0000 22 a6 4b 52 24 30 4f 43 80 f9 f4 a8 85 7e 18 b0 ".KR$0OC.....~.. 0010 04 e7 a0 e3 20 b6 e5 29 5b 2a 7f 87 b9 c1 c5 73 .... ..)[*.....s 0020 6e f9 6a d6 69 25 82 de 2c f6 a2 74 2e 58 5f 4f n.j.i%..,..t.X_O 0030 a3 0d 80 5c 8f 14 d7 6e 63 57 c3 4b ae 70 50 99 ...\...ncW.K.pP. 0040 ea f7 b6 38 73 5d 53 5c be b7 60 35 79 5a 18 17 ...8s]S\..`5yZ.. 0050 7c 48 ec ee f8 f3 11 03 95 a0 b4 3b 00 ee 3e 5f |H.........;..>_ 0060 86 f4 e4 58 60 e6 08 c4 d9 24 d0 95 db 13 42 cc ...X`....$....B. 0070 bf 69 59 07 82 25 e6 37 30 d2 87 45 21 0c a4 69 .iY..%.70..E!..i 0080 9c 71 60 e5 de 66 25 05 ac 80 e3 5c 7f cd 9d e2 .q`..f%....\.... 0090 f2 c3 fa be 03 97 b9 04 c4 fc 92 ef d7 d7 99 64 ...............d 00a0 46 a9 a5 2d 1a 32 78 75 79 28 9b e5 dd bf f8 78 F..-.2xuy(.....x 00b0 3d 2d d2 3e 30 c2 a7 8a 54 cf 03 73 91 80 54 0d =-.>0...T..s..T. 00c0 87 11 ce 0c f9 54 79 73 b7 43 79 e6 0d 01 93 4e .....Tys.Cy....N 00d0 40 45 ce 98 cf e3 7b db 0d eb 38 35 53 49 52 5c @E....{...85SIR\ 00e0 75 c7 1a ea 03 2b 09 2a 5b 33 e3 5e a2 33 56 e1 u....+.*[3.^.3V. 00f0 b2 8d 01 78 f8 06 95 f4 d3 a6 7e 7b cf f8 71 88 ...x......~{..q. 0100 66 aa 45 fb fe 68 1d 38 ca 4d ff a3 98 aa 77 c7 f.E..h.8.M....w. 0110 e4 c7 44 5e 8d df c1 5c da b2 52 e2 32 98 78 94 ..D^...\..R.2.x. 0120 fc 84 71 50 36 e6 37 75 39 6c 97 d7 c5 79 ce 07 ..qP6.7u9l...y.. 0130 c1 4f 50 36 d8 70 d7 aa 1e 1e e7 00 6c 14 a7 d0 .OP6.p......l... 0140 5d 50 1e ba ff 72 79 5e 76 aa 7b d7 27 c5 43 0a ]P...ry^v.{.'.C. 0150 9c ff 6a f4 da fa 7e 40 1e a5 b5 33 23 44 38 97 ..j...~@...3#D8. 0160 e1 73 d3 99 93 4e 3a f4 3f 2e 0b 79 38 d4 66 8f .s...N:.?..y8.f. 0170 4c ed b7 1c d7 6d 89 dc f3 b7 4b 9f 2b 34 a0 6d L....m....K.+4.m 0180 9c 0b c9 bb d6 5c 8b 7c 69 68 d5 74 02 70 e5 5f .....\.|ih.t.p._ 0190 75 eb 07 ac 92 fb 59 f5 dd d0 a0 5e 7c e3 58 e6 u.....Y....^|.X. 01a0 3d e9 91 95 e6 4e da 2b 5e 89 60 b1 39 9e 3b b8 =....N.+^.`.9.;. 01b0 8c 3b 33 fb c7 1e a3 fd 7e f9 75 dd b1 44 fb 28 .;3.....~.u..D.( 01c0 39 a2 37 34 a3 17 fc 0a fb bd 12 b1 0e 0a f3 ab 9.74............ 01d0 4c e0 a9 71 52 94 45 40 e4 71 d8 cc 5c 45 7d 66 L..qR.E@.q..\E}f 01e0 17 c5 69 7a 06 e7 74 97 b3 b8 c3 36 af c9 c3 3c ..iz..t....6...< 01f0 51 06 a7 01 34 ec 95 d4 27 93 21 71 62 ab cf 0d Q...4...'.!qb... 0200 8d ba 7f e7 82 0b d1 b7 b5 35 ff 8a e5 ec d3 fd .........5...... 0210 a3 66 d4 15 2b 6f f4 4d c2 50 4b e7 ea 64 1e c9 .f..+o.M.PK..d.. 0220 1b 66 fd ce f4 63 33 e2 73 61 db c7 a8 c3 6c 5d .f...c3.sa....l] 0230 ec 21 dc 13 9f bc 1a 78 cd 0d 02 cb e4 f5 aa 2e .!.....x........ 0240 49 10 84 51 e1 30 11 f4 25 27 90 46 e2 93 5b 69 I..Q.0..%'.F..[i 0250 d1 96 0a d4 38 0f cb e7 ef b1 fc 49 7f a4 b0 c7 ....8......I.... 0260 f9 d5 0d 1d 87 ca 74 25 5d 27 9a 72 bc f4 6d 4b ......t%]'.r..mK 0270 a9 c2 61 c8 6b 0c cf d7 c2 5f 70 03 6c 27 4d ab ..a.k...._p.l'M. 0280 1b da b5 30 36 8f 33 c4 68 15 43 98 17 58 dd 18 ...06.3.h.C..X.. 0290 a2 e6 8e 4b 6b 28 de 3b f3 da df 0f ea 19 d4 9e ...Kk(.;........ 02a0 0c 88 58 60 58 8e 6a 5c ff cd d4 d1 67 5e 5c 69 ..X`X.j\....g^\i 02b0 59 f1 8c d3 e4 85 3f 5a 7c 0f a7 ec 42 9d d8 37 Y.....?Z|...B..7 02c0 ff df 7f 46 d7 3d eb f4 b7 cd 22 ac 04 d0 18 7b ...F.=...."....{ 02d0 15 39 f4 4f 35 fe 3f d7 22 be df 1d e2 b3 b4 05 .9.O5.?."....... 02e0 e6 1c 4e 45 48 96 f4 77 4d f1 61 0d ef 63 89 4e ..NEH..wM.a..c.N 02f0 e0 f0 99 6b 28 6c 71 b0 63 81 63 61 29 e9 e4 f3 ...k(lq.c.ca)... 0300 83 11 08 01 71 94 d5 24 f9 48 5a e2 c9 18 75 ff ....q..$.HZ...u. 0310 62 5e 31 65 42 d1 c2 e1 4f df 0f fe 0c 63 30 e8 b^1eB...O....c0. 0320 53 9f 39 c3 f7 bc 4d 48 0c 55 8b d7 13 05 5d ec S.9...MH.U....]. 0330 a7 33 b8 20 2a 8a 53 b1 3f e1 ba 38 be ea e3 bd .3. *.S.?..8.... 0340 da 3e ac a6 4e b2 7b 31 34 8e fd 30 d3 f7 b7 d9 .>..N.{14..0.... 0350 0d 83 6a 99 5f 01 ca 2c 3f 5a db 98 86 d4 f1 81 ..j._..,?Z...... 0360 ff a6 bc 8b 69 68 5a 8a c2 49 07 59 b8 73 5d c1 ....ihZ..I.Y.s]. 0370 5e bd 45 ee 56 b8 a9 44 61 1c 49 00 ab 36 b4 86 ^.E.V..Da.I..6.. 0380 d4 92 38 b7 0b 3c 2b bb 9b 8d 74 60 21 a6 cf a0 ..8..<+...t`!... 0390 ed 7e 87 92 29 4d 6c 76 a3 e6 78 7e a5 15 e0 6a .~..)Mlv..x~...j 03a0 97 a2 63 52 c2 db 78 d4 6a 16 7f 41 75 83 2c 8a ..cR..x.j..Au.,. 03b0 97 ea 6a 4a a0 05 80 15 6d 10 90 b0 28 c3 e4 68 ..jJ....m...(..h 03c0 9f 5c 5a 4f 32 63 8f fd f1 a6 fd b4 7e 64 47 22 .\ZO2c......~dG" 03d0 c5 0e a0 b4 32 5e ac 00 8d 06 48 5c 7c 94 98 c7 ....2^....H\|... 03e0 4c 68 dc e4 1c 04 4e de 61 b3 27 be bf 05 88 44 Lh....N.a.'....D 03f0 40 bf 1e bd ad 79 11 d5 ed 62 21 4f c1 50 d7 52 @....y...b!O.P.R 0400 e7 dc 5d 35 21 3b 5f 7a c6 19 71 bf 6b d5 9e 48 ..]5!;_z..q.k..H 0410 ad 19 b2 0e 05 cc 69 0f 66 cd b0 b2 42 84 50 0d ......i.f...B.P. 0420 ff d2 be 71 bd bb 79 72 3e e2 e4 d1 9c 52 12 ad ...q..yr>....R.. 0430 db ca b8 47 46 3a 1d 5c 3d fe c8 d7 98 6c 3e 92 ...GF:.\=....l>. 0440 63 93 b1 c5 2b 78 93 8a b9 db 87 38 cc 15 a6 66 c...+x.....8...f 0450 43 18 ef c4 f9 70 16 6d 9a f0 12 c2 f9 e8 98 34 C....p.m.......4 0460 3e a9 55 62 9e a4 ed 73 45 51 9f e6 52 8a be 74 >.Ub...sEQ..R..t 0470 db 04 9d 89 61 bf 83 ce 9d 82 34 84 f5 5d 4d 1e ....a.....4..]M. 0480 36 0d 6d a4 99 b9 5a 37 71 50 c6 17 c5 66 d9 f4 6.m...Z7qP...f.. 0490 38 63 d6 7f 73 66 91 03 8c 93 be 6a 30 b3 7e 4b 8c..sf.....j0.~K 04a0 84 68 98 f9 26 0e b9 3b 12 07 0a 2d d5 d5 74 13 .h..&..;...-..t. 04b0 03 86 3b 0d f2 76 73 a5 1c e4 dc f2 f9 63 9a 7f ..;..vs......c.. 04c0 29 c4 0e f7 60 09 82 a8 2e 97 eb ae 73 c8 2c 9e )...`.......s.,. 04d0 d6 a9 a7 28 e3 b8 33 ed cf 8b 5f 4d ad 9b 81 45 ...(..3..._M...E 04e0 33 85 be d1 1b 80 4a 84 9f 08 32 9d b0 33 1b 2f 3.....J...2..3./ 04f0 7f 8e f8 37 b0 7e c4 84 b7 41 24 b6 e8 78 d0 3f ...7.~...A$..x.? 0500 19 2c 9d d6 6b 9b c3 c1 2c e2 7d a9 9c 68 37 9e .,..k...,.}..h7. 0510 66 25 bf 09 a8 28 27 f6 65 93 3b 3d dc 22 f6 53 f%...('.e.;=.".S 0520 2d e4 4f f9 57 28 fa 1d 69 c9 13 7d 47 bf ef 80 -.O.W(..i..}G... 0530 fa 00 c0 3f 6b 60 e4 f3 3b f0 62 fd f6 76 1b 2e ...?k`..;.b..v.. 0540 02 38 96 68 64 58 c1 f7 bd 4d 53 0c a7 eb 38 63 .8.hdX...MS...8c 0550 a9 ab bc 67 28 de 00 cb e2 8a 91 7e 74 35 8b 60 ...g(......~t5.` 0560 18 fe b5 17 a7 80 32 82 f3 01 6b 72 a9 47 ac 53 ......2...kr.G.S 0570 df 9c 93 b2 d7 50 16 e8 49 e1 d9 56 83 f4 99 7a .....P..I..V...z 0580 3d 11 04 fd c3 0d f5 d0 38 9e 1d 01 6c 89 0f 4a =.......8...l..J 0590 83 9d 26 fe 74 ab 40 72 30 0d bf 56 61 bb 1b 10 ..&.t.@r0..Va... 05a0 91 1b 9b b3 40 6a c0 7f 6f 5a ae 5a f2 1a e2 ed ....@j..oZ.Z.... 05b0 af 00 f1 22 ..." No. Time Source Destination Protocol Info 3553 945.760395 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=44275 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3553 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:45:54.518899000 Time delta from previous packet: 0.000011000 seconds Time since reference or first frame: 945.760395000 seconds Frame Number: 3553 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x4a86 (19078) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2652] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 44275, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 44275 (relative sequence number) Next sequence number: 45735 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0xa84c] Data (1460 bytes) 0000 d3 ee 1e 89 1c b9 b9 e3 6d b3 7e 2c 3b bd ee c6 ........m.~,;... 0010 9f ab 5a 35 ae 40 ad 4f 98 f5 ef 2b 15 f4 6c 04 ..Z5.@.O...+..l. 0020 41 11 a7 b4 5f f2 35 06 32 67 b4 e4 f6 fc 90 71 A..._.5.2g.....q 0030 9e 31 40 a8 ac 88 aa 56 8f a3 14 8b 4c 73 d7 4b .1@....V....Ls.K 0040 18 a3 bd e0 d4 33 f2 20 64 e2 6b 44 bd ad 2c 9b .....3. d.kD..,. 0050 ba cf 38 af a4 e7 82 7e 69 20 61 3f 89 e9 97 bb ..8....~i a?.... 0060 74 7d 13 2c 77 96 99 8e 73 74 0c 61 f3 3b 56 c0 t}.,w...st.a.;V. 0070 09 ea 35 eb c7 0b d7 8f 7d c1 e0 8b b0 85 ed 41 ..5.....}......A 0080 5c 93 46 02 08 a1 e3 87 a4 e1 73 ce 44 9a a1 17 \.F.......s.D... 0090 5a f7 b1 35 ab 28 1d fd c0 10 ab bd ed ed 77 d8 Z..5.(........w. 00a0 b4 2f cd e5 ee 07 bc 9d bc 41 33 b9 37 4a a5 d0 ./.......A3.7J.. 00b0 f9 b4 4f 64 27 0b 56 55 bd ab 61 6e 4f fe d3 42 ..Od'.VU..anO..B 00c0 6e f9 93 05 49 41 93 20 e1 dc 6e 2b c5 0b 1c a3 n...IA. ..n+.... 00d0 a9 f1 93 09 2f 06 5f 8e 41 db 4c 8e 2b 16 03 86 ..../._.A.L.+... 00e0 2d 2c 51 8b 34 d6 9e df d9 98 b8 2d a4 9f 08 2e -,Q.4......-.... 00f0 68 b8 4a 29 3f 21 42 ed 89 7c 1e f7 c3 6d ff f3 h.J)?!B..|...m.. 0100 de 1d c8 d1 08 08 b1 bd 54 a5 d4 f8 cd 44 a3 1a ........T....D.. 0110 a8 dc 33 33 35 b8 2f c0 55 fa 10 b9 1b c4 f3 d9 ..335./.U....... 0120 1c e6 52 1c fb ca c9 62 92 95 be d7 84 69 e5 c7 ..R....b.....i.. 0130 51 5e cc ac 52 c9 a2 03 e9 92 8a 46 b8 31 9d 9c Q^..R......F.1.. 0140 94 c5 8f f9 32 89 33 7d 05 33 ee bb 9f 96 74 f2 ....2.3}.3....t. 0150 d9 18 0f 71 6c ac 6e d4 b9 11 ac 8a 16 c1 17 b1 ...ql.n......... 0160 3c de a7 69 83 91 f1 0b c4 57 a2 b2 bc 8d 8d c4 <..i.....W...... 0170 2f de 1b fb d5 d2 93 73 09 b1 5b 55 45 8a cd ad /......s..[UE... 0180 64 15 e7 99 d1 ab 85 b9 a8 3e 4e 66 14 71 75 97 d........>Nf.qu. 0190 5e 7c 11 35 34 cc 4a 34 5d 75 af e7 11 a8 c9 1c ^|.54.J4]u...... 01a0 5a a6 f7 58 46 d1 2d 27 0e 75 de 61 9d 1b 76 5a Z..XF.-'.u.a..vZ 01b0 fb 0c 05 95 3b d2 f7 00 fc 57 30 cd 41 df 7d 48 ....;....W0.A.}H 01c0 96 ab 10 39 67 06 d7 82 09 bf ae 83 3d 90 98 01 ...9g.......=... 01d0 c8 bd 5b 5d 4b 98 9b f6 06 bb 94 fc f0 4f ad 0a ..[]K........O.. 01e0 93 80 02 43 64 3f 7f 35 7d 62 d6 de ce 43 86 3a ...Cd?.5}b...C.: 01f0 b0 8e 26 91 95 95 f0 f3 d9 69 26 2a 10 2b 7d eb ..&......i&*.+}. 0200 e0 66 7a 2b f1 71 3f ae 35 98 a1 8f 7b 65 32 bb .fz+.q?.5...{e2. 0210 78 ae 05 2e e7 b5 6c 18 52 9f 80 e4 ce c7 d9 fb x.....l.R....... 0220 34 d2 d4 7c 3f 19 f0 bd 06 8b 77 36 81 eb df 74 4..|?.....w6...t 0230 79 0e 54 6e 62 21 85 17 30 e5 3a 08 d8 57 a9 65 y.Tnb!..0.:..W.e 0240 ee 7d c5 a7 90 97 5d 66 47 dc f4 47 6d 6a 68 11 .}....]fG..Gmjh. 0250 a9 7c 0f 75 32 a1 66 ff d6 c5 6f c1 17 51 fd 66 .|.u2.f...o..Q.f 0260 dc 9c 48 4c e5 91 d4 d8 e0 98 b1 9e 6c 7f a6 ac ..HL........l... 0270 e9 22 db 66 77 cf a9 33 9c 5e c8 22 07 9d c2 96 .".fw..3.^.".... 0280 27 cd d1 c8 1b f9 c8 5f 4b 23 93 29 d8 d2 ac 75 '......_K#.)...u 0290 f1 9f ea 9b 3f f0 c0 30 cc 16 8a 77 42 85 90 75 ....?..0...wB..u 02a0 e0 4d 83 b4 d1 b2 4c 18 a1 9b fb 91 0e 6b e7 03 .M....L......k.. 02b0 37 44 d8 09 53 94 2a 1d de f8 4d fa 9d 61 6c dd 7D..S.*...M..al. 02c0 d1 3a b6 53 74 b3 76 63 e0 59 98 4d f1 45 68 bb .:.St.vc.Y.M.Eh. 02d0 25 ff 0a 4e 6c 07 93 bb 21 de 44 5b ba 1d 85 31 %..Nl...!.D[...1 02e0 fb 7e d6 db e4 d8 07 5b 29 20 22 8e 3f 08 e0 e4 .~.....[) ".?... 02f0 e4 ad 6f 01 0a ca 3e cd 49 67 25 b6 72 75 39 40 ..o...>.Ig%.ru9@ 0300 a6 70 8e 26 13 f7 16 c6 11 45 d6 f7 ef 65 06 8f .p.&.....E...e.. 0310 2a ae 3d eb 2b 80 2c 63 9c d0 fc 70 84 c7 62 ab *.=.+.,c...p..b. 0320 49 2c 1f 19 ca 8a a9 70 31 0b d6 a3 6c 9f ee 90 I,.....p1...l... 0330 24 06 a3 3a b8 c0 f1 41 5e 6c 83 f4 70 80 2d b1 $..:...A^l..p.-. 0340 e7 6a fe 53 9d 46 d6 52 a5 2a d3 bc 69 a8 99 bd .j.S.F.R.*..i... 0350 2d 98 0d be 0f a1 13 18 c0 7c 9c cd 26 99 af 46 -........|..&..F 0360 04 68 a6 59 7b aa 7e 1c 4e 5e b7 c2 df 41 0a f5 .h.Y{.~.N^...A.. 0370 54 6c a1 a9 c5 84 8a 21 cc 11 87 84 91 8d 0a 4f Tl.....!.......O 0380 fb 8d d1 cf 99 f2 ec 56 7b 63 3a 63 ba d5 9e e2 .......V{c:c.... 0390 fa 0c 9f 03 90 0b b8 af 91 6c e6 ff 12 97 7f 32 .........l.....2 03a0 2c 9d 7d 21 3f ea 50 51 d3 0e 7a e5 42 b6 30 41 ,.}!?.PQ..z.B.0A 03b0 2b d1 20 82 35 20 28 e9 31 f2 40 91 e8 01 2b 8e +. .5 (.1.@...+. 03c0 e7 ef 18 0e 1c 2b 25 f1 38 66 02 99 0c ad 9c 11 .....+%.8f...... 03d0 57 15 70 22 35 8d d1 cf d7 fa 0e a0 6b 2f 4e 55 W.p"5.......k/NU 03e0 96 a5 3c a5 55 91 82 47 5e 31 da 4e 2f 41 bd 3b ..<.U..G^1.N/A.; 03f0 02 28 7f 9b 47 94 21 62 a6 1f 2c 27 04 25 aa 7e .(..G.!b..,'.%.~ 0400 05 a7 ef 2a c4 09 42 37 50 50 66 85 72 25 57 ac ...*..B7PPf.r%W. 0410 64 fc bc 20 d7 85 3f c7 0b 05 cc 91 70 ca 17 bf d.. ..?.....p... 0420 d3 68 ed 80 20 89 85 45 73 ee 7d da 50 c5 79 b1 .h.. ..Es.}.P.y. 0430 74 8e 00 92 75 24 28 e8 71 98 b0 78 52 b2 a2 dc t...u$(.q..xR... 0440 20 3a 5e 9f 1a 9a 1c 84 4e 96 02 67 10 41 a5 2e :^.....N..g.A.. 0450 4d f2 d0 c2 00 40 22 ea 6c 1f 21 65 d5 05 f4 a0 M....@".l.!e.... 0460 11 71 42 60 81 46 81 6c dc 11 f9 6b 20 0d cf 07 .qB`.F.l...k ... 0470 6e e6 94 57 75 92 af cf 10 57 4f bd 7d dc 02 f3 n..Wu....WO.}... 0480 2e f3 2f 2a c0 d9 a1 2e d6 c4 de bd e7 36 ee 3c ../*.........6.< 0490 c7 9d 98 d1 3f 71 82 c3 1d 4f 93 11 cc e9 c5 1e ....?q...O...... 04a0 a2 b0 a7 18 a0 8b 8b 46 d4 55 64 1e 5f 92 9b 26 .......F.Ud._..& 04b0 d6 9e ee 4e 5b e1 31 d0 ba e2 4a 36 fc e1 3b fe ...N[.1...J6..;. 04c0 79 b9 da 03 a7 9d ff 7d 71 86 f3 08 51 e4 93 45 y......}q...Q..E 04d0 bc b2 d1 ea 85 06 e7 2b 71 7f ce 24 4c b9 4b fd .......+q..$L.K. 04e0 b0 02 13 5d 9a d9 de 1e 5a 38 f0 b2 ed 18 bc 70 ...]....Z8.....p 04f0 4c db d2 5b 50 7a e8 72 7e be 34 a1 75 53 bc cd L..[Pz.r~.4.uS.. 0500 60 79 eb e9 4b 4b 34 0d 11 e0 e6 4c 74 73 fc d2 `y..KK4....Lts.. 0510 39 bb 8a a8 2f 44 a3 bd b5 02 e8 55 c7 1e d7 c8 9.../D.....U.... 0520 ba 79 12 47 ec 44 9a 37 fc a6 ce 87 8a d9 ea c7 .y.G.D.7........ 0530 90 a5 b9 8a 43 a5 f2 b7 f4 5b 0c 50 bf 0c 0f 81 ....C....[.P.... 0540 1a d5 47 4d d9 50 a6 ab 49 ca c6 82 0f cd b3 9a ..GM.P..I....... 0550 11 f0 b8 79 ef f2 39 ff 2c f2 6a 83 01 0e 4f 58 ...y..9.,.j...OX 0560 dd 04 39 dd fb 3b ab 32 ea 67 5b ca 18 4a 56 01 ..9..;.2.g[..JV. 0570 86 b7 9e a3 da 87 7c 5b 93 83 6c 14 bd 2b 72 72 ......|[..l..+rr 0580 7f a4 51 57 c8 b3 89 32 fa 3f 7c 36 1d bd 80 11 ..QW...2.?|6.... 0590 f3 26 5a 3a f1 86 ae 27 f0 6e 03 e6 ac 82 f7 cd .&Z:...'.n...... 05a0 3e 64 13 dc 46 7d 84 67 6b d0 ec da ec e9 48 fb >d..F}.gk.....H. 05b0 ff 4f 3f 9e .O?. No. Time Source Destination Protocol Info 3643 977.806095 zen1 soth1 TCP [TCP Retransmission] 4605 > 1677 [ACK] Seq=42815 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3643 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:46:26.564599000 Time delta from previous packet: 32.045700000 seconds Time since reference or first frame: 977.806095000 seconds Frame Number: 3643 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x4c73 (19571) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2465] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 42815, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 42815 (relative sequence number) Next sequence number: 44275 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0x9a67] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 32.045700000 seconds RTO based on delta from frame: 3553 Data (1460 bytes) 0000 22 a6 4b 52 24 30 4f 43 80 f9 f4 a8 85 7e 18 b0 ".KR$0OC.....~.. 0010 04 e7 a0 e3 20 b6 e5 29 5b 2a 7f 87 b9 c1 c5 73 .... ..)[*.....s 0020 6e f9 6a d6 69 25 82 de 2c f6 a2 74 2e 58 5f 4f n.j.i%..,..t.X_O 0030 a3 0d 80 5c 8f 14 d7 6e 63 57 c3 4b ae 70 50 99 ...\...ncW.K.pP. 0040 ea f7 b6 38 73 5d 53 5c be b7 60 35 79 5a 18 17 ...8s]S\..`5yZ.. 0050 7c 48 ec ee f8 f3 11 03 95 a0 b4 3b 00 ee 3e 5f |H.........;..>_ 0060 86 f4 e4 58 60 e6 08 c4 d9 24 d0 95 db 13 42 cc ...X`....$....B. 0070 bf 69 59 07 82 25 e6 37 30 d2 87 45 21 0c a4 69 .iY..%.70..E!..i 0080 9c 71 60 e5 de 66 25 05 ac 80 e3 5c 7f cd 9d e2 .q`..f%....\.... 0090 f2 c3 fa be 03 97 b9 04 c4 fc 92 ef d7 d7 99 64 ...............d 00a0 46 a9 a5 2d 1a 32 78 75 79 28 9b e5 dd bf f8 78 F..-.2xuy(.....x 00b0 3d 2d d2 3e 30 c2 a7 8a 54 cf 03 73 91 80 54 0d =-.>0...T..s..T. 00c0 87 11 ce 0c f9 54 79 73 b7 43 79 e6 0d 01 93 4e .....Tys.Cy....N 00d0 40 45 ce 98 cf e3 7b db 0d eb 38 35 53 49 52 5c @E....{...85SIR\ 00e0 75 c7 1a ea 03 2b 09 2a 5b 33 e3 5e a2 33 56 e1 u....+.*[3.^.3V. 00f0 b2 8d 01 78 f8 06 95 f4 d3 a6 7e 7b cf f8 71 88 ...x......~{..q. 0100 66 aa 45 fb fe 68 1d 38 ca 4d ff a3 98 aa 77 c7 f.E..h.8.M....w. 0110 e4 c7 44 5e 8d df c1 5c da b2 52 e2 32 98 78 94 ..D^...\..R.2.x. 0120 fc 84 71 50 36 e6 37 75 39 6c 97 d7 c5 79 ce 07 ..qP6.7u9l...y.. 0130 c1 4f 50 36 d8 70 d7 aa 1e 1e e7 00 6c 14 a7 d0 .OP6.p......l... 0140 5d 50 1e ba ff 72 79 5e 76 aa 7b d7 27 c5 43 0a ]P...ry^v.{.'.C. 0150 9c ff 6a f4 da fa 7e 40 1e a5 b5 33 23 44 38 97 ..j...~@...3#D8. 0160 e1 73 d3 99 93 4e 3a f4 3f 2e 0b 79 38 d4 66 8f .s...N:.?..y8.f. 0170 4c ed b7 1c d7 6d 89 dc f3 b7 4b 9f 2b 34 a0 6d L....m....K.+4.m 0180 9c 0b c9 bb d6 5c 8b 7c 69 68 d5 74 02 70 e5 5f .....\.|ih.t.p._ 0190 75 eb 07 ac 92 fb 59 f5 dd d0 a0 5e 7c e3 58 e6 u.....Y....^|.X. 01a0 3d e9 91 95 e6 4e da 2b 5e 89 60 b1 39 9e 3b b8 =....N.+^.`.9.;. 01b0 8c 3b 33 fb c7 1e a3 fd 7e f9 75 dd b1 44 fb 28 .;3.....~.u..D.( 01c0 39 a2 37 34 a3 17 fc 0a fb bd 12 b1 0e 0a f3 ab 9.74............ 01d0 4c e0 a9 71 52 94 45 40 e4 71 d8 cc 5c 45 7d 66 L..qR.E@.q..\E}f 01e0 17 c5 69 7a 06 e7 74 97 b3 b8 c3 36 af c9 c3 3c ..iz..t....6...< 01f0 51 06 a7 01 34 ec 95 d4 27 93 21 71 62 ab cf 0d Q...4...'.!qb... 0200 8d ba 7f e7 82 0b d1 b7 b5 35 ff 8a e5 ec d3 fd .........5...... 0210 a3 66 d4 15 2b 6f f4 4d c2 50 4b e7 ea 64 1e c9 .f..+o.M.PK..d.. 0220 1b 66 fd ce f4 63 33 e2 73 61 db c7 a8 c3 6c 5d .f...c3.sa....l] 0230 ec 21 dc 13 9f bc 1a 78 cd 0d 02 cb e4 f5 aa 2e .!.....x........ 0240 49 10 84 51 e1 30 11 f4 25 27 90 46 e2 93 5b 69 I..Q.0..%'.F..[i 0250 d1 96 0a d4 38 0f cb e7 ef b1 fc 49 7f a4 b0 c7 ....8......I.... 0260 f9 d5 0d 1d 87 ca 74 25 5d 27 9a 72 bc f4 6d 4b ......t%]'.r..mK 0270 a9 c2 61 c8 6b 0c cf d7 c2 5f 70 03 6c 27 4d ab ..a.k...._p.l'M. 0280 1b da b5 30 36 8f 33 c4 68 15 43 98 17 58 dd 18 ...06.3.h.C..X.. 0290 a2 e6 8e 4b 6b 28 de 3b f3 da df 0f ea 19 d4 9e ...Kk(.;........ 02a0 0c 88 58 60 58 8e 6a 5c ff cd d4 d1 67 5e 5c 69 ..X`X.j\....g^\i 02b0 59 f1 8c d3 e4 85 3f 5a 7c 0f a7 ec 42 9d d8 37 Y.....?Z|...B..7 02c0 ff df 7f 46 d7 3d eb f4 b7 cd 22 ac 04 d0 18 7b ...F.=...."....{ 02d0 15 39 f4 4f 35 fe 3f d7 22 be df 1d e2 b3 b4 05 .9.O5.?."....... 02e0 e6 1c 4e 45 48 96 f4 77 4d f1 61 0d ef 63 89 4e ..NEH..wM.a..c.N 02f0 e0 f0 99 6b 28 6c 71 b0 63 81 63 61 29 e9 e4 f3 ...k(lq.c.ca)... 0300 83 11 08 01 71 94 d5 24 f9 48 5a e2 c9 18 75 ff ....q..$.HZ...u. 0310 62 5e 31 65 42 d1 c2 e1 4f df 0f fe 0c 63 30 e8 b^1eB...O....c0. 0320 53 9f 39 c3 f7 bc 4d 48 0c 55 8b d7 13 05 5d ec S.9...MH.U....]. 0330 a7 33 b8 20 2a 8a 53 b1 3f e1 ba 38 be ea e3 bd .3. *.S.?..8.... 0340 da 3e ac a6 4e b2 7b 31 34 8e fd 30 d3 f7 b7 d9 .>..N.{14..0.... 0350 0d 83 6a 99 5f 01 ca 2c 3f 5a db 98 86 d4 f1 81 ..j._..,?Z...... 0360 ff a6 bc 8b 69 68 5a 8a c2 49 07 59 b8 73 5d c1 ....ihZ..I.Y.s]. 0370 5e bd 45 ee 56 b8 a9 44 61 1c 49 00 ab 36 b4 86 ^.E.V..Da.I..6.. 0380 d4 92 38 b7 0b 3c 2b bb 9b 8d 74 60 21 a6 cf a0 ..8..<+...t`!... 0390 ed 7e 87 92 29 4d 6c 76 a3 e6 78 7e a5 15 e0 6a .~..)Mlv..x~...j 03a0 97 a2 63 52 c2 db 78 d4 6a 16 7f 41 75 83 2c 8a ..cR..x.j..Au.,. 03b0 97 ea 6a 4a a0 05 80 15 6d 10 90 b0 28 c3 e4 68 ..jJ....m...(..h 03c0 9f 5c 5a 4f 32 63 8f fd f1 a6 fd b4 7e 64 47 22 .\ZO2c......~dG" 03d0 c5 0e a0 b4 32 5e ac 00 8d 06 48 5c 7c 94 98 c7 ....2^....H\|... 03e0 4c 68 dc e4 1c 04 4e de 61 b3 27 be bf 05 88 44 Lh....N.a.'....D 03f0 40 bf 1e bd ad 79 11 d5 ed 62 21 4f c1 50 d7 52 @....y...b!O.P.R 0400 e7 dc 5d 35 21 3b 5f 7a c6 19 71 bf 6b d5 9e 48 ..]5!;_z..q.k..H 0410 ad 19 b2 0e 05 cc 69 0f 66 cd b0 b2 42 84 50 0d ......i.f...B.P. 0420 ff d2 be 71 bd bb 79 72 3e e2 e4 d1 9c 52 12 ad ...q..yr>....R.. 0430 db ca b8 47 46 3a 1d 5c 3d fe c8 d7 98 6c 3e 92 ...GF:.\=....l>. 0440 63 93 b1 c5 2b 78 93 8a b9 db 87 38 cc 15 a6 66 c...+x.....8...f 0450 43 18 ef c4 f9 70 16 6d 9a f0 12 c2 f9 e8 98 34 C....p.m.......4 0460 3e a9 55 62 9e a4 ed 73 45 51 9f e6 52 8a be 74 >.Ub...sEQ..R..t 0470 db 04 9d 89 61 bf 83 ce 9d 82 34 84 f5 5d 4d 1e ....a.....4..]M. 0480 36 0d 6d a4 99 b9 5a 37 71 50 c6 17 c5 66 d9 f4 6.m...Z7qP...f.. 0490 38 63 d6 7f 73 66 91 03 8c 93 be 6a 30 b3 7e 4b 8c..sf.....j0.~K 04a0 84 68 98 f9 26 0e b9 3b 12 07 0a 2d d5 d5 74 13 .h..&..;...-..t. 04b0 03 86 3b 0d f2 76 73 a5 1c e4 dc f2 f9 63 9a 7f ..;..vs......c.. 04c0 29 c4 0e f7 60 09 82 a8 2e 97 eb ae 73 c8 2c 9e )...`.......s.,. 04d0 d6 a9 a7 28 e3 b8 33 ed cf 8b 5f 4d ad 9b 81 45 ...(..3..._M...E 04e0 33 85 be d1 1b 80 4a 84 9f 08 32 9d b0 33 1b 2f 3.....J...2..3./ 04f0 7f 8e f8 37 b0 7e c4 84 b7 41 24 b6 e8 78 d0 3f ...7.~...A$..x.? 0500 19 2c 9d d6 6b 9b c3 c1 2c e2 7d a9 9c 68 37 9e .,..k...,.}..h7. 0510 66 25 bf 09 a8 28 27 f6 65 93 3b 3d dc 22 f6 53 f%...('.e.;=.".S 0520 2d e4 4f f9 57 28 fa 1d 69 c9 13 7d 47 bf ef 80 -.O.W(..i..}G... 0530 fa 00 c0 3f 6b 60 e4 f3 3b f0 62 fd f6 76 1b 2e ...?k`..;.b..v.. 0540 02 38 96 68 64 58 c1 f7 bd 4d 53 0c a7 eb 38 63 .8.hdX...MS...8c 0550 a9 ab bc 67 28 de 00 cb e2 8a 91 7e 74 35 8b 60 ...g(......~t5.` 0560 18 fe b5 17 a7 80 32 82 f3 01 6b 72 a9 47 ac 53 ......2...kr.G.S 0570 df 9c 93 b2 d7 50 16 e8 49 e1 d9 56 83 f4 99 7a .....P..I..V...z 0580 3d 11 04 fd c3 0d f5 d0 38 9e 1d 01 6c 89 0f 4a =.......8...l..J 0590 83 9d 26 fe 74 ab 40 72 30 0d bf 56 61 bb 1b 10 ..&.t.@r0..Va... 05a0 91 1b 9b b3 40 6a c0 7f 6f 5a ae 5a f2 1a e2 ed ....@j..oZ.Z.... 05b0 af 00 f1 22 ..." No. Time Source Destination Protocol Info 3644 977.806397 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=67967 Ack=44275 Win=20744 Len=0 Frame 3644 (60 bytes on wire, 60 bytes captured) Arrival Time: Nov 11, 2005 16:46:26.564901000 Time delta from previous packet: 0.000302000 seconds Time since reference or first frame: 977.806397000 seconds Frame Number: 3644 Packet Length: 60 bytes Capture Length: 60 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Trailer: 000000000000 Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0xce90 (52880) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0xa7fb [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 67967, Ack: 44275, Len: 0 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 67967 (relative sequence number) Acknowledgement number: 44275 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 20744 Checksum: 0x9700 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3512 The RTT to ACK the segment was: 48.069070000 seconds No. Time Source Destination Protocol Info 3645 977.806440 zen1 soth1 TCP [TCP Retransmission] 4605 > 1677 [ACK] Seq=44275 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3645 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:46:26.564944000 Time delta from previous packet: 0.000043000 seconds Time since reference or first frame: 977.806440000 seconds Frame Number: 3645 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x4c74 (19572) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2464] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 44275, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 44275 (relative sequence number) Next sequence number: 45735 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0xa84c] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 32.046045000 seconds RTO based on delta from frame: 3553 Data (1460 bytes) 0000 d3 ee 1e 89 1c b9 b9 e3 6d b3 7e 2c 3b bd ee c6 ........m.~,;... 0010 9f ab 5a 35 ae 40 ad 4f 98 f5 ef 2b 15 f4 6c 04 ..Z5.@.O...+..l. 0020 41 11 a7 b4 5f f2 35 06 32 67 b4 e4 f6 fc 90 71 A..._.5.2g.....q 0030 9e 31 40 a8 ac 88 aa 56 8f a3 14 8b 4c 73 d7 4b .1@....V....Ls.K 0040 18 a3 bd e0 d4 33 f2 20 64 e2 6b 44 bd ad 2c 9b .....3. d.kD..,. 0050 ba cf 38 af a4 e7 82 7e 69 20 61 3f 89 e9 97 bb ..8....~i a?.... 0060 74 7d 13 2c 77 96 99 8e 73 74 0c 61 f3 3b 56 c0 t}.,w...st.a.;V. 0070 09 ea 35 eb c7 0b d7 8f 7d c1 e0 8b b0 85 ed 41 ..5.....}......A 0080 5c 93 46 02 08 a1 e3 87 a4 e1 73 ce 44 9a a1 17 \.F.......s.D... 0090 5a f7 b1 35 ab 28 1d fd c0 10 ab bd ed ed 77 d8 Z..5.(........w. 00a0 b4 2f cd e5 ee 07 bc 9d bc 41 33 b9 37 4a a5 d0 ./.......A3.7J.. 00b0 f9 b4 4f 64 27 0b 56 55 bd ab 61 6e 4f fe d3 42 ..Od'.VU..anO..B 00c0 6e f9 93 05 49 41 93 20 e1 dc 6e 2b c5 0b 1c a3 n...IA. ..n+.... 00d0 a9 f1 93 09 2f 06 5f 8e 41 db 4c 8e 2b 16 03 86 ..../._.A.L.+... 00e0 2d 2c 51 8b 34 d6 9e df d9 98 b8 2d a4 9f 08 2e -,Q.4......-.... 00f0 68 b8 4a 29 3f 21 42 ed 89 7c 1e f7 c3 6d ff f3 h.J)?!B..|...m.. 0100 de 1d c8 d1 08 08 b1 bd 54 a5 d4 f8 cd 44 a3 1a ........T....D.. 0110 a8 dc 33 33 35 b8 2f c0 55 fa 10 b9 1b c4 f3 d9 ..335./.U....... 0120 1c e6 52 1c fb ca c9 62 92 95 be d7 84 69 e5 c7 ..R....b.....i.. 0130 51 5e cc ac 52 c9 a2 03 e9 92 8a 46 b8 31 9d 9c Q^..R......F.1.. 0140 94 c5 8f f9 32 89 33 7d 05 33 ee bb 9f 96 74 f2 ....2.3}.3....t. 0150 d9 18 0f 71 6c ac 6e d4 b9 11 ac 8a 16 c1 17 b1 ...ql.n......... 0160 3c de a7 69 83 91 f1 0b c4 57 a2 b2 bc 8d 8d c4 <..i.....W...... 0170 2f de 1b fb d5 d2 93 73 09 b1 5b 55 45 8a cd ad /......s..[UE... 0180 64 15 e7 99 d1 ab 85 b9 a8 3e 4e 66 14 71 75 97 d........>Nf.qu. 0190 5e 7c 11 35 34 cc 4a 34 5d 75 af e7 11 a8 c9 1c ^|.54.J4]u...... 01a0 5a a6 f7 58 46 d1 2d 27 0e 75 de 61 9d 1b 76 5a Z..XF.-'.u.a..vZ 01b0 fb 0c 05 95 3b d2 f7 00 fc 57 30 cd 41 df 7d 48 ....;....W0.A.}H 01c0 96 ab 10 39 67 06 d7 82 09 bf ae 83 3d 90 98 01 ...9g.......=... 01d0 c8 bd 5b 5d 4b 98 9b f6 06 bb 94 fc f0 4f ad 0a ..[]K........O.. 01e0 93 80 02 43 64 3f 7f 35 7d 62 d6 de ce 43 86 3a ...Cd?.5}b...C.: 01f0 b0 8e 26 91 95 95 f0 f3 d9 69 26 2a 10 2b 7d eb ..&......i&*.+}. 0200 e0 66 7a 2b f1 71 3f ae 35 98 a1 8f 7b 65 32 bb .fz+.q?.5...{e2. 0210 78 ae 05 2e e7 b5 6c 18 52 9f 80 e4 ce c7 d9 fb x.....l.R....... 0220 34 d2 d4 7c 3f 19 f0 bd 06 8b 77 36 81 eb df 74 4..|?.....w6...t 0230 79 0e 54 6e 62 21 85 17 30 e5 3a 08 d8 57 a9 65 y.Tnb!..0.:..W.e 0240 ee 7d c5 a7 90 97 5d 66 47 dc f4 47 6d 6a 68 11 .}....]fG..Gmjh. 0250 a9 7c 0f 75 32 a1 66 ff d6 c5 6f c1 17 51 fd 66 .|.u2.f...o..Q.f 0260 dc 9c 48 4c e5 91 d4 d8 e0 98 b1 9e 6c 7f a6 ac ..HL........l... 0270 e9 22 db 66 77 cf a9 33 9c 5e c8 22 07 9d c2 96 .".fw..3.^.".... 0280 27 cd d1 c8 1b f9 c8 5f 4b 23 93 29 d8 d2 ac 75 '......_K#.)...u 0290 f1 9f ea 9b 3f f0 c0 30 cc 16 8a 77 42 85 90 75 ....?..0...wB..u 02a0 e0 4d 83 b4 d1 b2 4c 18 a1 9b fb 91 0e 6b e7 03 .M....L......k.. 02b0 37 44 d8 09 53 94 2a 1d de f8 4d fa 9d 61 6c dd 7D..S.*...M..al. 02c0 d1 3a b6 53 74 b3 76 63 e0 59 98 4d f1 45 68 bb .:.St.vc.Y.M.Eh. 02d0 25 ff 0a 4e 6c 07 93 bb 21 de 44 5b ba 1d 85 31 %..Nl...!.D[...1 02e0 fb 7e d6 db e4 d8 07 5b 29 20 22 8e 3f 08 e0 e4 .~.....[) ".?... 02f0 e4 ad 6f 01 0a ca 3e cd 49 67 25 b6 72 75 39 40 ..o...>.Ig%.ru9@ 0300 a6 70 8e 26 13 f7 16 c6 11 45 d6 f7 ef 65 06 8f .p.&.....E...e.. 0310 2a ae 3d eb 2b 80 2c 63 9c d0 fc 70 84 c7 62 ab *.=.+.,c...p..b. 0320 49 2c 1f 19 ca 8a a9 70 31 0b d6 a3 6c 9f ee 90 I,.....p1...l... 0330 24 06 a3 3a b8 c0 f1 41 5e 6c 83 f4 70 80 2d b1 $..:...A^l..p.-. 0340 e7 6a fe 53 9d 46 d6 52 a5 2a d3 bc 69 a8 99 bd .j.S.F.R.*..i... 0350 2d 98 0d be 0f a1 13 18 c0 7c 9c cd 26 99 af 46 -........|..&..F 0360 04 68 a6 59 7b aa 7e 1c 4e 5e b7 c2 df 41 0a f5 .h.Y{.~.N^...A.. 0370 54 6c a1 a9 c5 84 8a 21 cc 11 87 84 91 8d 0a 4f Tl.....!.......O 0380 fb 8d d1 cf 99 f2 ec 56 7b 63 3a 63 ba d5 9e e2 .......V{c:c.... 0390 fa 0c 9f 03 90 0b b8 af 91 6c e6 ff 12 97 7f 32 .........l.....2 03a0 2c 9d 7d 21 3f ea 50 51 d3 0e 7a e5 42 b6 30 41 ,.}!?.PQ..z.B.0A 03b0 2b d1 20 82 35 20 28 e9 31 f2 40 91 e8 01 2b 8e +. .5 (.1.@...+. 03c0 e7 ef 18 0e 1c 2b 25 f1 38 66 02 99 0c ad 9c 11 .....+%.8f...... 03d0 57 15 70 22 35 8d d1 cf d7 fa 0e a0 6b 2f 4e 55 W.p"5.......k/NU 03e0 96 a5 3c a5 55 91 82 47 5e 31 da 4e 2f 41 bd 3b ..<.U..G^1.N/A.; 03f0 02 28 7f 9b 47 94 21 62 a6 1f 2c 27 04 25 aa 7e .(..G.!b..,'.%.~ 0400 05 a7 ef 2a c4 09 42 37 50 50 66 85 72 25 57 ac ...*..B7PPf.r%W. 0410 64 fc bc 20 d7 85 3f c7 0b 05 cc 91 70 ca 17 bf d.. ..?.....p... 0420 d3 68 ed 80 20 89 85 45 73 ee 7d da 50 c5 79 b1 .h.. ..Es.}.P.y. 0430 74 8e 00 92 75 24 28 e8 71 98 b0 78 52 b2 a2 dc t...u$(.q..xR... 0440 20 3a 5e 9f 1a 9a 1c 84 4e 96 02 67 10 41 a5 2e :^.....N..g.A.. 0450 4d f2 d0 c2 00 40 22 ea 6c 1f 21 65 d5 05 f4 a0 M....@".l.!e.... 0460 11 71 42 60 81 46 81 6c dc 11 f9 6b 20 0d cf 07 .qB`.F.l...k ... 0470 6e e6 94 57 75 92 af cf 10 57 4f bd 7d dc 02 f3 n..Wu....WO.}... 0480 2e f3 2f 2a c0 d9 a1 2e d6 c4 de bd e7 36 ee 3c ../*.........6.< 0490 c7 9d 98 d1 3f 71 82 c3 1d 4f 93 11 cc e9 c5 1e ....?q...O...... 04a0 a2 b0 a7 18 a0 8b 8b 46 d4 55 64 1e 5f 92 9b 26 .......F.Ud._..& 04b0 d6 9e ee 4e 5b e1 31 d0 ba e2 4a 36 fc e1 3b fe ...N[.1...J6..;. 04c0 79 b9 da 03 a7 9d ff 7d 71 86 f3 08 51 e4 93 45 y......}q...Q..E 04d0 bc b2 d1 ea 85 06 e7 2b 71 7f ce 24 4c b9 4b fd .......+q..$L.K. 04e0 b0 02 13 5d 9a d9 de 1e 5a 38 f0 b2 ed 18 bc 70 ...]....Z8.....p 04f0 4c db d2 5b 50 7a e8 72 7e be 34 a1 75 53 bc cd L..[Pz.r~.4.uS.. 0500 60 79 eb e9 4b 4b 34 0d 11 e0 e6 4c 74 73 fc d2 `y..KK4....Lts.. 0510 39 bb 8a a8 2f 44 a3 bd b5 02 e8 55 c7 1e d7 c8 9.../D.....U.... 0520 ba 79 12 47 ec 44 9a 37 fc a6 ce 87 8a d9 ea c7 .y.G.D.7........ 0530 90 a5 b9 8a 43 a5 f2 b7 f4 5b 0c 50 bf 0c 0f 81 ....C....[.P.... 0540 1a d5 47 4d d9 50 a6 ab 49 ca c6 82 0f cd b3 9a ..GM.P..I....... 0550 11 f0 b8 79 ef f2 39 ff 2c f2 6a 83 01 0e 4f 58 ...y..9.,.j...OX 0560 dd 04 39 dd fb 3b ab 32 ea 67 5b ca 18 4a 56 01 ..9..;.2.g[..JV. 0570 86 b7 9e a3 da 87 7c 5b 93 83 6c 14 bd 2b 72 72 ......|[..l..+rr 0580 7f a4 51 57 c8 b3 89 32 fa 3f 7c 36 1d bd 80 11 ..QW...2.?|6.... 0590 f3 26 5a 3a f1 86 ae 27 f0 6e 03 e6 ac 82 f7 cd .&Z:...'.n...... 05a0 3e 64 13 dc 46 7d 84 67 6b d0 ec da ec e9 48 fb >d..F}.gk.....H. 05b0 ff 4f 3f 9e .O?. No. Time Source Destination Protocol Info 3646 977.806451 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=45735 Ack=67967 Win=16802 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3646 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:46:26.564955000 Time delta from previous packet: 0.000011000 seconds Time since reference or first frame: 977.806451000 seconds Frame Number: 3646 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x4c75 (19573) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2463] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 45735, Ack: 67967, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 45735 (relative sequence number) Next sequence number: 47195 (relative sequence number) Acknowledgement number: 67967 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16802 Checksum: 0x8a12 [incorrect, should be 0xc748] Data (1460 bytes) 0000 2b fa ca 9c d5 2a 5d 9f 03 ab 5a 6d 93 21 9f 09 +....*]...Zm.!.. 0010 bd 4d 04 8c 81 4a ba fc 46 cf 5c 76 e2 71 b9 58 .M...J..F.\v.q.X 0020 77 96 89 55 15 33 44 23 e4 5d a2 39 b4 22 77 91 w..U.3D#.].9."w. 0030 21 f9 c5 3e 94 df c4 37 4d a9 b4 67 f3 7a 7c 7f !..>...7M..g.z|. 0040 17 6b b5 66 bd e5 6d 25 95 be ce 0a 47 fb 72 4f .k.f..m%....G.rO 0050 2e a5 0e d4 97 f1 92 09 76 29 48 5c 7c a6 9b 54 ........v)H\|..T 0060 0f 0b 77 92 5f 0a 10 2f c3 8d 92 4f 6e d7 76 b5 ..w._../...On.v. 0070 0d a1 d2 0d e8 da 8f cb f2 df 64 17 1b 31 58 49 ..........d..1XI 0080 3b db 7b f8 f4 0a 54 8c cf 27 b2 38 b5 38 43 d7 ;.{...T..'.8.8C. 0090 ef 27 b7 8b 21 6a 7e fb d6 bd 14 38 5f b9 53 bb .'..!j~....8_.S. 00a0 ce 3b 8f 62 29 4c 64 0f 16 fd 86 ff 39 93 92 62 .;.b)Ld.....9..b 00b0 26 b8 f6 ed ec ee 6e 29 f3 7f 6d c2 1e cf a4 99 &.....n)..m..... 00c0 8b 1b 58 0a a7 f3 bd 8d 08 ef c3 68 6d b7 3b b6 ..X........hm.;. 00d0 a6 4e 52 fc 54 28 79 23 c3 55 7f ef 43 7f 70 a1 .NR.T(y#.U..C.p. 00e0 01 24 b8 0b 1d 8f ee af b0 15 b1 6d 27 11 58 7d .$.........m'.X} 00f0 b1 5e 3f cd 65 3e 1f 0a 02 56 c2 24 cc ea 82 9e .^?.e>...V.$.... 0100 70 ef 34 ed 32 cf d2 5a b6 f7 5f 22 af 59 d1 51 p.4.2..Z.._".Y.Q 0110 14 69 dc 45 05 53 aa 68 93 e9 32 da 65 7d fc b5 .i.E.S.h..2.e}.. 0120 b9 52 1e fb 7f 19 9c 5e ca de 3b ab cb 22 8f ec .R.....^..;..".. 0130 f1 81 b9 92 18 8f 88 a7 a3 e2 da 38 ac 56 c8 34 ...........8.V.4 0140 83 e8 17 58 34 b9 6f 9e 1e c3 46 0b 37 b0 9f 96 ...X4.o...F.7... 0150 7d c6 5d a1 b0 d0 2a 78 9b fa b6 f8 23 9c 9c 98 }.]...*x....#... 0160 de f3 cb 77 f0 58 02 cf 0b 2d 37 e3 62 86 eb 4b ...w.X...-7.b..K 0170 b0 81 9b 7d bd bb 61 1d b8 09 cc b1 70 d4 5f cd ...}..a.....p._. 0180 60 8d 68 5b 7c 80 ed 2c 26 a9 cb f8 6b 8a f3 68 `.h[|..,&...k..h 0190 83 bc 44 39 ee 9b e0 7c 1a 39 ce 84 01 42 db 3d ..D9...|.9...B.= 01a0 20 ef 6c d0 ac 69 e8 e9 14 8e e8 0c 97 b1 3f f1 .l..i........?. 01b0 4d e6 ba 5a 5c d9 5f f7 8f b0 13 f0 6a e4 33 f7 M..Z\._.....j.3. 01c0 45 13 a6 50 0f 03 90 08 be a5 40 30 d9 99 a0 28 E..P......@0...( 01d0 81 50 6f ac d9 d5 c7 c8 ed e4 3d 50 85 79 55 31 .Po.......=P.yU1 01e0 f5 06 f7 8e 36 2d a6 96 57 f8 f1 09 3e 95 cf 46 ....6-..W...>..F 01f0 7d dc a5 1c ca fa 58 7b 1f 82 6a 26 e5 20 6a 60 }.....X{..j&. j` 0200 72 22 c6 25 ef 29 34 3c 52 1e 97 46 ad cd 72 3b r".%.)4.M../5.. ...s.p 0380 d3 0a 3c 78 97 cf 4d 8d 86 51 98 78 c5 3e ef 3e ...> 0390 16 0e 75 10 85 ec f0 ef fd d7 77 dd 18 26 1a 95 ..u.......w..&.. 03a0 60 8b dd 32 8b 49 a7 aa 24 0b de c9 28 6c 15 9c `..2.I..$...(l.. 03b0 27 55 2b da 0f 3e f2 7c ec 5c 6a 06 9b f9 93 4c 'U+..>.|.\j....L 03c0 fd 03 65 79 6b e8 91 9b a0 45 64 fc 80 6f 23 fd ..eyk....Ed..o#. 03d0 e5 04 37 f9 1b 1c 7a 23 5d 9a 75 8f d9 69 c6 72 ..7...z#].u..i.r 03e0 c5 fb 87 a4 21 e9 a0 85 91 73 8c bb 7d a8 86 a0 ....!....s..}... 03f0 40 b3 c6 c0 ab 69 9f 98 9e 11 35 c0 e5 6b d8 8f @....i....5..k.. 0400 eb 7b cb dd c8 77 f6 be 37 de 2a f4 27 bf cf 8d .{...w..7.*.'... 0410 c5 cd f3 ab a4 f3 7b c6 4f f1 24 33 47 b1 61 93 ......{.O.$3G.a. 0420 de ca 34 7d 52 93 9d 0d a3 7d 68 f0 f8 74 c6 83 ..4}R....}h..t.. 0430 17 28 66 68 26 88 67 da 92 9d 45 41 ab 7d 8d 6b .(fh&.g...EA.}.k 0440 fc 7c 0c c9 b3 5a 5a 52 ed e4 d9 48 6f 8f c5 70 .|...ZZR...Ho..p 0450 85 ee d4 39 27 0f 39 73 e5 6b 1e c7 61 0d 2e ee ...9'.9s.k..a... 0460 47 50 1d c4 9d 77 df bf b3 d0 44 e3 74 58 9b 33 GP...w....D.tX.3 0470 e5 a7 f4 a0 94 dd f5 b3 26 a5 18 6b 7c 3d bf fe ........&..k|=.. 0480 af cf c7 bc e1 9f f9 3b 37 ea 5a 44 06 01 bf b9 .......;7.ZD.... 0490 dd ef d9 bb e0 7d bc 57 1a 9d c4 c6 8f 02 cf 5f .....}.W......._ 04a0 ee 1f ee 58 4d 43 0a c9 74 1c 3e a8 64 2d 0a 57 ...XMC..t.>.d-.W 04b0 e9 b9 58 f8 1f 18 27 ec 33 2c 5a c6 b1 62 ce 92 ..X...'.3,Z..b.. 04c0 9f 6a 9d 1c 78 1e 00 33 18 4b c5 5e bd 82 22 f7 .j..x..3.K.^..". 04d0 07 9f 56 b9 d4 f1 52 b4 cb 18 e7 eb ad b7 75 de ..V...R.......u. 04e0 ac e8 e6 d2 e2 2f 81 85 8a 76 1e 71 b9 de 4b cf ...../...v.q..K. 04f0 e3 42 6d 96 57 33 8d c4 09 b5 48 b0 19 a5 c3 68 .Bm.W3....H....h 0500 ab 29 2b c8 db f4 20 75 62 8b 54 fa df eb 8b 18 .)+... ub.T..... 0510 36 94 80 0d 30 f7 e6 b6 b3 a5 0c df be 3c 9f c4 6...0........<.. 0520 93 57 ed 41 f7 87 ba d9 d4 d2 ca 69 f2 87 8a ac .W.A.......i.... 0530 de ce 7f 12 24 3d bf 93 cd a9 bd ae ad 38 2b eb ....$=.......8+. 0540 0e d0 6a f2 03 e4 a3 12 9b 88 0c 88 30 ed 95 25 ..j.........0..% 0550 fd 0f 96 46 18 26 a9 72 85 99 a7 61 af be ce 1b ...F.&.r...a.... 0560 18 d4 4a a8 ca 96 e6 fb 00 7f 4d 95 26 e3 a2 ae ..J.......M.&... 0570 11 f2 7b a7 49 8b dc d4 2a 49 3f 9c 09 31 c0 06 ..{.I...*I?..1.. 0580 42 34 9b 4e 01 3b 79 82 b9 a2 98 10 4e 1d 0f f4 B4.N.;y.....N... 0590 47 34 8d 4e 5d e5 2e 42 89 e6 85 43 f6 f5 e4 66 G4.N]..B...C...f 05a0 6c e2 73 bb cc 18 60 3f a4 ef 4c 0f 8a c9 f8 44 l.s...`?..L....D 05b0 f0 fb 06 f7 .... No. Time Source Destination Protocol Info 3788 1037.527999 soth1 zen1 TCP 1677 > 4605 [PSH, ACK] Seq=67967 Ack=45735 Win=22204 Len=22 Frame 3788 (76 bytes on wire, 76 bytes captured) Arrival Time: Nov 11, 2005 16:47:26.286503000 Time delta from previous packet: 59.721548000 seconds Time since reference or first frame: 1037.527999000 seconds Frame Number: 3788 Packet Length: 76 bytes Capture Length: 76 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 62 Identification: 0x3993 (14739) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x3ce3 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 67967, Ack: 45735, Len: 22 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 67967 (relative sequence number) Next sequence number: 67989 (relative sequence number) Acknowledgement number: 45735 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 22204 Checksum: 0x90e8 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3553 The RTT to ACK the segment was: 91.767604000 seconds Data (22 bytes) 0000 bc ef 16 00 b5 fe 14 00 00 00 00 20 00 78 33 06 ........... .x3. 0010 14 05 00 00 16 00 ...... No. Time Source Destination Protocol Info 3789 1037.528039 soth1 zen1 TCP 1677 > 4605 [FIN, PSH, ACK] Seq=67989 Ack=45735 Win=22204 Len=46 Frame 3789 (100 bytes on wire, 100 bytes captured) Arrival Time: Nov 11, 2005 16:47:26.286543000 Time delta from previous packet: 0.000040000 seconds Time since reference or first frame: 1037.528039000 seconds Frame Number: 3789 Packet Length: 100 bytes Capture Length: 100 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 86 Identification: 0x3b93 (15251) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x3acb [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 67989, Ack: 45735, Len: 46 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 67989 (relative sequence number) Next sequence number: 68035 (relative sequence number) Acknowledgement number: 45735 (relative ack number) Header length: 20 bytes Flags: 0x0019 (FIN, PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...1 = Fin: Set Window size: 22204 Checksum: 0x6f31 [correct] Data (46 bytes) 0000 bc ef 1a 00 b5 fe 18 00 00 00 00 20 67 cf 32 0a ........... g.2. 0010 00 00 00 00 00 00 01 00 1a 00 bc ef 14 00 b5 fe ................ 0020 0e 00 02 00 02 21 52 16 7f 24 43 e7 14 00 .....!R..$C... No. Time Source Destination Protocol Info 3790 1037.528082 zen1 soth1 TCP 4605 > 1677 [ACK] Seq=47195 Ack=68036 Win=16734 [TCP CHECKSUM INCORRECT] Len=1460 Frame 3790 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:47:26.286586000 Time delta from previous packet: 0.000043000 seconds Time since reference or first frame: 1037.528082000 seconds Frame Number: 3790 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x5077 (20599) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2061] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 47195, Ack: 68036, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 47195 (relative sequence number) Next sequence number: 48655 (relative sequence number) Acknowledgement number: 68036 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16734 Checksum: 0x8a12 [incorrect, should be 0x5743] SEQ/ACK analysis This is an ACK to the segment in frame: 3789 The RTT to ACK the segment was: 0.000043000 seconds Data (1460 bytes) 0000 0b b6 f6 15 6c 19 2d 1a c6 7a 6f 89 97 d4 67 b1 ....l.-..zo...g. 0010 9a ad a6 4c 92 d3 ed 95 9d 92 08 ef 7c d3 df d1 ...L........|... 0020 c6 a6 04 97 db a5 e3 e6 4f 9a eb 13 2e 5a f3 84 ........O....Z.. 0030 f8 01 9c bb cb 87 d2 3f 23 71 f8 d9 bd d5 29 48 .......?#q....)H 0040 29 77 57 67 c7 3f 53 1c 26 18 b5 3f 1b 95 17 db )wWg.?S.&..?.... 0050 4f 2c 66 46 cc c9 70 c6 c9 96 05 86 eb 73 7e b0 O,fF..p......s~. 0060 69 cd c6 74 b7 0b 4b 50 be 80 53 9b 4a c5 24 35 i..t..KP..S.J.$5 0070 9b 21 5e ff 53 c2 8d a1 18 ce ce f3 4a ed f7 6f .!^.S.......J..o 0080 11 c9 f7 5d 1f ae 05 00 7a ea 47 09 44 93 6a bd ...]....z.G.D.j. 0090 80 37 c7 45 c5 3e b6 1a 10 06 7e 33 c5 f7 a3 18 .7.E.>....~3.... 00a0 85 29 64 ff 7d 47 ca 42 63 28 e1 7b 4e 00 72 f0 .)d.}G.Bc(.{N.r. 00b0 e1 65 b8 ee 4a 3f 4c fe 0a 29 27 e7 40 49 fc 39 .e..J?L..)'.@I.9 00c0 70 0b cf 95 a5 10 6a 76 e6 b7 07 86 cd 81 dc aa p.....jv........ 00d0 01 98 cd ec d2 51 4a 8a 2d 62 1d 8b c6 08 4c a6 .....QJ.-b....L. 00e0 dc 0e 27 8e 9a a8 53 ca 7b a5 fc ac 41 4c c1 06 ..'...S.{...AL.. 00f0 2b 58 3b 0a 4f e7 4f ff 8b 17 95 74 7d f6 de 00 +X;.O.O....t}... 0100 15 fd 09 2c 98 8c 4b 0f c5 46 8f 06 b3 b4 4a e4 ...,..K..F....J. 0110 29 8f 4f fb 44 30 b6 2b ca 53 61 5a 1a 9a 36 2d ).O.D0.+.SaZ..6- 0120 d4 b5 bc e9 21 3d f0 c8 d1 d4 70 99 4e 95 7b 55 ....!=....p.N.{U 0130 61 29 22 10 6c 25 76 44 bb 77 ba ac 8d b1 4c ad a)".l%vD.w....L. 0140 ec 22 4b 3c ce 6f 46 e7 41 66 63 bc 75 b6 41 c2 ."K<.oF.Afc.u.A. 0150 3a dc 5d 74 02 1c 83 fe 67 80 9c af 9f ed 42 46 :.]t....g.....BF 0160 7b 3c e6 b9 0a 1a 88 0a da 89 d0 65 44 15 87 69 {<.........eD..i 0170 bf 91 39 b6 e4 46 cd b4 16 c1 20 f3 74 b2 69 b7 ..9..F.... .t.i. 0180 c1 81 d7 ef 1e f5 b2 2c 85 14 c9 1d f4 b9 cc da .......,........ 0190 eb ef f6 57 1e de f6 94 29 89 12 13 f6 8d 68 a8 ...W....).....h. 01a0 f2 e1 8c 2c b9 c5 b6 1e 5d e8 ce 96 d1 05 46 10 ...,....].....F. 01b0 fa 6f ed 22 b3 42 0c e7 51 ee ca 7a 4a 39 4c cc .o.".B..Q..zJ9L. 01c0 68 95 40 78 2c 18 d5 ad 4d e5 3c 17 9c 1a fc 9b h.@x,...M.<..... 01d0 74 96 bb ae 82 d8 1b 30 36 d4 d6 4f ae 0f be a0 t......06..O.... 01e0 7d f4 17 73 a1 5c 3b d6 94 d4 c2 11 5e ed 94 06 }..s.\;.....^... 01f0 96 b6 cc 2e ef 74 27 87 09 52 74 c0 fc 92 20 a3 .....t'..Rt... . 0200 ad 04 9f 8d 4d 49 a6 e4 e3 2c 2c 73 a8 0a 65 49 ....MI...,,s..eI 0210 49 c2 10 69 8d e9 68 09 80 8f a6 63 4a 07 bf 83 I..i..h....cJ... 0220 3d 04 d3 27 f2 73 89 1a 4b f8 17 23 9f 2b 7d 45 =..'.s..K..#.+}E 0230 28 ae 20 5e 76 40 a7 f5 17 fa ac 06 28 f3 dc 58 (. ^v@......(..X 0240 76 3c b0 25 c2 0f 9c a4 a1 66 ba 0a aa 04 79 37 v<.%.....f....y7 0250 d9 96 e1 84 30 3d 48 13 6e f2 09 be 5e ff 7a b1 ....0=H.n...^.z. 0260 c6 65 79 e4 85 cd e9 a1 4d a3 06 8e 75 96 d8 61 .ey.....M...u..a 0270 4b f4 bf 52 6c 17 37 75 0b 6e c7 62 fe c6 d9 45 K..Rl.7u.n.b...E 0280 05 f7 77 e6 1c de 6e 8e 67 12 68 ba 1c ba 54 7f ..w...n.g.h...T. 0290 3b 0c a0 0a 41 93 74 89 18 d7 3e 66 50 80 41 72 ;...A.t...>fP.Ar 02a0 72 d8 60 c4 c5 f3 ba 72 3c 9a de ae 7f 78 a9 97 r.`....r<....x.. 02b0 da 1a 16 89 69 2c 74 6c 8c 61 1e 96 2c 8a ab 1d ....i,tl.a..,... 02c0 63 c4 8c d3 82 f5 11 f9 8e e9 96 b3 7e 06 39 e8 c...........~.9. 02d0 66 64 25 6e 95 e6 b9 fa f5 b5 cb c8 49 21 1e 3d fd%n........I!.= 02e0 48 2d 80 65 05 70 39 44 a8 59 e2 5e 0e 2c 4e 8a H-.e.p9D.Y.^.,N. 02f0 05 17 fa 3a 91 8e e7 a1 4b 2b 7c 5a f7 e5 da 72 ...:....K+|Z...r 0300 44 fc 4e e6 8e fe cc ed 3d 8a 78 4a 40 04 31 bf D.N.....=.xJ@.1. 0310 ab 2a 7e 24 fb 90 3c ae ea 4f 4c 00 ee 79 ff e0 .*~$..<..OL..y.. 0320 c3 ca 8f 8f 6e bc ab 9d 52 db 7e 36 28 d3 10 b7 ....n...R.~6(... 0330 36 88 34 7d 82 4b 71 20 06 d5 99 92 be a3 42 e3 6.4}.Kq ......B. 0340 81 65 56 4f 4b 6d fa ca 22 9a 52 b1 3b 32 98 0e .eVOKm..".R.;2.. 0350 12 22 67 84 64 90 7b d0 f8 62 f0 7a 5b 50 71 0b ."g.d.{..b.z[Pq. 0360 fe 2a 05 91 3c 5f bc fc 35 75 1b 61 fa c4 41 eb .*..<_..5u.a..A. 0370 50 ef f0 46 39 76 96 b6 b6 52 99 32 23 e5 76 c8 P..F9v...R.2#.v. 0380 af f1 ee ca 75 21 c9 4a fc ec b9 36 3e 20 fd 2f ....u!.J...6> ./ 0390 73 e2 90 68 2a ae 38 84 e0 5a 9a 01 d0 e3 c1 c1 s..h*.8..Z...... 03a0 dc fc 39 91 45 cb b2 4a d3 d7 66 07 80 3a 38 8b ..9.E..J..f..:8. 03b0 93 fe 52 79 49 d0 8b a4 db 4b 74 e2 27 5d f3 70 ..RyI....Kt.'].p 03c0 89 42 95 d0 0c 27 7a e3 39 6d 00 fb 3c ff 11 77 .B...'z.9m..<..w 03d0 9f 6b 56 f2 14 4e ca 41 da 85 12 4b 79 5f 63 c7 .kV..N.A...Ky_c. 03e0 cb 04 fb 26 08 7d 54 07 00 32 57 08 e1 06 dc f5 ...&.}T..2W..... 03f0 7c 3e b8 15 e8 5d 03 61 77 a8 21 19 c7 4f db 84 |>...].aw.!..O.. 0400 3d a8 13 46 2c 37 6b a5 e3 62 79 55 7b 2d c5 bb =..F,7k..byU{-.. 0410 39 6e cf 43 98 d3 96 58 50 65 97 d1 98 02 61 58 9n.C...XPe....aX 0420 19 e0 76 1e a2 7d 54 be 4e a3 56 7d 55 13 0e 83 ..v..}T.N.V}U... 0430 b8 3f 95 d8 8b a1 96 2b a8 ae bf 5f 88 d8 6b 59 .?.....+..._..kY 0440 e5 f5 93 51 81 39 87 81 ca 1b d2 4c 7d 81 91 59 ...Q.9.....L}..Y 0450 6f ec d9 4a ba ce 40 6b 50 0d 26 e7 74 31 8e a9 o..J..@kP.&.t1.. 0460 e0 ff 7a 78 65 c5 90 66 74 9c 63 62 e6 58 19 2a ..zxe..ft.cb.X.* 0470 db b8 00 39 b5 e1 ce 78 8d 8e 3f bd 1b 4a 2e 53 ...9...x..?..J.S 0480 14 40 26 fd 3e f0 25 81 fe f9 e2 5b 1c c0 3d c4 .@&.>.%....[..=. 0490 0e 94 b0 44 07 4d da b3 1a 11 7f 41 8e 23 1f 7f ...D.M.....A.#.. 04a0 43 2e e2 b0 8b 01 aa 4f 30 1c d1 28 72 11 93 51 C......O0..(r..Q 04b0 f8 fa 5e b1 ad 52 83 47 d5 01 a8 86 8e 32 a0 02 ..^..R.G.....2.. 04c0 a4 97 85 2d 7c c5 01 b9 9d d8 b1 bd 7a 31 e5 4b ...-|.......z1.K 04d0 ec 2c 7d bc f4 64 ab ac 17 34 eb 13 17 26 07 23 .,}..d...4...&.# 04e0 c8 dd ab 3c 23 96 8d f6 90 3e f1 b0 7e f0 78 54 ...<#....>..~.xT 04f0 d3 6b 65 25 7d a1 55 94 99 6b f5 3f 98 42 08 58 .ke%}.U..k.?.B.X 0500 5d 78 27 e7 a4 36 0a bb b4 02 5e 0b 30 30 07 bc ]x'..6....^.00.. 0510 82 be ae fd 29 4b bb 87 74 48 cd fe c7 c3 34 a8 ....)K..tH....4. 0520 46 4b a4 eb 8c 5a 07 9c 81 e3 ab 17 1a 53 d5 e2 FK...Z.......S.. 0530 25 6c df 59 6d 75 e8 6c ed 94 8a d1 6f 9a 3a d0 %l.Ymu.l....o.:. 0540 f3 a9 96 32 d1 c1 8d 7d 77 28 da 76 8f 5e cb c9 ...2...}w(.v.^.. 0550 55 6f f4 37 79 d5 85 25 b3 86 ba 54 1a 1f 71 ec Uo.7y..%...T..q. 0560 cb c0 97 39 c9 d3 7d 3a f2 46 0c 30 49 5f 06 4a ...9..}:.F.0I_.J 0570 d7 15 11 f1 c2 48 9f c8 2d be e6 30 3d 50 fa 21 .....H..-..0=P.! 0580 c9 78 21 79 e5 2c 12 fc 10 c6 4d 07 a1 ca eb 99 .x!y.,....M..... 0590 0e ea c0 5e 76 0e f6 d1 19 f6 12 a1 1b 4d e1 7a ...^v........M.z 05a0 24 1c 11 36 e0 94 99 ee b7 a4 d7 13 4f 63 05 3f $..6........Oc.? 05b0 66 76 9e 77 fv.w No. Time Source Destination Protocol Info 3791 1037.528372 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=68036 Ack=45735 Win=22204 Len=0 SLE=47195 SRE=48655 Frame 3791 (66 bytes on wire, 66 bytes captured) Arrival Time: Nov 11, 2005 16:47:26.286876000 Time delta from previous packet: 0.000290000 seconds Time since reference or first frame: 1037.528372000 seconds Frame Number: 3791 Packet Length: 66 bytes Capture Length: 66 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3c93 (15507) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x39ed [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 68036, Ack: 45735, Len: 0 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 68036 (relative sequence number) Acknowledgement number: 45735 (relative ack number) Header length: 32 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 22204 Checksum: 0x4d91 [correct] Options: (12 bytes) NOP NOP SACK: 47195-48655 left edge = 47195 (relative) right edge = 48655 (relative) No. Time Source Destination Protocol Info 3792 1037.528395 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=48655 Ack=68036 Win=16734 [TCP CHECKSUM INCORRECT] Len=1426 Frame 3792 (1480 bytes on wire, 1480 bytes captured) Arrival Time: Nov 11, 2005 16:47:26.286899000 Time delta from previous packet: 0.000023000 seconds Time since reference or first frame: 1037.528395000 seconds Frame Number: 3792 Packet Length: 1480 bytes Capture Length: 1480 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1466 Identification: 0x5078 (20600) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2082] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 48655, Ack: 68036, Len: 1426 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 48655 (relative sequence number) Next sequence number: 50081 (relative sequence number) Acknowledgement number: 68036 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16734 Checksum: 0x89f0 [incorrect, should be 0x4675] Data (1426 bytes) 0000 73 4d 83 70 6c c9 e7 62 58 29 d5 e4 59 07 37 12 sM.pl..bX)..Y.7. 0010 c2 3d ce 14 f1 a4 3d 83 9f 0b dd 05 96 ef fd e7 .=....=......... 0020 5b 0a 42 c3 82 4a 85 c8 92 a9 ca 30 d7 6e 84 12 [.B..J.....0.n.. 0030 9a db 3d 4a 9f fb 1d 08 53 c1 1a c6 a7 33 7c 81 ..=J....S....3|. 0040 e4 83 b0 28 c7 b7 4d 7f cd 26 a1 ca fe 1f 9f a0 ...(..M..&...... 0050 ce cf f6 b1 ae 19 f9 84 f4 9b fd 08 d1 22 89 5c .............".\ 0060 d3 1c 73 a6 0d f6 a1 0a 14 1a 62 01 29 5d 6e df ..s.......b.)]n. 0070 ee 5f ce b0 ec 10 73 b4 3d 12 89 5e 73 5b 36 ad ._....s.=..^s[6. 0080 85 97 34 65 f5 0f 99 93 71 e8 12 2a af ef b4 c2 ..4e....q..*.... 0090 82 51 01 68 6f 56 fb f2 43 9e 77 fc de a0 23 be .Q.hoV..C.w...#. 00a0 aa 7b 98 04 13 3c fb ea 88 2e 29 95 2e e9 e8 6d .{...<....)....m 00b0 41 c7 1d 76 f3 5e 13 79 17 f3 f1 70 e0 ef ea 26 A..v.^.y...p...& 00c0 74 85 6f 4b 10 1a d4 ae fd 46 a5 2f f2 51 72 f6 t.oK.....F./.Qr. 00d0 09 b7 40 cb d5 ab a6 49 8d 26 93 d5 69 cd 05 7e ..@....I.&..i..~ 00e0 32 fe 12 c9 6f bf ad 3d 5e dc 23 e3 f9 fb de 6a 2...o..=^.#....j 00f0 fd 94 4e 5f b4 ce 9e 79 54 4c c5 fe a4 3f 5a 33 ..N_...yTL...?Z3 0100 37 94 f0 e1 71 ec d6 84 3e 43 d1 24 80 31 cd d1 7...q...>C.$.1.. 0110 03 4c bd 98 00 a1 3c 14 6f 1c 92 f4 4d 9a 54 29 .L....<.o...M.T) 0120 c4 6c 30 4f f6 85 c2 3e ab 48 94 52 0b 1e bb 9d .l0O...>.H.R.... 0130 af 75 7a 4a 1d 15 c3 82 ee c1 90 03 e3 76 c4 a0 .uzJ.........v.. 0140 d4 ff 71 56 01 7b 69 4d 1e 03 f9 31 4b 99 98 66 ..qV.{iM...1K..f 0150 37 9f e1 ea 5c 37 41 8d 9e 0c 23 10 01 1d ee 32 7...\7A...#....2 0160 cd 25 db 5f 23 f8 c6 b6 75 15 97 cb 99 2e 54 af .%._#...u.....T. 0170 8d 35 df 5c 81 9d 21 24 33 9a 2a 47 d9 3b 48 2f .5.\..!$3.*G.;H/ 0180 a7 20 23 0f 46 60 3b ef 4d 52 40 ec 41 13 91 01 . #.F`;.MR@.A... 0190 ed 8f be 93 ed 49 4c 68 a5 07 6b 19 48 3a 68 26 .....ILh..k.H:h& 01a0 a1 e7 63 2c 0c 79 a7 1c 5a ff b2 48 63 17 f1 3c ..c,.y..Z..Hc..< 01b0 07 b0 2c 27 41 03 5f ca 03 c0 93 71 cc 3f 4c 2c ..,'A._....q.?L, 01c0 79 91 a1 32 66 f3 02 96 2c 59 a1 18 5e 93 82 4d y..2f...,Y..^..M 01d0 aa 25 6a 50 3a 52 dd 00 fb 2d d4 6b 79 2b f5 f7 .%jP:R...-.ky+.. 01e0 0e da 57 e3 a1 90 01 3e c4 d4 a3 7f 42 ff 34 ac ..W....>....B.4. 01f0 96 fc 24 ff cc 68 ce 4d a9 24 4b 11 f5 38 65 f2 ..$..h.M.$K..8e. 0200 53 30 f8 fb 5f 76 62 15 51 6d e3 c2 0c 9c 9f e6 S0.._vb.Qm...... 0210 3c 44 71 e6 63 8c 58 b8 08 c4 40 b0 7c f6 97 1d .Y;..*..!..); 0280 17 f6 ca c9 2c 0c 53 54 2a 68 ae f5 6a 73 49 ab ....,.ST*h..jsI. 0290 1e 3d 42 93 ab 7a 72 12 56 86 0e f0 c2 d1 c8 ee .=B..zr.V....... 02a0 75 1b 36 ec 50 50 6b a5 fa ac f8 cd b0 4c 06 13 u.6.PPk......L.. 02b0 20 22 ff e3 40 48 42 1c 49 f3 e6 ff 66 05 f7 b1 "..@HB.I...f... 02c0 9b 84 7a 01 4a 6a fd cb 85 99 8d c5 de 15 1f a3 ..z.Jj.......... 02d0 27 3b 67 cf 79 f6 a3 1b cd 79 9b ae 4a 9b 75 6d ';g.y....y..J.um 02e0 1b 79 85 69 5d 02 1d 89 9e 02 04 a1 0c 49 83 9a .y.i]........I.. 02f0 57 8f 73 01 d6 c5 a0 1b 48 ba a9 91 41 b1 1d ee W.s.....H...A... 0300 44 ae 20 b4 f6 d8 7a 40 f0 63 12 0d 39 22 94 5e D. ...z@.c..9".^ 0310 b7 a2 2d c5 99 7c d2 55 1c e0 53 77 fa 66 7e 8d ..-..|.U..Sw.f~. 0320 16 f8 52 a2 2a af cf de cb 1f 2b b3 da a6 73 d8 ..R.*.....+...s. 0330 a5 03 d4 aa c4 f3 2d 9f b6 50 a9 56 dd 7d 41 c3 ......-..P.V.}A. 0340 31 c7 0e 4c da ec 84 2a 41 9a d8 54 6f 55 f5 53 1..L...*A..ToU.S 0350 c9 b4 5f fc 53 eb e3 be 2a 70 fc e9 e2 de bb 4f .._.S...*p.....O 0360 05 4b bb 05 2e 4e 1f 0e 89 c3 6c 9f 54 f3 8d 99 .K...N....l.T... 0370 7b af 61 f4 90 19 a2 4e 57 cd 8a 39 ed bf c7 9e {.a....NW..9.... 0380 64 f1 85 d7 ec e1 62 de 38 32 25 9d f2 1b a3 d8 d.....b.82%..... 0390 c1 98 4c 7b 8b 17 65 f3 70 ad dc 49 10 4a b0 b1 ..L{..e.p..I.J.. 03a0 03 ad e5 ef 16 ed cc 5c 43 c1 fa b6 fd 53 8a a8 .......\C....S.. 03b0 56 91 c9 b3 53 dc b1 5f 59 ea 7c 13 b2 e2 1b f7 V...S.._Y.|..... 03c0 20 be 10 46 78 dc 85 56 bc 46 74 47 3c ba 77 c9 ..Fx..V.FtG<.w. 03d0 90 3c 7a d6 9a 07 e3 5e ec 0d 6c 0e 4f cc de 12 . 4605 [ACK] Seq=68036 Ack=45735 Win=22204 Len=0 SLE=47195 SRE=50081 Frame 3793 (66 bytes on wire, 66 bytes captured) Arrival Time: Nov 11, 2005 16:47:26.287159000 Time delta from previous packet: 0.000260000 seconds Time since reference or first frame: 1037.528655000 seconds Frame Number: 3793 Packet Length: 66 bytes Capture Length: 66 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x3d93 (15763) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x38ed [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 68036, Ack: 45735, Len: 0 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 68036 (relative sequence number) Acknowledgement number: 45735 (relative ack number) Header length: 32 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 22204 Checksum: 0x47ff [correct] Options: (12 bytes) NOP NOP SACK: 47195-50081 left edge = 47195 (relative) right edge = 50081 (relative) SEQ/ACK analysis TCP Analysis Flags This is a TCP duplicate ack Duplicate ACK #: 1 Duplicate to the ACK in frame: 3791 No. Time Source Destination Protocol Info 3794 1037.528679 zen1 soth1 TCP [TCP Retransmission] 4605 > 1677 [ACK] Seq=45735 Ack=68036 Win=16734 Len=1460 Frame 3794 (1514 bytes on wire, 1514 bytes captured) Arrival Time: Nov 11, 2005 16:47:26.287183000 Time delta from previous packet: 0.000024000 seconds Time since reference or first frame: 1037.528679000 seconds Frame Number: 3794 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0x5079 (20601) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x205f] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 45735, Ack: 68036, Len: 1460 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 45735 (relative sequence number) Next sequence number: 47195 (relative sequence number) Acknowledgement number: 68036 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16734 Checksum: 0xc747 [correct] SEQ/ACK analysis TCP Analysis Flags This frame is a (suspected) retransmission The RTO for this segment was: 0.000284000 seconds RTO based on delta from frame: 3792 Data (1460 bytes) 0000 2b fa ca 9c d5 2a 5d 9f 03 ab 5a 6d 93 21 9f 09 +....*]...Zm.!.. 0010 bd 4d 04 8c 81 4a ba fc 46 cf 5c 76 e2 71 b9 58 .M...J..F.\v.q.X 0020 77 96 89 55 15 33 44 23 e4 5d a2 39 b4 22 77 91 w..U.3D#.].9."w. 0030 21 f9 c5 3e 94 df c4 37 4d a9 b4 67 f3 7a 7c 7f !..>...7M..g.z|. 0040 17 6b b5 66 bd e5 6d 25 95 be ce 0a 47 fb 72 4f .k.f..m%....G.rO 0050 2e a5 0e d4 97 f1 92 09 76 29 48 5c 7c a6 9b 54 ........v)H\|..T 0060 0f 0b 77 92 5f 0a 10 2f c3 8d 92 4f 6e d7 76 b5 ..w._../...On.v. 0070 0d a1 d2 0d e8 da 8f cb f2 df 64 17 1b 31 58 49 ..........d..1XI 0080 3b db 7b f8 f4 0a 54 8c cf 27 b2 38 b5 38 43 d7 ;.{...T..'.8.8C. 0090 ef 27 b7 8b 21 6a 7e fb d6 bd 14 38 5f b9 53 bb .'..!j~....8_.S. 00a0 ce 3b 8f 62 29 4c 64 0f 16 fd 86 ff 39 93 92 62 .;.b)Ld.....9..b 00b0 26 b8 f6 ed ec ee 6e 29 f3 7f 6d c2 1e cf a4 99 &.....n)..m..... 00c0 8b 1b 58 0a a7 f3 bd 8d 08 ef c3 68 6d b7 3b b6 ..X........hm.;. 00d0 a6 4e 52 fc 54 28 79 23 c3 55 7f ef 43 7f 70 a1 .NR.T(y#.U..C.p. 00e0 01 24 b8 0b 1d 8f ee af b0 15 b1 6d 27 11 58 7d .$.........m'.X} 00f0 b1 5e 3f cd 65 3e 1f 0a 02 56 c2 24 cc ea 82 9e .^?.e>...V.$.... 0100 70 ef 34 ed 32 cf d2 5a b6 f7 5f 22 af 59 d1 51 p.4.2..Z.._".Y.Q 0110 14 69 dc 45 05 53 aa 68 93 e9 32 da 65 7d fc b5 .i.E.S.h..2.e}.. 0120 b9 52 1e fb 7f 19 9c 5e ca de 3b ab cb 22 8f ec .R.....^..;..".. 0130 f1 81 b9 92 18 8f 88 a7 a3 e2 da 38 ac 56 c8 34 ...........8.V.4 0140 83 e8 17 58 34 b9 6f 9e 1e c3 46 0b 37 b0 9f 96 ...X4.o...F.7... 0150 7d c6 5d a1 b0 d0 2a 78 9b fa b6 f8 23 9c 9c 98 }.]...*x....#... 0160 de f3 cb 77 f0 58 02 cf 0b 2d 37 e3 62 86 eb 4b ...w.X...-7.b..K 0170 b0 81 9b 7d bd bb 61 1d b8 09 cc b1 70 d4 5f cd ...}..a.....p._. 0180 60 8d 68 5b 7c 80 ed 2c 26 a9 cb f8 6b 8a f3 68 `.h[|..,&...k..h 0190 83 bc 44 39 ee 9b e0 7c 1a 39 ce 84 01 42 db 3d ..D9...|.9...B.= 01a0 20 ef 6c d0 ac 69 e8 e9 14 8e e8 0c 97 b1 3f f1 .l..i........?. 01b0 4d e6 ba 5a 5c d9 5f f7 8f b0 13 f0 6a e4 33 f7 M..Z\._.....j.3. 01c0 45 13 a6 50 0f 03 90 08 be a5 40 30 d9 99 a0 28 E..P......@0...( 01d0 81 50 6f ac d9 d5 c7 c8 ed e4 3d 50 85 79 55 31 .Po.......=P.yU1 01e0 f5 06 f7 8e 36 2d a6 96 57 f8 f1 09 3e 95 cf 46 ....6-..W...>..F 01f0 7d dc a5 1c ca fa 58 7b 1f 82 6a 26 e5 20 6a 60 }.....X{..j&. j` 0200 72 22 c6 25 ef 29 34 3c 52 1e 97 46 ad cd 72 3b r".%.)4.M../5.. ...s.p 0380 d3 0a 3c 78 97 cf 4d 8d 86 51 98 78 c5 3e ef 3e ...> 0390 16 0e 75 10 85 ec f0 ef fd d7 77 dd 18 26 1a 95 ..u.......w..&.. 03a0 60 8b dd 32 8b 49 a7 aa 24 0b de c9 28 6c 15 9c `..2.I..$...(l.. 03b0 27 55 2b da 0f 3e f2 7c ec 5c 6a 06 9b f9 93 4c 'U+..>.|.\j....L 03c0 fd 03 65 79 6b e8 91 9b a0 45 64 fc 80 6f 23 fd ..eyk....Ed..o#. 03d0 e5 04 37 f9 1b 1c 7a 23 5d 9a 75 8f d9 69 c6 72 ..7...z#].u..i.r 03e0 c5 fb 87 a4 21 e9 a0 85 91 73 8c bb 7d a8 86 a0 ....!....s..}... 03f0 40 b3 c6 c0 ab 69 9f 98 9e 11 35 c0 e5 6b d8 8f @....i....5..k.. 0400 eb 7b cb dd c8 77 f6 be 37 de 2a f4 27 bf cf 8d .{...w..7.*.'... 0410 c5 cd f3 ab a4 f3 7b c6 4f f1 24 33 47 b1 61 93 ......{.O.$3G.a. 0420 de ca 34 7d 52 93 9d 0d a3 7d 68 f0 f8 74 c6 83 ..4}R....}h..t.. 0430 17 28 66 68 26 88 67 da 92 9d 45 41 ab 7d 8d 6b .(fh&.g...EA.}.k 0440 fc 7c 0c c9 b3 5a 5a 52 ed e4 d9 48 6f 8f c5 70 .|...ZZR...Ho..p 0450 85 ee d4 39 27 0f 39 73 e5 6b 1e c7 61 0d 2e ee ...9'.9s.k..a... 0460 47 50 1d c4 9d 77 df bf b3 d0 44 e3 74 58 9b 33 GP...w....D.tX.3 0470 e5 a7 f4 a0 94 dd f5 b3 26 a5 18 6b 7c 3d bf fe ........&..k|=.. 0480 af cf c7 bc e1 9f f9 3b 37 ea 5a 44 06 01 bf b9 .......;7.ZD.... 0490 dd ef d9 bb e0 7d bc 57 1a 9d c4 c6 8f 02 cf 5f .....}.W......._ 04a0 ee 1f ee 58 4d 43 0a c9 74 1c 3e a8 64 2d 0a 57 ...XMC..t.>.d-.W 04b0 e9 b9 58 f8 1f 18 27 ec 33 2c 5a c6 b1 62 ce 92 ..X...'.3,Z..b.. 04c0 9f 6a 9d 1c 78 1e 00 33 18 4b c5 5e bd 82 22 f7 .j..x..3.K.^..". 04d0 07 9f 56 b9 d4 f1 52 b4 cb 18 e7 eb ad b7 75 de ..V...R.......u. 04e0 ac e8 e6 d2 e2 2f 81 85 8a 76 1e 71 b9 de 4b cf ...../...v.q..K. 04f0 e3 42 6d 96 57 33 8d c4 09 b5 48 b0 19 a5 c3 68 .Bm.W3....H....h 0500 ab 29 2b c8 db f4 20 75 62 8b 54 fa df eb 8b 18 .)+... ub.T..... 0510 36 94 80 0d 30 f7 e6 b6 b3 a5 0c df be 3c 9f c4 6...0........<.. 0520 93 57 ed 41 f7 87 ba d9 d4 d2 ca 69 f2 87 8a ac .W.A.......i.... 0530 de ce 7f 12 24 3d bf 93 cd a9 bd ae ad 38 2b eb ....$=.......8+. 0540 0e d0 6a f2 03 e4 a3 12 9b 88 0c 88 30 ed 95 25 ..j.........0..% 0550 fd 0f 96 46 18 26 a9 72 85 99 a7 61 af be ce 1b ...F.&.r...a.... 0560 18 d4 4a a8 ca 96 e6 fb 00 7f 4d 95 26 e3 a2 ae ..J.......M.&... 0570 11 f2 7b a7 49 8b dc d4 2a 49 3f 9c 09 31 c0 06 ..{.I...*I?..1.. 0580 42 34 9b 4e 01 3b 79 82 b9 a2 98 10 4e 1d 0f f4 B4.N.;y.....N... 0590 47 34 8d 4e 5d e5 2e 42 89 e6 85 43 f6 f5 e4 66 G4.N]..B...C...f 05a0 6c e2 73 bb cc 18 60 3f a4 ef 4c 0f 8a c9 f8 44 l.s...`?..L....D 05b0 f0 fb 06 f7 .... No. Time Source Destination Protocol Info 3795 1037.528944 soth1 zen1 TCP 1677 > 4605 [ACK] Seq=68036 Ack=50081 Win=22204 Len=0 Frame 3795 (60 bytes on wire, 60 bytes captured) Arrival Time: Nov 11, 2005 16:47:26.287448000 Time delta from previous packet: 0.000265000 seconds Time since reference or first frame: 1037.528944000 seconds Frame Number: 3795 Packet Length: 60 bytes Capture Length: 60 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: soth1 (00:04:23:bf:34:62), Dst: zen1 (00:01:02:55:40:39) Destination: zen1 (00:01:02:55:40:39) Source: soth1 (00:04:23:bf:34:62) Type: IP (0x0800) Trailer: 000000000000 Internet Protocol, Src: soth1 (192.168.1.100), Dst: zen1 (192.168.1.143) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x3e93 (16019) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x37f9 [correct] Good: True Bad : False Source: soth1 (192.168.1.100) Destination: zen1 (192.168.1.143) Transmission Control Protocol, Src Port: 1677 (1677), Dst Port: 4605 (4605), Seq: 68036, Ack: 50081, Len: 0 Source port: 1677 (1677) Destination port: 4605 (4605) Sequence number: 68036 (relative sequence number) Acknowledgement number: 50081 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 22204 Checksum: 0x7a59 [correct] SEQ/ACK analysis This is an ACK to the segment in frame: 3792 The RTT to ACK the segment was: 0.000549000 seconds No. Time Source Destination Protocol Info 3796 1037.529044 zen1 soth1 TCP 4605 > 1677 [PSH, ACK] Seq=50081 Ack=68036 Win=16734 [TCP CHECKSUM INCORRECT] Len=16 Frame 3796 (70 bytes on wire, 70 bytes captured) Arrival Time: Nov 11, 2005 16:47:26.287548000 Time delta from previous packet: 0.000100000 seconds Time since reference or first frame: 1037.529044000 seconds Frame Number: 3796 Packet Length: 70 bytes Capture Length: 70 bytes Protocols in frame: eth:ip:tcp:data Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 56 Identification: 0x507a (20602) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2602] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 50081, Ack: 68036, Len: 16 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 50081 (relative sequence number) Next sequence number: 50097 (relative sequence number) Acknowledgement number: 68036 (relative ack number) Header length: 20 bytes Flags: 0x0018 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16734 Checksum: 0x846e [incorrect, should be 0x8758] Data (16 bytes) 0000 bc ef 10 00 b5 fe 0e 00 00 00 00 20 67 38 10 00 ........... g8.. No. Time Source Destination Protocol Info 3797 1037.622069 zen1 soth1 TCP 4605 > 1677 [RST] Seq=50097 Ack=2744164039 Win=0 Len=0 Frame 3797 (54 bytes on wire, 54 bytes captured) Arrival Time: Nov 11, 2005 16:47:26.380573000 Time delta from previous packet: 0.093025000 seconds Time since reference or first frame: 1037.622069000 seconds Frame Number: 3797 Packet Length: 54 bytes Capture Length: 54 bytes Protocols in frame: eth:ip:tcp Ethernet II, Src: zen1 (00:01:02:55:40:39), Dst: soth1 (00:04:23:bf:34:62) Destination: soth1 (00:04:23:bf:34:62) Source: zen1 (00:01:02:55:40:39) Type: IP (0x0800) Internet Protocol, Src: zen1 (192.168.1.143), Dst: soth1 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x507c (20604) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0x2610] Good: False Bad : True Source: zen1 (192.168.1.143) Destination: soth1 (192.168.1.100) Transmission Control Protocol, Src Port: 4605 (4605), Dst Port: 1677 (1677), Seq: 50097, Ack: 2744164039, Len: 0 Source port: 4605 (4605) Destination port: 1677 (1677) Sequence number: 50097 (relative sequence number) Header length: 20 bytes Flags: 0x0004 (RST) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...0 .... = Acknowledgment: Not set .... 0... = Push: Not set .... .1.. = Reset: Set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 0 Checksum: 0x987f [correct]